WO2018076742A1 - 一种数据传输方法、相关设备及系统 - Google Patents

一种数据传输方法、相关设备及系统 Download PDF

Info

Publication number
WO2018076742A1
WO2018076742A1 PCT/CN2017/090317 CN2017090317W WO2018076742A1 WO 2018076742 A1 WO2018076742 A1 WO 2018076742A1 CN 2017090317 W CN2017090317 W CN 2017090317W WO 2018076742 A1 WO2018076742 A1 WO 2018076742A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
data unit
protocol data
air interface
identifier
Prior art date
Application number
PCT/CN2017/090317
Other languages
English (en)
French (fr)
Inventor
张博
甘露
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17864761.6A priority Critical patent/EP3512291B1/en
Priority to JP2019522766A priority patent/JP2019533956A/ja
Publication of WO2018076742A1 publication Critical patent/WO2018076742A1/zh
Priority to US16/400,032 priority patent/US11228908B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/06—Optimizing the usage of the radio link, e.g. header compression, information sizing, discarding information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a data transmission method, related device, and system.
  • Air interface transmission is a key feature of wireless communication.
  • the security protection mechanism from the user equipment (English: User Equipment, UE for short) to the Internet is the hop-by-hop mechanism, that is, the form of segment encryption. All the information in the session is protected.
  • the intermediate nodes through which the information passes can obtain the plaintext of the information, so it cannot resist the eavesdropping of the intermediate node.
  • end-to-end protection mechanism for example, end-to-end protection between the UE and the core network (English: core network, referred to as CN), UE and Internet server. End-to-end protection and so on.
  • End-to-end protection between the UE and the CN specifically refers to the transmission of session data between the UE and the network element in the CN (for example, the control network element in the CN, the carrier server in the CN, the user plane gateway in the CN, etc.)
  • the uplink data unit (English: Protocol Data Unit, PDU for short) is directly encrypted by the UE, and the uplink protocol data unit is decrypted by the network element in the CN, and the downlink data is directly used by the network element in the CN.
  • FIG. 1 is a schematic diagram of a scenario of an end-to-end protection mechanism in the prior art.
  • FIG. 1 includes a UE, an AN, and a control plane authentication unit (English: Control Plane-Authentication Unit, referred to as CP- AU), User Plane Gateway (English: User Plane-Gateway, UP-GW for short) and Internet server.
  • the process of the UE communicating in the network is as follows:
  • Step S101 The UE sends an access request to the AN by using an air interface technology, and the UE and the AN belong to an air interface segment;
  • Step S102 The AN receives the access request and sends the access request to the CP-AU in the CN.
  • Step S103 the UE and the CP-AU are authenticated in both directions;
  • Step S104 The UE establishes a session between the UE and the CN after the mutual authentication of the CP-AU is successful.
  • Step S105 The UE and the UP-GW in the CN perform protocol data unit transmission based on the session, and adopt an end-to-end protection mechanism to protect protocol data unit transmission, that is, the UE encrypts the uplink protocol data unit and is used by the UP-GW. Decrypting the uplink protocol data unit, the UP-GW encrypts the downlink protocol data unit, and the UE decrypts the downlink protocol data unit, and the intermediate node AN between the UE and the UP-GW is responsible for the The uplink protocol data unit and the downlink protocol data unit are transited, but no encryption and decryption operations are performed; thereby preventing the AN from eavesdropping on content between the UE and the UP-GW.
  • the object protected by the end-to-end protection mechanism is usually the payload part of the protocol data unit rather than the header part of the protocol data unit, because the intermediate node needs to read the information used to identify the session in the header of the protocol data unit (eg , session ID, IMSI, bearer identity, etc., to determine how to forward the protocol data unit based on the information. Since the information used to identify the session is not encrypted, an attacker can easily obtain the message during the air interface transmission phase. The information is tracked to the session based on the information, posing a threat to the security of the session.
  • the information used to identify the session is not encrypted, an attacker can easily obtain the message during the air interface transmission phase.
  • the information is tracked to the session based on the information, posing a threat to the security of the session.
  • the embodiment of the invention discloses a data transmission method, a related device and a system, which can prevent a session between a UE and a target node from being attacked.
  • an embodiment of the present invention provides a communication system, where the communication system includes an access network device AN and a user equipment UE, where: the AN is configured to receive a basic key sent by a device that manages a key in the core network, The base key is a key generated by the UE and the core network for mutual authentication or a key derived based on the key generated by the two-way authentication; the AN and the UE are both used to process the basic key according to a preset rule.
  • the UE is further configured to protect a target field in the uplink protocol data unit PDU by using the air interface protection key, and send the uplink protocol data unit that protects the target field to the AN, the target field Included information for identifying a session between the UE and the target node, the data of the session between the target node and the UE needs to pass through the AN when transmitting;
  • the AN is configured to receive the uplink protocol data unit, and pass the The air interface protection key parses the target field in the uplink protocol data unit.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the AN is configured to protect a target field in a downlink protocol data unit by using the air interface protection key, and the downlink protocol that protects the target field is protected
  • the data unit is sent to the UE; the UE is configured to receive the downlink protocol data unit, and parse the target field in the downlink protocol data unit by using the air interface protection key.
  • the target field in the downlink protocol data unit is protected by the air interface protection key, specifically: according to the foregoing
  • the rule defined by the obtained air interface policy protects the target field in the downlink protocol data unit by using the air interface protection key, where the air interface policy defines a usage rule of the key; the parsing of the downlink protocol data unit by the air interface protection key
  • the target field is specifically: parsing the target field in the downlink protocol data unit by using the air interface protection key according to a rule defined by the air interface policy acquired in advance.
  • the air interface protection Key field protection target field in the uplink protocol data unit PDU specifically: using the air interface protection key to protect the target field in the uplink protocol data unit according to the rule defined by the pre-acquired air interface policy
  • the air interface policy defines the use of the key a rule that parses the target field in the uplink protocol data unit by using the air interface protection key, specifically: parsing the target field in the uplink protocol data unit by using the air interface protection key according to a rule defined by a pre-acquired air interface policy .
  • the AN is configured to receive an initial from the core network a security policy, the initial security policy defines a generation rule of a key used in the target session, the target session is a session between the target node and the UE; and the AN is configured to generate an air interface policy according to the initial security policy; AN is used to send the UE to the UE An air interface policy; the UE is configured to receive the air interface policy.
  • the UE is further configured to determine whether a protocol data unit payload PDU payload field in the uplink protocol data unit is protected; if not, The UE is configured to protect the uplink protocol data unit by using the air interface protection key; if yes, the UE is configured to perform an operation of protecting the target field in the uplink protocol data unit by using the air interface protection key.
  • the AN is further used to determine a protocol data unit in the downlink protocol data unit. Whether the load PDU payload field has been protected; if not, the AN is configured to protect the downlink protocol data unit by using the air interface protection key; if yes, the AN is configured to perform the downlink protocol data unit by using the air interface protection key The operation of the target field in .
  • the air interface protection The key includes at least one of an encryption key and an integrity protection key.
  • the target field includes at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, and media access of the hardware Control identifier, session identifier, internet protocol address of the UE, IP address of the access network device, access network identifier of the access network accessed by the access network device, IP address of the UE, quality of service identifier, international Mobile subscriber identity, international mobile device identity, internet protocol multimedia private identity, IP multimedia public identity, temporary mobile subscriber identity, mobile number of the UE, and global uniqueness of the UE At least one of the temporary user device IDs.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or in the Internet A server that establishes a communication connection with a network element in the core network.
  • the embodiment of the present invention provides a communication system, where the system includes a user equipment UE and an access network equipment AN, where: the AN is used to generate a target identifier corresponding to the target session, where the target session is the UE and the target a session between the nodes, the data of the target session needs to pass through the AN when transmitting; the AN is configured to send corresponding relationship information to the UE, where the correspondence relationship information indicates a correspondence between the target session and the target identifier; the UE And receiving the corresponding relationship information, and determining, according to the correspondence information, that the target session corresponds to the target identifier; the UE is configured to encapsulate the target identifier in an uplink protocol data unit PDU of the target session and encapsulate the uplink of the target identifier.
  • the AN is used to generate a target identifier corresponding to the target session, where the target session is the UE and the target a session between the nodes, the data of the target session needs to pass through the
  • a protocol data unit is sent to the AN; the AN is configured to receive the uplink protocol data unit; the AN is configured to replace the target identifier in the uplink protocol data unit with a reference identifier, and send the replaced uplink protocol data unit to the A target node, the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UP and the GW, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the AN is configured to receive a downlink protocol data unit that is sent by the target node, where the downlink protocol data unit includes the reference identifier to indicate the downlink protocol data unit The target session is used; the AN is configured to replace the reference identifier in the downlink protocol data unit with the target identifier, and send the replaced downlink protocol data unit to the UE; the UE is configured to receive the downlink protocol data unit and Determining, according to the target identifier, the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in an outer IP header outer IP header field, a encapsulation header encapsulation header field And at least one field in the protocol data unit header PDU header field.
  • the reference identifier includes a bearer The identifier, the flow identifier, the media access control identifier of the hardware, the session identifier, the Internet Protocol address of the UE, the IP address of the access network device, and the access network identifier of the access network accessed by the access network device, UE's IP address, quality of service identifier, international mobile subscriber identity, international mobile device identity, Internet Protocol multimedia private identity, IP multimedia public identity, temporary mobile subscriber identity, mobile phone number of the UE, and global unique temporary user equipment identity of the UE At least one of them.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • an embodiment of the present invention provides a user equipment (UE), where the user equipment includes: a generating unit, configured to process a basic key according to a preset rule to generate an air interface protection key, where the basic key is the UE and the core network.
  • a generating unit configured to process a basic key according to a preset rule to generate an air interface protection key, where the basic key is the UE and the core network.
  • the device for managing the key in the core network is used to send the basic key to the access network device AN, so that the AN Processing the basic key according to the preset rule to generate the air interface protection key; and the protection unit, configured to protect, by using the air interface protection key, a target field in the uplink protocol data unit PDU, where the target field is used to identify the UE and the target
  • the sending unit is configured to send the uplink protocol data unit that protects the target field to the AN, So that the AN resolves the target field in the uplink protocol data unit by using the air interface protection key.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the user equipment further includes: a first receiving unit, configured to receive, by the UE, a downlink protocol data unit sent by the AN, and protect the confidentiality through the air interface
  • the key parses the target field in the downlink protocol data unit, and the target field in the downlink protocol data unit is encrypted by the air interface protection key.
  • the first receiving unit parses the target field in the downlink protocol data unit by using the air interface protection key, specifically The target field in the downlink protocol data unit is parsed by using the air interface protection key according to the rule defined by the pre-acquisition air interface policy, where the target field in the downlink protocol data unit is defined by the AN according to the air interface policy acquired in advance.
  • the rule is protected by the air interface protection key, which defines the usage rules of the key.
  • the protection unit is specifically used
  • the target field in the uplink protocol data unit is protected by the air interface protection key according to a rule defined by the air interface policy
  • the AN is configured to use the air interface protection key to parse the target field according to a rule defined by the air interface policy acquired in advance.
  • the air interface policy defines the rules for using the key.
  • the user equipment further includes: a second receiving unit And the air interface policy is sent by the AN, where the air interface policy is generated by the AN according to an initial security policy, where the initial security policy defines a key generation rule used in the target session, where the target session is the target node and The session between the UEs.
  • the method further includes: a determining unit, configured to determine whether the protocol data unit payload PDU payload field in the uplink protocol data unit is protected, if If yes, the protection unit is triggered to protect the uplink protocol data unit by using the air interface protection key; if yes, the protection unit is triggered to perform an operation of the UE to protect the target field in the uplink protocol data unit PDU by using the air interface protection key.
  • the air interface protection key includes an encryption key and an integrity protection key. At least one.
  • the target field The method includes an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or The network element in the core network establishes a server for communication connection.
  • an embodiment of the present invention provides an access network device AN, where the access network device includes: a first receiving unit, configured to receive a basic key sent by a device that manages a key in a core network, and the basic key a key generated by the user equipment UE and the core network, or a key derived based on the key generated by the two-way authentication; the UE is configured to process the basic key according to a preset rule to generate an air interface protection key; a generating unit, configured to process the basic key according to the preset rule to generate an air interface protection key; the second receiving unit is configured to receive an uplink protocol data unit sent by the UE, and parse the uplink protocol by using the air interface protection key a target field in the data unit, the target field in the uplink protocol data unit is protected by the UE by the air interface protection key, the target field containing information for identifying a session between the UE and the target node, the target The data of the session between the node and the UE needs to pass through the
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the AN further includes: a protection unit, configured to protect a target field in the downlink protocol data unit by using the air interface protection key, and protect the The downlink protocol data unit of the target field is sent to the UE; so that the UE parses the target field in the downlink protocol data unit by using the air interface protection key.
  • a protection unit configured to protect a target field in the downlink protocol data unit by using the air interface protection key, and protect the The downlink protocol data unit of the target field is sent to the UE; so that the UE parses the target field in the downlink protocol data unit by using the air interface protection key.
  • the AN further includes: a determining unit, configured to determine a protocol data unit payload PDU in the downlink protocol data unit Whether the payload field is protected, if not, triggering the protection unit to protect the downlink protocol data unit by the air interface protection key; if yes, triggering the protection unit to perform the protection of the target in the downlink protocol data unit by the air interface protection key The operation of the field.
  • a determining unit configured to determine a protocol data unit payload PDU in the downlink protocol data unit Whether the payload field is protected, if not, triggering the protection unit to protect the downlink protocol data unit by the air interface protection key; if yes, triggering the protection unit to perform the protection of the target in the downlink protocol data unit by the air interface protection key The operation of the field.
  • the protection unit is protected by the air interface protection key
  • the target field in the downlink protocol data unit is specifically configured to: use the air interface protection key to protect the target field in the downlink protocol data unit according to the rule defined by the air interface policy that is obtained in advance, and the UE is used to define the air interface policy according to the previously obtained air interface policy.
  • the rule uses the air interface protection key to parse the target field in the downlink protocol data unit, and the air interface policy defines a usage rule of the key.
  • the second receiving unit parses the target field in the uplink protocol data unit by using the air interface protection key, specifically: parsing the air interface protection key according to a rule defined by a pre-acquired air interface policy.
  • a target field in the uplink protocol data unit, the target field in the uplink protocol data unit is protected by the UE according to a rule defined by the air interface policy acquired in advance, and the air interface policy defines the use of the key. rule.
  • the AN further includes: a third receiving unit, For receiving an initial security policy from a core network, the initial security policy defines a generation rule of a key used in a target session, the target session is a session between the target node and the UE; and a sending unit is configured to The initial security policy generates an air interface policy and sends the air interface policy to the UE.
  • the air interface protection key includes an encryption key and an integrity protection key. At least one.
  • the target field The method includes an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information for identifying the session between the UE and the target node includes a bearer identifier, a flow identifier, and a hardware
  • the media access control identifier, the session identifier, the Internet Protocol address of the UE, the IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, and the service At least one of a quality identity, an international mobile subscriber identity, an international mobile device identity, an internet protocol multimedia private identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or The network element in the core network establishes a server for communication connection.
  • an embodiment of the present invention provides a user equipment (UE), where the UE includes: a first receiving unit, configured to receive correspondence information sent by an access network device AN, and determine a target session corresponding target identifier according to the corresponding relationship information, The target identifier is generated by the AN, the target session is a session between the UE and the target node, the data of the target session needs to pass through the AN when transmitting; the encapsulating unit is used for an uplink protocol data unit PDU in the target session Transmitting the target identifier and transmitting an uplink protocol data unit encapsulating the target identifier to the AN; the AN is configured to replace the target identifier in the uplink protocol data unit with the reference identifier and replace the replaced uplink protocol data unit Sending to the target node, the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a first receiving unit configured to receive correspondence information sent by an access network device AN, and determine a target session
  • the session protection mechanism is set in the air interface transmission segment of the UE and the AN by running the foregoing unit, that is, after the UE establishes the target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the UE further includes: a second receiving unit, configured to receive a downlink protocol data unit that is sent by the AN, and determine the downlink protocol data according to the target identifier.
  • the unit belongs to the target session
  • the AN is configured to replace the reference identifier in the downlink protocol data unit with the target identifier when receiving the downlink protocol data unit sent by the target node, and send the replaced downlink protocol data unit
  • the downlink protocol data unit sent by the target node includes the reference identifier to indicate that the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in an outer IP header outer IP header field, and an encapsulation header encapsulation header field And at least one field in the protocol data unit header PDU header field.
  • the reference identifier includes a bearer Identification, flow identification, hardware access control identifier of the hardware, session identifier, internet protocol address of the UE, IP address of the access network device, The access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private identity, the IP multimedia public identity, and the temporary mobility At least one of a subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • an embodiment of the present invention provides an access network device AN, where the AN includes: a generating unit, configured to generate a target identifier corresponding to the target session, where the target session is a session between the user equipment UE and the target node, The data of the target session needs to pass through the AN when transmitting; the first sending unit is configured to send corresponding relationship information to the UE, so that the UE encapsulates the target identifier in an uplink protocol data unit PDU of the target session, and the corresponding The relationship information indicates the correspondence between the target session and the target identifier; the first receiving unit is configured to receive the uplink protocol data unit that encapsulates the target identifier sent by the UE, and the replacement unit is configured to use the uplink protocol data unit The target identifier is replaced with a reference identifier and the replaced uplink protocol data unit is sent to the target node, the reference identifier being used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • the AN includes:
  • the session protection mechanism is set in the air interface transmission segment of the UE and the AN by running the foregoing unit, that is, after the UE establishes the target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the AN further includes: a second receiving unit, configured to receive a downlink protocol data unit that is sent by the target node, where the downlink protocol data unit includes the reference The identifier is used to indicate that the downlink protocol data unit belongs to the target session, and the second sending unit is configured to replace the reference identifier in the downlink protocol data unit with the target identifier, and send the replaced downlink protocol data unit to the UE. So that the UE determines, according to the target identifier, that the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in an outer IP header outer IP header field, and an encapsulation header encapsulation header field And at least one field in the protocol data unit header PDU header field.
  • the reference identifier includes a bearer The identifier, the flow identifier, the media access control identifier of the hardware, the session identifier, the Internet Protocol address of the UE, the IP address of the access network device, and the access network identifier of the access network accessed by the access network device, UE's IP address, quality of service identifier, international mobile subscriber identity, international mobile device identity, Internet Protocol multimedia private identity, IP multimedia public identity, temporary mobile subscriber identity, mobile phone number of the UE, and global unique temporary user equipment identity of the UE At least one of them.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • the embodiment of the present invention provides a data transmission method, where the method includes: the user equipment UE processes the basic key according to a preset rule to generate an air interface protection key, where the basic key is a two-way authentication generation between the UE and the core network. a key or a key derived based on the key generated by the two-way authentication; the device for managing the key in the core network is configured to send the basic key to the access network device AN, so that the AN follows the pre- Setting a rule to process the basic key to generate the air interface protection key; the UE protects a target field in the uplink protocol data unit PDU by using the air interface protection key, where the target field includes a session for identifying a session between the UE and the target node.
  • the data of the session between the target node and the UE needs to pass through the AN when transmitting; the UE sends the uplink protocol data unit that protects the target field to the AN, so that the AN protects the confidentiality through the air interface.
  • the key resolves the target field in the upstream protocol data unit.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the method further includes: the UE receiving the AN sending a downlink protocol data unit, and parsing a target field in the downlink protocol data unit by using the air interface protection key, where the target field in the downlink protocol data unit is encrypted by the air interface protection key.
  • the determining, by the air interface protection key, the target field in the downlink protocol data unit including: pre-acquisition
  • the rule defined by the air interface policy uses the air interface protection key to parse the target field in the downlink protocol data unit, and the target field in the downlink protocol data unit is used by the AN according to the rule defined by the air interface policy acquired in advance.
  • the key is protected. This air interface policy defines the rules for using the key.
  • the UE passes the air interface
  • the protection key protects the target field in the uplink protocol data unit PDU, including: protecting the target field in the uplink protocol data unit by using the air interface protection key according to a rule defined by the pre-acquired air interface policy, where the AN is used according to the pre-acquired
  • the rule defined by the air interface policy uses the air interface protection key to resolve the target field, and the air interface policy defines the usage rule of the key.
  • the method further includes: the UE receiving the AN The air interface policy is sent, and the air interface policy is generated by the AN according to an initial security policy, where the initial security policy defines a key generation rule used in the target session, where the target session is a session between the target node and the UE. .
  • the method before the UE protects the target field in the uplink protocol data unit PDU by using the air interface protection key, the method further includes: determining, by the UE, the uplink protocol Protocol data in the data unit Whether the unit payload PDU payload field has been protected; if not, the UE protects the uplink protocol data unit by the air interface protection key; if yes, the UE performs the UE to protect the uplink protocol data unit PDU through the air interface protection key The operation of the target field.
  • the air interface protection key includes an encryption key and an integrity protection key. At least one.
  • the target field The method includes an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or The network element in the core network establishes a server for communication connection.
  • an embodiment of the present invention provides a data transmission method, where the method includes: an access network device AN receives a basic key sent by a device that manages a key in a core network, where the basic key is a user equipment UE and the core a key generated by the network bidirectional authentication or a key derived based on the key generated by the mutual authentication; the UE is configured to process the basic key according to a preset rule to generate an air interface protection key; the AN follows the preset rule Processing the basic key to generate an air interface protection key; the AN receives an uplink protocol data unit sent by the UE, and parses a target field in the uplink protocol data unit by using the air interface protection key, where the uplink protocol data unit The target field is protected by the UE by the air interface protection key, and the target field includes information for identifying a session between the UE and the target node, and the data of the session between the target node and the UE needs to pass through during transmission.
  • the AN receives a basic key sent by a
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the method further includes: the AN is protected by the air interface The key protects a target field in the downlink protocol data unit, and sends the downlink protocol data unit that protects the target field to the UE, so that the UE parses the target in the downlink protocol data unit by using the air interface protection key Field.
  • the method further includes : the AN determines whether the protocol data unit payload PDU payload field in the downlink protocol data unit is protected; if not, the AN protects the downlink protocol data unit by using the air interface protection key; if yes, the AN performs the pass The step of protecting the target field in the downlink protocol data unit by the air interface protection key.
  • the AN protects the downlink by using the air interface protection key
  • the target field in the protocol data unit includes: using the air interface protection key to protect the target field in the downlink protocol data unit according to the rule defined by the pre-acquisition air interface policy, the UE is used according to the rule defined by the air interface policy acquired in advance.
  • the air interface protection key parses the target field in the downlink protocol data unit, and the air interface policy defines a usage rule of the key.
  • the parsing the target field in the uplink protocol data unit by using the air interface protection key includes: parsing the uplink protocol data unit by using the air interface protection key according to a rule defined by a pre-acquired air interface policy
  • the target field, the target field in the uplink protocol data unit is protected by the UE according to the rule defined by the pre-acquired air interface policy, and the air interface policy defines a usage rule of the key.
  • the method further includes: the AN receiving the core An initial security policy of the network, the initial security policy defines a generation rule of a key used in the target session, the target session is a session between the target node and the UE; and the AN generates an air interface policy according to the initial security policy, And sending the air interface policy to the UE.
  • the air interface protection key includes an encryption key and an integrity protection key. At least one.
  • the target field The method includes an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information for identifying the session between the UE and the target node includes a bearer
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or The network element in the core network establishes a server for communication connection.
  • the embodiment of the present invention provides a data transmission method, the method includes: the user equipment UE receives the correspondence relationship information sent by the access network device AN, and determines a target session corresponding target identifier according to the correspondence relationship information, where the target identifier is determined by The AN generates, the target session is a session between the UE and the target node, the data of the target session needs to pass through the AN when transmitting; the UE encapsulates the target identifier in an uplink protocol data unit PDU of the target session and An uplink protocol data unit that encapsulates the target identifier is sent to the AN; the AN is configured to replace the target identifier in the uplink protocol data unit with a reference identifier, and send the replaced uplink protocol data unit to the target node, where The reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a session protection mechanism is set in the air interface transmission section of the UE and the AN, that is, after the UE establishes a target session between the UP and the GW, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the method further The method includes: receiving, by the UE, a downlink protocol data unit sent by the AN, and determining, according to the target identifier, that the downlink protocol data unit belongs to the target session, where the AN is configured to receive the downlink protocol data unit when the target node sends the downlink protocol data unit
  • the reference identifier in the data unit is replaced with the target identifier, and the replaced downlink protocol data unit is sent to the UE, and the downlink protocol data unit sent by the target node includes the reference identifier to indicate that the downlink protocol data unit belongs to the Target session.
  • the reference identifier is encapsulated in an outer IP header outer IP header field, and an encapsulation header encapsulation header field And at least one field in the protocol data unit header PDU header field.
  • the reference identifier includes a bearer The identifier, the flow identifier, the media access control identifier of the hardware, the session identifier, the Internet Protocol address of the UE, the IP address of the access network device, and the access network identifier of the access network accessed by the access network device, UE's IP address, quality of service identifier, international mobile subscriber identity, international mobile device identity, Internet Protocol multimedia private identity, IP multimedia public identity, temporary mobile subscriber identity, mobile phone number of the UE, and global unique temporary user equipment identity of the UE At least one of them.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • an embodiment of the present invention provides a data transmission method, where the method includes: the access network device AN generates a target identifier corresponding to a target session, where the target session is a session between the user equipment UE and the target node, and the target The data of the session needs to pass through the AN when transmitting; the AN sends the correspondence information to the UE, so that the UE encapsulates the target identifier in the uplink protocol data unit PDU of the target session, and the correspondence information indicates the target session.
  • the AN receives the uplink protocol data unit that is encapsulated by the UE and encapsulates the target identifier; the AN replaces the target identifier in the uplink protocol data unit with the reference identifier and replaces the uplink protocol
  • the data unit is sent to the target node, and the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a session protection mechanism is set in the air interface transmission section of the UE and the AN, that is, after the UE establishes a target session between the UP and the GW, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the method further includes: the AN receiving the downlink protocol data unit sent by the target node, the downlink The protocol data unit includes the reference identifier to indicate that the downlink protocol data unit belongs to the target session; the AN replaces the reference identifier in the downlink protocol data unit with the target identifier and sends the replaced downlink protocol data unit to the UE So that the UE determines, according to the target identifier, that the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in an outer IP header outer IP header field, and an encapsulation header encapsulation header field And at least one field in the protocol data unit header PDU header field.
  • the reference identifier includes a bearer The identifier, the flow identifier, the media access control identifier of the hardware, the session identifier, the Internet Protocol address of the UE, the IP address of the access network device, and the access network identifier of the access network accessed by the access network device, UE's IP address, quality of service identifier, international mobile subscriber identity, international mobile device identity, Internet Protocol multimedia private identity, IP multimedia public identity, temporary mobility At least one of a subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • an embodiment of the present invention provides a user equipment, where the user equipment includes a processor and a memory, where the memory is used to store a program and data, and the processor calls a program in the memory to perform the seventh aspect or A data transmission method as described in any of the possible implementations of the seventh aspect.
  • an embodiment of the present invention provides an access network device, where the access network device includes a processor and a memory, where the memory is used to store programs and data, and the processor calls a program in the memory for execution.
  • an embodiment of the present invention provides a user equipment, where the user equipment includes a processor and a memory, where the memory is used to store a program and data, and the processor calls a program in the memory to perform the ninth aspect or A data transmission method as described in any of the possible implementations of the ninth aspect.
  • an embodiment of the present invention provides an access network device, where the access network device includes a processor and a memory, where the memory is used to store programs and data, and the processor calls a program in the memory for executing The data transmission method described in the tenth aspect or any possible implementation of the tenth aspect.
  • an embodiment of the present invention provides a storage medium for storing an instruction, where the instruction is executed on a processor, such that the seventh aspect, or any possible implementation manner of the seventh aspect, or the eighth aspect Or any of the possible implementations of the eighth aspect, or the ninth aspect, or any of the possible implementations of the ninth aspect, or the tenth aspect, or the method described in any of the possible implementations of the tenth aspect.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit, which is used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information. This prevents the session from being attacked.
  • FIG. 1 is a schematic flow chart of an end-to-end protection mechanism in the prior art
  • FIG. 2 is a schematic structural diagram of a communication system according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a data format in a classified transmission mode according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of another data format in a classified transmission mode according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of another data format in a classified transmission mode according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of another data format in a classification transmission mode according to an embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of still another data transmission method according to an embodiment of the present invention.
  • FIG. 9 is a schematic flowchart diagram of still another data transmission method according to an embodiment of the present invention.
  • FIG. 10 is a schematic flowchart diagram of still another data transmission method according to an embodiment of the present invention.
  • FIG. 11 is a schematic flowchart diagram of still another data transmission method according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a user equipment according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of an access network device according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of still another user equipment according to an embodiment of the present invention.
  • FIG. 15 is a schematic structural diagram of still another access network device according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic structural diagram of still another user equipment according to an embodiment of the present invention.
  • FIG. 17 is a schematic structural diagram of still another access network device according to an embodiment of the present disclosure.
  • FIG. 18 is a schematic structural diagram of still another user equipment according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of still another access network device according to an embodiment of the present invention.
  • the end-to-end protection mechanism usually has end-to-end protection between the UE and devices in the core network (for example, user plane gateway), end-to-end protection between the UE and the Internet server, and UE and network.
  • the end-to-end protection between other devices, and the node that protects the data protection between the UEs according to the end-to-end protection mechanism may be referred to as a target node, that is, the target node may be a user in the core network.
  • a gateway a service server (service server or application server) in the core network, a server in the Internet that establishes a communication connection with devices in the core network (generally referred to as an Internet server, including a gateway controller in the Internet), etc.
  • the embodiment of the present invention focuses on the end-to-end protection mechanism between the UE and the user plane gateway in the core network. If the UE and the user plane gateway perform end-to-end protection, then The UE negotiates with the user plane gateway through what scheme to protect the service data (for example, in some scenarios, the service data is encapsulated in a protocol data unit payload (PDU payload))
  • PDU payload protocol data unit payload
  • the node between the UE and the user plane gateway cannot know how to protect the service data between the UE and the user plane gateway. However, in the process of transmitting the service data, some other information transmission is also involved.
  • Protocol data unit header PDU header
  • embodiments of the present invention will focus on how to protect end-to-end protection of service data from protection. Additional information.
  • FIG. 2 is a schematic structural diagram of a communication system 20 according to an embodiment of the present invention, where the architecture diagram includes a user equipment (UE) 201, an access network equipment (AN) 202, and a core network (CN).
  • UE user equipment
  • AN access network equipment
  • CN core network
  • the device in practical applications, the communication system 20 may also include other devices.
  • the UE can be an intelligent terminal such as a mobile phone or a smart watch, and can also be a communication device such as a server, a gateway, a base station, a controller, etc., and can also be an Internet of Things (English: Internet of Things, referred to as IoT) device such as a sensor, an electric meter, or a water meter. It can also be other devices that can access the cellular or wired network.
  • IoT Internet of Things
  • the access network device 202 may be a device that communicates with the user equipment 201 by using a wireless device, for example, a base station (English: NodeB, NB for short), an eNB, and wireless fidelity (English: Wireless Fidelity, referred to as WiFi).
  • a wireless device for example, a base station (English: NodeB, NB for short), an eNB, and wireless fidelity (English: Wireless Fidelity, referred to as WiFi).
  • Wired transmission methods include, but are not limited to, Internet Protocol (English: Internet Protocol, IP for short), content-based network, identity-based network, and so on.
  • the following embodiment is described by taking a wireless access network of a UE as an example
  • Mobility Management MM
  • session management English: Session Management, SM
  • Key Management System English: Key Management System, KMS for short
  • Network Element Control Plane Authentication Unit
  • CP-AU Control Plane-Authentication Unit
  • User Plane Gateway English: User Plane-Gateway
  • UP-GW User Plane-GW
  • the MM network element may be referred to as a mobility management device or an MM.
  • the SM network element may be referred to as a session management device or SM for performing session, slice, flow flow, or bearer establishment and management.
  • a KMS network element can be called a key management device or a KMS, and is responsible for key generation, management, and negotiation, and supports lawful interception.
  • KMS can be deployed as a separate logical function entity, or it can be integrated in MM, SM, Mobility Management Entity (MME), Authentication Server Function Entity (AUSF).
  • Security anchor function network element (English: Security Anchor Function: SEAF), secure Context Management Function (SCMF), and boot server function network element (English: Bootstrapping Server Function: BSF)
  • the KMS is usually an authentication unit (English: Control Plane-Authentication Unit, CP-AU).
  • the UP-GW is used to connect to the operator network and the data network (English: Data Network, DN), and the UE accesses the Internet through the UP-GW.
  • FIG. 3 is a schematic flowchart of a data transmission method according to an embodiment of the present invention. The method may be implemented based on the communication system 20 shown in FIG. 2, and the specific processes include, but are not limited to, the following steps.
  • Step S301 The UE performs mutual authentication with the device that manages the key in the CN.
  • the device that manages the key in the CN is usually a CP-AU.
  • the function of the management key is integrated into other network elements, and the shared key is generated after the UE and the device that manages the key are successfully authenticated.
  • Step S302 The device managing the key in the CN sends the base key to the AN.
  • the basic key may exist in the following two cases: Case 1, the basic key is a key generated by mutual authentication of the UE and the device managing the key; and second, the basic key is generated based on the mutual authentication.
  • the key of the key is deduced or derived multiple times.
  • the derivation rule can be pre-defined in the communication protocol, and the device of the UE and the management key can be pushed based on the rules defined in the communication protocol.
  • the base key is derived.
  • Step S303 The AN receives the base key.
  • Step S304 The AN processes the basic key according to a preset rule to generate an air interface protection key.
  • the preset rule defines a rule for generating a key.
  • the preset rule may define information such as a key algorithm, a key length, a key update period, and the like, for example, a commonly used secret.
  • the key algorithm has null, Snow 3G, ZUC, AES, etc.
  • the commonly used key length is 64bit, 128bit, 256bit, etc.
  • the commonly used key update time is 6 hours, 12 hours, 1 day, 2 days, and so on.
  • the preset rule may be pre-configured in the protocol, or may be calculated based on real-time information.
  • the predetermined rule may refer to a method for generating a key used in a hollow port transmission of the fourth generation mobile communication technology (English: the 4th Generation mobile communication, 4G for short), and the AN according to the base station a security algorithm priority list and a list of security algorithms supported by the UE, determining an algorithm for the air interface encryption of the AN, and an integrity protection algorithm; the AN generates an air interface encryption protection key according to the identifier of the air interface encryption algorithm and the base key; Generating an air interface integrity protection key according to the identity of the integrity protection algorithm and the base key, the air interface encryption The protection key and the air interface integrity protection key belong to the air interface protection key.
  • the air interface encryption algorithm and the negotiation of the complete protection algorithm may include multiple methods, for example, the same manner as the 4G algorithm negotiation. Or determine the protection algorithm based on the policy generated when the session is established.
  • the AN derives the air interface protection key according to the basic key, and other parameters may also be used in the derivation, for example, the device identifier of the AN, the temporary identifier of the cell wireless network (English: Cell Radio Network Temporary Identifier (C-RNTI), serial number (English: sequence number, SN for short), identity of the UE, and so on.
  • C-RNTI Cell Radio Network Temporary Identifier
  • serial number English: sequence number, SN for short
  • Step S305 The UE processes the basic key according to a preset rule to generate an air interface protection key.
  • the UE generates the air interface protection key in the same manner as the AN.
  • Step S306 The UE protects the target field in the uplink protocol data unit by using the air interface protection key.
  • the embodiment of the present invention protects a protocol data unit by using a symmetric key-based cryptographic technique, where the protection includes at least one of encryption protection and integrity protection, and the symmetric key-based cryptography requires an advance between the two parties.
  • the shared key K used for protection is shared. The following describes the principle of encryption protection and integrity protection by taking the two sides of the communication as USER1 (user 1) and USER2 (user 2) as an example.
  • Encryption protection USER1 and USER2 share the key K.
  • the encryption encryption options include Advanced Encryption Standard (AES), Triple Data Encryption Algorithm (TDEA, also known as 3DES), Blowfish, Serpent, Snow 3G, ZUC, HC-256, Grain, etc.
  • Integrity protection USER1 and USER2 share the key K.
  • the message authentication code MAC1 corresponding to the message m is calculated using the shared key K.
  • USER1 sends the message authentication code MAC1 and message m to the USER2.
  • USER2 receives the MAC1 and the message, and then verifies the correctness of the MAC1 by using the shared key K and the message m. After the verification is correct, the message is not tampered with.
  • the algorithm used for integrity protection may have a Hash-based Message Authentication Code (HMAC) algorithm (such as HMAC-sha256) and a secret message verification code (English: one-key MAC, Abbreviation: OMAC), cipher block chaining message authentication code (CBC-MAC), parallel message authentication code (English: Parallelizable MAC, PMAC for short), universal hash Message authentication code (English: message authentication code based on universal hashing, abbreviated as: UMAC).
  • HMAC Hash-based Message Authentication Code
  • OMAC cipher block chaining message authentication code
  • CBC-MAC cipher block chaining message authentication code
  • parallel message authentication code English: Parallelizable MAC, PMAC for short
  • UMAC universal hash Message authentication code
  • the relationship between the UE and the AN in the embodiment of the present invention is equivalent to the relationship between USER1 and USER2, and the air interface protection key corresponds to the above-mentioned "shared key K".
  • the target field includes a reference identifier for identifying a session between the UE and a user plane gateway in the core network, the reference identifier being generally in an outer IP header field, an encapsulation header field, and a protocol.
  • the reference identifier is usually a bearer ID, a flow ID, and a media access control (MAC) identifier of the hardware.
  • Session identifier the Internet Protocol (English: Internet Protocol) address of the UE, and the access network design IP address of the backup, the access network identifier of the access network, the identity of the other party of the end-to-end communication, the IP address of the other party of the end-to-end communication, the quality of service (English: Quality of Service, QoS for short), international Mobile User Identity (English: International Mobile Subscriber Identity, IMSI), International Mobile Equipment Identity (IMEI), Internet Protocol (English: Internet Protocol, IP) Multimedia Private logo (English) : IP Multimedia Private Identity (IMPI), IP Multimedia Public Identity (IMPU), Temporary Mobile Subscriber Identity (TMSI), mobile phone number, global unique Temporary UE Identity (English: Globally Unique Temporary UE Identity, abbreviation: GUTI).
  • Mode 1 As shown in Figure 4, the session is classified and transmitted based on the QoS class.
  • the protocol data unit (English: Protocol data unit, PDU for short) includes the L1/L2 header (L1/L2header) field and the external IP header. (Outer IP header) field, Encapsulation header field, Protocol data unit header (PDU header) field, and Protocol data unit payload (PDU payload) field, which session the protocol data unit belongs to by the Outer IP header field and the Encapsulation header field Together, the reference identifier is in the Outer IP header field and the Encapsulation header field.
  • the protocol data unit (English: Protocol data unit, PDU for short) includes the L1/L2 header (L1/L2header) field and the external IP header. (Outer IP header) field, Encapsulation header field, Protocol data unit header (PDU header) field, and Protocol data unit payload (PDU payload) field, which session the protocol data unit belongs to by the Outer IP header field and the Encapsulation header field Together, the reference identifier
  • Mode 2 As shown in FIG. 5, the session is classified according to a protocol data unit session (PDU session), and the protocol data unit includes an L1/L2 header field, an Outer IP header field, an Encapsulation header field, a PDU header field, and a PDU payload field, and protocol data. Which session the cell belongs to is represented by the Encapsulation header field, that is, the reference identifier is in the Encapsulation header field.
  • Mode 3 As shown in FIG. 6, the session is classified and transmitted based on a Per Node-level tunnel.
  • the protocol data unit includes an L1/L2 header field, an Outer IP header field, an Encapsulation header field, a PDU header field, and a PDU payload field.
  • Mode 4 As shown in FIG. 7, the session is classified and transmitted based on an SDN-based Approach, and the protocol data unit includes an L1/L2 header field, a PDU header field, and a PDU payload field, and which session the protocol data unit belongs to by the PDU header The field is distinguished, that is, the reference identifier is in the PDU header.
  • the target field may include at least one of an outer IP header field, an encapsulation header field, and a PDU header field.
  • the field Encapsulation header is protected by the air interface protection key.
  • the field PDU header is protected by the air interface protection key.
  • the field Encapsulation header and the field PDU header are protected by the air interface protection key. Normally, the standard will pre-define which part of the field to protect.
  • Step S307 The UE sends the uplink protocol data unit whose target field is protected to the AN.
  • Step S308 The AN receives the uplink protocol data unit whose target field is protected and parses the target information in the uplink protocol data unit by using the air interface protection key.
  • the parsing here includes the operation of decrypting; if the protection uplink protocol data unit of the UE includes integrity protection, the parsing here Corresponding to the operation of verifying the correctness of the message authentication code; whether it is a decrypted operation or a verification message authentication
  • the AN protocol data unit is reassembled and Send to the core network.
  • Step S309 The AN protects the target information in the downlink protocol data unit by using the air interface protection key.
  • step S309 can refer to the related description of step S306.
  • Step S310 The AN sends the downlink protocol data unit whose target field is protected to the UE.
  • Step S311 The UE receives the downlink protocol data unit whose target field is protected and parses the target field in the downlink protocol data unit by using the air interface protection key.
  • step S311 can refer to the related description of step S308.
  • steps S301-S311 can be basically performed in the described order, but the position adjustment of some steps does not affect the execution of the solution.
  • steps S309-S311 can be synchronously moved to after step S305 and before step S306.
  • the solution formed after the step adjustment also belongs to the solution of the embodiment of the present invention.
  • a person skilled in the art prefers to establish an initial session security policy corresponding to the session when establishing a session.
  • steps S301-S311 several more specific implementations are described in combination with the initial security policy.
  • the embodiments shown in Figures 8, 9, and 10 are included.
  • FIG. 8 is a schematic flowchart of a data transmission method according to an embodiment of the present invention.
  • the UE directly protects an uplink protocol through the air interface protection key regardless of whether the payload field in the uplink protocol data unit is protected.
  • the target field in the data unit is protected.
  • the AN directly protects the target field in the downlink protocol data unit through the air interface protection key regardless of whether the payload field in the downlink protocol data unit has been protected.
  • the method includes but is not limited to the following steps.
  • Step S801 The UE performs mutual authentication with the CP-AU, and the CP-AU sends the key K0 obtained by the mutual authentication to the KMS, and the KMS manages the K0, and the function of the KMS may be integrated in the CP-AU. In this case, the CP-AU does not need to send K0 to the KMS. K0 may also be a key directly obtained after the authentication succeeds, or may be a key obtained by one derivation or multiple derivation based on the directly obtained key.
  • Step S802 The KMS sends the basic key K_AN to the AN, and the KMS may send the basic K_AN to the MM in advance.
  • the MM then sends the basic key K_AN to the AN, and the K_AN may be the K0, or may be A key obtained based on the K0 derivation or multiple derivation.
  • Step S803 The AN derives the K_AN according to a preset rule to obtain an air interface protection key (for example, an encryption key K_Anec, an integrity protection key K_ANint).
  • an air interface protection key for example, an encryption key K_Anec, an integrity protection key K_ANint.
  • Step S804 The UE also derives the K_AN according to a preset rule to obtain an air interface protection key.
  • the K_AN is a key derived based on the K0, the manner in which the UE derives the K_AN and the KMS derives the K_AN. The same way.
  • Step S805 The UE establishes a request for the session, and accordingly, the network element in the core network performs a series of negotiation, and the session ID (session ID) of the session and the initial security associated with the session are generated during the negotiation process.
  • the UP-GW in the core network obtains information such as the session identifier, initial security policy, and session key.
  • Step S806 The AN receives the session identifier and the initial security policy sent by the SM in the core network.
  • Step S807 The AN sends the session identifier and the initial security policy to the UE.
  • Step S808 The UE receives the session identifier and the initial security policy, the session between the UE and the UP-GW is successfully established, and the session established between the UE and the UP-GW may be referred to as a target session.
  • steps S805-S808 In addition to establishing a target session in steps S805-S808, other information and operations are optional.
  • Step S809 The UE generates an uplink protocol data unit of the target session, and the target field is protected by the air interface protection key in the process of generating the uplink protocol data unit, where the target field includes an outer IP header field, an encapsulation header field, and a PDU. At least one of the header fields, the protection includes at least one of encryption protection and integrity protection.
  • Step S810 The UE sends the uplink protocol data unit that protects the target field to the AN by using an air interface transmission technology.
  • Step S811 The AN parses the information of the target field in the uplink protocol data unit by using the air interface protection key. For example, the AN decrypts the encrypted protected target field by using an encryption key; for example, the AN first uses the integrity protection key to verify the integrity of the encrypted target field, and then encrypts and decrypts the encrypted target field through the air interface; for example, The AN decrypts the encrypted target field first, and then verifies and obtains the target field through the integrity protection key.
  • the AN can compose the parsed information and the information of other fields into a complete protocol data unit and send it to the core network.
  • the AN may allocate the corresponding air interface identifier to the UE in advance and send the air interface identifier to the UE, and if the device sends the uplink protocol data unit to the AN, the air interface identifier corresponding to the UE is sent, indicating that the The device of the uplink protocol data unit is the UE.
  • the AN may generate a plurality of air interface protection keys respectively corresponding to different devices, and the air interface protection key corresponding to the UE is used to protect data in the uplink protocol data unit sent by the UE, and other devices (or other devices) The corresponding air interface protection key of the UE is used to protect data in the uplink protocol data unit sent by other devices.
  • the AN determines the air interface protection key corresponding to the UE from the air interface protection key corresponding to the multiple equipments to obtain an air interface identifier corresponding to the UE, and obtains an uplink protocol with the UE.
  • the data unit is protected.
  • the air interface identifier may be a Cell Radio Network Temporary Identifier (C-RNTI), and the carrier frequency (for example, the carrier frequency of 4G is expressed as: E-UTRA Absolute Radio Frequency Channel Number, Abbreviation: EARFCN).
  • C-RNTI Cell Radio Network Temporary Identifier
  • the AN may allocate a corresponding air interface transmission mode to the UE, and send indication information to the UE to notify the UE of the air interface transmission mode, and the AN may also allocate an air interface transmission mode to other devices, if If the air interface transmission mode of the uplink protocol data unit received by the AN is the air interface transmission mode corresponding to the UE, the uplink protocol data unit is considered to be sent by the UE, and thus multiple air interface protection keys generated in advance (the multiple air interfaces) The protection key corresponds to a device, and the air interface protection key corresponding to the UE is selected to protect the uplink protocol data unit, where the air interface transmission mode includes Code Division Multiple Access (CDMA) technology.
  • CDMA Code Division Multiple Access
  • Step S812 The AN generates a downlink protocol data unit of the target session, and the target field is protected by the air interface protection key in the process of generating the downlink protocol data unit, where the target field includes an outer IP header field, an encapsulation header field, and a PDU. At least one of the header fields, the protection includes at least one of encryption protection and integrity protection.
  • Step S813 The AN sends the downlink protocol data unit that protects the target field to the UE.
  • Step S814 The UE parses the information of the target field in the downlink protocol data unit by using the air interface protection key.
  • the generation of the air interface protection key may be performed after the session is established.
  • the negotiation mechanism of the air interface protection algorithm in the 4G is used to determine the protection algorithm and the air interface protection key.
  • FIG. 9 is a schematic flowchart of a data transmission method according to an embodiment of the present invention.
  • the UE determines in advance whether a payload field in the uplink protocol data unit is protected; if not, the UE passes the The air interface protection key protects the uplink protocol data unit; if so, the UE performs the operation of protecting the target field in the uplink protocol data unit by the air interface protection key.
  • the access network device also pre-determines whether the payload field in the downlink protocol data unit has been protected; if not, the access network device is configured to protect the downlink protocol data unit by using the air interface protection key; If yes, the access network device performs the operation of protecting the target information in the downlink protocol data unit by using the air interface protection key.
  • the method includes but is not limited to the following steps.
  • Step S901 The UE performs mutual authentication with the CP-AU, and the CP-AU sends the key K0 obtained by the mutual authentication to the KMS, and the KMS manages the K0, and the function of the KMS may be integrated in the CP-AU. In this case, the CP-AU does not need to send K0 to the KMS. K0 may also be a key directly obtained after the authentication succeeds, or may be a key obtained by one derivation or multiple derivation based on the directly obtained key.
  • Step S902 The KMS sends the basic key K_AN to the AN, and the KMS may send the basic K_AN to the MM in advance.
  • the MM then sends the basic key K_AN to the AN, and the K_AN may be the K0, or may be A key obtained based on the K0 derivation or multiple derivation.
  • Step S903 The AN derives the K_AN according to a preset rule to obtain an air interface protection key (for example, an encryption key K_Anec, an integrity protection key K_ANint).
  • an air interface protection key for example, an encryption key K_Anec, an integrity protection key K_ANint.
  • Step S904 The UE also derives the K_AN according to a preset rule to obtain an air interface protection key.
  • the K_AN is a key derived based on the K0, the manner in which the UE derives the K_AN and the KMS derives the K_AN. The same way.
  • Step S905 The UE establishes a request for the session, and correspondingly, the network element in the core network performs a series of negotiation, and the session ID (session ID) of the session and the initial security associated with the session are generated during the negotiation.
  • the UP-GW in the core network obtains information such as the session identifier, initial security policy, and session key.
  • Step S906 The AN receives the session identifier and the initial security policy sent by the SM in the core network.
  • Step S907 The AN sends the session identifier and the initial security policy to the UE.
  • Step S908 The UE receives the session identifier and the initial security policy, the session between the UE and the UP-GW is successfully established, and the session established between the UE and the UP-GW may be referred to as a target session.
  • steps S905-S908 In addition to establishing the target session in steps S905-S908, other information and operations are optional.
  • Step S909 The UE generates an uplink protocol data unit of the target session, and determines whether the payload field in the uplink protocol data unit is protected in the process of generating the uplink protocol data unit.
  • the UE determines the target session according to the target session.
  • the initial security policy corresponding to the target session then, according to the initial security policy, it can be determined whether the payload field has been protected according to the rules defined by the initial security policy.
  • the UE may directly determine, according to the data format of the uplink protocol data unit, whether the payload field is encrypted, and the payload field is protected by the key and the unprotected uplink data unit format is different. .
  • the UE protects the complete uplink protocol data unit by the air interface protection key; then sends the complete uplink protocol data unit to the AN, and accordingly, the AN is encrypted by the air interface protection key resolution
  • the upstream protocol data unit is to obtain information in the uplink protocol data unit.
  • the UE protects the target field by using the air interface protection key and performs subsequent steps S910-S911.
  • the target field includes at least one of an outer IP header field, an encapsulation header field, and a PDUheader field, and the protection includes encryption protection. And at least one of integrity protection.
  • Step S910 The UE sends the uplink protocol data unit that protects the target field to the AN by using an air interface transmission technology.
  • Step S911 The AN parses the information of the target field in the uplink protocol data unit by using the air interface protection key. For example, the AN decrypts the encrypted protected target field by using an encryption key; for example, the AN first uses the integrity protection key to verify the integrity of the encrypted target field, and then decrypts the encrypted target field through the air interface encryption key; For example, the AN first decrypts the encrypted target field, and then verifies and obtains the target field through the integrity protection key.
  • the AN can compose the parsed information and the information of other fields into a complete protocol data unit and send it to the core network.
  • the AN may allocate the corresponding air interface identifier to the UE in advance and send the air interface identifier to the UE, and if the device sends the uplink protocol data unit to the AN, the air interface identifier corresponding to the UE is sent, indicating that the The device of the uplink protocol data unit is the UE.
  • the AN may generate a plurality of air interface protection keys respectively corresponding to different devices, and the air interface protection key corresponding to the UE is used to protect data in the uplink protocol data unit sent by the UE, and other devices (or other devices) The corresponding air interface protection key of the UE is used to protect data in the uplink protocol data unit sent by other devices.
  • the AN determines the air interface protection key corresponding to the UE from the air interface protection key corresponding to the multiple equipments to obtain an air interface identifier corresponding to the UE, and obtains an uplink protocol with the UE.
  • the data unit is protected.
  • the air interface identifier may be a Cell Radio Network Temporary Identifier (C-RNTI), and the carrier frequency (for example, the carrier frequency of 4G is expressed as: E-UTRA Absolute Radio Frequency Channel Number, Abbreviation: EARFCN).
  • C-RNTI Cell Radio Network Temporary Identifier
  • the AN may allocate a corresponding air interface transmission mode to the UE, and send indication information to the UE to notify the UE of the air interface transmission mode, and the AN may also allocate an air interface transmission mode to other devices, if If the air interface transmission mode of the uplink protocol data unit received by the AN is the air interface transmission mode corresponding to the UE, the uplink protocol data unit is considered to be sent by the UE, and thus multiple air interface protection keys generated in advance (the multiple air interfaces) The protection key corresponds to a device, and the air interface protection key corresponding to the UE is selected to protect the uplink protocol data unit, where the air interface transmission mode includes a codeword corresponding to each user equipment in the CDMA technology, or the UE sends data in an air interface. Modulation and so on.
  • Step S912 The AN generates a downlink protocol data unit of the target session, and determines whether the payload field in the downlink protocol data unit is protected in the process of generating the downlink protocol data unit.
  • the AN determines the target according to the target session.
  • the initial security policy corresponding to the session then, according to the initial security policy, it can be verified whether the payload field has passed the key protection generated according to the rules defined by the initial security policy.
  • the AN may determine whether the payload field is encrypted according to the data format of the downlink protocol data unit, and the format of the downlink protocol data unit in the payload field is protected by the key and unprotected. .
  • the AN protects the downlink protocol data unit by using the air interface protection key; and then sends the complete uplink protocol data unit to the UE, and accordingly, the UE resolves the encrypted uplink protocol by using the air interface protection key
  • the data unit obtains information in the downlink protocol data unit.
  • the AN protects the target field by the air interface protection key and performs subsequent steps S913 and S914, the target field including at least one of an outer IP header field, an encapsulation header field, and a PDUheader field, including protection. Includes at least one of encryption protection and integrity protection.
  • Step S913 The AN sends the downlink protocol data unit that protects the target field to the UE.
  • Step S914 The UE parses the information of the target field in the downlink protocol data unit by using the air interface protection key.
  • the generation of the air interface protection key may be performed after the session is established.
  • the negotiation mechanism of the air interface protection algorithm in the 4G is used to determine the protection algorithm and the air interface protection key.
  • FIG. 10 is a schematic flowchart of a data transmission method according to an embodiment of the present invention.
  • the UE and the AN need to follow corresponding rules when protecting a protocol data unit and parsing a protocol data unit through an air interface protection key.
  • This rule can be called an air interface policy.
  • the AN protects the target information in the downlink protocol data unit by using the air interface protection key, specifically: using the air interface protection key to protect the target in the downlink protocol data unit according to the rule defined by the pre-acquired air interface policy.
  • this air interface policy defines the rules for data protection.
  • the UE parses the target field in the downlink protocol data unit by using the air interface protection key, and specifically: parsing the target field in the downlink protocol data unit by using the air interface protection key according to the rule defined by the air interface policy acquired in advance.
  • the UE protects the target field in the uplink protocol data unit by using the air interface protection key. Specifically, the target field in the uplink protocol data unit is protected by using the air interface protection key according to the rule defined by the air interface policy.
  • the AN parses the target information in the uplink protocol data unit by using the air interface protection key. Specifically, the target information in the uplink protocol data unit is parsed by using the air interface protection key according to the rule defined by the air interface policy.
  • the AN is configured to receive an initial security policy from the core network, and the AN generates an air interface policy according to the initial security policy; the AN sends the air interface policy to the UE; and the UE receives the air interface policy, thereby ensuring Both the AN and the UE have the air interface policy.
  • the UE is configured to receive an initial security policy from the core network, and the UE generates an air interface policy according to the initial security policy; the UE sends the air interface policy to the AN; the AN receives the air interface policy, thereby ensuring Both the AN and the UE have the air interface policy.
  • the AN receives the initial security policy from the core network and forwards the initial security policy to the UE, and then the UE and the AN each generate the air interface policy according to the initial security policy, thereby ensuring the UE and the AN has this air interface strategy.
  • each network element may have its own security requirement.
  • the security requirement indicates which key algorithms the network element can accept, which key lengths are acceptable, and an acceptable key update period. What is the solution, such as the key algorithm, the key length, and the key update period that the core network obtains according to the security requirements of the relevant network element, which can meet the requirements of each network element in the relevant network element.
  • the related network element (for example, a key management network element, a mobility management network element, and the like) specifically refers to at least one network element involved when the UE transmits data in the network.
  • the initial security policy defines a generation rule of a key used in the target session, and a protection mode of the target session, where the target session is a session between the UE and the user plane gateway after the UE is successfully authenticated.
  • the air interface policy is generated according to the reference initial security policy, and the reference may be performed by using a parameter in the initial security policy (for example, a key algorithm), or adjusting a parameter in the initial security policy. Obtaining the parameters in the air interface policy may also be other methods. In summary, the air interface policy uses the information in the initial security policy. Take Figure 10 as an example. The method includes, but is not limited to, the following steps.
  • Step S1001 The UE performs mutual authentication with the CP-AU, and the CP-AU sends the key K0 obtained by the mutual authentication to the KMS, and the KMS manages the K0, and the function of the KMS may be integrated in the CP-AU. In this case, the CP-AU does not need to send K0 to the KMS. K0 may also be a key directly obtained after the authentication succeeds, or may be a key obtained by one derivation or multiple derivation based on the directly obtained key.
  • Step S1002 The KMS sends the basic key K_AN to the AN, and the KMS may send the basic K_AN to the MM in advance.
  • the MM then sends the basic key K_AN to the AN, and the K_AN may be the K0, or may be A key obtained based on the K0 derivation or multiple derivation.
  • Step S1003 The AN derives the K_AN according to a preset rule to obtain an air interface protection key (for example, an encryption key K_Anec, an integrity protection key K_ANint).
  • an air interface protection key for example, an encryption key K_Anec, an integrity protection key K_ANint.
  • Step S1004 The UE also derives the K_AN according to a preset rule to obtain an air interface protection key.
  • the K_AN is a key derived based on the K0, the manner in which the UE derives the K_AN and the KMS derives the K_AN. The same way.
  • Step S1005 The UE establishes a request for the session, and accordingly, the network element in the core network performs a series of negotiation, and the session ID (session ID) of the session and the initial security associated with the session are generated during the negotiation.
  • the UP-GW in the core network obtains information such as the session identifier, initial security policy, and session key.
  • Step S1006 The AN receives the session identifier and the initial security policy sent by the SM in the core network, and then generates an air interface policy according to the initial security policy.
  • Step S1007 The AN sends the session identifier, the initial security policy, and the air interface policy to the UE.
  • Step S1008 The UE receives the session identifier, the air interface policy, and the initial security policy, and the session established between the UE and the UP-GW is successful, and the session established between the UE and the UP-GW may be referred to as a target session.
  • Step S1009 The UE generates an uplink protocol data unit of the target session, and uses the air interface protection key to protect the target field by using the air interface protection key in the process of generating the uplink protocol data unit, where the target field includes an outer IP header. At least one of a field, an encapsulation header field, and a PDU header field, the protection including at least one of encryption protection and integrity protection.
  • Step S1010 The UE sends the uplink protocol data unit that protects the target field to the AN by using an air interface transmission technology.
  • Step S1011 The AN parses the information of the target field in the uplink protocol data unit by using the air interface protection key with reference to the rule defined by the air interface policy. For example, the AN decrypts the encrypted protected target field by using an encryption key; for example, the AN first uses the integrity protection key to verify the integrity of the encrypted target field, and then encrypts and decrypts the encrypted target field through the air interface; for example, The AN decrypts the encrypted target field first, and then verifies and obtains the target field through the integrity protection key.
  • the AN can compose the parsed information and the information of other fields into a complete protocol data unit and send it to the core network.
  • the AN may allocate the corresponding air interface identifier to the UE in advance and send the air interface identifier to the UE, and if the device sends the uplink protocol data unit to the AN, the air interface identifier corresponding to the UE is sent, indicating that the The device of the uplink protocol data unit is the UE.
  • the AN may generate a plurality of air interface protection keys respectively corresponding to different devices, and the air interface protection key corresponding to the UE is used to enter data in the uplink protocol data unit sent by the UE. Line protection, the air interface protection key corresponding to other devices (or other UEs) is used to protect data in the uplink protocol data unit sent by other devices.
  • the AN determines the air interface protection key corresponding to the UE from the air interface protection key corresponding to the multiple equipments to obtain an air interface identifier corresponding to the UE, and obtains an uplink protocol with the UE.
  • the data unit is protected.
  • the air interface identifier may be a Cell Radio Network Temporary Identifier (C-RNTI), and the carrier frequency (for example, the carrier frequency of 4G is expressed as: E-UTRA Absolute Radio Frequency Channel Number, Abbreviation: EARFCN).
  • C-RNTI Cell Radio Network Temporary Identifier
  • the AN may allocate a corresponding air interface transmission mode to the UE, and send indication information to the UE to notify the UE of the air interface transmission mode, and the AN may also allocate an air interface transmission mode to other devices, if If the air interface transmission mode of the uplink protocol data unit received by the AN is the air interface transmission mode corresponding to the UE, the uplink protocol data unit is considered to be sent by the UE, and thus multiple air interface protection keys generated in advance (the multiple air interfaces) The protection key corresponds to a device, and the air interface protection key corresponding to the UE is selected to protect the uplink protocol data unit, where the air interface transmission mode includes a codeword corresponding to each user equipment in the CDMA technology, or the UE sends data in an air interface. Modulation and so on.
  • Step S1012 The AN generates a downlink protocol data unit of the target session.
  • the target field is protected by using the air interface protection key according to the rule defined by the air interface policy, where the target field includes an outer IP header.
  • the protection including at least one of encryption protection and integrity protection.
  • Step S1013 The AN sends the downlink protocol data unit that protects the target field to the UE.
  • Step S1014 The UE parses the information of the target field in the downlink protocol data unit by using the air interface protection key by referring to the rule defined by the air interface policy.
  • the air interface policy may also define which part of the protocol data unit (including the uplink protocol data unit and the downlink protocol data unit) needs to be protected, and the defined scheme may be:
  • the first type determines whether the payload field has been protected, and protects the entire protocol data unit if the Payload is not protected; if the Payload field has been protected, the operation of protecting the target field is performed;
  • the generation of the air interface protection key can be performed after the session is established.
  • the negotiation mechanism of the air interface protection algorithm in the 4G is used to determine the protection algorithm and the air interface protection key, or the air interface policy is determined based on the initial security policy, and the air interface protection key is generated according to the security algorithm identifier defined in the air interface policy; Or determining an air interface policy based on the initial security policy, and generating an air interface protection key based on the basic key.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the user data plane in the protocol data unit for identifying the UE and the core network.
  • the field of the information of the session between the gateways so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the information based on the information. Session, thus avoiding the session being attacked.
  • FIG. 11 is a schematic flowchart of still another data transmission method according to an embodiment of the present invention. The method may be implemented based on the communication system 30 of FIG. 3, and the process is as follows.
  • Step S1101 The UE performs mutual authentication with the device that manages the key in the CN, and the UE and the core after the mutual authentication succeeds.
  • the user plane gateway UP-GW in the CN establishes a session, which can be called the target session.
  • the network element in the core network performs a series of negotiation.
  • the session ID (session ID) of the target session and the initial security policy associated with the session are generated.
  • the session key (K_session) generated according to the rules defined by the initial security policy.
  • the session key may be generated by other rules, and the initial security policy defines the session.
  • the UP-GW in the core network obtains information such as the session identifier, initial security policy (optional), and session key.
  • the network element in the CN also sends the session ID of the target session to the UE.
  • the session identifier passes through the AN, and the AN is based on the AN.
  • the session ID determines the target session.
  • Step S1102 The AN generates a target identifier corresponding to the target session.
  • the rule for generating the target identifier is not limited herein, and can be used for the AN and the UE to uniquely correspond to the target session, and the target identifier does not require the address of the UE and the UP-GW to be reflected (eg, Information such as IP address, MAC address, etc., that is, the device other than the AN and the UE does not negotiate with the AN (or the UE), and if the target identifier is intercepted, The target identifier is known to have a corresponding relationship with the target session, so it is impossible to determine the target session by the target identifier.
  • Information such as IP address, MAC address, etc.
  • the target identifier may be a randomly generated random number, or some existing identifier may be used, for example, a C-RNTI, or a carrier frequency point (for example, a 4G carrier frequency point is expressed as English: E-UTRA Absolute Radio Frequency Channel Number, Abbreviation: EARFCN) and other marks.
  • Step S1103 The AN sends corresponding relationship information to the UE, and the AN may send the target identifier to the UE by sending the session identifier in the signaling to the UE or after the signaling, and may also send the target identifier and the session identifier together with the AN. To the UE, so that the UE determines the correspondence.
  • the correspondence relationship information indicates a correspondence between the target session and the target identifier.
  • Step S1104 The UE receives the correspondence relationship information and determines, according to the correspondence relationship information, that the target session corresponds to the target identifier.
  • Step S1105 The UE encapsulates the target identifier in an uplink protocol data unit of the target session and sends an uplink protocol data unit encapsulating the target identifier to the AN.
  • the reference identifier used to distinguish the session in the protocol data unit is replaced with the target identifier.
  • the UE when transmitting the uplink protocol data unit, the UE encapsulates the reference identifier in the uplink protocol data unit to indicate that the uplink protocol data unit belongs to the target session, and in particular indicates to the UP-GW that the uplink protocol data unit belongs to the target. Conversation.
  • determining, by the reference identifier, that the uplink protocol data unit belongs to the target session is not only possible for the UE and the AN, but other devices other than the UE and the AN can also be implemented, that is, the UE and the AN are The other device can determine that the uplink packet belongs to the target session by intercepting the reference identifier in the uplink packet.
  • the reference identifier is usually in the fields of the outer IP header field, the encapsulation header field, and the PDU header field.
  • the identifier is usually a bearer ID, a flow ID, a media access control (MAC) identifier, a session identifier, an IP address of the UE, and an access network device.
  • MAC media access control
  • IP address the access network identifier of the access network, the identity of the other party of the end-to-end communication, the IP address of the other party of the end-to-end communication, the QoS identity, and the international mobile subscriber identity
  • IMSI International Mobile Subscriber Identity
  • IMEI International Mobile Equipment Identity
  • IP Internet Protocol
  • IP IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • TMSI Temporary Mobile Subscriber Identity
  • GUI Globally Unique Temporary UE Identity
  • the target logo will not Contains information that clearly indicates the source and whereabouts of the message.
  • the payload field is also included in the uplink packet to encapsulate the service data, and the manner of processing the service data may be modified in the embodiment of the present invention.
  • Step S1106 The AN receives the uplink protocol data unit.
  • Step S1107 The AN replaces the target identifier in the uplink protocol data unit with the reference identifier and sends the replaced uplink protocol data unit to the core network.
  • the AN parses the uplink protocol data unit, for example, parses information of a header header field of the protocol data unit, to obtain a target identifier in the uplink protocol data unit, and then according to the pre-stored
  • the correspondence between the target session and the target identifier may determine that the uplink packet belongs to the target session. Therefore, the AN replaces the target identifier in the uplink packet with the reference identifier, so that the UP-GW can determine, according to the reference identifier, that the uplink protocol data unit belongs to the target session.
  • Step S1108 The AN receives the downlink protocol data unit sent by the user plane gateway.
  • any device may indicate that the downlink message belongs to the target session by using the reference identifier, and therefore, the UP-GW encapsulates the reference in the downlink protocol data unit by using a common rule.
  • the identifier is to indicate that the downlink message belongs to the target session.
  • Step S1109 The AN replaces the reference identifier in the downlink protocol data unit with the target identifier and sends the replaced downlink protocol data unit to the UE.
  • the AN parses the downlink protocol data unit, and when parsing the reference identifier, determining that the downlink protocol data unit belongs to the target session, and replacing the target identifier corresponding to the target session
  • the reference identifier is sent to the UE after the replaced downlink protocol data unit.
  • Step S1110 The UE receives the downlink protocol data unit and determines that the downlink protocol data unit belongs to the target session according to the target identifier.
  • the UE parses the downlink protocol data unit after receiving the downlink protocol data unit, and when the target identifier is parsed from the downlink protocol data unit, determining that the downlink packet belongs to the target session corresponding to the target identifier.
  • the downlink protocol data unit usually has a payload field, and the field encapsulates the service data, and the user can further parse the service data to perform related operations according to the service data.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to identify the target.
  • the target identifier of the session When the subsequent packet is transmitted in the air interface segment, the target identifier is used in the packet to indicate that the packet is from the target session.
  • the target identifier When communicating with the core network, the target identifier is replaced with the reference identifier. (It can also be determined by the reference identifier that the target session is a device other than the AN and the UE), so that even if the device other than the AN and the UE intercepts the target identifier, the message cannot be derived. Belongs to the target session, thus avoiding the session being attacked.
  • the above is a description of the session session transmission mode.
  • the idea of additional protection of the part of the information transmitted between the UE and the AN can also be applied to the bearer based on the bearer.
  • the transmission method based on the flow transmission method.
  • FIG. 12 is a schematic structural diagram of a user equipment 120 according to an embodiment of the present invention.
  • the user equipment 120 may include a generating unit 1201, a protection unit 1202, and a sending unit 1203.
  • the detailed description of each unit is as follows.
  • the generating unit 1201 is configured to process the basic key according to the preset rule to generate an air interface protection key, where the basic key is a key generated by the UE and the core network for mutual authentication, or a key derived based on the key generated by the mutual authentication. a key; the device that manages the key in the core network is configured to send the basic key to the access network device AN, so that the AN processes the basic key according to the preset rule to generate the air interface protection key;
  • the protection unit 1202 is configured to protect, by using the air interface protection key, a target field in the uplink protocol data unit PDU, where the target field includes information for identifying a session between the UE and the target node, and the target node and the UE The data of the session needs to pass through the AN when transmitting;
  • the sending unit 1203 is configured to send the uplink protocol data unit that protects the target field to the AN, so that the AN parses the target field in the uplink protocol data unit by using the air interface protection key.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the user equipment further includes a first receiving unit, where the first receiving unit is configured to receive, by the UE, a downlink protocol data unit sent by the AN, and parse the downlink protocol data by using the air interface protection key.
  • a target field in the unit, the target field in the downlink protocol data unit is encrypted by the air interface protection key.
  • the first receiving unit parses the target field in the downlink protocol data unit by using the air interface protection key, specifically: using the air interface protection key according to a rule defined by a pre-acquired air interface policy.
  • a target field in the downlink protocol data unit is parsed, and the target field in the downlink protocol data unit is protected by the AN according to a rule defined by the air interface policy acquired in advance, and the air interface policy defines a key. Usage rules.
  • the protection unit is specifically configured to use the air interface protection key to protect a target field in the uplink protocol data unit according to a rule defined by a pre-acquired air interface policy, where the AN is used according to the pre-acquired
  • the rule defined by the air interface policy uses the air interface protection key to resolve the target field, and the air interface policy defines the usage rule of the key.
  • the user equipment further includes a second receiving unit, where the second receiving unit is configured to receive the air interface policy sent by the AN, where the air interface policy is generated by the AN according to an initial security policy, where the initial security is performed.
  • the policy defines a generation rule of a key used in the target session, and the target session is a session between the target node and the UE.
  • the user equipment further includes a determining unit, configured to determine whether a payload field in the uplink protocol data unit is protected, and if not, triggering the protection unit to protect through the air interface.
  • the key protects the uplink protocol data unit; if yes, the protection unit is triggered to perform an operation of the UE to protect the target field in the uplink protocol data unit PDU through the air interface protection key.
  • the air interface protection key includes at least one of an encryption key and an integrity protection key.
  • the target field includes at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each unit may also correspond to the corresponding description of the method embodiments shown in FIG. 3, FIG. 8, FIG. 9, and FIG.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit, which is used to identify the UE and the user in the core network.
  • the field of the information of the session between the gateways so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine based on the information.
  • the session prevents the session from being attacked.
  • FIG. 13 is a schematic structural diagram of an access network device 130 according to an embodiment of the present invention.
  • the access network device 130 may include a first receiving unit 1301, a generating unit 1302, and a second receiving unit 1303. A detailed description of the unit is as follows.
  • the first receiving unit 1301 is configured to receive a basic key that is sent by the device that manages the key in the core network, where the basic key is a key generated by the user equipment UE and the core network is generated by mutual authentication, or the key is generated based on the two-way authentication. a derived key; the UE is configured to process the basic key according to a preset rule to generate an air interface protection key;
  • the generating unit 1302 is configured to process the basic key according to the preset rule to generate an air interface protection key
  • the second receiving unit 1303 is configured to receive an uplink protocol data unit sent by the UE, and parse a target field in the uplink protocol data unit by using the air interface protection key, where the target field in the uplink protocol data unit is used by the UE The air interface protection key is protected.
  • the target field contains information for identifying a session between the UE and the target node, and the data of the session between the target node and the UE needs to pass through the AN when transmitting.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the access network device further includes a protection unit, where the protection unit is configured to protect the target field in the downlink protocol data unit by using the air interface protection key, and protect the downlink protocol data of the target field.
  • the unit sends the UE to the UE to parse the target field in the downlink protocol data unit by using the air interface protection key.
  • the access network device further includes a determining unit, configured to determine whether a payload field in the downlink protocol data unit is protected, and if not, triggering the protection unit to pass the air interface.
  • the protection key protects the downlink protocol data unit; if so, the protection unit is triggered to perform the operation of protecting the target field in the downlink protocol data unit by the air interface protection key.
  • the protection unit protects the target field in the downlink protocol data unit by using the air interface protection key, specifically: using the air interface protection key to protect the downlink protocol according to the rule defined by the pre-acquired air interface policy.
  • a target field in the data unit the UE is configured to parse the target field in the downlink protocol data unit by using the air interface protection key according to a rule defined by the air interface policy that is obtained in advance, and the air interface policy defines a usage rule of the key.
  • the second receiving unit parses the target field in the uplink protocol data unit by using the air interface protection key, specifically:
  • the target field in the uplink protocol data unit is parsed by using the air interface protection key according to a rule defined by the air interface policy, and the target field in the uplink protocol data unit is used by the UE according to the rule defined by the air interface policy acquired in advance.
  • the air interface protection key is protected, and the air interface policy defines a usage rule of the key.
  • the access network device further includes:
  • a third receiving unit configured to receive an initial security policy from a core network, where the initial security policy defines a generation rule of a key used in the target session, where the target session is a session between the target node and the UE;
  • a sending unit configured to generate an air interface policy according to the initial security policy, and send the air interface policy to the UE.
  • the air interface protection key includes at least one of an encryption key and an integrity protection key.
  • the target field includes at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each unit may also correspond to the corresponding description of the method embodiments shown in FIG. 3, FIG. 8, FIG. 9, and FIG.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit, which is used to identify the UE and the core network.
  • FIG. 14 is a schematic structural diagram of still another user equipment 140 according to an embodiment of the present invention.
  • the user equipment 140 may include a first receiving unit 1401 and a packaging unit 1402, where detailed descriptions of the respective units are as follows. under.
  • the first receiving unit 1401 is configured to receive corresponding relationship information sent by the access network device AN, and determine, according to the corresponding relationship information, a target session corresponding target identifier, where the target identifier is generated by the AN, where the target session is between the UE and the target node. Session, the data of the target session needs to pass through the AN when transmitting;
  • the encapsulating unit 1402 is configured to encapsulate the target identifier in an uplink protocol data unit PDU of the target session and send an uplink protocol data unit encapsulating the target identifier to the AN; the AN is used to target the uplink protocol data unit The identifier is replaced with a reference identifier and the replaced uplink protocol data unit is sent to the target node, the reference identifier being used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • the session protection mechanism is set in the air interface transmission segment of the UE and the AN by running the foregoing unit, that is, after the UE establishes the target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the user equipment further includes a second receiving unit, where the second receiving unit is configured to receive a downlink protocol data unit sent by the AN, and determine, according to the target identifier, that the downlink protocol data unit belongs to the target session,
  • the AN is configured to replace the reference identifier in the downlink protocol data unit with the target identifier when receiving the downlink protocol data unit sent by the target node, and send the replaced downlink protocol data unit to the UE, where the target is
  • the downlink protocol data unit sent by the node includes the reference identifier to indicate that the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the reference identifier includes a bearer identifier, a stream identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, an IP address of the access network device, and the access The access network identifier of the access network accessed by the network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private identity, the IP multimedia public identity, the temporary mobile subscriber identity, At least one of a mobile number of the UE and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each unit may also correspond to the corresponding description of the method embodiment shown in FIG.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to identify the The target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and the target identifier is replaced with a reference when communicating with the core network. Identification (by the reference identifier, it is determined that the target session is a device other than the AN and the UE), so that even if the device other than the AN and the UE intercepts the target identifier, the report cannot be derived.
  • the text belongs to the target session, thus avoiding the session being attacked.
  • FIG. 15 is a schematic structural diagram of still another access network device 150 according to an embodiment of the present invention.
  • the access network device 150 may include a generating unit 1501, a first sending unit 1502, a first receiving unit 1503, and A replacement unit 1504 in which the detailed description of each unit is as follows.
  • the generating unit 1501 is configured to generate a target identifier corresponding to the target session, where the target session is a session between the user equipment UE and the target node, and the data of the target session needs to pass through the AN when transmitting;
  • the first sending unit 1502 is configured to send corresponding relationship information to the UE, so that the UE encapsulates the target identifier in an uplink protocol data unit PDU of the target session, where the correspondence relationship information indicates a correspondence between the target session and the target identifier. relationship;
  • the first receiving unit 1503 is configured to receive, by the UE, the uplink protocol data unit that encapsulates the target identifier;
  • the replacing unit 1504 is configured to replace the target identifier in the uplink protocol data unit with the reference identifier and send the replaced uplink protocol data unit to the target node, where the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to The target session.
  • the session protection mechanism is set in the air interface transmission segment of the UE and the AN by running the foregoing unit, that is, after the UE establishes the target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the access network device further includes:
  • a second receiving unit configured to receive a downlink protocol data unit sent by the target node, where the downlink protocol data unit includes the reference identifier to indicate that the downlink protocol data unit belongs to the target session;
  • a second sending unit configured to replace the reference identifier in the downlink protocol data unit with the target identifier, and send the replaced downlink protocol data unit to the UE, so that the UE determines the downlink protocol data according to the target identifier.
  • the unit belongs to the target session.
  • the reference identifier is encapsulated in at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the reference identifier includes a bearer identifier, a stream identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, an IP address of the access network device, and the access The access network identifier of the access network accessed by the network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private identity, the IP multimedia public identity, the temporary mobile subscriber identity, At least one of a mobile number of the UE and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each unit may also correspond to the corresponding description of the method embodiment shown in FIG. 12 .
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to use the same. Identifying the target identifier of the target session, and the subsequent packet indicates, by the target identifier, that the packet is from the destination when the air interface is transmitted.
  • the target session when communicating with the core network, replaces the target identifier with a reference identifier (determining that the target session is a device other than the AN and the UE by the reference identifier), so that even if the AN is excluded
  • the device other than the UE intercepts the target identifier, and cannot derive that the packet belongs to the target session, thereby avoiding the session being attacked.
  • FIG. 16 is a user equipment 160 according to an embodiment of the present invention.
  • the user equipment 160 includes a processor 1601, a memory 1602, and a transceiver 1603.
  • the processor 1601, the memory 1602, and the transceiver 1603 are mutually connected by a bus. connection.
  • the memory 1602 includes, but is not limited to, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), or a portable read only memory (CD-ROM). Memory 1602 is used for related instructions and data.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the transceiver 1603 can include a receiver and a transmitter, for example, a radio frequency module.
  • the processor 1601 described below receives or transmits a certain protocol data unit. Specifically, it can be understood that the processor 1601 receives or receives the transceiver through the transceiver. send.
  • the processor 1601 may be one or more central processing units (English: Central Processing Unit, CPU for short). In the case where the processor 1601 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • CPU Central Processing Unit
  • the processor 1601 in the user equipment 160 is configured to read the program code stored in the memory 1602, and perform the following operations:
  • the basic key is processed according to a preset rule to generate an air interface protection key, where the basic key is a key generated by the UE and the core network for mutual authentication or a key derived based on the key generated by the two-way authentication; the core network
  • the device that manages the key is used to send the basic key to the access network device AN, so that the AN processes the basic key according to the preset rule to generate the air interface protection key;
  • a target field in the uplink protocol data unit PDU where the target field includes information for identifying a session between the UE and the target node, and data of the session between the target node and the UE is transmitted. Need to pass the AN;
  • the uplink protocol data unit that protects the target field is sent to the AN, so that the AN resolves the target field in the uplink protocol data unit by using the air interface protection key.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the processor 1601 processes the basic key to generate the air interface protection key according to the preset rule, and is further configured to receive the downlink protocol data unit sent by the AN, and parse the key through the air interface protection key.
  • the target field in the downlink protocol data unit, the target field in the downlink protocol data unit is encrypted by the air interface protection key.
  • the processor 1601 parses the target field in the downlink protocol data unit by using the air interface protection key, specifically: using the air interface protection key to be parsed according to a rule defined by a pre-acquired air interface policy.
  • a target field in the downlink protocol data unit the target field in the downlink protocol data unit is protected by the AN according to a rule defined by the air interface policy acquired in advance, and the air interface policy defines a key Use rules.
  • the processor 1601 protects the target field in the uplink protocol data unit PDU by using the air interface protection key, specifically:
  • the target field in the uplink protocol data unit is protected by the air interface protection key according to the rule defined by the air interface policy, and the AN is configured to use the air interface protection key to parse the target field according to the rule defined by the air interface policy acquired in advance.
  • This air interface policy defines the rules for the use of keys.
  • the processor 1601 is further configured to receive the air interface policy sent by the AN, where the air interface policy is generated by the AN according to an initial security policy, where the initial security policy defines a target session.
  • a key generation rule, the target session is a session between the target node and the UE.
  • the processor 1601 before the processor 1601 protects the target field in the uplink protocol data unit PDU by using the air interface protection key, the processor 1601 is further configured to determine whether the payload field in the uplink protocol data unit has been protected; No, the uplink protocol data unit is protected by the air interface protection key; if yes, the operation of protecting the target field in the uplink protocol data unit PDU by the UE through the air interface protection key is performed.
  • the air interface protection key includes at least one of an encryption key and an integrity protection key.
  • the target field includes at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each operation may also correspond to the corresponding description of the method embodiments shown in FIG. 3, FIG. 8, FIG. 9, and FIG.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit that is used to identify the UE and the user in the core network.
  • the field of the information of the session between the gateways so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine based on the information.
  • the session prevents the session from being attacked.
  • FIG. 17 is an access network device 170 according to an embodiment of the present invention.
  • the access network device 170 includes a processor 1701, a memory 1702, and a transceiver 1703.
  • the processor 1701, the memory 1702, and the transceiver The 1703 is connected to each other through a bus.
  • the memory 1702 includes, but is not limited to, a random access memory (RAM), a read only memory (ROM), and an erasable Programmable read only memory (EPROM or flash memory), or portable read only memory (CD-ROM), which is used for related instructions and data.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable Programmable read only memory
  • CD-ROM portable read only memory
  • the transceiver 1703 can include a receiver and a transmitter, for example, a radio frequency module.
  • the processor 1701 described below receives or transmits a certain protocol data unit. Specifically, it can be understood that the processor 1701 receives or receives the transceiver through the transceiver. send.
  • the processor 1701 may be one or more central processing units (English: Central Processing Unit, CPU for short). In the case where the processor 1701 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • CPU Central Processing Unit
  • the processor 1701 in the access network device 170 is configured to read the program code stored in the memory 1702, and perform the following operations:
  • a basic key where the basic key is a key generated by the user equipment UE and the core network, or a key derived based on the key generated by the two-way authentication;
  • the UE is configured to process the basic key according to a preset rule to generate an air interface protection key;
  • the target field contains information for identifying a session between the UE and the target node, and the data of the session between the target node and the UE needs to pass through the AN when transmitting.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit from being used to identify the UE and the user plane gateway in the core network.
  • the field of the information of the session so that the attacker cannot easily obtain the information for identifying the session between the UE and the user plane gateway in the core network from the air interface segment, so that the attacker cannot determine the session based on the information, thereby avoiding The session was attacked.
  • the processor 1701 after the processor 1701 processes the basic key according to the preset rule to generate an air interface protection key, the processor 1701 is further configured to protect a target field in the downlink protocol data unit by using the air interface protection key. And transmitting, to the UE, the downlink protocol data unit that protects the target field, so that the UE parses the target field in the downlink protocol data unit by using the air interface protection key.
  • the processor before the processor protects the target field in the downlink protocol data unit by using the air interface protection key, the processor is further configured to determine whether the payload field in the downlink protocol data unit is protected; And protecting, by the air interface protection key, the downlink protocol data unit; if yes, performing an operation of protecting the target field in the downlink protocol data unit by the air interface protection key.
  • the processor 1701 protects the target field in the downlink protocol data unit by using the air interface protection key, specifically: using the air interface protection key to protect the downlink according to a rule defined by the pre-acquired air interface policy.
  • the UE is configured to use the air interface protection key to parse the target field in the downlink protocol data unit according to a rule defined by the air interface policy acquired in advance, and the air interface policy defines a usage rule of the key .
  • the processor parses the target field in the uplink protocol data unit by using the air interface protection key, specifically: parsing the air interface protection key according to a rule defined by a pre-acquired air interface policy.
  • a target field in the uplink protocol data unit the target field in the uplink protocol data unit is pre-acquired by the UE
  • the rules defined by the air interface policy are protected by the air interface protection key, which defines the usage rules of the key.
  • the processor is further configured to receive an initial security policy from the core network, where the initial security policy defines a generation rule of a key used in the target session, where the target session is the target node. a session with the UE; generating an air interface policy according to the initial security policy, and sending the air interface policy to the UE.
  • the air interface protection key includes at least one of an encryption key and an integrity protection key.
  • the target field includes at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the information used to identify the session between the UE and the target node includes a bearer identifier, a flow identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, The IP address of the access network device, the access network identifier of the access network accessed by the access network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private At least one of an identity, an IP multimedia public identity, a temporary mobile subscriber identity, a mobile number of the UE, and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • each operation may also correspond to the corresponding description of the method embodiments shown in FIG. 3, FIG. 8, FIG. 9, and FIG.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit, which is used to identify the UE and the core network.
  • FIG. 18 is a user equipment 180 according to an embodiment of the present invention.
  • the user equipment 180 includes a processor 1801, a memory 1802, and a transceiver 1803.
  • the processor 1801, the memory 1802, and the transceiver 1803 pass each other through a bus. connection.
  • the memory 1802 includes, but is not limited to, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), or a portable read only memory (CD-ROM). Memory 1802 is used for related instructions and data.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the transceiver 1803 can include a receiver and a transmitter, for example, a radio frequency module.
  • the processor 1801 described below receives or transmits a certain protocol data unit. Specifically, it can be understood that the processor 1801 receives or receives the transceiver through the transceiver. send.
  • the processor 1801 may be one or more central processing units (English: Central Processing Unit, CPU for short). In the case where the processor 1801 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • CPU Central Processing Unit
  • the processor 1801 in the user equipment 180 is configured to read the program code stored in the memory 1802 and perform the following operations:
  • the AN is configured to replace the target identifier in the uplink protocol data unit with a reference identifier And transmitting the replaced uplink protocol data unit to the target node, where the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the processor 1801 receives the corresponding relationship information sent by the access network device AN, and after determining the target session corresponding target identifier according to the corresponding relationship information, is further configured to receive the downlink protocol data unit sent by the AN and Determining, according to the target identifier, that the downlink protocol data unit belongs to the target session, and the AN is configured to replace the reference identifier in the downlink protocol data unit with the target identifier when receiving the downlink protocol data unit sent by the target node, and The downlink protocol data unit obtained by the replacement is sent to the UE, and the downlink protocol data unit sent by the target node includes the reference identifier to indicate that the downlink protocol data unit belongs to the target session.
  • the reference identifier is encapsulated in at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the reference identifier includes a bearer identifier, a stream identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, an IP address of the access network device, and the access The access network identifier of the access network accessed by the network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private identity, the IP multimedia public identity, the temporary mobile subscriber identity, At least one of a mobile number of the UE and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with a network element in the core network.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to identify the The target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and the target identifier is replaced with a reference when communicating with the core network. Identification (by the reference identifier, it is determined that the target session is a device other than the AN and the UE), so that even if the device other than the AN and the UE intercepts the target identifier, the report cannot be derived.
  • the text belongs to the target session, thus avoiding the session being attacked.
  • FIG. 19 is an access network device 190 according to an embodiment of the present invention.
  • the access network device 190 includes a processor 1901, a memory 1902, and a transceiver 1903.
  • the processor 1901, the memory 1902, and the transceiver 1903 Connected to each other via a bus.
  • the memory 1902 includes, but is not limited to, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM or flash memory), or a portable read only memory (CD-ROM). Memory 1902 is used for related instructions and data.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable read only memory
  • the transceiver 1903 can include a receiver and a transmitter, for example, a radio frequency module.
  • the processor 1901 described below receives or transmits a certain protocol data unit. Specifically, it can be understood that the processor 1901 receives or receives the transceiver through the transceiver. send.
  • the processor 1901 may be one or more central processing units (English: Central Processing Unit, CPU for short). In the case where the processor 1901 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • CPU Central Processing Unit
  • the processor 1901 in the access network device 190 is configured to read the program code stored in the memory 1902, and perform the following operations:
  • Target session is a session between the user equipment UE and the target node, and the data of the target session needs to pass through the AN when transmitting;
  • the target identifier in the uplink protocol data unit is replaced with a reference identifier, and the replaced uplink protocol data unit is sent to the target node, where the reference identifier is used by the target node to confirm that the uplink protocol data unit belongs to the target session.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to identify the target identifier of the target session.
  • the target identifier is used in the packet to indicate that the packet is from the target session, and when the communication is with the core network, the target identifier is replaced with the reference identifier (by the reference)
  • the identification determines that the target session is also possible for the device other than the AN and the UE, so that even if the device other than the AN and the UE intercepts the target identifier, the packet cannot be inferred to belong to the target session. , thus avoiding the session being attacked.
  • the processor 1901 is further configured to:
  • the AN replaces the reference identifier in the downlink protocol data unit with the target identifier and sends the replaced downlink protocol data unit to the UE, so that the UE determines, according to the target identifier, that the downlink protocol data unit belongs to the target session. .
  • the reference identifier is encapsulated in at least one of an outer IP header outer IP header field, an encapsulation header encapsulation header field, and a protocol data unit header PDU header field.
  • the reference identifier includes a bearer identifier, a stream identifier, a media access control identifier of the hardware, a session identifier, an internet protocol address of the UE, an IP address of the access network device, and the access The access network identifier of the access network accessed by the network device, the IP address of the UE, the quality of service identifier, the international mobile subscriber identity, the international mobile device identity, the Internet Protocol multimedia private identity, the IP multimedia public identity, the temporary mobile subscriber identity, At least one of a mobile number of the UE and a globally unique temporary user equipment identity of the UE.
  • the target node includes a user plane gateway in the core network, or a service server in the core network, or a server in the Internet that establishes a communication connection with the network element in the core network.
  • a session protection mechanism is set in the air interface transmission segment of the UE and the AN, that is, after the UE establishes a target session between the UE and the UE, the AN and the UE agree to use the same. Identifying a target identifier of the target session, and the subsequent packet indicates, by the target identifier, that the packet is from the target session when the air interface is transmitted, and replaces the target identifier when communicating with the core network. For the reference identifier (determining that the target session is a device other than the AN and the UE by using the reference identifier), even if the device other than the AN and the UE intercepts the target identifier, it cannot be derived. The message belongs to the target session, thus avoiding the session being attacked.
  • the air interface protection key is pre-negotiated between the UE and the AN, and then the two parties use the air interface protection key to protect the protocol data unit, which is used to identify the UE and the core network.
  • the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明实施例公开了一种数据传输方法、相关设备及系统，该系统包括接入网设备AN和用户设备UE，其中：该AN用于接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为该UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该AN和该UE均用于按照预设规则处理该基础密钥以生成空口保护密钥；该UE还用于通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；该AN用于通过该空口保护密钥解析该上行协议数据单元中的该目标字段。采用本发明实施例，能够防止会话被攻击。

Description

一种数据传输方法、相关设备及系统 技术领域
本发明涉及计算机技术领域，尤其涉及一种数据传输方法、相关设备及系统。
背景技术
无线通信技术已经深入了人们的生活，我们在享受通信便利的同时也会面临安全和隐私的威胁。空口传输是无线通信的重点特征，为了避免空口传输的内容被窃听就需要制定相应的保护机制来对传输内容加密。在长期演进(英文：Long Term Evolution，简称：LTE)中，从用户设备(英文：User Equipment，简称：UE)到Internet的安全保护机制为hop-by-hop机制，即采用分段加密的形式完成对会话中的所有信息进行保护，然而这些信息所经过的中间节点可以获得这些信息的明文，因此不能够抗击中间节点窃听。为了抗击中间节点窃听，本领域的技术人员提出了采用端到端地保护机制，例如，UE与核心网(英文：core network，简称：CN)之间端到端地保护、UE与Internet服务器之间端到端地保护等等。
UE与CN之间端到端地保护具体是指UE与CN中的网元(例如，CN中的控制网元、CN中的运营商服务器、CN中的用户面网关等)之间传输会话数据时，直接由该UE对上行协议数据单元(英文：Protocol data unit，简称：PDU)加密并由该CN中的网元对该上行协议数据单元解密，直接由该CN中的网元对下行数据进行加密并由该UE对该下行协议数据单元进行解密，该上行协议数据单元和该下行协议数据单元在传输过程中不需要经过该UE与该CN之间的中间节点(例如，接入网(英文：Access Network，简称：AN))加密和解密，从而避免了该中间节点的监听。请参见图1，图1是现有技术中的一种端到端地保护机制的场景示意图，图1中包括UE、AN、控制面认证单元(英文：Control Plane-Authentication Unit，简称：CP-AU)、用户面网关(英文：User Plane-Gateway，简称：UP-GW)和Internet服务器，该UE进行在网络中通信的流程如下：
步骤S101：UE采用空口技术向AN发送接入请求，UE与AN间属于空口段；
步骤S102：AN接收该接入请求并将该接入请求发送给CN中的CP-AU；
步骤S103：UE与该CP-AU双向认证；
步骤S104：UE与该CP-AU双向认证成功后建立UE与CN之间的会话；
步骤S105：UE与该CN中的UP-GW基于该会话进行协议数据单元传输且采用端到端地保护机制来保护协议数据单元传输，即由UE对上行协议数据单元进行加密并由UP-GW对该上行协议数据单元进行解密，由UP-GW对下行协议数据单元进行加密并由该UE对该下行协议数据单元进行解密，该UE与该UP-GW之间的中间节点AN则负责对该上行协议数据单元和该下行协议数据单元进行中转，但不进行加密和解密操作；从而避免了该AN窃听该UE与该UP-GW之间的内容。
然而，端到端地保护机制所保护的对象通常为协议数据单元中的payload部分而非协议数据单元的header部分，因为中间节点需要读取协议数据单元的header中用于标识会话的信息(例如，session ID、IMSI、承载标识等)，从而根据该信息确定如何转发该协议数据单元。由于用于标识会话的信息未被加密，因此攻击者可以轻易在空口传输阶段获取该信 息并根据该信息追踪到该会话，从而对该会话的安全带来威胁。
发明内容
本发明实施例公开了一种数据传输方法、相关设备及系统，能够防止UE与目标节点之间的会话被攻击。
第一方面，本发明实施例提供了一种通信系统，该通信系统包括接入网设备AN和用户设备UE，其中：该AN用于接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为该UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该AN和该UE均用于按照预设规则处理该基础密钥以生成空口保护密钥；该UE还用于通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，并将保护了该目标字段的该上行协议数据单元发送给该AN，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；该AN用于接收该上行协议数据单元，并通过该空口保护密钥解析该上行协议数据单元中的该目标字段。
通过运行上述系统，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
结合第一方面，在第一方面的第一种可能的实现方式中，该AN用于通过该空口保护密钥保护下行协议数据单元中的目标字段，并将保护了该目标字段的该下行协议数据单元发送给该UE；该UE用于接收该下行协议数据单元，并通过该空口保护密钥解析该下行协议数据单元中的该目标字段。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，该通过该空口保护密钥保护该下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该空口策略定义了密钥的使用规则；该通过该空口保护密钥解析该下行协议数据单元中的该目标字段，具体为：按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的该目标字段。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，该通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段，该空口策略定义了密钥的使用规则；该通过该空口保护密钥解析该上行协议数据单元中的该目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的该目标字段。
结合第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，该AN用于接收来自核心网的初始安全策略，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话；该AN用于根据该初始安全策略生成空口策略；该AN用于向该UE发送该 空口策略；该UE用于接收该空口策略。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，该UE还用于判断该上行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；若否，则该UE用于通过该空口保护密钥保护该上行协议数据单元；若是，则该UE用于执行该通过该空口保护密钥保护上行协议数据单元中的目标字段的操作。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，或者第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，该AN还用于判断该下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；若否，则该AN用于通过该空口保护密钥保护该下行协议数据单元；若是，该AN用于执行该通过该空口保护密钥保护该下行协议数据单元中的目标字段的操作。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，或者第一方面的第五种可能的实现方式，或者第一方面的第六种可能的实现方式，在第一方面的第七种可能的实现方式中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，或者第一方面的第五种可能的实现方式，或者第一方面的第六种可能的实现方式，或者第一方面的第七种可能的实现方式，在第一方面的第八种可能的实现方式中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，或者第一方面的第五种可能的实现方式，或者第一方面的第六种可能的实现方式，或者第一方面的第七种可能的实现方式，或者第一方面的第八种可能的实现方式，在第一方面的第九种可能的实现方式中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第一方面，或者第一方面的第一种可能的实现方式，或者第一方面的第二种可能的实现方式，或者第一方面的第三种可能的实现方式，或者第一方面的第四种可能的实现方式，或者第一方面的第五种可能的实现方式，或者第一方面的第六种可能的实现方式，或者第一方面的第七种可能的实现方式，或者第一方面的第八种可能的实现方式，或者第 一方面的第九种可能的实现方式，在第一方面的第十种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第二方面，本发明实施例提供一种通信系统，该系统包括用户设备UE和接入网设备AN，其中：该AN用于生成与目标会话对应的目标标识，该目标会话为该UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；该AN用于向该UE发送对应关系信息，该对应关系信息指示了该目标会话与该目标标识的对应关系；该UE用于接收该对应关系信息并根据该对应关系信息确定该目标会话对应该目标标识；该UE用于在该目标会话的上行协议数据单元PDU中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN；该AN用于接收该上行协议数据单元；该AN用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过运行该系统，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
结合第二方面，在第二方面的第一种可能的实现方式中，该AN用于接收该目标节点发送的下行协议数据单元，该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话；该AN用于将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE；该UE用于接收该下行协议数据单元并根据该目标标识确定该下行协议数据单元属于该目标会话。
结合第二方面，或者第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
结合第二方面，或者第二方面的第一种可能的实现方式，或者第二方面的第二种可能的实现方式，在第二方面的第三种可能的实现方式中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第二方面，或者第二方面的第一种可能的实现方式，或者第二方面的第二种可能的实现方式，或者第二方面的第三种可能的实现方式，在第二方面的第四种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第三方面，本发明实施例提供一种用户设备UE，该用户设备包括：生成单元，用于按照预设规则处理基础密钥以生成空口保护密钥，该基础密钥为该UE与核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该核心网中管理密钥的设备用于将该基础密钥发送给接入网设备AN，以使该AN按照该预设规则处理该基础密钥生成该空口保护密钥；保护单元，用于通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；发送单元，用于将保护了该目标字段的该上行协议数据单元发送给该AN，以使该AN通过该空口保护密钥解析该上行协议数据单元中的该目标字段。
通过运行上述单元，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
结合第三方面，在第三方面的第一种可能的实现方式中，该用户设备还包括：第一接收单元，用于该UE接收该AN发送的下行协议数据单元，并通过该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段经过了该空口保护密钥加密。
结合第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，该第一接收单元通过该空口保护密钥解析该下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段由该AN按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，在第三方面的第三种可能的实现方式中，该保护单元具体用于按照预先获取的空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段，该AN用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该目标字段，该空口策略定义了密钥的使用规则。
结合第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，在第三方面的第四种可能的实现方式中，该用户设备还包括：第二接收单元，用于接收该AN发送的该空口策略，该空口策略由该AN根据初始安全策略生成，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，或者第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，还包括：判断单元，用于判断该上行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护，若否，则触发该保护单元通过该空口保护密钥保护该上行协议数据单元；若是则触发该保护单元执行该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，或者第三方面的第四种可能的实现方式，或者第三方面的第五种可能的实现方式，在第三方面的第六种可能的实现方式中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，或者第三方面的第四种可能的实现方式，或者第三方面的第五种可能的实现方式，或者第三方面的第六种可能的实现方式，在第三方面的第七种可能的实现方式中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，或者第三方面的第四种可能的实现方式，或者第三方面的第五种可能的实现方式，或者第三方面的第六种可能的实现方式，或者第三方面的第七种可能的实现方式，在第三方面的第八种可能的实现方式中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第三方面，或者第三方面的第一种可能的实现方式，或者第三方面的第二种可能的实现方式，或者第三方面的第三种可能的实现方式，或者第三方面的第四种可能的实现方式，或者第三方面的第五种可能的实现方式，或者第三方面的第六种可能的实现方式，或者第三方面的第七种可能的实现方式，或者第三方面的第八种可能的实现方式，在第三方面的第九种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第四方面，本发明实施例提供一种接入网设备AN，该接入网设备包括：第一接收单元，用于接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为用户设备UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该UE用于按照预设规则处理该基础密钥以生成空口保护密钥；生成单元，用于按照该预设规则处理该基础密钥以生成空口保护密钥；第二接收单元，用于接收该UE发送的上行协议数据单元，并通过该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段由该UE通过该空口保护密钥保护过，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN。
通过运行上述单元，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
结合第四方面，在第四方面的第一种可能的实现方式中，该AN还包括：保护单元，用于通过该空口保护密钥保护下行协议数据单元中的目标字段，并将保护了该目标字段的该下行协议数据单元发送给该UE；以使该UE通过该空口保护密钥解析该下行协议数据单元中的该目标字段。
结合第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中，该AN还包括：判断单元，用于判断该下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护，若否，则触发该保护单元通过该空口保护密钥保护该下行协议数据单元；若是，触发该保护单元执行该通过该空口保护密钥保护下行协议数据单元中的目标字段的操作。
结合第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，在第四方面的第三种可能的实现方式中，该保护单元通过该空口保护密钥保护下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该UE用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的该目标字段，该空口策略定义了密钥的使用规则。
结合第四方面，或者第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，或者第四方面的第三种可能的实现方式，在第四方面的第四种可能的实现方式中，该第二接收单元通过该空口保护密钥解析该上行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段为该UE按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
结合第四方面的第三种可能的实现方式，或者第四方面的第四种可能的实现方式，在第四方面的第五种可能的实现方式中，该AN还包括：第三接收单元，用于接收来自核心网的初始安全策略，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话；发送单元，用于根据该初始安全策略生成空口策略，并向该UE发送该空口策略。
结合第四方面，或者第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，或者第四方面的第三种可能的实现方式，或者第四方面的第四种可能的实现方式，或者第四方面的第五种可能的实现方式，在第四方面的第六种可能的实现方式中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
结合第四方面，或者第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，或者第四方面的第三种可能的实现方式，或者第四方面的第四种可能的实现方式，或者第四方面的第五种可能的实现方式，或者第四方面的第六种可能的实现方式，在第四方面的第七种可能的实现方式中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
结合第四方面，或者第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，或者第四方面的第三种可能的实现方式，或者第四方面的第四种可能的实现方式，或者第四方面的第五种可能的实现方式，或者第四方面的第六种可能的实现方式， 或者第四方面的第七种可能的实现方式，在第四方面的第八种可能的实现方式中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第四方面，或者第四方面的第一种可能的实现方式，或者第四方面的第二种可能的实现方式，或者第四方面的第三种可能的实现方式，或者第四方面的第四种可能的实现方式，或者第四方面的第五种可能的实现方式，或者第四方面的第六种可能的实现方式，或者第四方面的第七种可能的实现方式，或者第四方面的第八种可能的实现方式，在第四方面的第九种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第五方面，本发明实施例提供一种用户设备UE，该UE包括：第一接收单元，用于接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识，该目标标识由该AN生成，该目标会话为该UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；封装单元，用于在该目标会话的上行协议数据单元PDU中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN；该AN用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过运行上述单元，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
结合第五方面，在第五方面的第一种可能的实现方式中，该UE还包括：第二接收单元，用于接收该AN发送的下行协议数据单元并根据该目标标识确定该下行协议数据单元属于该目标会话，该AN用于在接收到该目标节点发送的下行协议数据单元时将该下行协议数据单元中的参考标识替换为该目标标识，并将替换得到的该下行协议数据单元发送给该UE，该目标节点发送的该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话。
结合第五方面，或者第五方面的第一种可能的实现方式，在第五方面的第二种可能的实现方式中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
结合第五方面，或者第五方面的第一种可能的实现方式，或者第五方面的第二种可能的实现方式，在第五方面的第三种可能的实现方式中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、 该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第五方面，或者第五方面的第一种可能的实现方式，或者第五方面的第二种可能的实现方式，或者第五方面的第三种可能的实现方式，在第五方面的第四种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第六方面，本发明实施例提供一种接入网设备AN，该AN包括：生成单元，用于生成与目标会话对应的目标标识，该目标会话为用户设备UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；第一发送单元，用于向该UE发送对应关系信息，以使该UE在该目标会话的上行协议数据单元PDU中封装该目标标识，该对应关系信息指示了该目标会话与该目标标识的对应关系；第一接收单元，用于接收该UE发送的封装该目标标识的该上行协议数据单元；替换单元，用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过运行上述单元，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
结合第六方面，在第六方面的第一种可能的实现方式中，该AN还包括：第二接收单元，用于接收该目标节点发送的下行协议数据单元，该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话；第二发送单元，用于将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE，以使该UE根据该目标标识确定该下行协议数据单元属于该目标会话。
结合第六方面，或者第六方面的第一种可能的实现方式，在第六方面的第二种可能的实现方式中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
结合第六方面，或者第六方面的第一种可能的实现方式，或者第六方面的第二种可能的实现方式，在第六方面的第三种可能的实现方式中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第六方面，或者第六方面的第一种可能的实现方式，或者第六方面的第二种可能的实现方式，或者第六方面的第三种可能的实现方式，在第六方面的第四种可能的实现方 式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第七方面，本发明实施例提供一种数据传输方法，该方法包括：用户设备UE按照预设规则处理基础密钥以生成空口保护密钥，该基础密钥为该UE与核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该核心网中管理密钥的设备用于将该基础密钥发送给接入网设备AN，以使该AN按照该预设规则处理该基础密钥生成该空口保护密钥；该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；该UE将保护了该目标字段的该上行协议数据单元发送给该AN，以使该AN通过该空口保护密钥解析该上行协议数据单元中的该目标字段。
通过执行上述步骤，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
结合第七方面，在第七方面的第一种可能的实现方式中，该用户设备UE按照预设规则处理基础密钥以生成空口保护密钥之后，该方法还包括：该UE接收该AN发送的下行协议数据单元，并通过该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段经过了该空口保护密钥加密。
结合第七方面的第一种可能的实现方式，在第七方面的第二种可能的实现方式中，该通过该空口保护密钥解析该下行协议数据单元中的目标字段，包括：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段由该AN按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，在第七方面的第三种可能的实现方式中，该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，包括：按照预先获取的空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段，该AN用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该目标字段，该空口策略定义了密钥的使用规则。
结合第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，在第七方面的第四种可能的实现方式中，该方法还包括：该UE接收该AN发送的该空口策略，该空口策略由该AN根据初始安全策略生成，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，或者第七方面的第四种可能的实现方式，在第七方面的第五种可能的实现方式中，该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段之前，还包括：该UE判断该上行协议数据单元中的协议数据 单元载荷PDU payload字段是否已被保护；若否，则该UE通过该空口保护密钥保护该上行协议数据单元；若是，则该UE执行该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，或者第七方面的第四种可能的实现方式，或者第七方面的第五种可能的实现方式，在第七方面的第六种可能的实现方式中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，或者第七方面的第四种可能的实现方式，或者第七方面的第五种可能的实现方式，或者第七方面的第六种可能的实现方式，在第七方面的第七种可能的实现方式中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，或者第七方面的第四种可能的实现方式，或者第七方面的第五种可能的实现方式，或者第七方面的第六种可能的实现方式，或者第七方面的第七种可能的实现方式，在第七方面的第八种可能的实现方式中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第七方面，或者第七方面的第一种可能的实现方式，或者第七方面的第二种可能的实现方式，或者第七方面的第三种可能的实现方式，或者第七方面的第四种可能的实现方式，或者第七方面的第五种可能的实现方式，或者第七方面的第六种可能的实现方式，或者第七方面的第七种可能的实现方式，或者第七方面的第八种可能的实现方式，在第七方面的第九种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第八方面，本发明实施例提供一种数据传输方法，该方法包括：接入网设备AN接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为用户设备UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该UE用于按照预设规则处理该基础密钥以生成空口保护密钥；该AN按照该预设规则处理该基础密钥以生成空口保护密钥；该AN接收该UE发送的上行协议数据单元，并通过该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段由该UE通过该空口保护密钥保护过，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN。
通过执行上述步骤，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会 话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
结合第八方面，在第八方面的第一种可能的实现方式中，该AN按照该预设规则处理该基础密钥以生成空口保护密钥之后，该方法还包括：该AN通过该空口保护密钥保护下行协议数据单元中的目标字段，并将保护了该目标字段的该下行协议数据单元发送给该UE；以使该UE通过该空口保护密钥解析该下行协议数据单元中的该目标字段。
结合第八方面的第一种可能的实现方式，在第八方面的第二种可能的实现方式中，该AN通过该空口保护密钥保护下行协议数据单元中的目标字段之前，该方法还包括：该AN判断该下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；若否，则该AN通过该空口保护密钥保护该下行协议数据单元；若是，该AN执行该通过该空口保护密钥保护下行协议数据单元中的目标字段的步骤。
结合第八方面的第一种可能的实现方式，或者第八方面的第二种可能的实现方式，在第八方面的第三种可能的实现方式中，该AN通过该空口保护密钥保护下行协议数据单元中的目标字段，包括：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该UE用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的该目标字段，该空口策略定义了密钥的使用规则。
结合第八方面，或者第八方面的第一种可能的实现方式，或者第八方面的第二种可能的实现方式，或者第八方面的第三种可能的实现方式，在第八方面的第四种可能的实现方式中，该通过该空口保护密钥解析该上行协议数据单元中的目标字段，包括：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段为该UE按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
结合第八方面的第三种可能的实现方式，或者第八方面的第四种可能的实现方式，在第八方面的第五种可能的实现方式中，该方法还包括：该AN接收来自核心网的初始安全策略，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话；该AN根据该初始安全策略生成空口策略，并向该UE发送该空口策略。
结合第八方面，或者第八方面的第一种可能的实现方式，或者第八方面的第二种可能的实现方式，或者第八方面的第三种可能的实现方式，或者第八方面的第四种可能的实现方式，或者第八方面的第五种可能的实现方式，在第八方面的第六种可能的实现方式中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
结合第八方面，或者第八方面的第一种可能的实现方式，或者第八方面的第二种可能的实现方式，或者第八方面的第三种可能的实现方式，或者第八方面的第四种可能的实现方式，或者第八方面的第五种可能的实现方式，或者第八方面的第六种可能的实现方式，在第八方面的第七种可能的实现方式中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
结合第八方面，或者第八方面的第一种可能的实现方式，或者第八方面的第二种可能 的实现方式，或者第八方面的第三种可能的实现方式，或者第八方面的第四种可能的实现方式，或者第八方面的第五种可能的实现方式，或者第八方面的第六种可能的实现方式，或者第八方面的第七种可能的实现方式，在第八方面的第八种可能的实现方式中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第八方面，或者第八方面的第一种可能的实现方式，或者第八方面的第二种可能的实现方式，或者第八方面的第三种可能的实现方式，或者第八方面的第四种可能的实现方式，或者第八方面的第五种可能的实现方式，或者第八方面的第六种可能的实现方式，或者第八方面的第七种可能的实现方式，或者第八方面的第八种可能的实现方式，在第八方面的第九种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第九方面，本发明实施例提供一种数据传输方法，该方法包括：用户设备UE接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识，该目标标识由该AN生成，该目标会话为该UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；该UE在该目标会话的上行协议数据单元PDU中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN；该AN用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过执行上述步骤，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
结合第九方面，在第九方面的第一种可能的实现方式中，用户设备UE接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识之后，该方法还包括：该UE接收该AN发送的下行协议数据单元并根据该目标标识确定该下行协议数据单元属于该目标会话，该AN用于在接收到该目标节点发送的下行协议数据单元时将该下行协议数据单元中的参考标识替换为该目标标识，并将替换得到的该下行协议数据单元发送给该UE，该目标节点发送的该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话。
结合第九方面，或者第九方面的第一种可能的实现方式，在第九方面的第二种可能的实现方式中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
结合第九方面，或者第九方面的第一种可能的实现方式，或者第九方面的第二种可能的实现方式，在第九方面的第三种可能的实现方式中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第九方面，或者第九方面的第一种可能的实现方式，或者第九方面的第二种可能的实现方式，或者第九方面的第三种可能的实现方式，在第九方面的第四种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第十方面，本发明实施例提供一种数据传输方法，该方法包括：接入网设备AN生成与目标会话对应的目标标识，该目标会话为用户设备UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；该AN向该UE发送对应关系信息，以使该UE在该目标会话的上行协议数据单元PDU中封装该目标标识，该对应关系信息指示了该目标会话与该目标标识的对应关系；该AN接收该UE发送的封装该目标标识的该上行协议数据单元；该AN将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过执行上述步骤，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
结合第十方面，在第十方面的第一种可能的实现方式中，该AN向该UE发送对应关系信息之后，该方法还包括：该AN接收该目标节点发送的下行协议数据单元，该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话；该AN将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE，以使该UE根据该目标标识确定该下行协议数据单元属于该目标会话。
结合第十方面，或者第十方面的第一种可能的实现方式，在第十方面的第二种可能的实现方式中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
结合第十方面，或者第十方面的第一种可能的实现方式，或者第十方面的第二种可能的实现方式，在第十方面的第三种可能的实现方式中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动 用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
结合第十方面，或者第十方面的第一种可能的实现方式，或者第十方面的第二种可能的实现方式，或者第十方面的第三种可能的实现方式，在第十方面的第四种可能的实现方式中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
第十一方面，本发明实施例提供一种用户设备，该用户设备包括处理器和存储器，该存储器用于存储程序和数据，该处理器调用该存储器中的程序，用于执行第七方面或者第七方面的任意可能实现方式所描述的数据传输方法。
第十二方面，本发明实施例提供一种接入网设备，该接入网设备包括处理器和存储器，该存储器用于存储程序和数据，该处理器调用该存储器中的程序，用于执行第八方面或者第八方面的任意可能实现方式所描述的数据传输方法。
第十三方面，本发明实施例提供一种用户设备，该用户设备包括处理器和存储器，该存储器用于存储程序和数据，该处理器调用该存储器中的程序，用于执行第九方面或者第九方面的任意可能实现方式所描述的数据传输方法。
第十四方面，本发明实施例提供一种接入网设备，该接入网设备包括处理器和存储器，该存储器用于存储程序和数据，该处理器调用该存储器中的程序，用于执行第十方面或者第十方面的任意可能实现方式所描述的数据传输方法。
第十五方面，本发明实施例提供一种存储介质，该存储介质用于存储指令，该指令在处理器上执行是使得第七方面，或者第七方面的任意可能实现方式，或者第八方面，或者第八方面的任意可能实现方式，或者第九方面，或者第九方面的任意可能实现方式，或者第十方面，或者第十方面的任意可能实现方式所描述的方法得以实现。
通过实施本发明实施例，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
附图说明
下面将对背景技术或者实施例所需要使用的附图作简单地介绍。
图1是现有技术中的端到端地保护机制的流程示意图；
图2是本发明实施例提供的一种通信系统的结构示意图；
图3是本发明实施例提供的一种数据传输方法的流程示意图；
图4是本发明实施例提供的一种分类传输模式下的数据格式的示意图；
图5是本发明实施例提供的又一种分类传输模式下的数据格式的示意图；
图6是本发明实施例提供的又一种分类传输模式下的数据格式的示意图；
图7是本发明实施例提供的又一种分类传输模式下的数据格式的示意图；
图8是本发明实施例提供的又一种数据传输方法的流程示意图；
图9是本发明实施例提供的又一种数据传输方法的流程示意图；
图10是本发明实施例提供的又一种数据传输方法的流程示意图；
图11是本发明实施例提供的又一种数据传输方法的流程示意图；
图12是本发明实施例提供的一种用户设备的结构示意图；
图13是本发明实施例提供的一种接入网设备的结构示意图；
图14是本发明实施例提供的又一种用户设备的结构示意图；
图15是本发明实施例提供的又一种接入网设备的结构示意图；
图16是本发明实施例提供的又一种用户设备的结构示意图；
图17是本发明实施例提供的又一种接入网设备的结构示意图；
图18是本发明实施例提供的又一种用户设备的结构示意图；
图19是本发明实施例提供的又一种接入网设备的结构示意图。
具体实施方式
下面将结合本发明实施例中的附图对本发明实施例中的技术方案进行描述。
在端到端地保护机制通常有该UE与核心网中的设备(例如，用户面网关)之间的端到端保护，UE与Internet服务器之间的端到端保护，还有UE与网络中的其他设备之间的端到端保护，与UE之间按照端到端地保护机制进行数据保护进行保护的节点可以称为目标节点，也即是说，该目标节点可以为核心网中的用户面网关、核心网中的业务服务器(service server或者application server)、互联网中与该核心网中的设备建立了通信连接的服务器(通常被称作Internet服务器，包括，互联网中的网关控制器)等等，本发明实施例重点以UE与核心网中的用户面网关之间的端到端保护机制为例来进行介绍，若该UE与该用户面网关之间执行端到端地保护，那么，该UE与该用户面网关会协商好通过什么方案来保护业务数据(例如，有些场景中该业务数据封装在协议数据单元载荷(PDU payload)中)的传输，该UE与该用户面网关之间的节点则无法获知该UE与该用户面网关之间如何保护该业务数据，然而，在传输该业务数据的过程中还涉及一些其他信息的传输，这些信息往往不方便由该UE和该用户面网进行端到端地保护，例如，协议数据单元头(PDU header)；本发明实施例将重点讲述如何保护端到端地保护业务数据时未被保护的其他信息。
请参见图2，图2是本发明实施例提供的一种通信系统20的架构示意图，该架构图中包含用户设备(UE)201、接入网设备(AN)202和核心网(CN)中的设备，在实际应用中该通信系统20还可以包含其他设备。
该UE可以为手机、智能手表等智能终端，还可以为服务器、网关、基站、控制器等通信设备，还可以为传感器、电表、水表等物联网(英文：Internet of thing，简称：IoT)设备，还可以为其他能够接入到蜂窝网或者有线网的设备。
接入网设备202可以是通过无线方式与用户设备201进行通信的设备，例如：基站(英文：NodeB，简称：NB)、eNB、无线保真(英文：Wireless Fidelity，简称：WiFi)中的无线接入点、未来5G网络中的无线接入网设备等等；同时，接入网设备202也可以是通过有线方式与用户设备201进行通信的设备，例如：网关，服务器，控制网关等等。有线的传输方式包括但不限于：基于因特网协议(英文：Internet Protocol，简称：IP)、基于内容的网络、基于身份的网络等等。以下实施例以UE采用无线方式接入网络为例来描述，UE与 AN的无线传输阶段为空口段，本发明实施例将重点讲述如何保护空口段的数据的安全传输。
CN中可能存在的设备(或称“网元”)有很多，例如，移动性管理(英文：Mobility Management，简称：MM)网元、会话管理(英文：Session Management，简称：SM)网元、密钥管理中心(英文：Key Management System，简称：KMS)网元、控制面认证单元(英文：Control Plane-Authentication Unit，简称：CP-AU)网元、用户面网关(英文：User Plane-Gateway，UP-GW)等等。其中，MM网元可以称作移动性管理设备或者MM。SM网元可以称作会话管理设备或者SM，用于执行会话、切片、流flow或者承载bearer的建立和管理。KMS网元可以称作密钥管理设备或者KMS，负责密钥的生成、管理和协商，支持合法监听。KMS可以作为一个独立的逻辑功能实体单独部署，也可以集合在MM、SM、移动管理实体(英文：Mobility Management Entity，简称：MME)、认证服务器功能实体(英文：Authentication Server Function简称：AUSF)、安全锚点函数网元(英文：Security Anchor Function简称：SEAF)、安全上行文管理网元(英文：Security Context Management Function简称：SCMF)、引导服务器功能网元(英文：Bootstrapping Server Function简称：BSF)、呼叫会话控制功能实体(英文：Call Session Control Function简称：CSCF)等网元中，通常情况下，该KMS为网络中的认证单元(英文：Control Plane-Authentication Unit，简称：CP-AU)。UP-GW用于连接运营商网络和数据网络(英文：Data Network，DN)，UE通过该UP-GW接入到互联网。
请参见图3，图3是本发明实施例提供的一种数据传输方法的流程示意图，该方法可基于图2所示的通信系统20来实现，具体流程包括但不限于如下步骤。
步骤S301：UE与CN中管理密钥的设备进行双向认证。
具体地，CN中管理密钥的设备通常为CP-AU，当然也不排除该管理密钥的功能集成到了其他网元，UE与管理密钥的设备双向认证成功后会生成共享密钥。
步骤S302：CN中管理密钥的设备向AN发送基础密钥。
具体地，该基础密钥可以存在如下两种情况：情况一，该基础密钥为该UE与管理密钥的设备双向认证生成的密钥；情况二，该基础密钥为基于该双向认证生成的密钥经过一次推衍或者多次推衍得到的密钥，推衍的规则在通信协议中可以预先定义好，该UE与该管理密钥的设备均可以基于该通信协议中定义的规则推衍出该基础密钥。
步骤S303：AN接收该基础密钥。
步骤S304：AN按照预设规则处理该基础密钥以生成空口保护密钥。
具体地，该预设规则定义了生成密钥的规则，在一种可选的方案中，该预设规则可以定义密钥算法、密钥长度、密钥更新周期等信息，例如，常用的密钥算法有null、Snow 3G、ZUC、AES等，常用密钥长度为64bit、128bit、256bit等，常用的密钥更新时间有6小时、12小时、1天、2天等。该预设规则可以是预先配置在协议中的，也可以是根据实时的信息计算得到。在又一种可选的方案中，该预定规则可以参照第四代移动通信技术(英文：the 4th Generation mobile communication，简称：4G)中空口传输中用到的密钥的生成方式，AN根据基站的安全算法优先级列表和UE支持的安全算法列表，确定AN的空口加密的算法，以及完整性保护算法；AN根据空口加密的算法的标识和基础密钥来生成空口加密保护密钥；AN在根据完整性保护算法的标识和基础密钥生成空口完整性保护密钥，该空口加密 保护密钥和该空口完整性保护密钥均属于此处的空口保护密钥，该空口加密的算法，以及完整保护算法的协商可以包含多种方式，例如，可以与4G的算法协商方式相同，或者根据建立会话时生成的策略确定保护算法。在又一种可选的方案中，AN根据基础密钥推衍出空口保护密钥，推衍中还可能用到其他参数，例如，AN的设备标识，小区无线网络临时标识(英文：Cell Radio Network Temporary Identifier，简称：C-RNTI)，序列号(英文：sequence number，简称：SN)，UE的身份标识等等。
步骤S305：UE按照预设规则处理该基础密钥以生成空口保护密钥。
具体地，该UE采用与该AN相同的方式生成该空口保护密钥。
步骤S306：UE通过该空口保护密钥保护上行协议数据单元中的目标字段。
具体地，本发明实施例采用基于对称密钥的密码技术来保护协议数据单元，保护的方式包括加密保护和完整性保护中至少一项，基于对称密钥的密码技术要求通信的双方之间提前共享用来进行保护的共享密钥K，下面以通信双方为USER1(用户1)与USER2(用户2)为例讲述加密保护和完整性保护的原理。
加密保护：USER1与USER2之间共享密钥K，User1使用共享密钥K对消息m进行加密，可表示为ciphtext＝En_K_(m)；然后发送给USER2。USER2可以利用共享密钥K和ciphertext恢复出m，可表示为m＝decrypt(K,ciphtext)。加密保护可选用的算法有高级加密标准(英语：Advanced Encryption Standard，缩写：AES)，三重数据加密算法(英文：Triple Data Encryption Algorithm，简称：TDEA，也称3DES)，Blowfish，Serpent，Snow 3G，ZUC，HC-256，Grain等。
完整性保护：USER1与USER2之间共享密钥K，USER1利用共享密钥K计算消息m的消息认证码(英文：message Authentication code，简称：MAC)，可表示为MAC1＝MAC_K_(m)，即使用共享密钥K计算出消息m对应的消息认证码MAC1。然后USER1将该消息认证码MAC1和消息m发送给该USER2，USER2接收该MAC1和消息吗，然后利用共享密钥K和消息m验证此MAC1的正确性，验证正确后说明此消息未被篡改。完整性保护用到的算法可以有哈希运算消息认证码(英文：Hash-based Message Authentication Code，简称：HMAC)算法(如HMAC-sha256)，一密消息验证码(英文：one-key MAC,简称：OMAC)，分组加密链的消息验证码(英文：cipher block chaining message authentication code，简称：CBC-MAC)，可平行的消息验证码(英文：Parallelizable MAC,简称：PMAC)，通用哈希的消息验证码(英文：message authentication code based on universal hashing,简称：UMAC)等。如果保护的方式包括加密保护则后续解析的方式包括解密，如果保护的方式包括完整性保护则后续解析的方式保护验证完整性。
本发明实施例中的UE与AN的关系相当于USER1与USER2的关系，该空口保护密钥即相当于上述“共享密钥K”。
该目标字段包含用于标识该UE与该核心网中的用户面网关之间的会话的参考标识，该参考标识通常在外部IP头(outer IP header)字段、封装头(encapsulation header)字段和协议数据单元头(PDU header)字段等字段中，该参考标识通常为承载标识(bearer ID)，流标识(flow ID)，硬件的媒体接入控制(英文：Media Access Control，简称：MAC)标识，会话标识、该UE的互联网协议(英文：Internet Protocol，简称：IP)地址、该接入网设 备的IP地址、该接入网的接入网标识、端到端通信另一方的标识、端到端通信另一方的IP地址、服务质量(英文：Quality of Service，简称：QoS)标识、国际移动用户标识(英文：International Mobile Subscriber Identity，简称：IMSI)、国际移动设备标识(英文：International Mobile Equipment Identity，简称：IMEI)、互联网协议(英文：Internet Protocol，简称：IP)多媒体私有标识(英文：IP Multimedia Private Identity，简称：IMPI)、IP多媒体公有标识(英文：IP Multimedia Public Identity，简称：IMPU)、临时移动用户标识(英文：Temporary Mobile Subscriber Identity，简称：TMSI)、手机号码、全球唯一临时UE标识(英文：Globally Unique Temporary UE Identity，简称：GUTI)等。在不同的会话数据传输模式下，用于标识该UE与该核心网中的用户面网关之间的会话的信息所在的字段可能不同，以下例举几种会话数据传输模式。模式一：如图4，会话基于服务质量类(QoS class)进行的分类传输，协议数据单元(英文：Protocol data unit，简称：PDU)包括L1/L2头(L1/L2header)字段、外部IP头(Outer IP header)字段、封装头(Encapsulation header)字段、协议数据单元头(PDU header)字段和协议数据单元载荷(PDU payload)字段，协议数据单元属于哪个会话由Outer IP header字段和Encapsulation header字段共同表明，即该参考标识在Outer IP header字段和Encapsulation header字段中。模式二：如图5，会话基于协议数据单元会话(PDU session)进行的分类传输，协议数据单元包括L1/L2header字段、Outer IP header字段、Encapsulation header字段、PDU header字段和PDU payload字段，协议数据单元属于哪个会话由Encapsulation header字段来表示，即该参考标识在Encapsulation header字段中。模式三：如图6，会话基于独立节点层的会话(Per Node-level tunnel)进行分类传输，协议数据单元包括L1/L2header字段、Outer IP header字段、Encapsulation header字段、PDU header字段和PDU payload字段，协议数据单元属于哪个会话由PDU header字段来区分，即该参考标识在PDU header中。模式四：如图7，会话基于软件定义网络的方法(SDN-based Approach)进行分类传输，协议数据单元包括L1/L2header字段、PDU header字段和PDU payload字段，协议数据单元属于哪个会话由PDU header字段来区分，即该参考标识在PDU header中。
该目标字段可以包括outer IP header字段、encapsulation header字段和PDUheader字段中至少一项，例如，若基于字段Encapsulation header中的信息可以区分不同会话，则通过该空口保护密钥对字段Encapsulation header进行保护。若基于字段PDU header中的信息可以区分不同会话，则通过空口保护密钥对字段PDU header进行保护。若基于字段Encapsulation header和字段PDU header中的信息才可以区分不同会话，则通过空口保护密钥对字段Encapsulation header和字段PDU header进行保护。通常情况下，标准中会预先定义好保护哪部分字段。
步骤S307：UE将该目标字段被保护的该上行协议数据单元发送给该AN。
步骤S308：AN接收该目标字段被保护的该上行协议数据单元并通过该空口保护密钥解析该上行协议数据单元中的目标信息。
具体地，若上述UE的保护上行协议数据单元的过程包括加密保护，那么此处的解析相应包含解密的操作；若上述UE的保护上行协议数据单元的过包括完整性保护，那么此处的解析相应包含验证消息认证码的正确性的操作；不管是解密的操作还是验证消息认证 码的正确性的操作均可以参照上面对加密保护技术和完整性保护技术的相关介绍，该AN解析出该上行报文的目标字段中的信息后，对该上行协议数据单元重新组包并发送到核心网。
步骤S309：AN通过该空口保护密钥保护该下行协议数据单元中的目标信息。
具体地，步骤S309的原理可以参照步骤S306的相关描述。
步骤S310：AN将该目标字段被保护的该下行协议数据单元发送给该UE。
步骤S311：UE接收目标字段被保护的该下行协议数据单元并通过该空口保护密钥解析下行协议数据单元中的目标字段。
具体地，步骤S311的原理可以参照步骤S308的相关描述。
需要说明的是，步骤S301～S311基本可以按照描述的顺序来执行，但是某些步骤的位置调整之后并不影响方案的执行，例如，步骤S309～S311可以同步移到步骤S305之后和步骤S306之前，总而言之，若部分步骤的顺序调整后方案不存在逻辑问题，则步骤调整后形成的方案同样属于本发明实施例的方案。
本领域的技术人员比较倾向于在在建立会话的时候建立初始会话安全策略与该会话对应，下面在步骤S301～S311所描述的实施例框架下，结合该初始安全策略描述几个更具体的实施例，包括图8、图9和图10所示的实施例。
请参见图8，图8是本发明实施例提供的一种数据传输方法的流程示意图，该UE不管该上行协议数据单元中的payload字段是否已被保护，直接通过该空口保护密钥保护上行协议数据单元中的目标字段。相应地，该AN不管下行协议数据单元中的payload字段是否已被保护，直接通过该空口保护密钥保护下行协议数据单元中的目标字段。以图8为例，该方法包括但不限于如下步骤。
步骤S801：UE与CP-AU进行双向认证，该CP-AU会将双向认证得到的密钥K0发送给该KMS由该KMS对该K0进行管理，也可能该KMS的功能集成在该CP-AU中，这时CP-AU就不需要将K0发送给KMS。K0也可以为认证成功后直接得到的密钥，也可以为根据该直接得到的密钥经过一次推衍或多次推衍得到的密钥。
步骤S802：KMS将基础密钥K_AN发送给该AN，也可能该KMS预先将该基础K_AN发送给了MM，该MM后续将该基础密钥K_AN发送给AN，该K_AN可能为该K0，也可能为基于该K0一次推衍或者多次推衍得到的密钥。
步骤S803：AN根据预设规则对该K_AN进行推衍得到空口保护密钥(例如，加密密钥K_Anec、完整性保护密钥K_ANint)。
步骤S804：UE同样根据预设规则对该K_AN进行推衍得到空口保护密钥，当该K_AN为基于该K0推衍得到的密钥时，该UE推衍K_AN的方式与该KMS推衍K_AN的方式相同。
步骤S805：UE向发送会话建立请求，相应地，该核心网中的网元会进行一系列的协商，协商的过程中会产生该会话的会话标识(session ID)、与该会话关联的初始安全策略、按照该初始安全策略定义的规则生成的会话密钥(K_session)，该初始安全策略定义了该会话中用到的一些密钥的生成规则。该核心网中的UP-GW会获得该会话标识、初始安全策略和会话密钥等信息。
步骤S806：AN接收该核心网中的SM发送的该会话标识和初始安全策略。
步骤S807：AN向该UE发送该会话标识和该初始安全策略。
步骤S808：UE接收该会话标识和该初始安全策略，该UE与该UP-GW之间的会话建立成功，该UE与该UP-GW之间建立的会话可以称为目标会话。
步骤S805-S808中除建立目标会话外，其他的信息和操作均为可选。
步骤S809：UE生成该目标会话的上行协议数据单元，生成该上行协议数据单元的过程中会通过该空口保护密钥对目标字段进行保护，该目标字段包括outer IP header字段、encapsulation header字段和PDU header字段中至少一项，保护包括加密保护和完整性保护中至少一种。
步骤S810：UE通过空口传输技术将保护了目标字段的上行协议数据单元发送给AN。
步骤S811：AN通过该空口保护密钥解析出该上行协议数据单元中的目标字段的信息。例如，AN利用加密密钥解密被加密保护的目标字段；再如，AN先利用完整性保护密钥验证被加密的目标字段的完整性，再通过空口加密解密被加密的目标字段；再如，AN先解密被加密的目标字段，再通过完整性保护密钥验证并得到该目标字段。该AN可以将解析出的信息与其他字段的信息组成完整的协议数据单元，并发送到核心网。
可选的，该AN可以预先为该UE分配对应空口标识并将该空口标识发送给该UE，如果后续有设备向该AN发送上行协议数据单元时也发送了该UE对应的空口标识则表明发送该上行协议数据单元的设备为该UE。该AN可能生成了多个分别与不同设备对应的空口保护密钥，该UE对应的空口保护密钥用于对该UE发送来的上行协议数据单元中的数据进行保护，其他设备(或称其他UE)对应的空口保护密钥用于对于其他设备发送的上行协议数据单元中的数据进行保护。该AN从在接收到上行协议数据单元时若同时获取了该UE对应的空口标识即可从多个设备对应的空口保护密钥中确定该UE对应的空口保护密钥来对与该UE上行协议数据单元进行保护。该空口标识可以为小区无线网络临时标识(英文：Cell Radio Network Temporary Identifier，简称：C-RNTI)，载频频点(例如4G的载频频点表示为，英文：E-UTRA Absolute Radio Frequency Channel Number，简称：EARFCN)等。
可选的，该AN可以为该UE分配对应的空口传输方式，并向该UE发送指示信息以告知该UE对应什么样的空口传输方式，该AN也可能为其他设备分配了空口传输方式，如果该AN接收到的上行协议数据单元的空口传输方式为该UE对应的空口传输方式，则认为该上行协议数据单元由该UE发送，因此从预先生成的多个空口保护密钥(该多个空口保护密钥分别对应一个设备)中选择该UE对应的空口保护密钥对该上行协议数据单元进行保护，该空口传输方式包括码分多址(英文：Code Division Multiple Access，简称：CDMA)技术中每个用户设备对应的码字，或者UE在空口发送数据的调制方式等等。
步骤S812：AN生成目标会话的下行协议数据单元，生成该下行协议数据单元的过程中会通过该空口保护密钥对该目标字段进行保护，该目标字段包括outer IP header字段、encapsulation header字段和PDU header字段中至少一项，保护包括加密保护和完整性保护中至少一种。
步骤S813：AN将保护了目标字段的下行协议数据单元发送给UE。
步骤S814：UE通过空口保护密钥解析出该下行协议数据单元中的目标字段的信息。
可选的，空口保护密钥的生成可以在会话建立之后再执行，可选的，采用4G中的空口保护算法的协商机制来确定保护算法和该空口保护密钥。
请参见图9，图9是本发明实施例提供的一种数据传输方法的流程示意图，该UE会预先判断该上行协议数据单元中的payload字段是否已被保护；若否，则该UE通过该空口保护密钥保护该上行协议数据单元；若是，该UE才执行该通过该空口保护密钥保护上行协议数据单元中的目标字段的操作。相应地，该接入网设备也会预先判断该下行协议数据单元中的payload字段是否已被保护；若否，则该接入网设备用于通过该空口保护密钥保护该下行协议数据单元；若是，该接入网设备执行该通过该空口保护密钥保护该下行协议数据单元中的目标信息的操作。以图9为例，该方法包括但不限于如下步骤。
步骤S901：UE与CP-AU进行双向认证，该CP-AU会将双向认证得到的密钥K0发送给该KMS由该KMS对该K0进行管理，也可能该KMS的功能集成在该CP-AU中，这时CP-AU就不需要将K0发送给KMS。K0也可以为认证成功后直接得到的密钥，也可以为根据该直接得到的密钥经过一次推衍或多次推衍得到的密钥。
步骤S902：KMS将基础密钥K_AN发送给该AN，也可能该KMS预先将该基础K_AN发送给了MM，该MM后续将该基础密钥K_AN发送给AN，该K_AN可能为该K0，也可能为基于该K0一次推衍或者多次推衍得到的密钥。
步骤S903：AN根据预设规则对该K_AN进行推衍得到空口保护密钥(例如，加密密钥K_Anec、完整性保护密钥K_ANint)。
步骤S904：UE同样根据预设规则对该K_AN进行推衍得到空口保护密钥，当该K_AN为基于该K0推衍得到的密钥时，该UE推衍K_AN的方式与该KMS推衍K_AN的方式相同。
步骤S905：UE向发送会话建立请求，相应地，该核心网中的网元会进行一系列的协商，协商的过程中会产生该会话的会话标识(session ID)、与该会话关联的初始安全策略、按照该初始安全策略定义的规则生成的会话密钥(K_session)，该初始安全策略定义了该会话中用到的一些密钥的生成规则。该核心网中的UP-GW会获得该会话标识、初始安全策略和会话密钥等信息。
步骤S906：AN接收该核心网中的SM发送的该会话标识和初始安全策略。
步骤S907：AN向该UE发送该会话标识和该初始安全策略。
步骤S908：UE接收该会话标识和该初始安全策略，该UE与该UP-GW之间的会话建立成功，该UE与该UP-GW之间建立的会话可以称为目标会话。
步骤S905-S908中除建立目标会话外，其他的信息和操作均为可选。
步骤S909：UE生成该目标会话的上行协议数据单元，生成该上行协议数据单元的过程中会判断该上行协议数据单元中的payload字段是否已被保护，一种方案中，UE根据目标会话确定该目标会话对应的初始安全策略；然后根据该初始安全策略即可确定该payload字段是否经过了按照该初始安全策略定义的规则进行了保护。又一种方案中，UE可以直接根据该上行协议数据单元的数据格式确定该payload字段是否被加密过，payload字段被密钥保护过和未保护过这两种情况下的上行协议数据单元格式不同。
若未被保护，则该UE通过该空口保护密钥保护该完整的上行协议数据单元；然后将该完整的上行协议数据单元发送给AN，相应地，该AN通过该空口保护密钥解析被加密的上行协议数据单元以得到该上行协议数据单元中的信息。
若已被保护，则UE通过该空口保护密钥对目标字段进行保护并执行后续的步骤S910～S911，目标字段包括outer IP header字段、encapsulation header字段和PDUheader字段中至少一项，保护包括加密保护和完整性保护中至少一种。
步骤S910：UE通过空口传输技术将保护了目标字段的上行协议数据单元发送给AN。
步骤S911：AN通过该空口保护密钥解析出该上行协议数据单元中的目标字段的信息。例如，AN利用加密密钥解密被加密保护的目标字段；再如，AN先利用完整性保护密钥验证被加密的目标字段的完整性，再通过空口加密密钥解密被加密的目标字段；再如，AN先解密被加密的目标字段，再通过完整性保护密钥验证并得到该目标字段。该AN可以将解析出的信息与其他字段的信息组成完整的协议数据单元，并发送到核心网。
可选的，该AN可以预先为该UE分配对应空口标识并将该空口标识发送给该UE，如果后续有设备向该AN发送上行协议数据单元时也发送了该UE对应的空口标识则表明发送该上行协议数据单元的设备为该UE。该AN可能生成了多个分别与不同设备对应的空口保护密钥，该UE对应的空口保护密钥用于对该UE发送来的上行协议数据单元中的数据进行保护，其他设备(或称其他UE)对应的空口保护密钥用于对于其他设备发送的上行协议数据单元中的数据进行保护。该AN从在接收到上行协议数据单元时若同时获取了该UE对应的空口标识即可从多个设备对应的空口保护密钥中确定该UE对应的空口保护密钥来对与该UE上行协议数据单元进行保护。该空口标识可以为小区无线网络临时标识(英文：Cell Radio Network Temporary Identifier，简称：C-RNTI)，载频频点(例如4G的载频频点表示为，英文：E-UTRA Absolute Radio Frequency Channel Number，简称：EARFCN)等。
可选的，该AN可以为该UE分配对应的空口传输方式，并向该UE发送指示信息以告知该UE对应什么样的空口传输方式，该AN也可能为其他设备分配了空口传输方式，如果该AN接收到的上行协议数据单元的空口传输方式为该UE对应的空口传输方式，则认为该上行协议数据单元由该UE发送，因此从预先生成的多个空口保护密钥(该多个空口保护密钥分别对应一个设备)中选择该UE对应的空口保护密钥对该上行协议数据单元进行保护，该空口传输方式包括CDMA技术中每个用户设备对应的码字，或者UE在空口发送数据的调制方式等等。
步骤S912：AN生成目标会话的下行协议数据单元，生成该下行协议数据单元的过程中会判断该下行协议数据单元中的payload字段是否已被保护，一种方案中，AN根据目标会话确定该目标会话对应的初始安全策略；然后根据该初始安全策略即可验证该payload字段是否经过了按照该初始安全策略定义的规则生成的密钥保护。又一种方案中，AN可以直接根据该下行协议数据单元的数据格式确定该payload字段是否被加密过，payload字段被密钥保护过和未保护过这两种情况下的下行协议数据单元格式不同。
若未被保护，则AN通过该空口保护密钥保护该下行协议数据单元；然后将该完整的上行协议数据单元发送给UE，相应地，该UE通过该空口保护密钥解析被加密的上行协议数据单元以得到该下行协议数据单元中的信息。
若已被保护，则AN通过该空口保护密钥对该目标字段进行保护以及执行后续的步骤S913和S914，该目标字段包括outer IP header字段、encapsulation header字段和PDUheader字段中至少一项，包括保护包括加密保护和完整性保护中至少一种。
步骤S913：AN将保护了目标字段的下行协议数据单元发送给UE。
步骤S914：UE通过空口保护密钥解析出下行协议数据单元中的目标字段的信息。
可选的，空口保护密钥的生成可以在会话建立之后再执行，可选的，采用4G中的空口保护算法的协商机制来确定保护算法和该空口保护密钥。
请参见图10，图10是本发明实施例提供的一种数据传输方法的流程示意图，该UE和该AN在通过空口保护密钥保护协议数据单元和解析协议数据单元时需要遵循相应的规则，该规则可以称为空口策略。可以理解的是，当按照空口策略定义的规则保护协议数据单元时，在解析该被保护的协议数据单元时需要参照该空口策略进行反向的操作才能解析成功。也即是说，该AN通过该空口保护密钥保护该下行协议数据单元中的目标信息，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该空口策略定义了数据保护的规则。该UE通过该空口保护密钥解析下行协议数据单元中的目标字段，具体为：按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的目标字段。该UE通过该空口保护密钥保护上行协议数据单元中的目标字段，具体为：按照该空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段。该AN通过该空口保护密钥解析该上行协议数据单元中的目标信息，具体为：按照该空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的目标信息。
在第一种情况中，该AN用于接收来自核心网的初始安全策略，该AN根据该初始安全策略生成空口策略；该AN向该UE发送该空口策略；该UE接收该空口策略，从而确保该AN和该UE均具有该空口策略。在第二种情况中，该UE用于接收来自核心网的初始安全策略，该UE根据该初始安全策略生成空口策略；该UE向该AN发送该空口策略；该AN接收该空口策略，从而确保该AN和该UE均具有该空口策略。在第三种情况中，该AN接收来自核心网的初始安全策略并向该UE转发该初始安全策略，然后该UE和该AN各自根据该初始安全策略生成该空口策略，从而确保该UE和该AN都具有该空口策略。
需要说明的是，每个网元都可能具有自身的安全需求，该安全需求表征了该网元可以接受的密钥算法有哪些、可以接受的密钥长度有哪些，可以接受的密钥更新周期是哪些等等，该初始安全策略即为核心网根据相关网元的安全需求得到的能够满足该相关网元中各个网元所要求的密钥算法、密钥长度、密钥更新周期的方案，该相关网元(例如，密钥管理网元、移动性管理网元等)具体指该UE在网络中传输数据时所涉及到的至少一个网元。该初始安全策略定义了目标会话中用到的密钥的生成规则，以及目标会话的保护方式，该目标会话为该UE双向认证成功后与该用户面网关之间的会话。该空口策略为根据参照初始安全策略生成的，参照的方式可以为沿用该初始安全策略中的某个参数(例如，密钥算法)，也可以为对该初始安全策略中的某个参数进行调整得到该空口策略中的参数，还可以为其他方式，总而言之，得到该空口策略用到了该初始安全策略中的信息。以图10为例， 该方法包括但不限于如下步骤。
步骤S1001：UE与CP-AU进行双向认证，该CP-AU会将双向认证得到的密钥K0发送给该KMS由该KMS对该K0进行管理，也可能该KMS的功能集成在该CP-AU中，这时CP-AU就不需要将K0发送给KMS。K0也可以为认证成功后直接得到的密钥，也可以为根据该直接得到的密钥经过一次推衍或多次推衍得到的密钥。
步骤S1002：KMS将基础密钥K_AN发送给该AN，也可能该KMS预先将该基础K_AN发送给了MM，该MM后续将该基础密钥K_AN发送给AN，该K_AN可能为该K0，也可能为基于该K0一次推衍或多次推衍得到的密钥。
步骤S1003：AN根据预设规则对该K_AN进行推衍得到空口保护密钥(例如，加密密钥K_Anec、完整性保护密钥K_ANint)。
步骤S1004：UE同样根据预设规则对该K_AN进行推衍得到空口保护密钥，当该K_AN为基于该K0推衍得到的密钥时，该UE推衍K_AN的方式与该KMS推衍K_AN的方式相同。
步骤S1005：UE向发送会话建立请求，相应地，该核心网中的网元会进行一系列的协商，协商的过程中会产生该会话的会话标识(session ID)、与该会话关联的初始安全策略、按照该初始安全策略定义的规则生成的会话密钥(K_session)，该初始安全策略定义了该会话中用到的一些密钥的生成规则。该核心网中的UP-GW会获得该会话标识、初始安全策略和会话密钥等信息。
步骤S1006：AN接收该核心网中的SM发送的该会话标识和初始安全策略；然后根据该初始安全策略生成空口策略。
步骤S1007：AN向该UE发送该会话标识、该初始安全策略和该空口策略。
步骤S1008：UE接收该会话标识、空口策略和该初始安全策略，该UE与该UP-GW之间的会话建立成功，该UE与该UP-GW之间建立的会话可以称为目标会话。
步骤S1009：UE生成该目标会话的上行协议数据单元，生成该上行协议数据单元的过程中会参照该空口策略定义的规则使用该空口保护密钥对目标字段进行保护，该目标字段包括outer IP header字段、encapsulation header字段和PDU header字段中至少一项，保护包括加密保护和完整性保护中至少一种。
步骤S1010：UE通过空口传输技术将保护了目标字段的上行协议数据单元发送给AN。
步骤S1011：AN参照该空口策略定义的规则使用该空口保护密钥解析出该上行协议数据单元中的目标字段的信息。例如，AN利用加密密钥解密被加密保护的目标字段；再如，AN先利用完整性保护密钥验证被加密的目标字段的完整性，再通过空口加密解密被加密的目标字段；再如，AN先解密被加密的目标字段，再通过完整性保护密钥验证并得到该目标字段。该AN可以将解析出的信息与其他字段的信息组成完整的协议数据单元，并发送到核心网。
可选的，该AN可以预先为该UE分配对应空口标识并将该空口标识发送给该UE，如果后续有设备向该AN发送上行协议数据单元时也发送了该UE对应的空口标识则表明发送该上行协议数据单元的设备为该UE。该AN可能生成了多个分别与不同设备对应的空口保护密钥，该UE对应的空口保护密钥用于对该UE发送来的上行协议数据单元中的数据进 行保护，其他设备(或称其他UE)对应的空口保护密钥用于对于其他设备发送的上行协议数据单元中的数据进行保护。该AN从在接收到上行协议数据单元时若同时获取了该UE对应的空口标识即可从多个设备对应的空口保护密钥中确定该UE对应的空口保护密钥来对与该UE上行协议数据单元进行保护。该空口标识可以为小区无线网络临时标识(英文：Cell Radio Network Temporary Identifier，简称：C-RNTI)，载频频点(例如4G的载频频点表示为，英文：E-UTRA Absolute Radio Frequency Channel Number，简称：EARFCN)等。
可选的，该AN可以为该UE分配对应的空口传输方式，并向该UE发送指示信息以告知该UE对应什么样的空口传输方式，该AN也可能为其他设备分配了空口传输方式，如果该AN接收到的上行协议数据单元的空口传输方式为该UE对应的空口传输方式，则认为该上行协议数据单元由该UE发送，因此从预先生成的多个空口保护密钥(该多个空口保护密钥分别对应一个设备)中选择该UE对应的空口保护密钥对该上行协议数据单元进行保护，该空口传输方式包括CDMA技术中每个用户设备对应的码字，或者UE在空口发送数据的调制方式等等。
步骤S1012：AN生成目标会话的下行协议数据单元，生成该下行协议数据单元的过程中会参照该空口策略定义的规则使用该空口保护密钥对该目标字段进行保护，该目标字段包括outer IP header字段、encapsulation header字段和PDU header字段中至少一项，保护包括加密保护和完整性保护中至少一种。
步骤S1013：AN将保护了目标字段的下行协议数据单元发送给UE。
步骤S1014：UE参照该空口策略定义的规则使用空口保护密钥解析出下行协议数据单元中的目标字段的信息。
需要说明的是，该空口策略还可能定义了协议数据单元(包括上行协议数据单元和下行协议数据单元)中哪部分的内容需要保护，定义的方案可能为：
第一种：判断payload字段是否已被保护，若Payload未被保护则对整个协议数据单元进行保护；若Payload字段已被保护，执行保护上述目标字段的操作；
第二种：不管Payload字段是否已被保护，均执行保护上述目标字段的操作。
在一种可选的方案中，空口保护密钥的生成可以在会话建立之后再执行。可选的，采用4G中的空口保护算法的协商机制来确定保护算法和该空口保护密钥，或者基于初始安全策略确定空口策略，再根据空口策略中定义的安全算法标识生成空口保护密钥；或者基于初始安全策略确定空口策略，基于基础密钥生成空口保护密钥。
在图3所描述的方法中，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
请参见图11，图11是本发明实施例提供的又一种数据传输方法的流程示意图，该方法可以基于图3该的通信系统30来实现，包含的流程如下。
步骤S1101：UE与CN中管理密钥的设备进行双向认证，双向认证成功后该UE与核 CN中的用户面网关UP-GW建立会话，可以称该会话为目标会话。建立该目标会话的过程中，该核心网中的网元会进行一系列的协商，协商的过程中会产生该目标会话的会话标识(session ID)、与该会话关联的初始安全策略(可选)、按照该初始安全策略定义的规则生成的会话密钥(K_session)，当然，如果不存在该初始安全策略则该会话密钥可以通过其他规则来生成，该初始安全策略定义了该会话中用到的一些密钥的生成规则。该核心网中的UP-GW会获得该会话标识、初始安全策略(可选)和会话密钥等信息。该CN中的网元还会将该目标会话的会话标识(session ID)发送给该UE，CN中的网元向该UE发送该会话标识的过程中该会话标识会经过AN，该AN会根据该会话标识确定该目标会话。
步骤S1102：该AN生成与目标会话对应的目标标识。
具体地，生成该目标标识的规则此处不作限定，能够用于该AN与该UE二者唯一对应到该目标会话即可，该目标标识不要求体现该UE和该UP-GW的地址(如，IP地址、MAC地址等)等信息，也即是说，除该AN和该UE之外的其他设备在没有与该AN(或该UE)协商的前提下，如果截取了该目标标识也不会知道该目标标识与该目标会话有对应关系，因此，不可能通过该目标标识确定该目标会话。该目标标识可以为随机生成的随机数，也可以采用一些已有标识，例如，C-RNTI，或者载频频点(例如4G的载频频点表示为，英文：E-UTRA Absolute Radio Frequency Channel Number，简称：EARFCN)等标识。
步骤S1103：该AN向该UE发送对应关系信息，AN可以通过CN向UE发送会话标识的信令中或者此信令之后，将目标标识发送至UE；在也可能AN发送目标标识和会话标识一起至UE，以使UE确定对应关系。
具体地，该对应关系信息指示了该目标会话与该目标标识的对应关系。
步骤S1104：该UE接收该对应关系信息并根据该对应关系信息确定该目标会话对应该目标标识。
步骤S1105：该UE在该目标会话的上行协议数据单元中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN。可选的，将协议数据单元中用于区分会话的参考标识替换为目标标识。
现有技术中，UE在传输上行协议数据单元时会在该上行协议数据单元中封装参考标识以表明该上行协议数据单元属于该目标会话，尤其向UP-GW表明该上行协议数据单元属于该目标会话。但是，通过参考标识确定该上行协议数据单元属于该目标会话不仅是该UE和AN可以做到，除该UE和该AN外的其他设备也可以做到，也即是说，该UE和该AN外的其他设备只要截取到了该上行报文中的参考标识就可以确定该上行报文属于该目标会话；该参考标识通常在outer IP header字段、encapsulation header字段和PDU header字段等字段中，该参考标识通常为承载标识(bearer ID)，流标识(flow ID)，硬件的媒体接入控制(英文：Media Access Control，简称：MAC)标识，会话标识、该UE的IP地址、该接入网设备的IP地址、该接入网的接入网标识、端到端通信另一方的标识、端到端通信另一方的IP地址、QoS标识、国际移动用户标识(英文：International Mobile Subscriber Identity，简称：IMSI)、国际移动设备标识(英文：International Mobile Equipment Identity，简称：IMEI)、互联网协议(英文：Internet Protocol，简称：IP)多媒体私有标识(英文：IP Multimedia Private Identity，简称：IMPI)、IP多媒体公有标识(英文：IP Multimedia Public Identity，简称：IMPU)、 临时移动用户标识(英文：Temporary Mobile Subscriber Identity，简称：TMSI)、手机号码、全球唯一临时UE标识(英文：Globally Unique Temporary UE Identity，简称：GUTI)等，相比而言，目标标识就不会包含这些能够明显表明报文的来源和去向等信息。另外，跟现有技术一样，该上行报文中还存在payload字段来封装业务数据，对业务数据的处理方式本发明实施例可以不做修改。
步骤S1106：该AN接收该上行协议数据单元；
步骤S1107：该AN将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送到核心网。
具体地，该AN接收到该上行协议数据单元后解析该上行协议数据单元，例如，解析该协议数据单元的包头header字段的信息，以获取该上行协议数据单元中的目标标识，然后根据预存的该目标会话与该目标标识的对应关系可以确定该上行报文属于目标会话。因此，该AN将该上行报文中的目标标识替换为参考标识，以便UP-GW能够根据该参考标识确定该上行协议数据单元属于该目标会话。
步骤S1108：该AN接收该用户面网关发送的下行协议数据单元。
具体地，按目前的通信协议中定义的规则，任何设备都可以通过参考标识来表明下行报文属于该目标会话，因此，该UP-GW通过通用的规则在该下行协议数据单元中封装该参考标识以表明该下行报文属于该目标会话。
步骤S1109：该AN将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE。
具体地，该AN接收到该下行协议数据单元后解析该下行协议数据单元，当解析出该参考标识时即可确定该下行协议数据单元属于该目标会话，将于该目标会话对应的目标标识替换该参考标识，并将替换后的下行协议数据单元发送给该UE。
步骤S1110：该UE接收包含该下行协议数据单元并根据该目标标识确定该下行协议数据单元属于上述目标会话。
具体地，该UE接收到该下行协议数据单元后解析该下行协议数据单元，当从该下行协议数据单元中解析出来该目标标识时，即可确定该下行报文属于该目标标识对应的目标会话的报文，该下行协议数据单元中通常还有payload字段，该字段中封装了业务数据，用户可以进一步解析出该业务数据，以便根据该业务数据执行相关操作。
在图11所描述的方法中，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
上述都是针对session会话传输方式为例的描述；UE与目标节点之间采用端到端地保护机制时，UE与AN之间这一段传输的部分信息进行额外保护的思想也可以应用于基于承载的传输方式，基于flow的传输方式等。
上述详细阐述了本发明实施例的方法，为了便于更好地实施本发明实施例的上述方案，相应地，下面提供了本发明实施例的装置。
请参见图12，图12是本发明实施例提供的一种用户设备120的结构示意图，该用户设备120可以包括生成单元1201、保护单元1202和发送单元1203，其中，各个单元的详细描述如下。
生成单元1201用于按照预设规则处理基础密钥以生成空口保护密钥，该基础密钥为该UE与核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该核心网中管理密钥的设备用于将该基础密钥发送给接入网设备AN，以使该AN按照该预设规则处理该基础密钥生成该空口保护密钥；
保护单元1202用于通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；
发送单元1203用于将保护了该目标字段的该上行协议数据单元发送给该AN，以使该AN通过该空口保护密钥解析该上行协议数据单元中的该目标字段。
通过运行上述单元，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
在一种可选的方案中，该用户设备还包括第一接收单元，该第一接收单元用于该UE接收该AN发送的下行协议数据单元，并通过该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段经过了该空口保护密钥加密。
在又一种可选的方案中，该第一接收单元通过该空口保护密钥解析该下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段由该AN按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该保护单元具体用于按照预先获取的空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段，该AN用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该目标字段，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该用户设备还包括第二接收单元，第二接收单元用于接收该AN发送的该空口策略，该空口策略由该AN根据初始安全策略生成，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话。
在又一种可选的方案中，该用户设备还包括判断单元，该判断单元用于判断该上行协议数据单元中的payload字段是否已被保护，若否，则触发该保护单元通过该空口保护密钥保护该上行协议数据单元；若是则触发该保护单元执行该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
在又一种可选的方案中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
在又一种可选的方案中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
在又一种可选的方案中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个单元的具体实现还可以对应参照图3、图8、图9、图10所示的方法实施例的相应描述。
在图12所描述的用户设备中，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
请参见图13，图13是本发明实施例提供的一种接入网设备130的结构示意图，该接入网设备130可以包括第一接收单元1301、生成单元1302和第二接收单元1303，各个单元的详细描述如下。
第一接收单元1301用于接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为用户设备UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该UE用于按照预设规则处理该基础密钥以生成空口保护密钥；
生成单元1302用于按照该预设规则处理该基础密钥以生成空口保护密钥；
第二接收单元1303用于接收该UE发送的上行协议数据单元，并通过该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段由该UE通过该空口保护密钥保护过，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN。
通过运行上述单元，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
在一种可选方案中，该接入网设备还包括保护单元，保护单元用于通过该空口保护密钥保护下行协议数据单元中的目标字段，并将保护了该目标字段的该下行协议数据单元发送给该UE；以使该UE通过该空口保护密钥解析该下行协议数据单元中的该目标字段。
在又一种可选方案中，该接入网设备还包括判断单元，该判断单元用于判断该下行协议数据单元中的payload字段是否已被保护，若否，则触发该保护单元通过该空口保护密钥保护该下行协议数据单元；若是，触发该保护单元执行该通过该空口保护密钥保护下行协议数据单元中的目标字段的操作。
在又一种可选的方案中国，该保护单元通过该空口保护密钥保护下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该UE用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的该目标字段，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该第二接收单元通过该空口保护密钥解析该上行协议数据单元中的目标字段，具体为：
按照预先获取的空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段为该UE按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该接入网设备还包括：
第三接收单元，用于接收来自核心网的初始安全策略，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话；
发送单元，用于根据该初始安全策略生成空口策略，并向该UE发送该空口策略。
在又一种可选的方案中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
在又一种可选的方案中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
在又一种可选的方案中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个单元的具体实现还可以对应参照图3、图8、图9、图10所示的方法实施例的相应描述。
在图13所描述的接入网设备中，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
请参见图14，图14是本发明实施例提供的又一种用户设备140的结构示意图，该用户设备140可以包括第一接收单元1401和封装单元1402，其中，各个单元的详细描述如 下。
第一接收单元1401用于接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识，该目标标识由该AN生成，该目标会话为该UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；
封装单元1402用于在该目标会话的上行协议数据单元PDU中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN；该AN用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过运行上述单元，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
在一种可选的方案中，该用户设备还包括第二接收单元，第二接收单元用于接收该AN发送的下行协议数据单元并根据该目标标识确定该下行协议数据单元属于该目标会话，该AN用于在接收到该目标节点发送的下行协议数据单元时将该下行协议数据单元中的参考标识替换为该目标标识，并将替换得到的该下行协议数据单元发送给该UE，该目标节点发送的该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话。
在又一种可选的方案中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
在又一种可选的方案中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个单元的具体实现还可以对应参照图11所示的方法实施例的相应描述。
在图14所描述的用户设备中，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
请参见图15，图15是本发明实施例提供的又一种接入网设备150的结构示意图，该接入网设备150可以包括生成单元1501、第一发送单元1502、第一接收单元1503和替换单元1504，其中，各个单元的详细描述如下。
生成单元1501用于生成与目标会话对应的目标标识，该目标会话为用户设备UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；
第一发送单元1502用于向该UE发送对应关系信息，以使该UE在该目标会话的上行协议数据单元PDU中封装该目标标识，该对应关系信息指示了该目标会话与该目标标识的对应关系；
第一接收单元1503用于接收该UE发送的封装该目标标识的该上行协议数据单元；
替换单元1504用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过运行上述单元，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
在一种可选的方案中，该接入网设备还包括：
第二接收单元，用于接收该目标节点发送的下行协议数据单元，该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话；
第二发送单元，用于将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE，以使该UE根据该目标标识确定该下行协议数据单元属于该目标会话。
在又一种可选的方案中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
在又一种可选的方案中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个单元的具体实现还可以对应参照图12所示的方法实施例的相应描述。
在图15所描述的接入网设备中，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目 标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
请参见图16，图16是本发明实施例提供的一种用户设备160，该用户设备160包括处理器1601、存储器1602和收发器1603，该处理器1601、存储器1602和收发器1603通过总线相互连接。
存储器1602包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)，该存储器1602用于相关指令及数据。
该收发器1603可以包括一个接收器和一个发送器，例如，无线射频模块，以下描述的处理器1601接收或者发送某个协议数据单元，具体可以理解为该处理器1601通过该收发器来接收或者发送。
处理器1601可以是一个或多个中央处理器(英文：Central Processing Unit，简称：CPU)，在处理器1601是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该用户设备160中的处理器1601用于读取该存储器1602中存储的程序代码，执行以下操作：
按照预设规则处理基础密钥以生成空口保护密钥，该基础密钥为该UE与核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该核心网中管理密钥的设备用于将该基础密钥发送给接入网设备AN，以使该AN按照该预设规则处理该基础密钥生成该空口保护密钥；
通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN；
将保护了该目标字段的该上行协议数据单元发送给该AN，以使该AN通过该空口保护密钥解析该上行协议数据单元中的该目标字段。
通过执行上述操作，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
在一种可选的方案中，该处理器1601按照预设规则处理基础密钥以生成空口保护密钥之后，还用于接收该AN发送的下行协议数据单元，并通过该空口保护密钥解析该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段经过了该空口保护密钥加密。
在又一种可选的方案中，该处理器1601通过该空口保护密钥解析该下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析 该下行协议数据单元中的目标字段，该下行协议数据单元中的该目标字段由该AN按照预先获取的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该处理器1601通过该空口保护密钥保护上行协议数据单元PDU中的目标字段，具体为：
按照预先获取的空口策略定义的规则使用该空口保护密钥保护上行协议数据单元中的目标字段，该AN用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该目标字段，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该处理器1601还用于接收该AN发送的该空口策略，该空口策略由该AN根据初始安全策略生成，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话。
在又一种可选的方案中，处理器1601通过该空口保护密钥保护上行协议数据单元PDU中的目标字段之前，还用于判断该上行协议数据单元中的payload字段是否已被保护；若否，则通过该空口保护密钥保护该上行协议数据单元；若是，则执行该UE通过该空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
在又一种可选的方案中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
在又一种可选的方案中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
在又一种可选的方案中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个操作的具体实现还可以对应参照图3、图8、图9、图10所示的方法实施例的相应描述。
在图16所描述的用户设备中，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
请参见图17，图17是本发明实施例提供的一种接入网设备170，该接入网设备170包括处理器1701、存储器1702和收发器1703，该处理器1701、存储器1702和收发器1703通过总线相互连接。
存储器1702包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可 编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)，该存储器1702用于相关指令及数据。
该收发器1703可以包括一个接收器和一个发送器，例如，无线射频模块，以下描述的处理器1701接收或者发送某个协议数据单元，具体可以理解为该处理器1701通过该收发器来接收或者发送。
处理器1701可以是一个或多个中央处理器(英文：Central Processing Unit，简称：CPU)，在处理器1701是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该接入网设备170中的处理器1701用于读取该存储器1702中存储的程序代码，执行以下操作：
接收核心网中管理密钥的设备发送的基础密钥，该基础密钥为用户设备UE与该核心网双向认证生成的密钥或者基于该双向认证生成的密钥推衍出的密钥；该UE用于按照预设规则处理该基础密钥以生成空口保护密钥；
按照该预设规则处理该基础密钥以生成空口保护密钥；
接收该UE发送的上行协议数据单元，并通过该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段由该UE通过该空口保护密钥保护过，该目标字段包含用于标识该UE与目标节点之间的会话的信息，该目标节点与该UE之间的会话的数据在传输时需要经过该AN。
通过执行上述操作，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
在一种可选的方案中，该处理器1701按照该预设规则处理该基础密钥以生成空口保护密钥之后，还用于通过该空口保护密钥保护下行协议数据单元中的目标字段，并将保护了该目标字段的该下行协议数据单元发送给该UE；以使该UE通过该空口保护密钥解析该下行协议数据单元中的该目标字段。
在又一种可选的方案中，该处理器通过该空口保护密钥保护下行协议数据单元中的目标字段之前，还用于判断该下行协议数据单元中的payload字段是否已被保护；若否，则通过该空口保护密钥保护该下行协议数据单元；若是，则执行该通过该空口保护密钥保护下行协议数据单元中的目标字段的操作。
在又一种可选的方案中，该处理器1701通过该空口保护密钥保护下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥保护下行协议数据单元中的目标字段，该UE用于按照预先获取的该空口策略定义的规则使用该空口保护密钥解析该下行协议数据单元中的该目标字段，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该处理器通过该空口保护密钥解析该上行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用该空口保护密钥解析该上行协议数据单元中的目标字段，该上行协议数据单元中的该目标字段为该UE按照预先获取 的该空口策略定义的规则使用该空口保护密钥保护过，该空口策略定义了密钥的使用规则。
在又一种可选的方案中，该处理器还用于接收来自核心网的初始安全策略，该初始安全策略定义了目标会话中用到的密钥的生成规则，该目标会话为该目标节点与该UE之间的会话；根据该初始安全策略生成空口策略，并向该UE发送该空口策略。
在又一种可选的方案中，该空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
在又一种可选的方案中，该目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
在又一种可选的方案中，该用于标识该UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个操作的具体实现还可以对应参照图3、图8、图9、图10所示的方法实施例的相应描述。
在图17所描述的接入网设备中，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
请参见图18，图18是本发明实施例提供的一种用户设备180，该用户设备180包括处理器1801、存储器1802和收发器1803，该处理器1801、存储器1802和收发器1803通过总线相互连接。
存储器1802包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)，该存储器1802用于相关指令及数据。
该收发器1803可以包括一个接收器和一个发送器，例如，无线射频模块，以下描述的处理器1801接收或者发送某个协议数据单元，具体可以理解为该处理器1801通过该收发器来接收或者发送。
处理器1801可以是一个或多个中央处理器(英文：Central Processing Unit，简称：CPU)，在处理器1801是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该用户设备180中的处理器1801用于读取该存储器1802中存储的程序代码，执行以下操作：
接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识，该目标标识由该AN生成，该目标会话为该UE与目标节点之间的会话，该目标 会话的数据在传输时需要经过该AN；
在该目标会话的上行协议数据单元PDU中封装该目标标识并将封装了该目标标识的上行协议数据单元发送给该AN；该AN用于将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过执行上述操作，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
在一种可选的方案中，处理器1801接收接入网设备AN发送的对应关系信息并根据该对应关系信息确定目标会话对应目标标识之后，还用于接收该AN发送的下行协议数据单元并根据该目标标识确定该下行协议数据单元属于该目标会话，该AN用于在接收到该目标节点发送的下行协议数据单元时将该下行协议数据单元中的参考标识替换为该目标标识，并将替换得到的该下行协议数据单元发送给该UE，该目标节点发送的该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话。
在又一种可选的方案中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
在又一种可选的方案中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选方案中，该目标节点包括该核心网中的用户面网关，或者该核心网中的业务服务器，或者互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个操作的具体实现还可以对应参照图11所示的方法实施例的相应描述。
在图18所描述的用户设备中，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
请参见图19，图19是本发明实施例提供的一种接入网设备190，该接入网设备190包括处理器1901、存储器1902和收发器1903，该处理器1901、存储器1902和收发器1903 通过总线相互连接。
存储器1902包括但不限于是随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或者快闪存储器)、或便携式只读存储器(CD-ROM)，该存储器1902用于相关指令及数据。
该收发器1903可以包括一个接收器和一个发送器，例如，无线射频模块，以下描述的处理器1901接收或者发送某个协议数据单元，具体可以理解为该处理器1901通过该收发器来接收或者发送。
处理器1901可以是一个或多个中央处理器(英文：Central Processing Unit，简称：CPU)，在处理器1901是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该接入网设备190中的处理器1901用于读取该存储器1902中存储的程序代码，执行以下操作：
生成与目标会话对应的目标标识，该目标会话为用户设备UE与目标节点之间的会话，该目标会话的数据在传输时需要经过该AN；
向该UE发送对应关系信息，以使该UE在该目标会话的上行协议数据单元PDU中封装该目标标识，该对应关系信息指示了该目标会话与该目标标识的对应关系；
接收该UE发送的封装该目标标识的该上行协议数据单元；
将该上行协议数据单元中的目标标识替换为参考标识并将替换后的该上行协议数据单元发送给该目标节点，该参考标识用于该目标节点确认该上行协议数据单元属于该目标会话。
通过执行上述操作，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
在一种可选的方案中，该处理器1901向该UE发送对应关系信息之后，还用于：
接收该目标节点发送的下行协议数据单元，该下行协议数据单元包含该参考标识以表明该下行协议数据单元属于该目标会话；
该AN将该下行协议数据单元中的参考标识替换为该目标标识并将替换后的该下行协议数据单元发送给该UE，以使该UE根据该目标标识确定该下行协议数据单元属于该目标会话。
在又一种可选的方案中，该参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
在又一种可选的方案中，该参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、该UE的互联网协议地址、该接入网设备的IP地址、该接入网设备接入的接入网的接入网标识、该UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、该UE的手机号码和该UE的全球唯一临时用户设备标识中至少一项。
在又一种可选的方案中，该目标节点包括核心网中的用户面网关，或核心网中的业务服务器，或互联网中与该核心网中的网元建立了通信连接的服务器。
需要说明的是，各个操作的具体实现还可以对应参照图11所示的方法实施例的相应描述。
在图19所描述的接入网设备中，在UE与AN的空口传输段设置会话保护机制，即在UE于UP-GW之间建立了目标会话后，该AN与该UE双方约定好用来标识该目标会话的目标标识，后续的报文在空口段传输时在该报文中通过该目标标识来表明该报文来自该目标会话，在与核心网之间通信时则将该目标标识替换为参考标识(通过该参考标识确定目标会话是该AN和UE以外的设备也可以做到的)，这样以来，即便除该AN和该UE之外的设备截取到了该目标标识，也无法推导出该报文属于该目标会话，从而避免了会话被攻击。
综上所述，通过实施本发明实施例，UE与AN之间预先协商出空口保护密钥，然后双方通过该空口保护密钥来保护协议数据单元中包含用于标识该UE与该核心网中的用户面网关之间的会话的信息的字段，使得攻击者无法轻易从空口段获取到用于标识该UE与该核心网中的用户面网关之间的会话的信息，使得攻击者无法基于该信息确定该会话，从而避免了该会话被攻击。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，可通过计算机程序来指令相关的硬件来完成，该的程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可存储程序代码的介质。

Claims (77)

  1. 一种通信系统，其特征在于，所述通信系统包括接入网设备AN和用户设备UE，其中：
    所述AN用于接收核心网中管理密钥的设备发送的基础密钥，所述基础密钥为所述UE与所述核心网双向认证生成的密钥或者基于所述双向认证生成的密钥推衍出的密钥；
    所述AN和所述UE均用于按照预设规则处理所述基础密钥以生成空口保护密钥；
    所述UE还用于通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段，并将保护了所述目标字段的所述上行协议数据单元发送给所述AN，所述目标字段包含用于标识所述UE与目标节点之间的会话的信息，所述目标节点与所述UE之间的会话的数据在传输时需要经过所述AN；
    所述AN用于接收所述上行协议数据单元，并通过所述空口保护密钥解析所述上行协议数据单元中的所述目标字段。
  2. 根据权利要求1所述的系统，其特征在于：
    所述AN用于通过所述空口保护密钥保护下行协议数据单元中的目标字段，并将保护了所述目标字段的所述下行协议数据单元发送给所述UE；
    所述UE用于接收所述下行协议数据单元，并通过所述空口保护密钥解析所述下行协议数据单元中的所述目标字段。
  3. 根据权利要求2所述的系统，其特征在于：
    所述通过所述空口保护密钥保护所述下行协议数据单元中的目标字段，具体为：按照预先获取的空口策略定义的规则使用所述空口保护密钥保护下行协议数据单元中的目标字段，所述空口策略定义了密钥的使用规则；
    所述通过所述空口保护密钥解析所述下行协议数据单元中的所述目标字段，具体为：按照预先获取的所述空口策略定义的规则使用所述空口保护密钥解析所述下行协议数据单元中的所述目标字段。
  4. 根据权利要求1～3任一项所述的系统，其特征在于：
    所述通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段，具体为：按照预先获取的空口策略定义的规则使用所述空口保护密钥保护上行协议数据单元中的目标字段，所述空口策略定义了密钥的使用规则；
    所述通过所述空口保护密钥解析所述上行协议数据单元中的所述目标字段，具体为：按照预先获取的空口策略定义的规则使用所述空口保护密钥解析所述上行协议数据单元中的所述目标字段。
  5. 根据权利要求3或4所述的系统，其特征在于：
    所述AN用于接收来自核心网的初始安全策略，所述初始安全策略定义了目标会话中用到的密钥的生成规则，所述目标会话为所述目标节点与所述UE之间的会话；
    所述AN用于根据所述初始安全策略生成空口策略；
    所述AN用于向所述UE发送所述空口策略；
    所述UE用于接收所述空口策略。
  6. 根据权利要求1～5任一项所述的系统，其特征在于：
    所述UE还用于判断所述上行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；
    若否，则所述UE用于通过所述空口保护密钥保护所述上行协议数据单元；
    若是，则所述UE用于执行所述通过所述空口保护密钥保护上行协议数据单元中的目标字段的操作。
  7. 根据权利要求1～5任一项所述的系统，其特征在于：
    所述AN还用于判断所述下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；
    若否，则所述AN用于通过所述空口保护密钥保护所述下行协议数据单元；
    若是，所述AN用于执行所述通过所述空口保护密钥保护所述下行协议数据单元中的目标字段的操作。
  8. 根据权利要求1～7任一项所述的系统，其特征在于，所述空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
  9. 根据权利要求1～8任一项所述的系统，其特征在于，所述目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
  10. 根据权利要求1～9任一项所述的系统，其特征在于，所述用于标识所述UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  11. 根据权利要求1～10任一项所述的系统，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  12. 一种通信系统，其特征在于，所述系统包括用户设备UE和接入网设备AN，其中：
    所述AN用于生成与目标会话对应的目标标识，所述目标会话为所述UE与目标节点 之间的会话，所述目标会话的数据在传输时需要经过所述AN；
    所述AN用于向所述UE发送对应关系信息，所述对应关系信息指示了所述目标会话与所述目标标识的对应关系；
    所述UE用于接收所述对应关系信息并根据所述对应关系信息确定所述目标会话对应所述目标标识；
    所述UE用于在所述目标会话的上行协议数据单元PDU中封装所述目标标识并将封装了所述目标标识的上行协议数据单元发送给所述AN；
    所述AN用于接收所述上行协议数据单元；
    所述AN用于将所述上行协议数据单元中的目标标识替换为参考标识并将替换后的所述上行协议数据单元发送给所述目标节点，所述参考标识用于所述目标节点确认所述上行协议数据单元属于所述目标会话。
  13. 根据权利要求12所述的系统，其特征在于：
    所述AN用于接收所述目标节点发送的下行协议数据单元，所述下行协议数据单元包含所述参考标识以表明所述下行协议数据单元属于所述目标会话；
    所述AN用于将所述下行协议数据单元中的参考标识替换为所述目标标识并将替换后的所述下行协议数据单元发送给所述UE；
    所述UE用于接收所述下行协议数据单元并根据所述目标标识确定所述下行协议数据单元属于所述目标会话。
  14. 根据权利要求12或13所述的系统，其特征在于，所述参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
  15. 根据权利要求12～14任一项所述的系统，其特征在于，所述参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  16. 根据权利要求12～15任一项所述的系统，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  17. 一种用户设备UE，其特征在于，包括：
    生成单元，用于按照预设规则处理基础密钥以生成空口保护密钥，所述基础密钥为所述UE与核心网双向认证生成的密钥或者基于所述双向认证生成的密钥推衍出的密钥；所 述核心网中管理密钥的设备用于将所述基础密钥发送给接入网设备AN，以使所述AN按照所述预设规则处理所述基础密钥生成所述空口保护密钥；
    保护单元，用于通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段，所述目标字段包含用于标识所述UE与目标节点之间的会话的信息，所述目标节点与所述UE之间的会话的数据在传输时需要经过所述AN；
    发送单元，用于将保护了所述目标字段的所述上行协议数据单元发送给所述AN，以使所述AN通过所述空口保护密钥解析所述上行协议数据单元中的所述目标字段。
  18. 根据权利要求17所述的用户设备，其特征在于，还包括：
    第一接收单元，用于所述UE接收所述AN发送的下行协议数据单元，并通过所述空口保护密钥解析所述下行协议数据单元中的目标字段，所述下行协议数据单元中的所述目标字段经过了所述空口保护密钥加密。
  19. 根据权利要求18所述的用户设备，其特征在于，所述第一接收单元通过所述空口保护密钥解析所述下行协议数据单元中的目标字段，具体为：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥解析所述下行协议数据单元中的目标字段，所述下行协议数据单元中的所述目标字段由所述AN按照预先获取的所述空口策略定义的规则使用所述空口保护密钥保护过，所述空口策略定义了密钥的使用规则。
  20. 根据权利要求17～19任一项所述的用户设备，其特征在于，所述保护单元具体用于按照预先获取的空口策略定义的规则使用所述空口保护密钥保护上行协议数据单元中的目标字段，所述AN用于按照预先获取的所述空口策略定义的规则使用所述空口保护密钥解析所述目标字段，所述空口策略定义了密钥的使用规则。
  21. 根据权利要求19或20所述的用户设备，其特征在于，还包括：
    第二接收单元，用于接收所述AN发送的所述空口策略，所述空口策略由所述AN根据初始安全策略生成，所述初始安全策略定义了目标会话中用到的密钥的生成规则，所述目标会话为所述目标节点与所述UE之间的会话。
  22. 根据权利要求17～21任一项所述的用户设备，其特征在于，还包括：
    判断单元，用于判断所述上行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护，若否，则触发所述保护单元通过所述空口保护密钥保护所述上行协议数据单元；若是则触发所述保护单元执行所述UE通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
  23. 根据权利要求17～22任一项所述的用户设备，其特征在于，所述空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
  24. 根据权利要求17～23任一项所述的用户设备，其特征在于，所述目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
  25. 根据权利要求17～24任一项所述的用户设备，其特征在于，所述用于标识所述UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  26. 根据权利要求17～25任一项所述的用户设备，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  27. 一种接入网设备AN，其特征在于，包括：
    第一接收单元，用于接收核心网中管理密钥的设备发送的基础密钥，所述基础密钥为用户设备UE与所述核心网双向认证生成的密钥或者基于所述双向认证生成的密钥推衍出的密钥；所述UE用于按照预设规则处理所述基础密钥以生成空口保护密钥；
    生成单元，用于按照所述预设规则处理所述基础密钥以生成空口保护密钥；
    第二接收单元，用于接收所述UE发送的上行协议数据单元，并通过所述空口保护密钥解析所述上行协议数据单元中的目标字段，所述上行协议数据单元中的所述目标字段由所述UE通过所述空口保护密钥保护过，所述目标字段包含用于标识所述UE与目标节点之间的会话的信息，所述目标节点与所述UE之间的会话的数据在传输时需要经过所述AN。
  28. 根据权利要求27所述的接入网设备，其特征在于，还包括：
    保护单元，用于通过所述空口保护密钥保护下行协议数据单元中的目标字段，并将保护了所述目标字段的所述下行协议数据单元发送给所述UE；以使所述UE通过所述空口保护密钥解析所述下行协议数据单元中的所述目标字段。
  29. 根据权利要求28所述的接入网设备，其特征在于，还包括：
    判断单元，用于判断所述下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护，若否，则触发所述保护单元通过所述空口保护密钥保护所述下行协议数据单元；若是，触发所述保护单元执行所述通过所述空口保护密钥保护下行协议数据单元中的目标字段的操作。
  30. 根据权利要求28或29所述的接入网设备，其特征在于，所述保护单元通过所述 空口保护密钥保护下行协议数据单元中的目标字段，具体为：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥保护下行协议数据单元中的目标字段，所述UE用于按照预先获取的所述空口策略定义的规则使用所述空口保护密钥解析所述下行协议数据单元中的所述目标字段，所述空口策略定义了密钥的使用规则。
  31. 根据权利要求27～30任一项所述的接入网设备，其特征在于，所述第二接收单元通过所述空口保护密钥解析所述上行协议数据单元中的目标字段，具体为：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥解析所述上行协议数据单元中的目标字段，所述上行协议数据单元中的所述目标字段为所述UE按照预先获取的所述空口策略定义的规则使用所述空口保护密钥保护过，所述空口策略定义了密钥的使用规则。
  32. 根据权利要求30或31所述的接入网设备，其特征在于，还包括：
    第三接收单元，用于接收来自核心网的初始安全策略，所述初始安全策略定义了目标会话中用到的密钥的生成规则，所述目标会话为所述目标节点与所述UE之间的会话；
    发送单元，用于根据所述初始安全策略生成空口策略，并向所述UE发送所述空口策略。
  33. 根据权利要求27～32任一项所述的接入网设备，其特征在于，所述空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
  34. 根据权利要求27～33任一项所述的接入网设备，其特征在于，所述目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
  35. 根据权利要求27～34任一项所述的接入网设备，其特征在于，所述用于标识所述UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  36. 根据权利要求27～35任一项所述的接入网设备，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  37. 一种用户设备UE，其特征在于，包括：
    第一接收单元，用于接收接入网设备AN发送的对应关系信息并根据所述对应关系信 息确定目标会话对应目标标识，所述目标标识由所述AN生成，所述目标会话为所述UE与目标节点之间的会话，所述目标会话的数据在传输时需要经过所述AN；
    封装单元，用于在所述目标会话的上行协议数据单元PDU中封装所述目标标识并将封装了所述目标标识的上行协议数据单元发送给所述AN；所述AN用于将所述上行协议数据单元中的目标标识替换为参考标识并将替换后的所述上行协议数据单元发送给所述目标节点，所述参考标识用于所述目标节点确认所述上行协议数据单元属于所述目标会话。
  38. 根据权利要求37所述的用户设备，其特征在于，还包括：
    第二接收单元，用于接收所述AN发送的下行协议数据单元并根据所述目标标识确定所述下行协议数据单元属于所述目标会话，所述AN用于在接收到所述目标节点发送的下行协议数据单元时将所述下行协议数据单元中的参考标识替换为所述目标标识，并将替换得到的所述下行协议数据单元发送给所述UE，所述目标节点发送的所述下行协议数据单元包含所述参考标识以表明所述下行协议数据单元属于所述目标会话。
  39. 根据权利要求37或38所述的用户设备，其特征在于，所述参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
  40. 根据权利要求37～39任一项所述的用户设备，其特征在于，所述参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  41. 根据权利要求37～40任一项所述的用户设备，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  42. 一种接入网设备AN，其特征在于，包括：
    生成单元，用于生成与目标会话对应的目标标识，所述目标会话为用户设备UE与目标节点之间的会话，所述目标会话的数据在传输时需要经过所述AN；
    第一发送单元，用于向所述UE发送对应关系信息，以使所述UE在所述目标会话的上行协议数据单元PDU中封装所述目标标识，所述对应关系信息指示了所述目标会话与所述目标标识的对应关系；
    第一接收单元，用于接收所述UE发送的封装所述目标标识的所述上行协议数据单元；
    替换单元，用于将所述上行协议数据单元中的目标标识替换为参考标识并将替换后的所述上行协议数据单元发送给所述目标节点，所述参考标识用于所述目标节点确认所述上 行协议数据单元属于所述目标会话。
  43. 根据权利要求42所述的接入网设备，其特征在于，还包括：
    第二接收单元，用于接收所述目标节点发送的下行协议数据单元，所述下行协议数据单元包含所述参考标识以表明所述下行协议数据单元属于所述目标会话；
    第二发送单元，用于将所述下行协议数据单元中的参考标识替换为所述目标标识并将替换后的所述下行协议数据单元发送给所述UE，以使所述UE根据所述目标标识确定所述下行协议数据单元属于所述目标会话。
  44. 根据权利要求42或43所述的接入网设备，其特征在于，所述参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
  45. 根据权利要求42～44任一项所述的接入网设备，其特征在于，所述参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  46. 根据权利要求42～45任一项所述的接入网设备，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  47. 一种数据传输方法，其特征在于，包括：
    用户设备UE按照预设规则处理基础密钥以生成空口保护密钥，所述基础密钥为所述UE与核心网双向认证生成的密钥或者基于所述双向认证生成的密钥推衍出的密钥；所述核心网中管理密钥的设备用于将所述基础密钥发送给接入网设备AN，以使所述AN按照所述预设规则处理所述基础密钥生成所述空口保护密钥；
    所述UE通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段，所述目标字段包含用于标识所述UE与目标节点之间的会话的信息，所述目标节点与所述UE之间的会话的数据在传输时需要经过所述AN；
    所述UE将保护了所述目标字段的所述上行协议数据单元发送给所述AN，以使所述AN通过所述空口保护密钥解析所述上行协议数据单元中的所述目标字段。
  48. 根据权利要求47所述的方法，其特征在于，所述用户设备UE按照预设规则处理基础密钥以生成空口保护密钥之后，所述方法还包括：
    所述UE接收所述AN发送的下行协议数据单元，并通过所述空口保护密钥解析所述 下行协议数据单元中的目标字段，所述下行协议数据单元中的所述目标字段经过了所述空口保护密钥加密。
  49. 根据权利要求48所述的方法，其特征在于，所述通过所述空口保护密钥解析所述下行协议数据单元中的目标字段，包括：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥解析所述下行协议数据单元中的目标字段，所述下行协议数据单元中的所述目标字段由所述AN按照预先获取的所述空口策略定义的规则使用所述空口保护密钥保护过，所述空口策略定义了密钥的使用规则。
  50. 根据权利要求47～49任一项所述的方法，其特征在于，所述UE通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段，包括：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥保护上行协议数据单元中的目标字段，所述AN用于按照预先获取的所述空口策略定义的规则使用所述空口保护密钥解析所述目标字段，所述空口策略定义了密钥的使用规则。
  51. 根据权利要求49或50所述的方法，其特征在于，所述方法还包括：
    所述UE接收所述AN发送的所述空口策略，所述空口策略由所述AN根据初始安全策略生成，所述初始安全策略定义了目标会话中用到的密钥的生成规则，所述目标会话为所述目标节点与所述UE之间的会话。
  52. 根据权利要求47～51任一项所述的方法，其特征在于，所述UE通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段之前，还包括：
    所述UE判断所述上行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；
    若否，则所述UE通过所述空口保护密钥保护所述上行协议数据单元；
    若是，则所述UE执行所述UE通过所述空口保护密钥保护上行协议数据单元PDU中的目标字段的操作。
  53. 根据权利要求47～52任一项所述的方法，其特征在于，所述空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
  54. 根据权利要求47～53任一项所述的方法，其特征在于，所述目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
  55. 根据权利要求47～54任一项所述的方法，其特征在于，所述用于标识所述UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、 所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  56. 根据权利要求47～55任一项所述的方法，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  57. 一种数据传输方法，其特征在于，包括：
    接入网设备AN接收核心网中管理密钥的设备发送的基础密钥，所述基础密钥为用户设备UE与所述核心网双向认证生成的密钥或者基于所述双向认证生成的密钥推衍出的密钥；所述UE用于按照预设规则处理所述基础密钥以生成空口保护密钥；
    所述AN按照所述预设规则处理所述基础密钥以生成空口保护密钥；
    所述AN接收所述UE发送的上行协议数据单元，并通过所述空口保护密钥解析所述上行协议数据单元中的目标字段，所述上行协议数据单元中的所述目标字段由所述UE通过所述空口保护密钥保护过，所述目标字段包含用于标识所述UE与目标节点之间的会话的信息，所述目标节点与所述UE之间的会话的数据在传输时需要经过所述AN。
  58. 根据权利要求57所述的方法，其特征在于，所述AN按照所述预设规则处理所述基础密钥以生成空口保护密钥之后，所述方法还包括：
    所述AN通过所述空口保护密钥保护下行协议数据单元中的目标字段，并将保护了所述目标字段的所述下行协议数据单元发送给所述UE；以使所述UE通过所述空口保护密钥解析所述下行协议数据单元中的所述目标字段。
  59. 根据权利要求58所述的方法，其特征在于，所述AN通过所述空口保护密钥保护下行协议数据单元中的目标字段之前，所述方法还包括：
    所述AN判断所述下行协议数据单元中的协议数据单元载荷PDU payload字段是否已被保护；
    若否，则所述AN通过所述空口保护密钥保护所述下行协议数据单元；
    若是，所述AN执行所述通过所述空口保护密钥保护下行协议数据单元中的目标字段的步骤。
  60. 根据权利要求58或59所述的方法，其特征在于，所述AN通过所述空口保护密钥保护下行协议数据单元中的目标字段，包括：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥保护下行协议数据单元中的目标字段，所述UE用于按照预先获取的所述空口策略定义的规则使用所述空口保护密钥解析所述下行协议数据单元中的所述目标字段，所述空口策略定义了密钥的使用规则。
  61. 根据权利要求57～60任一项所述的方法，其特征在于，所述通过所述空口保护密钥解析所述上行协议数据单元中的目标字段，包括：
    按照预先获取的空口策略定义的规则使用所述空口保护密钥解析所述上行协议数据单元中的目标字段，所述上行协议数据单元中的所述目标字段为所述UE按照预先获取的所述空口策略定义的规则使用所述空口保护密钥保护过，所述空口策略定义了密钥的使用规则。
  62. 根据权利要求60或61所述的方法，其特征在于，所述方法还包括：
    所述AN接收来自核心网的初始安全策略，所述初始安全策略定义了目标会话中用到的密钥的生成规则，所述目标会话为所述目标节点与所述UE之间的会话；
    所述AN根据所述初始安全策略生成空口策略，并向所述UE发送所述空口策略。
  63. 根据权利要求57～62任一项所述的方法，其特征在于，所述空口保护密钥包括加密密钥和完整性保护密钥中至少一项。
  64. 根据权利要求57～63任一项所述的方法，其特征在于，所述目标字段包括外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中至少一项。
  65. 根据权利要求57～64任一项所述的方法，其特征在于，所述用于标识所述UE与目标节点之间的会话的信息包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  66. 根据权利要求57～65任一项所述的方法，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  67. 一种数据传输方法，其特征在于，包括：
    用户设备UE接收接入网设备AN发送的对应关系信息并根据所述对应关系信息确定目标会话对应目标标识，所述目标标识由所述AN生成，所述目标会话为所述UE与目标节点之间的会话，所述目标会话的数据在传输时需要经过所述AN；
    所述UE在所述目标会话的上行协议数据单元PDU中封装所述目标标识并将封装了所述目标标识的上行协议数据单元发送给所述AN；所述AN用于将所述上行协议数据单元中的目标标识替换为参考标识并将替换后的所述上行协议数据单元发送给所述目标节点，所 述参考标识用于所述目标节点确认所述上行协议数据单元属于所述目标会话。
  68. 根据权利要求67所述的方法，其特征在于，用户设备UE接收接入网设备AN发送的对应关系信息并根据所述对应关系信息确定目标会话对应目标标识之后，所述方法还包括：
    所述UE接收所述AN发送的下行协议数据单元并根据所述目标标识确定所述下行协议数据单元属于所述目标会话，所述AN用于在接收到所述目标节点发送的下行协议数据单元时将所述下行协议数据单元中的参考标识替换为所述目标标识，并将替换得到的所述下行协议数据单元发送给所述UE，所述目标节点发送的所述下行协议数据单元包含所述参考标识以表明所述下行协议数据单元属于所述目标会话。
  69. 根据权利要求67或68所述的方法，其特征在于，所述参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
  70. 根据权利要求67～69任一项所述的方法，其特征在于，所述参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  71. 根据权利要求67～70任一项所述的方法，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  72. 一种数据传输方法，其特征在于，包括：
    接入网设备AN生成与目标会话对应的目标标识，所述目标会话为用户设备UE与目标节点之间的会话，所述目标会话的数据在传输时需要经过所述AN；
    所述AN向所述UE发送对应关系信息，以使所述UE在所述目标会话的上行协议数据单元PDU中封装所述目标标识，所述对应关系信息指示了所述目标会话与所述目标标识的对应关系；
    所述AN接收所述UE发送的封装所述目标标识的所述上行协议数据单元；
    所述AN将所述上行协议数据单元中的目标标识替换为参考标识并将替换后的所述上行协议数据单元发送给所述目标节点，所述参考标识用于所述目标节点确认所述上行协议数据单元属于所述目标会话。
  73. 根据权利要求72所述的方法，其特征在于，所述AN向所述UE发送对应关系信 息之后，所述方法还包括：
    所述AN接收所述目标节点发送的下行协议数据单元，所述下行协议数据单元包含所述参考标识以表明所述下行协议数据单元属于所述目标会话；
    所述AN将所述下行协议数据单元中的参考标识替换为所述目标标识并将替换后的所述下行协议数据单元发送给所述UE，以使所述UE根据所述目标标识确定所述下行协议数据单元属于所述目标会话。
  74. 根据权利要求72或73所述的方法，其特征在于，所述参考标识封装于外部IP头outer IP header字段、封装头encapsulation header字段和协议数据单元头PDU header字段中的至少一个字段中。
  75. 根据权利要求72～74任一项所述的方法，其特征在于，所述参考标识包括承载标识、流标识、硬件的媒体接入控制标识、会话标识、所述UE的互联网协议地址、所述接入网设备的IP地址、所述接入网设备接入的接入网的接入网标识、所述UE的IP地址、服务质量标识、国际移动用户标识、国际移动设备标识、互联网协议多媒体私有标识、IP多媒体公有标识、临时移动用户标识、所述UE的手机号码和所述UE的全球唯一临时用户设备标识中至少一项。
  76. 根据权利要求72～75任一项所述的方法，其特征在于，所述目标节点包括所述核心网中的用户面网关，或者所述核心网中的业务服务器，或者互联网中与所述核心网中的网元建立了通信连接的服务器。
  77. 一种存储介质，其特征在于，所述存储介质用于存储指令，所述指令在处理器上运行时使得权利要求47-76任一项所述的方法得以实现。
PCT/CN2017/090317 2016-10-31 2017-06-27 一种数据传输方法、相关设备及系统 WO2018076742A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17864761.6A EP3512291B1 (en) 2016-10-31 2017-06-27 Data transmission method, relevant device and system
JP2019522766A JP2019533956A (ja) 2016-10-31 2017-06-27 データ送信方法ならびに関連デバイスおよびシステム
US16/400,032 US11228908B2 (en) 2016-10-31 2019-04-30 Data transmission method and related device and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610942360.2 2016-10-31
CN201610942360.2A CN108377495B (zh) 2016-10-31 2016-10-31 一种数据传输方法、相关设备及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/400,032 Continuation US11228908B2 (en) 2016-10-31 2019-04-30 Data transmission method and related device and system

Publications (1)

Publication Number Publication Date
WO2018076742A1 true WO2018076742A1 (zh) 2018-05-03

Family

ID=62024328

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/090317 WO2018076742A1 (zh) 2016-10-31 2017-06-27 一种数据传输方法、相关设备及系统

Country Status (5)

Country Link
US (1) US11228908B2 (zh)
EP (1) EP3512291B1 (zh)
JP (1) JP2019533956A (zh)
CN (1) CN108377495B (zh)
WO (1) WO2018076742A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167076A (zh) * 2019-06-20 2019-08-23 杭州迪普信息技术有限公司 一种4g网络的流量分流方法、装置及设备

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830993B (zh) * 2018-08-10 2021-08-20 华为技术有限公司 一种数据处理的方法、装置和计算机可读存储介质
CN109327452A (zh) * 2018-10-31 2019-02-12 上海与德科技有限公司 加密方法、装置、设备及存储介质
CN112312389B (zh) * 2019-07-29 2022-05-06 中国移动通信集团广东有限公司 通信信息传输方法、装置及存储介质、电子设备
CN112492584B (zh) * 2019-08-23 2022-07-22 华为技术有限公司 终端设备和用户面网元之间的安全通信方法、装置及系统
CN110545176B (zh) * 2019-08-23 2021-08-13 深圳数联天下智能科技有限公司 加密和解密方法、装置以及物联网系统
CN110839036B (zh) * 2019-11-19 2021-09-03 武汉思普崚技术有限公司 一种sdn网络的攻击检测方法及系统
CN113225176B (zh) * 2020-02-04 2022-09-16 华为技术有限公司 密钥获取方法及装置
EP4149139B1 (en) * 2021-09-10 2024-04-03 Deutsche Telekom AG Method for operating a user equipment within or as part of a telecommunications network, user equipment, system or telecommunications network, application authorization function or functionality, program and computer program product
US11991525B2 (en) 2021-12-02 2024-05-21 T-Mobile Usa, Inc. Wireless device access and subsidy control
CN116781450B (zh) * 2023-08-23 2023-10-27 长沙普洛电气设备有限公司 基于can总线的通信方法及相关装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101510825A (zh) * 2009-02-25 2009-08-19 中兴通讯股份有限公司 一种管理消息的保护方法及系统
CN101534236A (zh) * 2008-03-11 2009-09-16 华为技术有限公司 中继站通信时的加密方法及装置
WO2011127253A1 (en) * 2010-04-07 2011-10-13 Sprint Spectrum L.P. Methods and systems for transitioning a communication session from a source base station to a target base station without terminating the session
CN102439919A (zh) * 2011-09-28 2012-05-02 华为技术有限公司 标签交换路径建立的方法、装置和系统

Family Cites Families (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040010612A1 (en) * 2002-06-11 2004-01-15 Pandya Ashish A. High performance IP processor using RDMA
DE102005027232A1 (de) 2005-06-13 2006-12-14 Siemens Ag Verfahren und Anordnung zum sicheren Übertragen von Daten in einem ein Mehrsprungverfahren nutzenden Kommunikationssystem
US20080226074A1 (en) * 2007-03-15 2008-09-18 Interdigital Technology Corporation Method and apparatus for ciphering packet units in wireless communications
CN101127768B (zh) * 2007-08-24 2012-12-19 张建中 创建多维网际协议的方法和装置以及系统
WO2011039571A1 (en) * 2009-09-30 2011-04-07 Nokia Corporation Apparatus and method for providing access to a local area network
CN102056159B (zh) * 2009-11-03 2014-04-02 华为技术有限公司 一种中继系统的安全密钥获取方法、装置
CN102394749B (zh) * 2011-09-26 2014-03-05 深圳市文鼎创数据科技有限公司 数据传输的线路保护方法、系统、信息安全设备及应用设备
IN2015DN01110A (zh) 2012-09-13 2015-06-26 Nec Corp
US9497673B2 (en) * 2013-11-01 2016-11-15 Blackberry Limited Method and apparatus to enable multiple wireless connections
WO2015200510A1 (en) * 2014-06-24 2015-12-30 Virsec Systems, Inc. Automated code lockdown to reduce attach surface for software
CN104704866B (zh) * 2014-06-30 2019-03-08 华为技术有限公司 重建pdn连接的方法、复位中心服务器、移动管理网元和数据网关
US20160285834A1 (en) 2014-11-10 2016-09-29 Qualcomm Incorporated Techniques for encrypting fields of a frame header for wi-fi privacy
US9717003B2 (en) * 2015-03-06 2017-07-25 Qualcomm Incorporated Sponsored connectivity to cellular networks using existing credentials
US9602677B2 (en) * 2015-06-16 2017-03-21 Alcatel Lucent Charging for commercial group based messaging
CN105553981B (zh) * 2015-12-18 2019-03-22 成都三零瑞通移动通信有限公司 一种wlan网络快速认证和密钥协商方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101534236A (zh) * 2008-03-11 2009-09-16 华为技术有限公司 中继站通信时的加密方法及装置
CN101510825A (zh) * 2009-02-25 2009-08-19 中兴通讯股份有限公司 一种管理消息的保护方法及系统
WO2011127253A1 (en) * 2010-04-07 2011-10-13 Sprint Spectrum L.P. Methods and systems for transitioning a communication session from a source base station to a target base station without terminating the session
CN102439919A (zh) * 2011-09-28 2012-05-02 华为技术有限公司 标签交换路径建立的方法、装置和系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167076A (zh) * 2019-06-20 2019-08-23 杭州迪普信息技术有限公司 一种4g网络的流量分流方法、装置及设备
CN110167076B (zh) * 2019-06-20 2022-06-28 杭州迪普信息技术有限公司 一种4g网络的流量分流方法、装置及设备

Also Published As

Publication number Publication date
US11228908B2 (en) 2022-01-18
EP3512291A1 (en) 2019-07-17
JP2019533956A (ja) 2019-11-21
US20190261167A1 (en) 2019-08-22
EP3512291B1 (en) 2020-12-16
CN108377495B (zh) 2021-10-15
CN108377495A (zh) 2018-08-07
EP3512291A4 (en) 2019-09-04

Similar Documents

Publication Publication Date Title
WO2018076742A1 (zh) 一种数据传输方法、相关设备及系统
CN107079023B (zh) 用于下一代蜂窝网络的用户面安全
CN110830991B (zh) 安全会话方法和装置
US11122405B2 (en) MTC key management for key derivation at both UE and network
CN113630773B (zh) 安全实现方法、设备以及系统
EP3216249B1 (en) Apparatuses and methods for wireless communication
JP5480890B2 (ja) 制御信号の暗号化方法
US9031535B2 (en) Un-ciphered network operation solution
CN108353279B (zh) 一种认证方法和认证系统
WO2020248624A1 (zh) 一种通信方法、网络设备、用户设备和接入网设备
AU2010201991A1 (en) Method and apparatus for security protection of an original user identity in an initial signaling message
KR102425273B1 (ko) 크기 제약된 인증 프로토콜들에서의 보안 연결을 보장하기 위한 방법 및 장치들
CN114245372B (zh) 一种认证方法、装置和系统
JP2023541563A (ja) 通信方法および関係する装置
JP2024537747A (ja) セルラーネットワークの動作方法
CN117834212A (zh) 一种安全网关及通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17864761

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017864761

Country of ref document: EP

Effective date: 20190409

Ref document number: 2019522766

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE