WO2017132947A1

WO2017132947A1 - Method for acquiring security parameters of to-be-transmitted service, signalling management network element, security function node and transmitting terminal

Info

Publication number: WO2017132947A1
Application number: PCT/CN2016/073531
Authority: WO
Inventors: 王江胜; 余承宇; 刘文济
Original assignee: 华为技术有限公司
Priority date: 2016-02-04
Filing date: 2016-02-04
Publication date: 2017-08-10

Abstract

Disclosed in the present invention are a method for acquiring security parameters of a to-be-transmitted service, a signaling management network element, a security function node and a transmitting terminal, the method comprising: a signaling management network element receives a first message which is sent from a security function node according to security reference information, the security reference information is used to indicate security requirements of the to-be-transmitted service of the transmitting terminal, the transmitting terminal comprising a user equipment or an application layer server; the signaling management network element acquires security parameters of the to-be-transmitted service according to the first message; and the signaling management network element transmits the security parameters of the to-be-transmitted service to the transmitting terminal. According to the method for acquiring security parameters of a to-be-transmitted service, the signaling management network element, the security function node and the transmitting terminal as provided in the embodiments of the present invention, security parameters maybe acquired according to security requirements of a to-be-transmitted service, which not only would improve the security of the data transmission, but also enable corresponding node to reduce the amount of power consumed during data transmission, thereby reducing the time delay to acquire data.

Description

Method for obtaining security parameters of a service to be transmitted, signaling management network element, security function node, and transmitting end

Technical field

The present invention relates to the field of communications technologies, and more particularly, to a method for obtaining security parameters of a service to be transmitted, a signaling management network element, a security function node, and a transmitting end.

Background technique

In order to ensure the security of data transmission, data needs to be kept encrypted during network transmission to prevent an attacker from capturing information about the data. When the data is securely protected, the encryption node needs to obtain the security parameters first, and then encrypt and protect the data according to the security parameters. For example, in the Long Term Evolution (LTE) system, the access layer (Access Stratum (AS)) security protection and the Non-access Stratum (NAS) security are included. Protection, AS security protection is the security protection between the user equipment and the base station. It mainly performs the encryption and integrity protection of the AS signaling. The NAS security protection is the security protection between the user equipment and the mobility management network element. Encryption and integrity protection. When performing AS security protection or NAS security protection on data, you need to obtain security parameters first, and then perform encryption and integrity protection on AS signaling or NAS signaling according to the security algorithm corresponding to the security parameters. However, both the AS security protection and the NAS security protection are based on the security-related capabilities reported by the user equipment (for example, algorithms supported by the user equipment, etc.) to obtain security parameters. Once the security parameters are determined, the security parameters correspond to a unique security algorithm. After the corresponding node receives the security parameter, the security algorithm is used to protect the data. With this method, an attacker can obtain all the data on the user equipment by cracking the security algorithm corresponding to a set of data.

Summary of the invention

The method for obtaining the security parameters of the to-be-transmitted service, the signaling management network element, the security function node, and the sending end according to the embodiment of the present invention obtain security parameters according to the security requirements of the to-be-transmitted service, and perform differential security on different to-be-transmitted services. Protection can improve the security of data transmission and the efficiency of data transmission.

In one aspect, a method for obtaining security parameters of a service to be transmitted is provided, the method comprising: The signaling management network element receives a first message sent by the security function node according to the security reference information, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server; the signaling management The network element acquires the security parameter of the to-be-transmitted service according to the first message; the signaling management network element sends the security parameter of the to-be-transmitted service to the sending end.

The security parameters obtained by the signaling management network element are related to the security requirements of the service to be transmitted. Compared with the security parameters of the service to be transmitted, the security parameters are obtained according to the security requirements of the service to be transmitted, and the differential security protection can be implemented for different services to be transmitted. Not only can the data leakage caused by fixed security parameters (single security algorithm) be avoided, but also the blind protection of the transmission service can be avoided, the cost and time of the node to obtain the data of the transmission service can be reduced, and the efficiency of transmitting the data can be improved.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the method further includes: the signaling management network element receiving the sending end sends the security reference information; the signaling management network element to the security function The node sends the security reference information.

The signaling management network element and the security function node can obtain the security parameters of the to-be-transmitted service through information interaction, and meet the security requirements of the service to be transmitted.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the first message includes at least one set of security parameters, and the signaling management network element is configured according to the first message Acquiring the security parameter of the to-be-transmitted service, the signaling management network element acquiring the security parameter of the to-be-transmitted service from the at least one set of security parameters.

When the first message includes a set of security parameters, the signaling management network element may directly use the set of security parameters as the security parameter corresponding to the to-be-transmitted service after receiving the first message; In the above security parameters, the signaling management network element may further obtain a set of security parameters from the plurality of sets of security parameters as security parameters of the to-be-transmitted service. The signaling management network element and the security function node can flexibly acquire the security parameters of the to-be-transmitted service through information interaction.

In conjunction with the first aspect or the foregoing possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, the first message does not include a security parameter.

It can be agreed that if the first message does not include the security parameter, there is no need to perform security protection processing on the to-be-transmitted service. The security of some services to be transmitted is not protected, and the power and delay of the node to obtain the data to be transmitted are reduced. The method is simple and easy to operate and has good compatibility with the prior art. It is also possible to stipulate that if the first message does not include the security parameter, the security of the to-be-transmitted service is protected by a certain level of security algorithm. Flexible setting of the content included in the first message or the content of the first message Meaning, the efficiency of the node to acquire the parameter to be transmitted can be improved.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, the method further includes: the signaling management network element sends the to-be-transmitted to the user equipment, the base station, or the gateway Security parameters of the business.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect, the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, and a user equipment. At least one of an attribute, a security level of the to-be-transmitted service, a protection type of the to-be-transmitted service, and an execution node identifier of the security algorithm; wherein the protection type includes path protection or data content protection.

The security reference information includes diversified contents, so that the signaling management network element and the security function node can match appropriate security parameters according to the diversified security reference information, thereby improving the security of data transmission and improving data transmission. effectiveness.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, the data attribute of the to-be-transmitted service includes a first parameter, where the first parameter is used to indicate that the to-be-transmitted The data of the service is the data that has been processed for security protection.

If the to-be-transmitted service has been cryptographically protected before being transmitted between the nodes, the security protection level of the to-be-transmitted service transmitted between the nodes may be appropriately adjusted, and the security parameters of the to-be-transmitted service may be flexibly determined, thereby reducing the node to acquire the transmission data. The cost of improving data transmission.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a seventh possible implementation manner of the first aspect, the security parameter of the to-be-transmitted service includes: an identifier of the security algorithm, a level information of the security algorithm, and a security algorithm. At least one of an execution node identifier and a parameter of the security algorithm; wherein the identifier of the security algorithm is used to identify a security algorithm of the service to be transmitted, and the level information of the security algorithm is used to indicate a security algorithm of the service to be transmitted The security level, the parameters of the security algorithm include a key length, and the execution node identifier of the security algorithm is used to indicate an execution node of the security algorithm.

The security parameters include diversified content, which facilitates the complete protection of the service to be transmitted by the node according to the security parameter.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in an eighth possible implementation manner of the first aspect, the execution node includes a user equipment, a base station, a gateway, a signaling management network element, and an application layer server. At least one.

Diversification of the execution body of the security parameter can implement multiple layers of protection for the service to be transmitted, High data transmission security.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a ninth possible implementation manner of the first aspect, the security parameter of the to-be-transmitted service includes a second parameter, where the second parameter is used to indicate that the The transport service does not perform security protection processing.

The security parameter may indicate that the security protection process is not performed on the to-be-transmitted service, thereby reducing the power consumption of acquiring the transmission data, and reducing the delay of acquiring the transmission data.

With reference to the first aspect or the foregoing possible implementation manner of the first aspect, in a tenth possible implementation manner of the first aspect, the security function node is a function node that includes a security policy, where the security policy includes security reference information and security parameters. The relationship between them.

The security function node can store the security policy, so that the signaling management network element and the security function node can obtain the security parameters of the service to be transmitted after the information is exchanged. Different security reference information can correspond to different security parameters, and the diversification of security parameters can realize the diversification of security algorithms. It avoids the single security algorithm and brings information leakage, which improves the security of data transmission.

A second aspect provides a method for obtaining a security parameter of a service to be transmitted, where the method includes: the security function node receives security reference information sent by a signaling management network element or an application layer server, where the security reference information is used to indicate that the security reference information is to be transmitted. The security function of the service sends a first message to the signaling management network element according to the security reference information, where the first message is used by the signaling management network element to obtain the security parameter of the service to be transmitted.

The security function node may send the first message according to the security requirement of the service to be transmitted, and the signaling management network element may obtain the security parameter of the to-be-transmitted service after receiving the first message. Compared with the security parameter determined by the user equipment reporting capability in the prior art, the present invention can obtain the security parameter according to the security requirement of the service to be transmitted, realize different security protection of the service to be transmitted, and improve the efficiency and security of data transmission. Sex and efficiency.

With reference to the second aspect, in a first possible implementation manner of the second aspect, the first message includes at least one set of security parameters, where the first message is specifically used by the signaling management network element from the at least one set of security parameters. Obtain the security parameters of the service to be transmitted.

If the first message includes a set of security parameters, the set of security parameters is a security parameter of the service to be transmitted, and the signaling management network element can directly obtain the security parameter of the to-be-transmitted service after receiving the first message, and the method is simple to operate. It is easy to implement; if the first message includes multiple sets of security parameters, the signaling management network element may obtain a set of security parameters from the plurality of sets of security parameters as security parameters of the service to be transmitted. Flexible access to security parameters of the service to be transmitted can improve the effectiveness of obtaining security parameters. rate.

In conjunction with the second aspect, in a second possible implementation of the second aspect, the first message does not include a security parameter.

It may be agreed that when the first message does not include the security parameter, the first message may be used to indicate that the security protection process is not performed on the to-be-transmitted service, and the signaling management network element may obtain the security protection process after receiving the first message. Security parameters. The security of certain services to be transmitted is not protected, and the efficiency of the node to obtain data of the service to be transmitted can be improved. It is also possible to stipulate that if the first message does not include the security parameter, the security of the to-be-transmitted service is protected by a certain level of security algorithm. Flexible setting of the content included in the first message and the meaning of the first message can improve the efficiency of obtaining security parameters and improve the efficiency of transmitting data.

With reference to the second aspect or the foregoing possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, and a user At least one of an attribute of the device, a security level of the service to be transmitted, a protection type of the service to be transmitted, and an execution node identifier of the security algorithm; wherein the protection type includes path protection or data content protection.

The security reference information includes diversified content, so that the signaling management network element and the security function node can match the most appropriate security parameters according to the diverse security reference information. Not only can the security of data transmission be improved, but also the cost of obtaining the transmitted data can be reduced to improve the efficiency of data transmission.

With reference to the second aspect or the foregoing possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the data attribute of the to-be-transmitted service includes a first parameter, where the first parameter is used to indicate the to-be-transmitted The data of the service is the data that has been processed for security protection.

Since the to-be-transmitted service has been encrypted and protected, the security protection level in the transmission process can be appropriately adjusted, and the flexible setting of the security parameter can reduce the cost of acquiring the transmission data.

With the second aspect or the foregoing possible implementation manner of the second aspect, in a fifth possible implementation manner of the second aspect, the security parameter of the to-be-transmitted service includes: an identifier of the security algorithm, a level information of the security algorithm, and a security algorithm. At least one of an execution node identifier and a parameter of the security algorithm; wherein the identifier of the security algorithm is used to identify a security algorithm of the service to be transmitted, and the level information of the security algorithm is used to indicate a security algorithm of the service to be transmitted The security level, the parameters of the security algorithm include a key length, and the execution node identifier of the security algorithm is used to indicate an execution node of the security algorithm.

With reference to the second aspect or the foregoing possible implementation manner of the second aspect, in a sixth possible implementation manner of the second aspect, the performing node includes a user equipment, a base station, a gateway, a signaling management network element, and an application layer server. At least one.

The diversification of the execution body of the security parameter can implement multi-layer protection of the service to be transmitted, thereby improving the security of data transmission.

With the second aspect or the foregoing possible implementation manner of the second aspect, in a seventh possible implementation manner of the second aspect, the security parameter of the to-be-transmitted service includes a second parameter, where the second parameter is used to indicate the The transport service does not perform security protection processing.

The security parameter may indicate that the security protection process of the to-be-transmitted service is not required, thereby reducing the power consumption of the execution node to obtain the transmission data, and reducing the delay of acquiring the transmission data.

With reference to the second aspect or the foregoing possible implementation manner of the second aspect, in the eighth possible implementation manner of the second aspect, the security function node is a function node that stores a security policy, where the security policy includes security reference information and security. The relationship between the parameters.

A third aspect provides a method for obtaining a security parameter of a service to be transmitted, where the method includes: the sending end sends security reference information to a signaling management network element or a security function node, where the sending end includes a user equipment or an application layer server, The security reference information is used to indicate the security requirement of the to-be-transmitted service at the transmitting end; the transmitting end receives the security parameter of the to-be-transmitted service sent by the signaling management network element.

The sending end sends the security reference information to the signaling management network element or the security function node, so that the signaling management network element and the security function node can flexibly obtain the security parameter according to the security requirement of the service to be transmitted. It not only avoids the phenomenon of data leakage caused by fixed security parameters (single security algorithm), but also avoids blind protection of the transmission service, which can reduce the cost and time for the node to obtain the service to be transmitted, and improve the efficiency of data transmission.

With reference to the third aspect, in a first possible implementation manner of the third aspect, the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of the user equipment, and a service to be transmitted. At least one of a security level, a protection type of the to-be-transmitted service, and an execution node identifier of the security algorithm; wherein the protection type includes path protection or data content protection.

The security reference information includes a variety of content, which can fully reflect the security requirements of the service to be transmitted, so that the signaling management network element and the security function node can obtain security parameters suitable for the service to be transmitted through information interaction.

With the third aspect or the foregoing possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the data attribute of the to-be-transmitted service includes a first parameter, where the first parameter is used by The data indicating the service to be transmitted is data that has been subjected to security protection processing.

With the third aspect or the foregoing possible implementation manner of the third aspect, in a third possible implementation manner of the third aspect, the security parameter of the to-be-transmitted service includes: an identifier of the security algorithm, a level information of the security algorithm, and a security algorithm. Performing at least one of a node identifier and a parameter of the security algorithm, where the identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate the security of the security algorithm of the to-be-transmitted service. Level, the parameters of the security algorithm include a key length, and the execution node identifier of the security algorithm is used to indicate an execution node of the security algorithm.

The security parameters include diversified content, which is beneficial for the execution node to perform security protection according to the security parameter to be transmitted.

With the third aspect or the foregoing possible implementation manner of the third aspect, in a fourth possible implementation manner of the third aspect, the execution node includes at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server. Kind.

Diversification of the execution node can implement layer-by-layer protection of the service to be transmitted and improve the security of data transmission.

With the third aspect or the foregoing possible implementation manner of the third aspect, in a fifth possible implementation manner of the third aspect, the security parameter of the to-be-transmitted service includes a second parameter, where the second parameter is used to indicate the service to be transmitted No security protection is performed.

With reference to the third aspect or the foregoing possible implementation manner of the third aspect, in the sixth possible implementation manner of the third aspect, the security function node is a function node that stores a security policy, where the security policy includes security reference information and security parameters. The relationship between the two.

In a fourth aspect, a signaling management network element is provided for performing the method in any of the foregoing first aspect or the first aspect of the first aspect. In particular, the signaling management network element comprises means or means for performing the method of any of the above-described first aspects or any of the possible implementations of the first aspect.

In a fifth aspect, a security function node is provided for performing the method of any of the foregoing second aspect or any of the possible implementations of the second aspect. In particular, the security function node comprises a module or unit for performing the method of any of the above-described second or second aspects of the second aspect.

In a sixth aspect, a method is provided for performing the method in any of the foregoing possible implementations of the third aspect or the third aspect. In particular, the transmitting end comprises a module or unit for performing the method in any of the possible implementations of the third aspect or the third aspect described above.

In a seventh aspect, a signaling management network element is provided, including: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are connected by the bus system, the transceiver is for receiving and transmitting information or signals, the memory is for storing instructions, the processor is configured to execute instructions stored by the memory, and the processor is used for The control transceiver receives or transmits information, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of the first aspect or any of the possible implementations of the first aspect.

In an eighth aspect, a security function node is provided, comprising: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are connected by the bus system, the transceiver is for receiving and transmitting information or signals, the memory is for storing instructions, the processor is configured to execute instructions stored by the memory, and the processor is used for The control transceiver receives or transmits information, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of any of the second aspect or any of the possible implementations of the second aspect.

In a ninth aspect, a transmitting end is provided, comprising: a transceiver, a memory, a processor, and a bus system. Wherein the transceiver, the memory and the processor are connected by the bus system, the transceiver is for receiving and transmitting information or signals, the memory is for storing instructions, the processor is configured to execute instructions stored by the memory, and the processor is used for The control transceiver receives or transmits information, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of any of the third aspect or any of the possible implementations of the third aspect.

DRAWINGS

FIG. 1 is a schematic structural diagram of an application scenario according to an embodiment of the present invention.

2 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to an embodiment of the present invention.

FIG. 3 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to an embodiment of the present invention.

FIG. 4 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to another embodiment of the present invention.

FIG. 5 is a schematic block diagram of a signaling management network element according to an embodiment of the present invention.

6 is a schematic block diagram of a security function node in accordance with an embodiment of the present invention.

FIG. 7 is a schematic block diagram of a transmitting end according to an embodiment of the present invention.

FIG. 8 is a schematic block diagram of a signaling management network element according to another embodiment of the present invention.

9 is a schematic block diagram of a security function node in accordance with another embodiment of the present invention.

FIG. 10 is a schematic block diagram of a transmitting end according to another embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

It should be understood that the technical solutions of the embodiments of the present invention can be applied to various communication systems, for example, Global System of Mobile communication ("GSM") system, Code Division Multiple Access (Code Division Multiple Access, referred to as "CDMA") system, Wideband Code Division Multiple Access (WCDMA) system, General Packet Radio Service ("GPRS"), Long Term Evolution (Long Term Evolution, Referred to as "LTE" system, LTE Frequency Division Duplex ("FDD") system, LTE Time Division Duplex (TDD), Universal Mobile Telecommunication System, referred to as "UMTS" for short, or Worldwide Interoperability for Microwave Access ("WiMAX") communication system.

In the embodiment of the present invention, a user equipment (User Equipment, referred to as "UE") may be referred to as a terminal (Mobile), a mobile station ("MS" for short), or a mobile terminal (Mobile Terminal). The user equipment can communicate with one or a core network via a Radio Access Network ("RAN"). For example, the user equipment can be a mobile phone (or "cellular" phone) or a computer with a mobile terminal. Etc. For example, the user device can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges voice or data with the wireless access network.

In the embodiment of the present invention, the base station may be a base station (Base Transceiver Station, abbreviated as "BTS") in GSM or CDMA, or may be a base station (NodeB, referred to as "NB") in WCDMA, or may be in LTE. The evolved base station (Evolved Node B, abbreviated as "ENB or e-NodeB"), the present invention is not limited thereto.

In the embodiment of the present invention, the signaling management network element may be a mobility management entity (Mobility Management Entity, referred to as "MME"). In the UMTS system, the signaling management network element may also be a serving GPRS support node (Serving). The GPRS Support Node, abbreviated as "SGSN"), is not limited to this.

FIG. 1 is a schematic structural diagram of an application scenario of an embodiment of the present invention. As shown in FIG. 1 , an LTE network may include: a UE, an Evolved UMTS Terrestrial Radio Access Network (E-UTRAN), an MME, and a Serving Gateway (referred to as “Serving Gateway”). SGW"), Packet Data Network Gateway ("PGW"), Policy and Charging Rule Function ("PCRF"), Home Subscriber Server , referred to as "HSS"), Security Function Function ("SECRF").

The core network of the wireless evolved network mainly includes three logical functions: MME, SGW, and PGW. The MME is a signaling management network element, and is responsible for non-access stratum (Non-Access Stratum, abbreviated as "NAS") signaling encryption. Assigning temporary identity to the UE, selecting core network elements such as SGW and PGW, providing roaming, tracking, security, etc.; SGW is a mobility anchor for switching between local eNBs, and provides lawful interception related functions; PGW is responsible for users The functions of address allocation, scheme control and charging rules, and lawful interception related functions; HSS is used to store subscription information of users; PCRF is used to provide scheme and charging control rules; SECRF is used to store security policies.

It should be understood that the SECRF is a logical node having a security function, that is, a node storing a security policy is collectively referred to as a SECRF node, and the SECRF may be a newly established node for storing a security policy, that is, a separate node, or may be If the other function node is located in the same entity node, for example, the security policy may be stored in the PCRF node, then the PCEF node may be considered as the SECRF node, or the security policy may be stored in the HSS node, and the HSS node may be considered as the SECRF node.

It should be understood that the embodiment of the present invention will be described by using the LTE system as an example, but the present invention is not limited thereto. Additionally, the terms "system" and "network" are used interchangeably herein.

When transmitting data, in order to ensure secure communication between nodes, the terminal and the network device need to negotiate to determine the security parameters, and enable the terminal or the network device to obtain the security parameter and then perform security protection on the transmitted data according to the security parameter. Among them, the connection establishment of the message security interaction mainly includes the following processes:

Establish a radio resource control (Radio Resource Control abbreviated as "RRC") connection, and also establish a signaling radio bearer (Signaling Radio Bearer referred to as "SRB");

Establish a NAS connection;

The authentication and key agreement (AKA) process of the third generation mobile communication network is initiated, and the corresponding security parameters are obtained, and the two-way authentication of the UE and the MME and the negotiation of the key K _ASME are completed;

Initiating the NAS security mode control (SMC) process, activating the NAS security mechanism, and then performing interactive NAS message security protection;

The AS SMC process is initiated, the AS security mechanism is activated, and the RRC messages that are exchanged are then secured.

The SMC is used to activate the secure interaction between the terminal and the network device, including the NAS SMC and the AS SMC. The security mode control mainly includes two modes of the security mode command sent by the network device to the UE and the security mode acknowledged by the UE to the network device. The SMC process mainly completes the negotiation between the security algorithm used by the terminal and the network device, and generates a key required by the corresponding security algorithm based on K _ASME to ensure security between the MME and the UE or between the eNB and the UE. The interaction.

In the LTE security system, there is only one level of security. That is to say, both the NAS security mechanism and the AS security mechanism obtain security parameters according to the capabilities reported by the UE, and then obtain security algorithms according to the security parameters. The UE or the network device performs a corresponding security algorithm to perform security protection on the transmission service according to the security parameter. Since the security parameters are determined in the same way, different security parameters are assigned to different services to be transmitted. After receiving the security parameters, the executing node uses the same security algorithm or the same key to protect different services to be transmitted. A set of security parameters corresponds to a unique security algorithm. If the security parameters received by the execution node are the same, the execution node will use the same security algorithm to secure the transmission service. In fact, the data of the AS includes the user's business data. Different business data have different security requirements. For example, mobile phone payment and other business related to the bank card require a high-level security algorithm for processing, but for some confidentiality. Non-high business data may not be securely protected during transmission. Therefore, in the case of only one security level, in order to protect certain private data, the system usually adopts a high level of security mechanisms, such as complex algorithms, extended keys, and the like. However, if a high-level security mechanism is adopted for all business data, the cost of the device will increase, because the higher the level of the security mechanism, the greater the power required to obtain the data and the longer the delay. In order to solve the problem, the method provided by the embodiment of the present invention may obtain different security parameters according to the security requirement of the to-be-transmitted service, so that after receiving the security parameter, the UE or the network device may perform different services to be transmitted according to the security parameter. Differential protection not only ensures the security of data transmission, but also improves the efficiency of data acquisition.

FIG. 2 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to an embodiment of the present invention. Figure. As shown in FIG. 2, the method may include:

S110. The security function node receives the security reference information sent by the signaling management network element or the sending end.

The security reference information may be used to indicate the security requirement of the to-be-transmitted service at the transmitting end.

The sender may include a UE or an application server (Application Server, abbreviated as “AS”).

The security function node may be specifically the SECRF shown in FIG. 1 , and the signaling management network element may be the MME shown in FIG. 1 , which is not limited herein.

S120. The security function node sends the first message to the signaling management network element according to the security reference information.

Specifically, the security function node may receive the security reference information according to an internally stored security policy (for example, the security function node stores an operator's security policy, and the security policy may be an association relationship between the security reference information and the security parameter) Sending a first message to the signaling management network element. S130. The signaling management network element receives the first message sent by the security function node.

S140. The signaling management network element acquires a security parameter of the to-be-transmitted service according to the first message.

S150. The signaling management network element sends the security parameter of the to-be-transmitted service to the sending end.

Specifically, the signaling management network element may send the security parameter of the to-be-transmitted service to the sending end according to the security parameter of the to-be-transmitted service, and may be used by the sending end to receive the security parameter according to the security parameter. Encryption or integrity protection when parameters are transmitted with the corresponding node.

It should be noted that the security parameter is related to the security requirement of the service to be transmitted, and different services to be transmitted may correspond to different security parameters. For example, the security parameter of the confidential service obtained by the method may be the security parameter corresponding to the advanced security algorithm, and the security parameter of the service with low confidentiality may be the security parameter corresponding to the low-level security algorithm.

S160: The sending end receives the security parameter of the to-be-transmitted service sent by the signaling management network element.

It should be noted that the foregoing security reference information may be used to explicitly or implicitly indicate the security requirement of the to-be-transmitted service. The security reference information may include a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of the user equipment, a security level of the to-be-transmitted service, a protection type of the to-be-transmitted service, and an execution node identifier of the security algorithm. At least one of the types of protection includes path protection or data content protection.

Optionally, the security reference information may include a security level for indicating a service to be transmitted (for example, the to-be-transmitted service requires three levels of security protection).

The data attribute of the to-be-transmitted service may be used to indicate the data type of the service to be transmitted. For example, the data attribute can be used to indicate whether the service to be transmitted includes text, picture, video or sound. Different data types, such as frequency, different data attributes can correspond to different security requirements. For example, the security requirement corresponding to a video may be a need to obtain a high level of security protection, and the security requirement of the text may be to obtain a low level of security protection. The data attribute may include a first parameter, where the first parameter is used to indicate that the data of the service to be transmitted is data that has been subjected to security protection processing.

The service attribute of the service to be transmitted may be used to indicate the service type of the service to be transmitted. For example, the service attribute may be used to indicate that the to-be-transmitted service belongs to an Alipay service, a Taobao service, a browser service, or belongs to another service type. The security requirement corresponding to the Alipay service may require a high level of security protection, and the security requirement of the browser service may require obtaining a low level of security protection. The service attribute can also be used to indicate the service classification of the service to be transmitted. For example, the service attribute may be used to indicate that the service to be transmitted belongs to a service category such as an entertainment class, a financial class, or a scientific research project class. Different business attributes can correspond to different security requirements.

The attribute of the user equipment may be used to indicate the type of the user equipment that sends the service to be transmitted. For example, the user equipment that transmits the service to be transmitted may include a medical institution, a military organization, or a scientific research institution. The attributes of different user devices can correspond to different security requirements. The security reference information may also include a security level of the service to be transmitted, the security level being used to indicate a security level required for the service to be transmitted. For example, the security reference information directly requests the signaling management network element or the security function node to configure a security parameter corresponding to the security algorithm with the security level of five for the to-be-transmitted service.

The protection type of the service to be transmitted may include path protection or data content protection. Path protection can refer to the protection of the to-be-transmitted service during transmission. For example, encryption protection is performed when transferring between two nodes. The data content protection may be the encryption protection of the data to be transmitted, that is, the data itself has been encrypted, and the data content cannot be obtained even if the data is intercepted by the attacker.

The execution node identifier of the security algorithm may be used to indicate a node that executes the security algorithm. After receiving the identity of the execution node, the signaling management network element or the security function node can learn the security protection when the user equipment wants to transmit data between the node.

The security reference information may further include a content attribute of the service to be transmitted, where the content attribute may be used to indicate a confidentiality level of the service to be transmitted. For example, the content attribute may be used to indicate that the content of the to-be-transmitted service belongs to a high-level secret, a medium-level secret, a low-level secret, or an open content.

Therefore, in the method for obtaining the security parameter of the to-be-transmitted service, the security function node may send the first message to the signaling management network element according to the security requirement of the to-be-transmitted service, and the signaling management network element further according to the first The message acquires the security parameters of the service to be transmitted. With prior art Obtaining security parameters according to the security-related capabilities reported by the UE. Obtaining security parameters according to the security requirements of the services to be transmitted can avoid the leakage of data caused by fixed security parameters (single security algorithm) and avoid blind protection of the transmission services. , reduce the cost of nodes to obtain transmission data.

It should be understood that the security function node may receive the security reference information sent by the sender or the signaling management network element, but the invention is not limited thereto. For example, the security function node may also receive messages of the security reference information sent by other gateway devices or other network devices. Regardless of which node the security reference information received by the security function node is sent, the security function node may send a first message to the signaling management network element, where the first message is used by the signaling management network element to obtain the security of the to-be-transmitted service. parameter.

Optionally, the security reference information may be carried in the request message. For example, the signaling management network element may send a request message to the security function node, where the request message may carry the security reference information, and the security function node may send the response message (ie, the first message) after receiving the request message. The signaling management network element and the security function node may obtain the security parameters of the to-be-transmitted service through the interaction request message and the response message.

Optionally, in the first implementation scenario of the foregoing embodiment, the first message may include at least one set of security parameters, and the signaling management network element obtains the security parameter of the to-be-transmitted service according to the first message in step S140. Can include:

The signaling management network element obtains the security parameter of the to-be-transmitted service from the at least one set of security parameters.

Further, optionally, step S120 can be implemented in the following two manners, as follows:

The security function node matches the received security reference information with the internally stored security parameters. If the security reference information corresponds to a set of security parameters, the set of security parameters is the security parameter of the to-be-transmitted service.

The security function node stores the association between the security reference information and the security parameters. The association relationship may be a one-to-one relationship or a one-to-many relationship. That is, a security reference information can correspond to a set of security parameters, and can also correspond to multiple sets of security parameters. Assume that the service attribute of the service to be transmitted is a QQ voice service, and the QQ voice service can correspond to multiple sets of security parameters. For example, the QQ voice service can correspond to the first set of security parameters when the network is congested, and the QQ voice service can correspond to the first time when the network is smooth. Two sets of security parameters. If the service attribute of the service to be transmitted is Alipay. The Alipay business can always correspond to a set of security parameters of a high security mechanism regardless of the circumstances.

Manner 2: If the security reference information corresponds to multiple sets of security parameters, the determination of the security parameters includes Two situations. In the first case, the security function node may determine a set of security parameters from the plurality of sets of security parameters, and send the set of security parameters to the signaling management network element by using the first message, that is, the security function node determines the final security parameter. . In the second case, the security function node may send the multiple sets of security parameters to the signaling management network element, and the signaling management network element determines a set of parameters from the multiple sets of security parameters as the security parameters of the service to be transmitted, that is, the letter. The management network element finally determines the security parameters of the to-be-transmitted service, and the flexible acquisition of the security parameters of the to-be-transmitted service can improve the efficiency of obtaining the security parameter. The present invention may determine a set of security parameters from a plurality of sets of security parameters, such as a signaling management network element or a security function node, by means of a random selection or according to capabilities reported by the user equipment (eg, supporting algorithm capabilities). There is no limit here.

In the above implementation scenario, the security function node may determine at least one set of security parameters according to the security reference information, and the signaling management network element further obtains a set of security parameters from the at least one set of security parameters as the security of the to-be-transmitted service. parameter. After the signaling management network element and the security function node negotiate the security parameters that match the to-be-transmitted service as the security parameters of the to-be-transmitted service, the to-be-transmitted service can obtain security protection that meets its own security requirements.

It should be understood that when security protection is to be performed on the transmission service, multiple security parameters need to be learned, and the security parameter of the to-be-transmitted service can be understood as a set of security parameters for the corresponding node to obtain a security algorithm according to the set of security parameters or A security scheme, and the security to be transmitted is secured according to the security algorithm or the security scheme.

Optionally, in the second implementation scenario of the foregoing embodiment, the first message does not include the security parameter, and the security management parameter of the to-be-transmitted service is obtained by the signaling management network element according to the first message in step S140. Two implementations:

Manner 1: If the first message does not contain the security parameter, the signaling management network element obtains the security parameter of the service to be transmitted according to the capability of the security algorithm of the user equipment.

Manner 2: If the first message does not include the security parameter, the signaling management network element uses the preset security parameter as the security parameter of the service to be transmitted.

Specifically, when the signaling management network element receives the first message that does not include the security parameter, the preset security parameter may be a parameter used to indicate that the security protection process is not performed on the to-be-transmitted service. Alternatively, when the signaling management network element receives the first message that does not include the security parameter, the preset security parameter may be a minimum security level, which is not limited herein. For example, the to-be-transmitted service is a video playing program, and the signaling management network element sends the security reference information to the security function node, where the security reference information indicates that the to-be-transmitted service is a video playing software, and the security function node receives the After the security reference information is determined, the video playback program may not be secured, and an acknowledgement message (Acknowledgement, hereinafter referred to as "ACK") is fed back. The acknowledgment message does not include a security parameter, and the signaling management network element receives the acknowledgment message. It can be known that the security function node has received the security reference information, and the security function node determines that the video player can be not subjected to security protection processing. The signaling management network element acquires a security parameter (for example, a security protection level of 0) that does not perform security protection processing on the video playback program according to the first message. It is also possible to stipulate that if the first message does not include the security parameter, the transmission service may be secured according to the agreed security parameters (for example, the security parameter corresponding to the lowest level security algorithm).

In summary, the first message may include at least one set of security parameters, or may be only an ACK. After receiving the first message, the signaling management network element may determine a security parameter of the to-be-transmitted service, where the information is used to indicate whether to perform security. The protection process is performed, or the service to be transmitted is security-protected according to the security parameter of the preset value. Flexible setting of the content or content of the first message can improve the efficiency of obtaining security parameters and the efficiency of transmitting data. The method is simple and easy to implement.

FIG. 3 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to an embodiment of the present invention. Optionally, in the third implementation scenario of the foregoing embodiment, as shown in FIG. 3, the foregoing method may further include:

S100. The sending end sends the security reference information to a security function node or a signaling management network element.

Optionally, if the sending end sends the security reference information to the signaling management network element in step S100, the method further includes:

S100a, the signaling management network element receives the sending end to send the security reference information;

S100b. The signaling management network element sends the security reference information to the security function node.

It should be understood that the sender can send the security reference information to the security function node in a direct or indirect manner. For example, when the sending end is an application layer server, the application layer server may directly send the security reference information to the security function node; if the sending end is a user equipment, the user equipment may indirectly send the security reference information to the security function node. For example, the user equipment may first send the security reference information to a signaling management network element (or an application layer server), and then send the security reference information to the security function node by a signaling management network element (or an application layer server).

It should be understood that the signaling management network element may receive the security reference information sent by the transmitting end, but the present invention is not limited thereto. For example, the signaling management network element may also receive the security reference information sent by other gateway devices or other network devices.

In addition, after receiving the security reference information, the signaling management network element may acquire the to-be-transmitted industry. For security requirements, the security reference information can also be forwarded directly to the security function node without any analysis processing.

It should be noted that the security parameters of the to-be-transmitted service in the embodiments of the present invention may include: at least one of an identifier of the security algorithm, a level information of the security algorithm, an execution node identifier of the security algorithm, and a parameter of the security algorithm; The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a key length, and the security The execution node identifier of the algorithm is used to indicate the execution node of the security algorithm. Optionally, the execution node includes at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.

In particular, the security parameters may include security related parameters used in encrypting the data. For example, the security parameter may include an execution node identifier of the security algorithm. After receiving the security parameter, the node may learn that the data is transmitted between the nodes, and the sender may obtain the security parameter. Data transfer between nodes requires encryption protection. The execution node identifier may be information that has an identification function, such as an identity ("ID") of the node.

For example, the security parameter may further include an identifier of the security algorithm, and after receiving the security parameter, the sender may learn which security algorithm to use for security protection. It is assumed that the security parameter includes the first identifier, and after receiving the security parameter, the sender can learn that the security algorithm corresponding to the first identifier is used for security protection.

For example, the security parameter may further include the level information of the security algorithm. After receiving the security parameter, the sending end may know which security level security algorithm is used to protect the transmission service. It is assumed that the security parameter includes the fifth-level security information. After receiving the security parameter, the sender can learn that the five-level security algorithm is used to protect the transmission service.

For example, the security parameter may further include a parameter of the security algorithm, and the parameter of the algorithm may include a length of the key, and the node that executes the security algorithm may know how long the key is used to protect the data after receiving the security parameter.

It should be understood that in the present invention, the security algorithm may include at least one of an encryption algorithm and an integrity protection algorithm.

Optionally, the security parameter of the to-be-transmitted service may include a second parameter, where the second parameter is used to indicate that the security protection process is not performed on the to-be-transmitted service.

Specifically, the security parameter of the to-be-transmitted service may include a second parameter, and the node receives the After the security parameter of the second parameter, it can be known that the data to be transmitted (for example, open data) is not subjected to security protection processing, and the power consumption of acquiring the transmission data can be reduced, and the delay for acquiring the transmission data can be reduced.

The embodiment shown in Figure 3 is described on the basis of the embodiment shown in Figure 2, as follows:

The above methods also include:

S170: The sending end performs security protection processing between the execution nodes according to the security parameter.

The security protection process may specifically be an encryption process or an integrity protection process.

The execution nodes in S170 may specifically include at least one of the following:

Between the transmitting end and the base station;

Between the sender and the signaling management network element;

Between the sender and the gateway;

When the sending end is a user equipment, between the user equipment and the application layer server;

When the sender is a user equipment, between the user equipment and the user equipment.

Specifically, after receiving the security parameter corresponding to the to-be-transmitted service, the sending end can obtain the security algorithm corresponding to the security parameter. The two-node nodes that perform the security algorithm may include (user equipment, user equipment), (user equipment, base station), (user equipment, signaling management network element), (user equipment, gateway), (user equipment, application layer server). ). It can also be any combination between user equipment, base stations, signaling management network elements, gateways, and application layer servers. For example, the signaling management network element can simultaneously send the security parameter to the user equipment and the base station, so that the same security algorithm is used for data transmission between the (user equipment, the base station) and the (user equipment, signaling management network element). After the security is activated between the nodes, the security algorithm corresponding to the security parameter can be used for security protection. The diversification of the execution body of the security algorithm can implement multiple layers of protection for the service to be transmitted, and improve the security of data transmission. For example, security protection (user equipment, base station) and (user equipment, application layer server) can be performed at the same time, and the two layers of security protection can be independent. After one layer is broken, the protection of the other layer is not affected. Diversification of the entity that performs this can improve the security of data transmission.

In the embodiment of the present invention, optionally, the method may further include:

S180. The signaling management network element sends the security parameter of the to-be-transmitted service to the user equipment, the base station, or the gateway.

The user equipment may include a user equipment (or a user equipment that sends the security reference information) that sends the service to be transmitted; the user equipment may also include a user that receives the service to be transmitted. device. For example, the first user equipment needs to send the online banking payment information to the second user equipment and the third user equipment, and the signaling management network element can send the online banking payment information to the first user equipment, the second user equipment, and the third user equipment. Security parameters.

Specifically, after receiving the security parameter, the user equipment, the application layer server, the base station, or the gateway may perform integrity protection on the transmission service according to the security algorithm corresponding to the security parameter. The user equipment, application layer server, base station or gateway may be the node that executes the security algorithm.

It should be understood that, in the implementation of the present invention, if the security function node receives the security reference information sent by the application layer server (the security reference information may be carried in the request message), and obtains a set of security parameters, the set of security parameters may be As a security parameter of the to-be-transmitted service. The response message sent by the security function node to the application layer server may include a security parameter of the service to be transmitted. After receiving the response message, the application layer server may send the security parameter of the to-be-transmitted service to the user equipment or the network device.

The foregoing FIG. 2 and FIG. 3 describe that the security function node obtains the security parameter matching the security reference information through the information exchange negotiation after the security function node receives the security reference information. In an actual application scenario, the services to be transmitted may have been secured before being transmitted between nodes. For example, the data of the service to be transmitted is protected at the application layer of the user equipment. The method 200 for obtaining security parameters after the security to be transmitted has been performed before transmission is specifically described below with reference to FIG.

FIG. 4 is a flowchart of a method for obtaining security parameters of a service to be transmitted according to another embodiment of the present invention. As shown in FIG. 4, taking the sending end as a user equipment as an example, the method may include:

S210: The user equipment performs security protection processing on data to be transmitted by the user equipment;

S220: The user equipment sends the security reference information to the signaling management network element, where the security reference information is used to indicate the security requirement of the service to be transmitted of the user equipment, where the security reference information includes a first parameter, where the first parameter is used to indicate the The data of the transmission service is data that has been subjected to security protection processing;

S230. The signaling management network element sends the security reference information to the security function node.

S240. The security function node sends the first message to the signaling management network element according to the security reference information.

S250. The signaling management network element acquires a security parameter of the to-be-transmitted service according to the first message.

If the to-be-transmitted service has established a security protection before the transmission, for example, S210, after receiving the security reference information, the signaling management network element can negotiate with the security function node to determine whether the transmission service needs to be transmitted. .

Assume that the service to be transmitted is a WeChat text service. If the WeChat text has been established in the application layer of the user equipment before the transmission, a Transport Layer Security ("TLS") is used for encryption protection. After receiving the security reference information, the signaling management network element and the security function node may determine that the WeChat text is not subjected to security protection processing between the user equipment and the base station through information interaction, thereby reducing the power and delay of acquiring data, and improving data. The efficiency of the transmission.

It is assumed that the to-be-transmitted service is a confidential file, and the confidential file is encrypted and protected at the application layer of the user equipment before the transmission, and the security reference information may include that the content attribute of the to-be-transmitted service is advanced secret, and the user attribute is the military organization and data. The attributes are text, eight levels of security and the first parameter. After receiving the security reference information, the signaling management network element and the security function node negotiate to determine that the security parameter corresponding to the six-level security algorithm can be configured for the confidential file. That is, if the data of the to-be-transmitted service has established security protection at the application layer of the user equipment, the security protection level in the transmission process may be appropriately adjusted (for example, the security protection level may be appropriately reduced), thereby reducing the power consumption of acquiring the transmission service. Reduce the delay in obtaining the transmission service.

It should be understood that, in the foregoing method, if the security function node and the signaling management network element obtain the security parameters of the to-be-transmitted service after negotiation, the relevant steps are similar to those in the embodiment shown in FIG. 2 and FIG. 3, in order to avoid The details are omitted.

It should be understood that the security of the to-be-transmitted service before the transmission may include: the data of the to-be-transmitted service is protected before being sent to the bottom layer for transmission by the application layer of the user equipment. Or the data of the service to be transmitted is already protected at the application layer of the user equipment. The bottom layer of the user equipment may include a media access control layer (Media Access Control, abbreviated as "MAC" layer), or may be a radio resource control layer (Radio Resource Control, abbreviated as "RRC" layer). The bottom layer may also be a network layer other than the physical layer, and the present invention is not limited herein.

It should be understood that obtaining the security parameter according to the security requirement of the service to be transmitted in the present invention is implemented on the premise that the user equipment supports the security algorithm corresponding to the security parameter. In other words, after the user equipment obtains the security parameter, the security algorithm corresponding to the security parameter can be used.

It should be understood that the security function node and the signaling management network element mentioned in the present invention negotiate (the security function node and the signaling management network element perform information interaction) to determine the security parameters, including two cases: the first one is that the security function node can directly Determining a security parameter of the to-be-transmitted service, sending a first message including the security parameter to the signaling management network element (the first message includes a set of security parameters); and second, the security function node matches the security reference information according to the security reference information a plurality of sets of security parameters (the first message includes a plurality of sets of security parameters), and the signaling management network element finally obtains the pair of service to be transmitted from the plurality of sets of security parameters The safety parameters should be.

Alternatively, the form of encryption between the execution nodes in the present invention is diversified. For example, the user equipment and the gateway are execution nodes, and security encryption is required between the user equipment and the gateway. The data transmission between the user equipment and the gateway may be through the signaling management network element. In this case, the security encryption between the user equipment and the gateway may be performed between the user equipment and the signaling management network element, and the signaling management network element and Encryption between gateways, the algorithm and key used by the user equipment, the signaling management network element, and the gateway are the same; the user equipment and the signaling management network element use the same algorithm and key for encryption. The signaling management network element only forwards the transmitted data. The specific form of the present invention is not limited herein.

The method for obtaining security parameters provided by the embodiments of the present invention can implement two kinds of diversification:

The first is that the acquired security parameters are themselves diverse. Regardless of the security parameter of the to-be-transmitted service directly obtained by the security function node, or the security parameter of the to-be-transmitted service obtained by the security function node and the signaling management network element, the security parameter is the security reference information that is to be transmitted. According to the security requirements, the different services to be transmitted can be configured with different security parameters. Compared with the security parameters that are transmitted according to the related capabilities reported by the user equipment in the prior art, the security requirements are combined with the security requirements of the service to be transmitted. Security parameters can enhance the protection of confidential data, weaken the protection of ordinary data, and can not protect certain data in certain situations. Diversified security parameters not only ensure the security of the transmitted data, but also avoid blind protection of the transmission service and improve the efficiency of data transmission.

The second is the diversification of executive entities. After the signaling management network element and the security function node negotiate the security parameters of the to-be-transmitted service, the security parameter may be sent to the user equipment or the network device. The execution entity may be any combination of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server. Layer-level encryption for data transmission further ensures the security of data transmission.

A method for obtaining security parameters of a service to be transmitted is described above with reference to FIG. 2 to FIG. 4 . The signaling management network element, the security function node, and the sending end according to the embodiment of the present invention will be described in detail below with reference to FIG. 5 to FIG. .

FIG. 5 shows a schematic block diagram of a signaling management network element 300 in accordance with an embodiment of the present invention. As shown in FIG. 5, the signaling management network element 300 includes:

The receiving module 310 is configured to receive a first message sent by the security function node according to the security reference information, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server;

The obtaining module 320 is configured to obtain a security parameter of the to-be-transmitted service according to the first message.

The sending module 330 is configured to send the security parameter of the to-be-transmitted service to the sending end.

Optionally, the receiving module 310 is further configured to receive the security reference information sent by the sending end, where the security reference information is used to indicate a security requirement of the to-be-transmitted service of the sending end;

The sending module 330 is further configured to send the security reference information to the security function node.

Optionally, the first message includes at least one set of security parameters, and the obtaining module 320 is specifically configured to obtain the security parameter of the to-be-transmitted service from the at least one set of security parameters.

Optionally, the sending module 330 is further configured to send the security parameter of the to-be-transmitted service to the user equipment, the base station, or the gateway.

Optionally, the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of the user equipment, a security level of the to-be-transmitted service, a protection type of the to-be-transmitted service, and execution of a security algorithm. At least one of the node identifiers; wherein the protection type includes path protection or data content protection.

Optionally, the data attribute of the to-be-transmitted service includes a first parameter, where the first parameter is used to indicate that the data of the service to be transmitted is data that has been subjected to security protection processing.

Optionally, the security parameter of the to-be-transmitted service includes: at least one of an identifier of the security algorithm, a level information of the security algorithm, an execution node identifier of the security algorithm, and a parameter of the security algorithm; wherein the identifier of the security algorithm is used for a security algorithm for identifying the to-be-transmitted service, the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, the parameter of the security algorithm includes a key length, and the execution node identifier of the security algorithm is used to indicate security The execution node of the algorithm.

Optionally, the execution node includes at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.

Optionally, the security parameter of the to-be-transmitted service includes a second parameter, where the second parameter is used to indicate that the security protection process is not performed on the to-be-transmitted service.

Optionally, the security function node is a function node that includes a security policy, and the security policy includes an association relationship between the security reference information and the security parameter.

It should be noted that the foregoing security reference information, the security parameter, the security requirement, and the service attribute of the service to be transmitted can be referred to the related description in the embodiment shown in FIG. 2 to FIG. 4 , and details are not described herein again.

It should be understood that the signaling management network element 300 according to the embodiment of the present invention may correspond to the method for obtaining the security parameter of the to-be-transmitted service according to the embodiment of the present invention, and the various modes in the signaling management network element 300. The above-mentioned and other operations or functions of the blocks are respectively implemented in order to implement the corresponding processes of the signaling management network elements of the respective methods shown in FIG. 2 to FIG. 4 , and are not described herein again for brevity.

FIG. 6 shows a schematic block diagram of a secure function node 400 in accordance with an embodiment of the present invention. As shown in FIG. 6, the security function node 400 includes:

The receiving module 410 is configured to receive the security reference information sent by the signaling management network element or the sending end, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server;

The sending module 420 is configured to send a first message to the signaling management network element according to the security reference information received by the receiving module, where the first message is used by the signaling management network element to obtain the security parameter of the to-be-transmitted service.

Optionally, the first message includes at least one set of security parameters, where the first message is specifically used by the signaling management network element to obtain the security parameter of the to-be-transmitted service from the at least one set of security parameters.

Optionally, the first message does not include a security parameter.

Optionally, the security function node is a function node that stores a security policy, and the security policy includes an association relationship between the security reference information and the security parameter.

It should be pointed out that the above safety reference information, safety parameters, safety requirements and the industry to be transmitted For the service attributes and the like, refer to the related description in the embodiment shown in FIG. 2 to FIG. 4, and details are not described herein again.

It should be understood that the security function node 400 according to the embodiment of the present invention may correspond to the method for obtaining the security parameter of the service to be transmitted according to the embodiment of the present invention, and the foregoing and other operations or functions of the respective modules in the security function node 400 are respectively implemented. The corresponding processes of the security function nodes in the respective methods shown in FIG. 2 to FIG. 4 are not described herein for brevity.

FIG. 7 shows a schematic block diagram of a transmitting end 500, which may include a user equipment or an application layer server, according to an embodiment of the present invention. As shown in FIG. 7, the transmitting end 500 includes:

The sending module 510 is configured to send security reference information to the security function node or the signaling management network element, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end;

The receiving module 520 is configured to receive a security parameter of the to-be-transmitted service sent by the signaling management network element.

It should be noted that the foregoing security reference information, security parameters, security requirements, and service attributes of the service to be transmitted can be referred to the related description in the embodiment shown in FIG. 2 to FIG. Said.

It should be understood that the sending end 500 according to the embodiment of the present invention may correspond to the method for obtaining the security parameter of the to-be-transmitted service according to the embodiment of the present invention, and the above-mentioned and other operations or functions of the respective modules in the transmitting end 500 are respectively implemented for 2 to the corresponding process of the sending end or the user equipment in each method shown in FIG. 4, for brevity, no further details are provided herein.

FIG. 8 shows a schematic block diagram of a signaling management network element 600 in accordance with another embodiment of the present invention. As shown in FIG. 8, the signaling management network element 600 includes:

Transceiver 610, processor 620, memory 630, and bus system 640. The processor 620, the memory 630 and the transceiver 610 are connected by a bus system 640 for storing instructions for executing instructions stored in the memory 630 and controlling the transceiver 610 to receive or transmit information. ;

The transceiver 610 is configured to receive a first message that is sent by the security function node according to the security reference information, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes the user equipment or the application layer server. The processor 620 is configured to obtain the security parameter of the to-be-transmitted service according to the first message received by the transceiver 610. The transceiver 610 is further configured to send the security parameter of the to-be-transmitted service to the sending end.

Optionally, the transceiver 610 is further configured to receive the security reference information sent by the sending end, and send the security reference information to the security function node.

Optionally, the first message includes at least one set of security parameters, and the processor 620 is specifically configured to obtain the security parameter of the to-be-transmitted service from the at least one set of security parameters.

Optionally, the first message does not include a security parameter.

Optionally, the transceiver 610 is further configured to send the security parameter of the to-be-transmitted service to the user equipment, the base station, or the gateway.

Optionally, the security reference information acquired by the processor 620 includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of the user equipment, a security level of the to-be-transmitted service, and protection of the to-be-transmitted service. At least one of a type and an execution node identifier of the security algorithm; wherein the protection type includes path protection or data content protection.

Optionally, the security reference information received by the transceiver 610 includes a data attribute of the service to be transmitted, and the data attribute of the to-be-transmitted service includes a first parameter, where the first parameter is used to indicate that the data of the service to be transmitted is secure. Protect processed data.

Optionally, the security parameter of the to-be-transmitted service received by the transceiver 610 includes: a security algorithm At least one of the identifier of the security algorithm, the identifier of the execution node of the security algorithm, and the parameter of the security algorithm; wherein the identifier of the security algorithm is used to identify a security algorithm of the service to be transmitted, and the level information of the security algorithm A security level for indicating a security algorithm of the service to be transmitted, the parameter of the security algorithm includes a key length, and an execution node identifier of the security algorithm is used to indicate an execution node of the security algorithm.

Optionally, the first message received by the transceiver 610 includes an execution node identifier of a security algorithm, where the execution node includes at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.

Optionally, the security parameter of the to-be-transmitted service acquired by the processor includes a second parameter, where the second parameter is used to indicate that the security protection process is not performed on the to-be-transmitted service.

It should be understood that, in the embodiment of the present invention, the processor 620 may be a central processing unit ("CPU"), and the processor 620 may also be other general-purpose processors, digital signal processors (DSPs). , an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

The memory 630 can include read only memory and random access memory and provides instructions and data to the processor 620. A portion of the memory 630 may also include a non-volatile random access memory. For example, the memory 630 can also store information of the device type.

The bus system 640 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 640 in the figure.

In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 620 or an instruction in a form of software. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in the memory 630, and the processor 620 reads the information in the memory 630, and completes the steps of the respective methods shown in FIG. 2 to FIG. 4 in combination with the hardware thereof. To avoid repetition, it will not be described in detail here.

FIG. 9 shows a schematic block diagram of a secure function node 700 in accordance with an embodiment of the present invention. As shown in FIG. 9, the security function node 700 includes:

Transceiver 710, processor 720, memory 730, and bus system 740. The processor 720, the memory 730 and the transceiver 710 are connected by a bus system 740 for storing instructions for executing instructions stored in the memory 730 and controlling the transceiver 710 to receive or transmit information. ;

The transceiver 710 is configured to receive the security reference information sent by the signaling management network element or the sending end, where the security reference information is used to indicate the security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server; The processor 720 is configured to send a first message to the signaling management network element according to the security reference information, where the first message is used by the signaling management network element to obtain a security parameter of the to-be-transmitted service.

Optionally, the first message does not include a security parameter.

Optionally, the security parameter of the to-be-transmitted service includes a second parameter, where the second parameter is used to indicate The security protection process is not performed on the to-be-transmitted service.

It should be understood that, in the embodiment of the present invention, the processor 720 may be a central processing unit ("CPU"), and the processor 720 may also be other general-purpose processors, digital signal processors (DSPs). , an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

The memory 730 can include read only memory and random access memory and provides instructions and data to the processor 720. A portion of the memory 730 may also include a non-volatile random access memory. For example, the memory 730 can also store information of the device type.

The bus system 740 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 740 in the figure.

In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 720 or an instruction in a form of software. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in the memory 730, and the processor 720 reads the information in the memory 730, and completes the steps of the respective methods shown in FIG. 2 to FIG. 4 in combination with the hardware thereof. To avoid repetition, it will not be described in detail here.

FIG. 10 shows a schematic block diagram of a transmitting end 800 in accordance with an embodiment of the present invention. As shown in FIG. 10, the transmitting end 800 includes:

Transceiver 810, processor 820, memory 830, and bus system 840. The processor 820, the memory 830 and the transceiver 810 are connected by a bus system 840 for storing instructions for executing instructions stored in the memory 830 and controlling the transceiver 810 to receive or transmit information. .

The transceiver 810 is configured to: send security reference information to the signaling management network element or the security function node, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end; the transceiver 810 is further configured to receive signaling Management security parameters of the to-be-transmitted service sent by the network element.

It should be noted that the foregoing security reference information, security parameters, security requirements, and service attributes of the service to be transmitted can be referred to the related description in the embodiment shown in FIG. 2 to FIG. 4 , and details are not described herein again.

It should be understood that, in the embodiment of the present invention, the processor 820 may be a central processing unit ("CPU"), and the processor 820 may also be other general-purpose processors, digital signal processors (DSPs). , an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, and the like. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

The memory 830 can include read only memory and random access memory and provides instructions and data to the processor 820. A portion of the memory 830 may also include a non-volatile random access memory. For example, the memory 830 can also store information of the device type.

The bus system 840 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus. However, for clarity of description, various buses are labeled as bus system 840 in the figure.

In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 820 or an instruction in a form of software. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in the memory 830, and the processor 820 reads the information in the memory 830, and completes the steps of the respective methods shown in FIG. 2 to FIG. 4 in combination with the hardware thereof. To avoid repetition, it will not be described in detail here.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, for clarity of hardware and software. Interchangeability, the composition and steps of the various examples have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described above as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. You can choose some of them according to actual needs or All units are used to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The above-described integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method of various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any equivalent person can be easily conceived within the technical scope of the present invention by any person skilled in the art. Modifications or substitutions are intended to be included within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A method for obtaining security parameters of a service to be transmitted, characterized in that the method comprises:

The signaling management network element receives a first message sent by the security function node according to the security reference information, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server;

Obtaining, by the signaling management network element, a security parameter of the to-be-transmitted service according to the first message;

The signaling management network element sends the security parameter of the to-be-transmitted service to the sending end.
The method of claim 1 further comprising:

Receiving, by the sending end, the security reference information by the signaling management network element;

The signaling management network element sends the security reference information to the security function node.
The method according to claim 1 or 2, wherein the first message includes at least one set of security parameters, and the signaling management network element acquires security parameters of the to-be-transmitted service according to the first message. ,include:

The signaling management network element obtains the security parameter of the to-be-transmitted service from the at least one set of security parameters.
The method of claim 1 or 2, wherein the first message does not include a security parameter.
The method according to any one of claims 1 to 4, further comprising:

The signaling management network element sends the security parameter of the to-be-transmitted service to the user equipment, the base station, or the gateway.
The method according to any one of claims 1 to 5, wherein the security reference information comprises a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of a user equipment, the At least one of a security level of the service to be transmitted, a protection type of the service to be transmitted, and an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The method according to claim 6, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the to-be-transmitted service is data that has been subjected to security protection processing.
The method according to any one of claims 1 to 7, wherein the security parameters of the to-be-transmitted service include: an identifier of a security algorithm, a level information of a security algorithm, an execution node identifier of a security algorithm, and a security algorithm. At least one of the parameters;

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The method according to claim 8, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, the signaling management network element, and the application layer server.
The method according to any one of claims 1 to 7, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate that security protection is not performed on the to-be-transmitted service. deal with.
The method according to any one of claims 1 to 10, wherein the security function node is a function node storing a security policy, and the security policy includes an association relationship between the security reference information and the security parameter.
A method for obtaining security parameters of a service to be transmitted, characterized in that the method comprises:

The security function node receives the security reference information sent by the signaling management network element or the sending end, where the security reference information is used to indicate the security requirement of the to-be-transmitted service of the sending end, and the sending end includes an application layer server or a user equipment;

The security function node sends a first message to the signaling management network element according to the security reference information, where the first message is used by the signaling management network element to obtain the security parameter of the to-be-transmitted service.
The method according to claim 12, wherein the first message includes at least one set of security parameters, and the first message is specifically used by the signaling management network element to obtain from the at least one set of security parameters. The security parameter of the service to be transmitted.
The method of claim 12 wherein said first message does not include a security parameter.
The method according to any one of claims 12 to 14, wherein the security reference information comprises a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of a user equipment, the The security level of the service to be transmitted and the type of protection of the service to be transmitted And at least one of an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The method according to claim 15, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the service to be transmitted is data that has been subjected to security protection processing.
The method according to any one of claims 12 to 16, wherein the security parameters of the to-be-transmitted service include: an identifier of the security algorithm, level information of the security algorithm, an execution node identifier of the security algorithm, and a security algorithm. At least one of the parameters;

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The method according to claim 17, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.
The method according to any one of claims 12 to 16, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate that security protection is not performed on the to-be-transmitted service. deal with.
The method according to any one of claims 12 to 19, wherein the security function node is a function node storing a security policy, and the security policy includes an association relationship between the security reference information and the security parameter.
A method for obtaining security parameters of a service to be transmitted, characterized in that the method comprises:

The sending end sends the security reference information to the signaling management network element or the security function node, where the security reference information is used to indicate the security requirement of the to-be-transmitted service of the sending end, and the sending end includes the user equipment or the application layer server;

The sending end receives the security parameter of the to-be-transmitted service sent by the signaling management network element.
The method according to claim 21, wherein the security reference information comprises a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of a user equipment, and a security level of the to-be-transmitted service. At least one of a protection type of the service to be transmitted and an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The method according to claim 22, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the service to be transmitted is data that has been subjected to security protection processing.
The method according to any one of claims 21 to 23, wherein the security parameters of the to-be-transmitted service include: an identifier of a security algorithm, a level information of a security algorithm, an execution node identifier of a security algorithm, and a security algorithm. At least one of the parameters;

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The method according to claim 24, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.
The method according to any one of claims 21 to 25, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate that security protection is not performed on the to-be-transmitted service. deal with.
The method according to any one of claims 21 to 26, wherein the security function node is a function node storing a security policy, and the security policy includes an association relationship between the security reference information and the security parameter.
A signaling management network element, comprising:

a receiving module, configured to receive a first message sent by the security function node according to the security reference information, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end, where the sending end includes a user equipment or an application layer server;

An obtaining module, configured to acquire, according to the first message, a security parameter of the to-be-transmitted service;

And a sending module, configured to send, to the sending end, a security parameter of the to-be-transmitted service.
The signaling management network element according to claim 28, wherein the receiving module is further configured to receive, by the sending end, the security reference information, where the sending module is further configured to send the Safety reference information.
The method according to claim 28 or 29, wherein the first message includes at least one set of security parameters, and the obtaining module is specifically configured to obtain the to-be-transmitted service from the at least one set of security parameters. Safety parameters.
A method according to claim 28 or 29, wherein said first message is not Includes safety parameters.
The signaling management network element according to any one of claims 28 to 31, wherein the sending module is further configured to send the security parameter of the to-be-transmitted service to a user equipment, a base station or a gateway.
The signaling management network element according to any one of claims 28 to 32, wherein the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, and a user equipment. At least one of an attribute, a security level of the to-be-transmitted service, a protection type of the to-be-transmitted service, and an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The signaling management network element according to claim 33, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the to-be-transmitted service is already secured. Processed data.
The signaling management network element according to any one of claims 28 to 34, wherein the security parameter of the to-be-transmitted service includes: an identifier of a security algorithm, a level information of a security algorithm, and an execution node identifier of the security algorithm. And at least one of the parameters of the security algorithm;

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The signaling management network element according to claim 35, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.
The signaling management network element according to any one of claims 28 to 34, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate the service to be transmitted. No security protection is performed.
The signaling management network element according to any one of claims 28 to 37, wherein the security function node is a function node including a security policy, and the security policy includes a relationship between security reference information and security parameters. connection relation.
A security function node, wherein the security function node comprises:

The receiving module is configured to receive the security reference information sent by the signaling management network element or the sending end, where the security reference information is used to indicate a security requirement of the to-be-transmitted service of the sending end, where the sending end includes a user equipment or an application layer server. ;

a sending module, configured to send, by using the security reference information received by the receiving module, a first message to the signaling management network element, where the first message is used by the signaling management network element to obtain the security of the to-be-transmitted service parameter.
The security function node according to claim 39, wherein the first message includes at least one set of security parameters, and the first message is specifically used by the signaling management network element from the at least one set of security parameters Obtaining the security parameter of the to-be-transmitted service.
The security function node of claim 39, wherein the first message does not include a security parameter.
The security function node according to any one of claims 39 to 41, wherein the security reference information includes a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of a user equipment, At least one of a security level of the to-be-transmitted service, a protection type of the to-be-transmitted service, and an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The security function node according to claim 42, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the to-be-transmitted service is already subjected to security protection processing. data.
The security function node according to any one of claims 39 to 43, wherein the security parameters of the to-be-transmitted service include: an identifier of a security algorithm, a level information of a security algorithm, an execution node identifier of the security algorithm, and security. At least one of the parameters of the algorithm;

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The security function node according to claim 44, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.
The security function node according to any one of claims 39 to 43, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate that the service to be transmitted is not executed. Security protection processing.
The security function node according to any one of claims 39 to 46, wherein the security function node is a function node storing a security policy, and the security policy includes an association between security reference information and security parameters. relationship.
A transmitting end, wherein the sending end comprises:

a sending module, configured to send the security reference information to the signaling management network element or the security function node, where the security reference information is used to indicate a security requirement of the to-be-transmitted service at the transmitting end;

And a receiving module, configured to receive a security parameter of the to-be-transmitted service sent by the signaling management network element.
The transmitting end according to claim 48, wherein the security reference information comprises a data attribute of the to-be-transmitted service, a service attribute of the to-be-transmitted service, an attribute of a user equipment, and a security of the to-be-transmitted service. At least one of a level, a protection type of the service to be transmitted, and an execution node identifier of the security algorithm;

The protection type includes path protection or data content protection.
The transmitting end according to claim 49, wherein the data attribute of the to-be-transmitted service includes a first parameter, and the first parameter is used to indicate that the data of the to-be-transmitted service is data that has been subjected to security protection processing. .
The transmitting end according to any one of claims 48 to 50, wherein the security parameter of the to-be-transmitted service includes: an identifier of the security algorithm, level information of the security algorithm, an execution node identifier of the security algorithm, and a parameter of the security algorithm. At least one

The identifier of the security algorithm is used to identify a security algorithm of the to-be-transmitted service, and the level information of the security algorithm is used to indicate a security level of the security algorithm of the to-be-transmitted service, where the parameters of the security algorithm include a secret. The length of the key, the execution node identifier of the security algorithm is used to indicate the execution node of the security algorithm.
The transmitting end according to claim 51, wherein the execution node comprises at least one of a user equipment, a base station, a gateway, a signaling management network element, and an application layer server.
The transmitting end according to any one of claims 48 to 50, wherein the security parameter of the to-be-transmitted service includes a second parameter, and the second parameter is used to indicate that security is not performed on the to-be-transmitted service. Protection processing.
The transmitting end according to any one of claims 48 to 53, wherein the security function node is a function node storing a security policy, and the security policy includes an association relationship between security reference information and security parameters. .