WO2018132952A1

WO2018132952A1 - Wireless communication method and apparatus

Info

Publication number: WO2018132952A1
Application number: PCT/CN2017/071452
Authority: WO
Inventors: 张丽佳; 陈璟; 张万强
Original assignee: 华为技术有限公司
Priority date: 2017-01-17
Filing date: 2017-01-17
Publication date: 2018-07-26

Abstract

Disclosed are a wireless communication method and apparatus. The method comprises: a gateway device determines a target security algorithm from security algorithms supported by a terminal device; the gateway device transmits first indication information to the terminal device, the first indication information being used for indicating the target security algorithm; the gateway device communicates with the terminal device according to the target security algorithm. According to the wireless communication method and apparatus provided by embodiments of the present application, the gateway device determines security algorithms supported by a terminal device according to the security capability of the terminal device, and indicates the target security algorithm selected by the gateway device to the terminal device, so that the terminal device and the gateway device can select suitable security algorithm for communication, thereby enhancing the security performance of communication between the terminal device and the gateway device.

Description

Method and device for wireless communication

Technical field

The present application relates to the field of communications, and in particular, to a method and apparatus for wireless communication.

Background technique

In wireless communication, the terminal device communicates with the enterprise server through a gateway device belonging to the Home Public Land Mobile Network (HPLMN). To ensure data security, it is necessary to establish an end-to-end between the terminal device and the gateway device. (End to End, E2E) Secure communication mechanism.

Currently, the terminal device and the gateway device can determine a key for E2E secure communication, and communicate according to the key and a security algorithm pre-configured in the terminal device, however, when the security algorithm pre-configured in the terminal device appears safe In the case of a vulnerability, the prior art cannot introduce a new security algorithm, resulting in a greater risk of E2E communication between the terminal device and the gateway device.

Summary of the invention

In view of this, the embodiment of the present application provides a method for wireless communication, which can enhance the security performance of communication between the terminal device and the gateway device.

In one aspect, a method for wireless communication is provided, the method comprising: a gateway device determining a target security algorithm from a security algorithm supported by a terminal device; the gateway device transmitting first indication information to the terminal device, the first The indication information is used to indicate the target security algorithm; the gateway device communicates with the terminal device according to the target security algorithm.

According to the method of wireless communication provided by the embodiment of the present application, the gateway device may determine a target security algorithm according to the security capability of the terminal device, and communicate with the terminal device according to the target security algorithm, thereby enhancing communication between the terminal device and the gateway device. Security performance.

Optionally, before the gateway device communicates with the terminal device according to the target security algorithm, the method further includes: the gateway device sending the second indication information and the message authentication code MAC to the terminal device, The second indication information is used to indicate an integrity algorithm, and the integrity algorithm and the MAC are used by the terminal device to check integrity of a message carrying the first indication information.

In the method for wireless communication provided by the embodiment of the present application, the gateway device instructs the terminal device to perform integrity verification on the message carrying the first indication information, so as to prevent the communication security caused by the tampering of the message carrying the first indication information from being weakened and enhanced. Security performance of communication between terminal devices and gateway devices.

Optionally, before the gateway device communicates with the terminal device according to the target security algorithm, the method further includes: the gateway device sending security capability information to the terminal device, so that the terminal device is configured according to the terminal device The security capability of the terminal device verifies whether the security capability information is correct.

In the method for wireless communication provided by the embodiment of the present application, the terminal device can prevent the network device from determining the target security algorithm according to the security capability of the wrong terminal device by verifying the security capability information sent by the network device, thereby enhancing the terminal device and the gateway device. The security of communication between.

Optionally, the method further includes: the gateway device receiving security capability information from the terminal device or the core network device; the gateway device determining, according to the security capability information, a security algorithm supported by the terminal device. Thereby, the security capability of the terminal device can be flexibly determined.

In another aspect, a method for wireless communication is provided, the method comprising: receiving, by a terminal device, first indication information from a gateway device, the first indication information being used to indicate a target security algorithm; and the terminal device is secured according to the target An algorithm communicates with the gateway device.

According to the method of wireless communication provided by the embodiment of the present application, the terminal device communicates with the gateway device according to the target security algorithm indicated by the gateway device, thereby enhancing the security performance of communication between the terminal device and the gateway device.

Optionally, before the terminal device communicates with the gateway device according to the target security algorithm, the method further includes: the terminal device receiving second indication information and a MAC from the gateway device, where the second The indication information is used to indicate an integrity algorithm; the terminal device checks the integrity of the message carrying the first indication information according to the integrity algorithm and the MAC check.

The terminal device performs integrity verification on the message carrying the first indication information, so that the communication security caused by the tampering of the message carrying the first indication information is prevented, and the security performance of communication between the terminal device and the gateway device is enhanced.

Optionally, before the terminal device communicates with the gateway device according to the target security algorithm, the method further includes: the terminal device receiving security capability information from the gateway device; The security capability of the terminal device verifies whether the security capability information is correct.

By verifying the security capability information sent by the gateway device, the terminal device can prevent the gateway device from determining the target security algorithm according to the security capability of the wrong terminal device, thereby enhancing the security performance of communication between the terminal device and the gateway device.

Optionally, before the terminal device receives the first indication information from the gateway device, the method further includes: the terminal device sending security capability information to the gateway device, where the security capability information is used to indicate the terminal device Supported security algorithms. Thereby, the gateway device can flexibly determine the security capability of the terminal device.

In another aspect, the embodiment of the present application provides a device for wireless communication, where the device can implement the functions performed by the gateway device in the method related to the foregoing aspect, where the function can be implemented by hardware, or the corresponding software can be executed by hardware. achieve. The hardware or software includes one or more corresponding units or modules of the above functions.

In one possible design, the apparatus includes a processor and a communication interface configured to support the apparatus to perform the corresponding functions of the above methods. The communication interface is used to support communication between the device and other network elements. The apparatus can also include a memory for coupling with the processor that retains the program instructions and data necessary for the apparatus.

In another aspect, the embodiment of the present application provides a device for wireless communication, where the device can implement the functions performed by the terminal device in the method related to the foregoing aspect, and the function can be implemented by using hardware, or the corresponding software can be executed by hardware. achieve. The hardware or software includes one or more corresponding units or modules of the above functions.

In one possible design, the apparatus includes a processor and a transceiver configured to support the apparatus to perform the corresponding functions of the above methods. The transceiver is used to support communication between the device and other network elements. The apparatus can also include a memory for coupling with the processor that retains the program instructions and data necessary for the apparatus.

In a further aspect, the embodiment of the present application provides a communication system, where the system includes the gateway device and the terminal device in the foregoing aspect.

In a further aspect, the embodiment of the present application provides a computer storage medium for storing computer software instructions used by the gateway device, which includes a program designed to perform the above aspects.

In a further aspect, the embodiment of the present application provides a computer storage medium for storing the foregoing terminal device. A computer software instruction is included that includes a program designed to perform the above aspects.

Compared with the prior art, according to the method and apparatus for wireless communication provided by the embodiment of the present application, the gateway device determines the security algorithm supported by the terminal device according to the security capability of the terminal device, and indicates the target security selected by the gateway device to the terminal device. The algorithm, so that the terminal device and the gateway device can select a suitable security algorithm to communicate, and enhance the security performance of communication between the terminal device and the gateway device.

DRAWINGS

1 is a schematic structural diagram of a communication system to which an embodiment of the present application is applied;

2 is a schematic flowchart of a method for wireless communication provided by an embodiment of the present application;

3 is a schematic flowchart of another method for wireless communication provided by an embodiment of the present application;

4 is a schematic flowchart of still another method for wireless communication provided by an embodiment of the present application;

FIG. 5 is a schematic flowchart of still another method for wireless communication provided by an embodiment of the present application; FIG.

FIG. 6 is a schematic flowchart of still another method for wireless communication provided by an embodiment of the present application; FIG.

FIG. 7 is a schematic flowchart of still another method for wireless communication provided by an embodiment of the present application; FIG.

FIG. 8A is a schematic structural diagram of a possible gateway device according to an embodiment of the present disclosure;

8B is a schematic structural diagram of another possible gateway device provided by an embodiment of the present application;

9A is a schematic structural diagram of a possible terminal device according to an embodiment of the present application;

FIG. 9B is a schematic structural diagram of another possible terminal device according to an embodiment of the present application.

detailed description

The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

FIG. 1 is a schematic architectural diagram of a communication system suitable for use in an embodiment of the present application. As shown in FIG. 1, the communication system 100 includes a terminal device 120 and a gateway device 110. The terminal device 120 can directly communicate with the gateway device 110, and can also communicate with the gateway device 110 through other devices.

In the embodiment of the present application, the terminal device 120 may communicate with one or more core network devices via a radio access network, and the terminal device 120 may be referred to as an access terminal, a user equipment (User Equipment, UE), a subscriber unit, User station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device. The access terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, a Personal Digital Assistant (PDA), with wireless communication. A functional handheld device, a computing device, or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, and a terminal device in a 5th-Generation (5G) communication system.

The gateway device 110 may be a gateway device in a Global System for Mobile Communication (GSM) system, a gateway device in a Code Division Multiple Access (CDMA) system, or a long term evolution ( A gateway device in a Long Term Evolution, LTE) system or a gateway device in a 5G communication system.

It should be understood that the above-mentioned communication system 100 is only an example. The communication system that is applicable to the embodiment of the present application is not limited thereto. For example, the communication system applicable to the embodiment of the present application may further include a Mobility Management Entity (MME). The terminal device communicates with the gateway device through the MME; for example, the communication system applicable to the embodiment of the present application may further include a serving GPRS support node (Serving GPRS Support) Node, SGSN, where GPRS is the abbreviation of "General Packet Radio Service", and the terminal device communicates with the gateway device through the SGSN. For example, the communication system applicable to the embodiment of the present application may further include an Access Management Function (AMF) and/or a Session Management Function (SMF), and the terminal device uses the AMF and/or the SMF and the gateway device. Communication.

FIG. 2 is a schematic flowchart of a method for wireless communication provided by an embodiment of the present application. As shown in Figure 2, the method includes:

S210. The gateway device determines a target security algorithm from a security algorithm supported by the terminal device.

The terminal device may support one security algorithm or multiple security algorithms. When the terminal device is a security algorithm, the gateway device determines that the security algorithm is a target security algorithm; when the terminal device supports multiple security algorithms, the gateway device determines a target security algorithm from the multiple security algorithms, where the target security The algorithm may be the security algorithm with the highest security level among the multiple security algorithms, or the security algorithm with lower security level among the multiple security algorithms, so that the appropriate security algorithm can be flexibly determined according to actual conditions.

S220. The gateway device sends first indication information to the terminal device, where the first indication information is used to indicate the target security algorithm.

S230. The gateway device communicates with the terminal device according to the target security algorithm.

After the gateway device and the terminal device negotiate the security algorithm, the communication is performed according to the target security algorithm, thereby enhancing the security performance of communication between the terminal device and the gateway device.

Optionally, before the gateway device communicates with the terminal device according to the target security algorithm, the method 200 further includes:

S201, the gateway device sends second indication information and a message authentication code (MAC) to the terminal device, where the second indication information is used to indicate an integrity algorithm, the integrity algorithm, and the The MAC is used by the terminal device to check the integrity of the message carrying the first indication information.

In the embodiment of the present application, the second indication information is used to indicate an integrity algorithm selected by the gateway device (where the terminal device supports the integrity algorithm), and the MAC is a correct result calculated according to the integrity algorithm, if the terminal device is configured according to the The result obtained by the integrity algorithm is the same as the MAC, indicating that the message carrying the first indication information is complete and has not been tampered with, and the terminal device can communicate with the gateway device according to the target security algorithm indicated by the first indication information; The result obtained by the integrity algorithm is different from the MAC, indicating that the message carrying the first indication information is incomplete, the message may be tampered with, and the terminal device may abandon the target security algorithm indicated by the first indication information. The second indication information and the MAC may be carried in the same message as the first indication information, or may be carried in a different message from the first indication information.

Therefore, in the method for wireless communication provided by the embodiment of the present application, the gateway device instructs the terminal device to perform integrity verification on the message carrying the first indication information, so that the communication security caused by the tampering of the message carrying the first indication information is prevented from being weakened. The security of communication between the terminal device and the gateway device is enhanced.

S202. The gateway device sends security capability information to the terminal device, so that the terminal device checks whether the security capability information is correct according to the security capability of the terminal device.

For example, the security capability information indicates a security algorithm. After receiving the security capability information, the terminal device verifies whether the security capability information is correct according to a security algorithm supported by the terminal device. If the security capability information indicates a security algorithm and If the security algorithm supported by the terminal device is consistent, the terminal device determines that the security capability information is correct, indicating that the security capability of the terminal device determined by the gateway device is correct, and the terminal device can communicate with the gateway device according to the target security algorithm indicated by the first indication information; If the security algorithm indicated by the security capability information is inconsistent with the security algorithm supported by the terminal device, the terminal device determines that the security capability information is incorrect, indicating that the security capability of the terminal device determined by the gateway device is incorrect, and the terminal device may abandon the use of the first indication information. Indicated target security algorithm. The foregoing embodiment is only an example, and the embodiment of the present application is not limited thereto. For example, the security information may also indicate other content. In addition, the security capability information may be carried in the same message as the first indication information, or may be carried in a different message from the first indication information.

Therefore, in the method for wireless communication provided by the embodiment of the present application, the terminal device can prevent the network device from determining the target security algorithm according to the security capability of the wrong terminal device by verifying the security capability information sent by the network device, thereby enhancing the terminal device and the gateway. Security performance of communication between devices.

Optionally, the method 200 further includes:

S203. The gateway device receives security capability information from the terminal device or a core network device.

S204. The gateway device determines, according to the security capability information, a security algorithm supported by the terminal device.

The gateway device may obtain the security capability information of the terminal device from the terminal device, or obtain the terminal device from other core network devices (for example, a Home Subscriber Server (HSS) or a Home Location Register (HLR)). Security capability information, so that the security capabilities of the terminal device can be flexibly determined.

FIG. 3 is a schematic flowchart of another method for wireless communication provided by an embodiment of the present application. As shown in FIG. 3, the method includes:

S310. The terminal device receives first indication information from the gateway device, where the first indication information is used to indicate a target security algorithm.

The terminal device may support one security algorithm or multiple security algorithms. When the terminal device is a security algorithm, the target security algorithm is the security algorithm; when the terminal device supports multiple security algorithms, the target security algorithm may be the security algorithm with the highest security level among the multiple security algorithms, or A security algorithm with a lower security level in multiple security algorithms, so that a suitable security algorithm can be flexibly determined according to actual conditions. .

S320. The terminal device communicates with the gateway device according to the target security algorithm.

After determining the target security algorithm according to the indication information sent by the gateway device, the terminal device communicates with the gateway device according to the target security algorithm, thereby enhancing the security performance of communication between the terminal device and the gateway device.

Optionally, before the terminal device communicates with the gateway device according to the target security algorithm, the method 300 further includes:

S330. The terminal device receives second indication information and a MAC from the gateway device, where the second indication information is used to indicate an integrity algorithm.

S340. The terminal device checks, according to the integrity algorithm and the MAC, the integrity of the message that carries the first indication information.

In the embodiment of the present application, the second indication information is used to indicate an integrity algorithm selected by the gateway device (ie, the gateway device), wherein the terminal device supports the integrity algorithm, and the MAC is the correct result calculated according to the integrity algorithm. If the result obtained by the terminal device according to the integrity algorithm is the same as the MAC, the message carrying the first indication information is complete and has not been tampered with, and the target device may use the target security algorithm and the gateway device indicated by the first indication information. Communicate; if the terminal device obtains a result different from the MAC according to the integrity algorithm, The message carrying the first indication information is incomplete, the message may be tampered with, and the terminal device may abandon the target security algorithm indicated by the first indication information. The second indication information and the MAC may be carried in the same message as the first indication information, or may be carried in a different message from the first indication information.

Therefore, in the method for wireless communication provided by the embodiment of the present application, the terminal device performs integrity verification on the message carrying the first indication information, so that the communication security caused by the tampering of the message carrying the first indication information is prevented, and the terminal is enhanced. The security of communication between the device and the gateway device.

S350. The terminal device receives security capability information from the gateway device.

S360: The terminal device checks whether the security capability information is correct according to the security capability of the terminal device.

The security capability information may, for example, indicate a security algorithm. After receiving the security capability information, the terminal device checks whether the security capability information is correct according to a security algorithm supported by the terminal device, if the security algorithm indicated by the security capability information and the security algorithm supported by the terminal device. If the security device is correct, the terminal device determines that the security capability of the terminal device is correct, and the terminal device can communicate with the gateway device according to the target security algorithm indicated by the first indication information; if the security capability information indicates The security algorithm is inconsistent with the security algorithm supported by the terminal device, and the terminal device determines that the security capability information is incorrect, indicating that the security capability of the terminal device determined by the gateway device is incorrect, and the terminal device may abandon the target security algorithm indicated by the first indication information. The foregoing embodiment is only an example, and the embodiment of the present application is not limited thereto. For example, the security information may also indicate other content. In addition, the security capability information may be carried in the same message as the first indication information, or may be carried in a different message from the first indication information.

Therefore, in the method for wireless communication provided by the embodiment of the present application, the terminal device can prevent the gateway device from determining the target security algorithm according to the security capability of the wrong terminal device by verifying the security capability information sent by the gateway device, thereby enhancing the terminal device and the gateway. Security performance of communication between devices.

Optionally, before the receiving, by the terminal device, the first indication information, the method further includes:

S370. The terminal device sends security capability information to the gateway device, where the security capability information is used to indicate a security algorithm supported by the terminal device.

The method for wireless communication provided by the embodiment of the present application can enable the gateway device to flexibly determine the security capability of the terminal device.

The foregoing embodiment describes the method of the wireless communication provided by the present application from the perspective of the gateway device and the terminal device. The following describes the embodiments of the present application in further detail based on the common aspects of the embodiments of the present application.

FIG. 4 is a schematic diagram of communication of a method for wireless communication according to an embodiment of the present application. As shown in FIG. 4, the method 400 includes:

S401. The UE sends an attach request/tracking area update request message to the SGSN, where the request message carries the identifier of the UE.

S402. The SGSN sends an authentication data request message to the HLR/HSS, where the request message carries the identifier of the UE.

S403. The HLR/HSS generates an Authentication Vector (AV) according to the identifier of the UE, and calculates an E2E security key, where the security key includes an encryption key (Ciphering Key, CK) and an integrity key (Integrity Key, IK). ).

S404. The HLR/HSS sends the AV to the SGSN.

S405. The UE and the SGSN perform authentication according to the AV.

S406: After the authentication succeeds, if the UE supports E2E security, the E2E security key is calculated.

S407. The HLR/HSS pushes the E2E security key to the Gateway GPRS Support Node (GGSN).

S408. The UE sends a Packet Data Protocol (PDP) context request message to the SGSN, where the request message includes the identifier of the UE, the security capability of the UE, and the E2E security indication. In this implementation, the E2E security indication is optional. ).

S409. The SGSN sends a PDP Context Request message to the GGSN, where the request message includes the identifier of the UE, the security capability of the UE, and the E2E security indication.

S410. The GGSN obtains an E2E security key from the HLR/HSS, where S410 and S407 are performed one by one.

S411. The GGSN selects an encryption algorithm (ie, a target security algorithm) and an integrity algorithm according to the security capability of the UE and the GGSN algorithm priority list.

S412. The GGSN sends a setup PDP context response message to the SGSN, where the response message includes an encryption algorithm selected by the GGSN, an integrity algorithm, a security capability of the UE, and a MAC value.

S413. The SGSN sends an activation PDP context accept message to the UE, where the acceptance message includes an encryption algorithm, an integrity algorithm, a security capability of the UE, and a MAC value.

S414: After the UE successfully verifies the security capabilities of the MAC and the UE, the UE and the GGSN provide E2E confidentiality and integrity protection for the data.

In the method 400 for wireless communication provided by the embodiment of the present application, the gateway device (ie, the GGSN) determines the security algorithm supported by the terminal device according to the security capability of the terminal device (ie, the UE), and indicates the target selected by the gateway device to the terminal device. The security algorithm can select a suitable security algorithm for communication, and enhances the security performance of communication between the terminal device and the gateway device.

FIG. 5 is a schematic diagram of communication of a method for wireless communication according to an embodiment of the present application. As shown in FIG. 5, the method 500 includes:

S501: The UE sends an attach request/tracking area update request message to the MME, where the request message carries the identifier of the UE.

S502: The MME sends an authentication data request message to the HLR/HSS, where the request message carries the identifier of the UE.

S503. The HLR/HSS generates an AV according to the identifier of the UE and calculates an E2E security key, where the security key includes CK and IK.

S504. The HLR/HSS sends the AV and E2E security indication to the MME.

S505. The UE and the MME perform authentication according to the AV.

S506: After the authentication succeeds, if the UE supports E2E security, the E2E security key is calculated.

S507, the HLR/HSS pushes the E2E security key to the Packet Data Network Gateway (P-GW).

S508. The MME sends a setup session request message to the serving gateway (S-GW). If the MME receives the E2E security indication from the HLR/HSS, the request message includes the identifier of the UE and the security capability of the UE.

S509: The S-GW sends a setup session request message to the P-GW, where the request message includes an identifier of the UE, and a security capability of the UE.

S510: The P-GW obtains an E2E security key from the HLR/HSS, where S510 and S507 are selectively executed.

S511. The P-GW selects an encryption algorithm (ie, a target security algorithm) and an integrity algorithm according to the security capability of the UE and the P-GW algorithm priority list.

S512. The P-GW sends a session establishment response message to the S-GW, where the response message includes an encryption algorithm selected by the P-GW, an integrity algorithm, a security capability of the UE, and a MAC.

S513. The S-GW sends a setup session response message to the MME, where the response message includes an encryption algorithm, an integrity algorithm, a security capability of the UE, and a MAC.

S514: The MME sends an attach accept message to the UE, where the accept message includes an encryption algorithm, an integrity algorithm, a security capability of the UE, and a MAC.

S515. The UE verifies the security capabilities of the MAC and the UE.

S516. After the UE successfully verifies the MAC and the security capability of the UE, the UE sends an attach complete message to the MME.

S517. The MME sends a modify bearer request message to the S-GW.

S518. The S-GW sends a modify bearer request message to the P-GW.

S519, the UE and the P-GW provide E2E confidentiality and integrity protection for the data.

The method 500 for wireless communication provided by the embodiment of the present application, the gateway device (ie, the P-GW) determines the security algorithm supported by the terminal device according to the security capability of the terminal device (ie, the UE), and indicates to the terminal device that the gateway device selects The target security algorithm, so that a suitable security algorithm can be selected for communication, and the security performance of communication between the terminal device and the gateway device is enhanced.

FIG. 6 is a schematic diagram of communication of a method for wireless communication according to an embodiment of the present application. As shown in FIG. 6, the method 600 includes:

S601, the HLR/HSS pushes the E2E security key and the security capability of the UE to the GGSN/P-GW, or the GGSN/P-GW obtains the E2E security key and the security capability of the UE from the HLR/HSS, wherein the HLR/HSS saves The security data of the UE is pre-configured in the subscription data.

S602. The GGSN selects an encryption algorithm and an integrity algorithm according to the security capability of the UE and the GGSN algorithm priority list, or the P-GW selects an encryption algorithm and an integrity algorithm according to the security capability of the UE and the P-GW algorithm priority list.

S603, the GGSN sends a response message to the SGSN, where the response message includes an encryption algorithm selected by the GGSN (ie, a target security algorithm), an integrity algorithm, a security capability of the UE, and a MAC, or the P-GW sends a response message to the MME, and the response message is sent. The encryption algorithm selected by the P-GW (ie, the target security algorithm), the integrity algorithm, the security capability of the UE, and the MAC are included.

S604: The SGSN/MME sends a response message to the UE, where the response message includes an encryption algorithm, an integrity algorithm, a security capability of the UE, and a MAC.

S605. The UE verifies the security capabilities of the MAC and the UE.

S606: After the UE successfully verifies the security capabilities of the MAC and the UE, the UE and the GGSN/P-GW provide E2E confidentiality and integrity protection for the data.

In the method 600 for wireless communication provided by the embodiment of the present application, the gateway device (ie, the P-GW or the GGSN) determines the security algorithm supported by the terminal device according to the security capability of the terminal device (ie, the UE), and indicates the gateway device to the terminal device. The selected target security algorithm can select a suitable security algorithm for communication, and enhances the security performance of communication between the terminal device and the gateway device.

FIG. 7 is a schematic diagram of communication of a method for wireless communication according to an embodiment of the present application. As shown in FIG. 7, the method 700 includes:

S701: The HLR/HSS pushes the E2E security key to the GGSN/P-GW, where the subscription data saved by the HLR/HSS is pre-configured with the security capability of the UE.

S702: The UE sends a request message to the SGSN/MME, where the message includes the security capability of the UE.

S703: The SGSN sends a request message to the GGSN, where the request message includes the security capability of the UE. Alternatively, the MME sends a request message to the P-GW, where the request message includes the security capability of the UE.

S704: The GGSN/P-GW obtains an E2E security key from the HLR/HSS, where S701 and S704 are performed by one of two;

S705: The GGSN selects an encryption algorithm and an integrity algorithm according to the security capability of the UE and the GGSN algorithm priority list. Alternatively, the P-GW selects an encryption algorithm and an integrity algorithm according to the security capability of the UE and the P-GW algorithm priority list.

S706: The GGSN sends a response message to the SGSN, where the response message includes an encryption algorithm selected by the GGSN (ie, a target security algorithm), an integrity algorithm, a security capability of the UE, and a MAC. Alternatively, the P-GW sends a response message to the MME, and the response message is sent. The encryption algorithm selected by the P-GW (ie, the target security algorithm), the integrity algorithm, the security capability of the UE, and the MAC are included.

S707: The SGSN/MME sends a response message to the UE, where the response message includes an encryption algorithm, an integrity algorithm, a security capability of the UE, and a MAC.

S708. The UE verifies the security capabilities of the MAC and the UE.

S709: After the UE successfully verifies the security capabilities of the MAC and the UE, the UE and the GGSN/P-GW provide E2E confidentiality and integrity protection for the data.

The method 700 for wireless communication provided by the embodiment of the present application, the gateway device (ie, the P-GW or the GGSN) determines the security algorithm supported by the terminal device according to the security capability of the terminal device (ie, the UE), and indicates the gateway device to the terminal device. The selected target security algorithm can select a suitable security algorithm for communication, and enhances the security performance of communication between the terminal device and the gateway device.

The solution of the embodiment of the present application is mainly introduced from the perspective of interaction between network elements. It can be understood that the gateway device and the terminal device include corresponding hardware structures and/or software modules for performing the respective functions in order to implement the above functions. Those skilled in the art will readily appreciate that the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.

The embodiments of the present application may perform functional unit division on a gateway device, a terminal device, and the like according to the foregoing method. For example, each functional unit may be divided according to each function, or two or more functions may be integrated into one processing unit. . The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.

In the case of employing an integrated unit, FIG. 8A shows a possible structural diagram of the gateway device involved in the above embodiment. The gateway device 800 includes a processing unit 802 and a communication unit 803. Processing unit 802 is configured to control management of the actions of gateway device 800, for example, processing unit 802 for supporting gateway device 800 to perform S210 of FIG. 2 and/or other processes for the techniques described herein. Communication unit 803 is used to support communication between gateway device 800 and other network entities, such as with the UE shown in FIG. Gateway device 800 can also A storage unit 801 is included for storing program codes and data of the gateway device 800.

The processing unit 802 can be a processor or a controller, and can be, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 803 can be a communication interface or the like. The storage unit 801 can be a memory.

When the processing unit 802 is a processor, the communication unit 803 is a communication interface, and the storage unit 801 is a memory, the gateway device involved in the embodiment of the present application may be the gateway device shown in FIG. 8B.

Referring to FIG. 8B, the gateway device 810 includes a processor 812, a communication interface 813, and a memory 811. The communication interface 813, the processor 812, and the memory 811 can communicate with each other through an internal connection path to transfer control and/or data signals.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

Therefore, the gateway device provided by the embodiment of the present application determines the security algorithm supported by the terminal device according to the security capability of the terminal device, and indicates the target security algorithm selected by the gateway device to the terminal device, so that a suitable security algorithm can be selected for communication. The security of communication between the terminal device and the gateway device is enhanced.

In the case of employing an integrated unit, FIG. 9A shows a possible structural diagram of the terminal device involved in the above embodiment. The terminal device 900 includes a processing unit 902 and a communication unit 903. The processing unit 902 is configured to control and manage the actions of the terminal device 900. For example, the processing unit 902 is configured to support the terminal device 900 through the communication unit 903 to perform S310 of FIG. 3, and/or other processes for the techniques described herein. Communication unit 903 is used to support communication between terminal device 900 and other network entities, such as with the GGSN shown in FIG. The terminal device 900 may further include a storage unit 901 for storing program codes and data of the terminal device 900.

The processing unit 902 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 903 can be a transceiver, a transceiver circuit, or the like. The storage unit 901 can be a memory.

When the processing unit 902 is a processor, the communication unit 903 is a transceiver, and the storage unit 901 is a memory, the terminal device involved in the embodiment of the present application may be the terminal device shown in FIG. 9B.

Referring to FIG. 9B, the terminal device 910 includes a processor 912, a transceiver 913, and a memory 911. The transceiver 913, the processor 912, and the memory 911 can communicate with each other through an internal connection path to transfer control and/or data signals.

Therefore, after determining the target security algorithm according to the indication information sent by the gateway device, the terminal device provided by the embodiment of the present application communicates with the gateway device according to the target security algorithm, thereby enhancing the terminal device and the gateway device. The security of communication between.

In the various embodiments of the present application, the size of the sequence number of each process does not mean the order of execution sequence, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. .

In addition, the term "and/or" herein is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A and B exist at the same time. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

The steps of the method or algorithm described in connection with the disclosure of the embodiments of the present application may be implemented in a hardware manner, or may be implemented by a processor executing software instructions. The software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a gateway device or a terminal device. Of course, the processor and the storage medium may also exist as a discrete component in the gateway device or the terminal device.

Those skilled in the art will appreciate that in one or more examples described above, the functions described herein can be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

The specific embodiments of the present invention have been described in detail with reference to the specific embodiments of the present application. It is to be understood that the foregoing description is only The scope of protection, any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application are included in the scope of protection of the present application.

Claims

A method of wireless communication, comprising:

The gateway device determines a target security algorithm from a security algorithm supported by the terminal device;

The gateway device sends first indication information to the terminal device, where the first indication information is used to indicate the target security algorithm;

The gateway device communicates with the terminal device according to the target security algorithm.
The method according to claim 1, wherein before the gateway device communicates with the terminal device according to the target security algorithm, the method further includes:

Transmitting, by the gateway device, second indication information and a message authentication code MAC to the terminal device, where the second indication information is used to indicate an integrity algorithm, where the integrity algorithm and the MAC are used by the terminal device Checking the integrity of the message carrying the first indication information.
The method according to claim 1 or 2, wherein before the gateway device communicates with the terminal device according to the target security algorithm, the method further includes:

The gateway device sends security capability information to the terminal device, so that the terminal device checks whether the security capability information is correct according to the security capability of the terminal device.
The method according to any one of claims 1 to 3, further comprising:

Receiving, by the gateway device, security capability information from the terminal device or a core network device;

The gateway device determines a security algorithm supported by the terminal device according to the security capability information.
A method of wireless communication, comprising:

Receiving, by the terminal device, first indication information, where the first indication information is used to indicate a target security algorithm;

The terminal device communicates with the gateway device according to the target security algorithm.
The method according to claim 5, wherein before the terminal device communicates with the gateway device according to the target security algorithm, the method further includes:

Receiving, by the terminal device, second indication information and a message authentication code MAC, where the second indication information is used to indicate an integrity algorithm;

The terminal device checks the integrity of the message carrying the first indication information according to the integrity algorithm and the MAC check.
The method according to claim 5 or 6, wherein before the terminal device communicates with the gateway device according to the target security algorithm, the method further includes:

Receiving, by the terminal device, security capability information from the gateway device;

The terminal device verifies whether the security capability information is correct according to the security capability of the terminal device.
The method according to any one of claims 5 to 7, wherein before the terminal device receives the first indication information from the gateway device, the method further includes:

The terminal device sends security capability information to the gateway device, where the security capability information is used to indicate a security algorithm supported by the terminal device.
A gateway device, comprising: a processing unit and a communication unit,

The processing unit is configured to determine a target security algorithm from a security algorithm supported by the terminal device, and configured to send first indication information to the terminal device by using the communication unit, where the first indication information is used to indicate the target a security algorithm; and for communicating with the terminal device through the communication unit in accordance with the target security algorithm.
The gateway device according to claim 9, wherein the processing unit is further configured to:

Transmitting, by the communication unit, the second indication information and the message authentication code MAC to the terminal device, where the second indication information is used to indicate an integrity algorithm, and the integrity algorithm and the MAC are used by the terminal device Verifying the integrity of the message carrying the first indication information.
The gateway device according to claim 9 or 10, wherein the processing unit is further configured to:

The security capability information is sent to the terminal device by the communication unit, so that the terminal device checks whether the security capability information is correct according to the security capability of the terminal device.
The gateway device according to any one of claims 9 to 11, wherein the processing unit is further configured to:

Receiving security capability information from the terminal device or the core network device by the communication unit; and determining a security algorithm supported by the terminal device according to the security capability information.
A terminal device for wireless communication, comprising: a processing unit and a communication unit,

The processing unit is configured to receive first indication information from the gateway device by using the communication unit, where the first indication information is used to indicate a target security algorithm; and configured to use the communication unit according to the target security algorithm The gateway device communicates.
The terminal device according to claim 13, wherein the processing unit is further configured to:

Receiving, by the communication unit, second indication information and a message authentication code MAC from the gateway device, the second indication information being used to indicate an integrity algorithm; and for performing, according to the integrity algorithm and the MAC check The integrity of the message carrying the first indication information.
The terminal device according to claim 13 or 14, wherein the processing unit is further configured to:

Receiving security capability information from the gateway device by the communication unit; and verifying whether the security capability information is correct according to the security capability of the terminal device.
The terminal device according to any one of claims 13 to 15, wherein the processing unit is further configured to:

The security capability information is sent to the gateway device by the communication unit, where the security capability information is used to indicate a security algorithm supported by the terminal device.