WO2018137255A1 - 数据的保护方法、装置和系统 - Google Patents

数据的保护方法、装置和系统 Download PDF

Info

Publication number
WO2018137255A1
WO2018137255A1 PCT/CN2017/072782 CN2017072782W WO2018137255A1 WO 2018137255 A1 WO2018137255 A1 WO 2018137255A1 CN 2017072782 W CN2017072782 W CN 2017072782W WO 2018137255 A1 WO2018137255 A1 WO 2018137255A1
Authority
WO
WIPO (PCT)
Prior art keywords
network node
service
security
node
data
Prior art date
Application number
PCT/CN2017/072782
Other languages
English (en)
French (fr)
Inventor
潘凯
李�赫
陈璟
胡力
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201780074415.5A priority Critical patent/CN110024331B/zh
Priority to EP17894055.7A priority patent/EP3567802A4/en
Priority to PCT/CN2017/072782 priority patent/WO2018137255A1/zh
Publication of WO2018137255A1 publication Critical patent/WO2018137255A1/zh
Priority to US16/522,278 priority patent/US11140545B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
    • H04W8/20—Transfer of user or subscriber data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation

Definitions

  • the present invention relates to communication systems, and in particular, to a data protection method, apparatus, and system.
  • the evolved node-B performs security protection on the downlink data of the service of the terminal device, for example, encryption protection, integrity. Protection, and the downlink data after performing the security protection is sent to the terminal device through the air interface between the base station and the terminal device; correspondingly, the terminal device performs security protection on the uplink data of the service, and passes the uplink data that performs the security protection through the air interface. Send to the base station.
  • the security-protected data is in a state of security protection during the air interface transmission, which can effectively prevent the attacker from robbing.
  • the embodiments of the present invention provide a method, a device, and a system for protecting data in a communication system, which can implement flexible security selection of network nodes, meet security requirements of operators or services, and improve network security.
  • a first aspect provides a method for protecting data in a communication system, comprising: a core network node acquiring information related to a service of a terminal device; and the core network node determining, according to the information associated with the service, the service The data is executed by a secure network node.
  • the method can flexibly select different network nodes for different services to perform security protection, thereby meeting the security requirements of operators or services.
  • the core network node determines, according to the information associated with the service, a network node that performs security protection on data of the service, including: the core Determining, by the network node, the network node according to the security capability of the user plane function UPF node to which the core network node is connected, and the information associated with the service; or, the core network node is associated with the service according to the information
  • the network node is determined in correspondence with a network node performing security protection.
  • the core network node acquires information related to the service of the terminal device, including: the core network node Receiving, by the terminal device, a request message, the request message is used to request to establish a session for the service, the request message includes information associated with the service; or the core network node is associated according to the core network node Slice information to obtain information associated with the business.
  • the network node is a UPF node
  • the method further includes: the core network node sending security related parameters Give the UPF node.
  • the security related parameter includes: a user plane root key K up , a security capability of the terminal device, and the UPF node Security policy.
  • the core network node indicates, to the UPF node, a user plane of data of the service
  • the UP security protection mode includes at least one of encryption protection and integrity protection; or the core network node indicates to the UPF node that the network node is a UPF node.
  • the security capability of the terminal device includes only the encryption capability of the terminal device; or The security capability includes only the integrity protection capability of the terminal device; or the security capability of the terminal device includes the encryption capability of the terminal device and the integrity protection capability of the terminal device.
  • the core network node is a session management function SMF node, and the SMF node receives UP security from the UPF node. algorithm.
  • the network node is a UPF node
  • the core network node is an SMF node
  • the SMF node determines an UP security algorithm according to the security capability of the terminal device and the security capability of the UPF node
  • the SMF node according to the UP security algorithm, K up and the The security policy of the UPF obtains a security key
  • the SMF node sends the UP security algorithm, and the security key and the identifier associated with the service are sent to the UPF node.
  • the SMF node instructs the UPF node to perform security protection on data of the service.
  • the SMF node indicates, to the terminal device, UP security protection of data of the service
  • the method of the UP security protection includes at least one of encryption protection and integrity protection.
  • the core network node sends a security policy of the access network node and an identifier of the service association to the Access network node.
  • the core network node indicates to the access network node that the network node is not an access network node; or The core network node indicates to the access network node that the network node is a UPF node; or the core network node indicates, to the access network node, an UP security protection mode of data of the service.
  • the network node is an access network node
  • the core network node sends the security policy of the access network node and the identifier of the service association to the access network node; the core network node indicates to the access network node that the network node is connected The network node, or the core network node indicates to the access network node that the network node is not a UPF node.
  • the core network node indicates, to the serving UPF node of the terminal device, that security protection is not performed on data of the service, Or the core network node indicates to the serving UPF node of the terminal device that the network node is not a UPF node; or the core network node indicates to the serving UPF node of the terminal device that the network node is an access network. node.
  • a second aspect provides a method for protecting data in a communication system, comprising: receiving, by a UFP node, information or security protection mode information of a network node that performs security protection on data of a service of the terminal device from a core network node; Determining whether to perform security on the data of the service according to the information of the network node or the security protection mode information protection.
  • the method enables the UPF node to flexibly perform security protection on the service of the terminal device according to the indication of the network node to meet the security requirements of the operator or the service.
  • the information of the network node includes: a network node that performs security protection on data of the service is an access network node; or, for the service The network node that performs security protection is not the access network node; or the network node that performs security protection on the data of the service is not a UPF node; or the network node that performs security protection on the data of the service is a UPF node.
  • the security protection mode information includes: a user plane UP security protection mode of the data of the service, where the UP security protection mode includes encryption protection and integrity. At least one of the protections.
  • the UPF node determines a user plane UP security algorithm according to the security capability of the terminal device and the security capability of the UPF node, The UF node determines an encryption algorithm according to the encryption capability of the terminal device and the encryption capability of the UPF node, when the security capability of the terminal device includes only the encryption capability of the terminal device; or When the security capability of the terminal device only includes the integrity protection capability of the terminal device, the UPF node determines an integrity protection algorithm according to the integrity protection capability of the terminal device and the integrity protection capability of the UPF node; Or, when the security capability of the terminal device includes the encryption capability of the terminal device and the integrity protection capability of the terminal device, the UPF node is configured according to the security capability of the terminal device and the security capability of the UPF node. Determine the encryption algorithm and the integrity protection algorithm.
  • the security protection mode information includes the UP security protection mode
  • the UPF node is configured according to the security capability and location of the terminal device.
  • the security function of the UPF node determines the UP security algorithm
  • the UFP node determines the UP security algorithm according to the UP security protection mode, the security capability of the terminal device, and the security capability of the UPF node.
  • the UFP node according to the UP security protection mode, the security capability of the terminal device, and the security capability of the UPF node, Determining the UP security algorithm, including: when the UP security protection mode is encryption protection, the UPF node determines an encryption algorithm according to an encryption capability of the terminal device and an encryption capability of the UPF node; or When the UP security protection mode is integrity protection, the UPF node determines an integrity protection algorithm according to the integrity protection capability of the terminal device and the integrity protection capability of the UPF node; or, when the UP security protection When the mode is cryptographic protection and integrity protection, the UPF node determines an encryption algorithm and an integrity protection algorithm according to the security capability of the terminal device and the security capability of the UPF node.
  • the UPF node sends the UP security algorithm to the terminal device.
  • the core network node is a session management function SMF node
  • the method further includes: the UPF node according to the The security key, the UP security algorithm and the identifier associated with the service perform security protection on data of the service.
  • a third aspect provides a method for protecting data in a communication system, where the method includes: accessing The network node acquires information related to the service of the terminal device; and the access network node determines whether to perform security protection on the data of the service according to the information associated with the service.
  • the method realizes that the access network node independently determines whether to perform security protection, thereby decoupling the security protection between the access network node and the security protection of the UPF node, and improving the security performance of the network.
  • the access network node determines, according to the information associated with the service, whether to perform security protection on data of the service, including: The network access node determines, according to the information associated with the service and the information indicated by the core network node, whether to perform security protection on the data of the service;
  • the information indicating that the network node that performs security protection on the data of the service is an access network node; or the network node that performs security protection on data of the service is not an access network node; or, The network node that performs the security protection of the data of the service is not a user plane function UPF node; or the network node that performs security protection on the data of the service is a UPF node; or the user plane UP security protection mode of the data of the service
  • the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the method when determining to perform security protection on the data of the service, the method further includes: the access network Determining, by the node, the access network node to perform security protection on data of the service; or, the access network node instructing the terminal device to perform access layer AS security protection mode of data of the service
  • the AS security protection mode includes at least one of encryption protection and integrity protection.
  • the access network node acquires a security capability of the terminal device, a security policy of the access network node, and the An identifier of the service association; the access network node determines an AS security algorithm according to the security capability of the terminal device and the security capability of the access network node; and the access network node is based on the security of the access network node
  • the policy, the AS security algorithm and the access network key Kan obtain a security key; the access network node sends the AS security algorithm and the identifier associated with the service to the terminal device.
  • the access network node according to the AS security algorithm, the security key and the identifier associated with the service, The data of the service performs security protection.
  • the method when it is determined that security is not performed on the data of the service, the method further includes: the accessing The network node indicates to the terminal device that the access network node does not perform security protection on data of the service.
  • a fourth aspect provides a method for protecting data in a communication system, where the method includes: receiving, by a terminal device, an access layer AS security algorithm and an identifier of a service association of the terminal device from an access network node; The terminal device obtains a first security key according to the AS security algorithm, an access network key Kan and an AS security protection mode of the data of the service indicated by the access network node, and the AS security protection
  • the method includes at least one of cryptographic protection and integrity protection; and the terminal device performs security protection on the data of the service according to the first security key, the AS security algorithm, and the identifier associated with the service.
  • the method can ensure successful decoupling between the security protection of the UPF node and the security protection of the access network node, and improve the security performance.
  • the fifth aspect provides a data protection method in a communication system, where the method includes: the terminal device receives, from an access network node, an access layer AS security algorithm and an identifier of a service association of the terminal device; When the access network node instructs the access network node to perform security protection on the data of the service, the terminal device obtains the first security key according to the AS security algorithm and the access network key K an The terminal device performs security protection on the data of the service according to the first security key, the AS security algorithm, and the identifier associated with the service. The method can successfully decouple the security protection of the UPF node from the security protection of the access network node, and improve the security performance.
  • the terminal device receives a user plane UP security algorithm from a core network node; the terminal device according to the UP security algorithm and a user plane root key K up , get the second security key.
  • the terminal device obtains a second security key according to the UP security algorithm and K up , including: the terminal device Obtaining the second security key according to the UP security algorithm, the Kup and the UP security protection mode of the data of the service indicated by the core network node;
  • the UP security protection mode includes at least one of encryption protection and integrity protection.
  • a core network node comprising means or means for performing the various steps of any of the methods of the above first aspect.
  • a core network node comprising a processor and a memory, the memory is for storing a program, and the processor calls a program stored in the memory to perform any of the methods of the above first aspect.
  • a core network node comprising at least one processing element or chip for performing any of the methods of the above first aspect.
  • a computer readable storage medium comprising the program of the ninth aspect is provided.
  • a user plane function UFP node comprising means or means for performing the various steps of any of the methods of the second aspect above.
  • a UFP node comprising a processor and a memory, the memory is for storing a program, and the processor calls a program stored in the memory to perform any of the methods of the above second aspect.
  • a UFP node comprising at least one processing element or chip for performing any of the methods of the above second aspect.
  • a program for performing any of the methods of the second aspect above when executed by a processor.
  • a computer readable storage medium comprising the program of the fourteenth aspect is provided.
  • an access network node comprising means or means for performing the various steps of any of the methods of the above third aspect.
  • an access network node comprising a processor and a memory, the memory is for storing a program, and the processor calls a program stored in the memory to perform any of the methods of the above third aspect.
  • an access network node comprising at least one processing element or chip for performing any of the methods of the above third aspect.
  • a program for performing any of the methods of the above third aspect when executed by a processor.
  • a computer readable storage medium comprising the program of the nineteenth aspect is provided.
  • a twenty-first aspect a terminal device is provided, comprising: any one of the above fourth aspect or fifth aspect Method The unit or means of each step.
  • a terminal device comprising a processor and a memory, wherein the memory is used to store a program, and the processor calls a program stored in the memory to perform any of the methods of the above fourth aspect or the fifth aspect.
  • a terminal device comprising at least one processing element or chip for performing the method of any of the above fourth or fifth aspect.
  • a computer readable storage medium comprising the program of the twenty-fourth aspect is provided.
  • Figure 1 is a network structure diagram
  • FIG. 2 is a flowchart of a method for protecting data according to an embodiment of the present invention
  • FIG. 3 is a flowchart of still another method for protecting data according to an embodiment of the present invention.
  • 4a is a flowchart of another method for protecting data according to an embodiment of the present invention.
  • 4b is a flowchart of another method for protecting data according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of still another method for protecting data according to an embodiment of the present invention.
  • FIG. 5a is a flowchart of still another method for protecting data according to an embodiment of the present invention.
  • FIG. 5b is a flowchart of still another method for protecting data according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of a data protection method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of another data protection method according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of still another method for protecting data according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of still another method for protecting data according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of a core network node according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of a UPF node according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of an access network node according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • FIG. 14 is a hardware structural diagram of a core network node according to an embodiment of the present disclosure.
  • FIG. 15 is a hardware structural diagram of a UPF node according to an embodiment of the present disclosure.
  • FIG. 16 is a hardware structural diagram of an access network node according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram of a hardware of a terminal device according to an embodiment of the present invention.
  • Figure 1 provides a network structure that can be applied to next generation communication systems.
  • the following components of the network structure are as follows:
  • Terminal device may include various handheld devices with wireless communication functions, in-vehicle devices, wearable devices, computing devices or other processing devices connected to a wireless modem, and various forms of terminals, mobile stations (MS), Terminal, user equipment (UE), soft terminal, etc., such as water meters, electricity meters, sensors, and the like.
  • MS mobile stations
  • UE user equipment
  • soft terminal etc., such as water meters, electricity meters, sensors, and the like.
  • Access network node Similar to the base station in the traditional network, it provides network access functions for authorized users in specific areas, and can use different quality transmission tunnels according to user level and service requirements.
  • the access network node can manage the radio resources and provide access services for the terminal devices, thereby completing the forwarding of control signals and user data between the terminal device and the core network.
  • Access and mobility management function (AMF) node responsible for mobility management and access management, etc., can be used to implement mobility management entity (MME) functions other than session management. other functions.
  • MME mobility management entity
  • Session management function (SMF) node establishes a session for a terminal device, assigns a session identification (ID), and manages or terminates the session.
  • ID session identification
  • UPF node Provides functions such as session and bearer management, and IP address allocation.
  • PCF Policy Control Function
  • DN Data network
  • Application function (AF) entity Provides application layer services.
  • each of the above components communicates via a next generation (NG) path, for example, an access network node communicates with a UPF node over an NG3 path.
  • NG next generation
  • the SMF node and the AMF node may be integrated in one physical device or may be distributed on different physical devices, which is not specifically limited in this application.
  • a data protection method is provided by an embodiment of the present invention.
  • the method is performed by a core network node, and the core network node may be an SMF node or an AMF node, and the method is specifically as follows.
  • the service of the terminal device may be an internet of things (IOT) service, a voice service or a car network service, and is not limited.
  • IOT internet of things
  • the service-related information may include service type information, slice type information, access point name (APN) information, DN name information, or other information that can characterize the terminal device service.
  • service type information slice type information
  • API access point name
  • DN name information or other information that can characterize the terminal device service.
  • the core network node receives a request message sent by the terminal device, where the request message is used to request to establish a session for the service, and the request message includes information associated with the service.
  • the request message may be a session establishment request message.
  • the core network node acquires information related to the service according to the slice information of the core network node.
  • the slice may be based on several major technical groups such as cloud computing, virtualization, software-defined network, and distributed cloud architecture.
  • the unified programming of the upper layer enables the network to have the ability of management and collaboration, thereby implementing a common A physical network infrastructure platform that supports the functionality of multiple logical networks simultaneously.
  • For each slice it has the following characteristics, for example, providing the same service type, or sharing a tenant; a slice letter of the core network node
  • the information may include a slice type, and the slice type may be a service type provided by a slice to which the core network node belongs; wherein the slice information of the core network node may also include tenant information.
  • the core network node determines, according to the information associated with the service, a network node that performs security protection on data of the service.
  • step 202 can be implemented as follows:
  • Manner 1 The core network node determines the network node according to the security capability of the UPF node connected to the core network node and the information associated with the service.
  • the security capability of the UPF node may include at least one of an encryption capability and an integrity protection capability.
  • the core network node may obtain a security capability requirement corresponding to the information associated with the service according to the correspondence between the information associated with the service and the security capability requirement, and the security capability requirement may be a priority of the security capability. Selecting a UPF node whose security capability meets the security capability requirement as the above-mentioned network node in the UPF node connected to the core network, for example, selecting a UPF node whose security capability has a priority higher than or equal to the security capability requirement.
  • the above network node may obtain a security capability requirement corresponding to the information associated with the service according to the correspondence between the information associated with the service and the security capability requirement, and the security capability requirement may be a priority of the security capability.
  • the security capability requirement corresponding to the information associated with the foregoing service is a 128-bit encryption algorithm
  • the priority of the encryption algorithm is 5
  • one of the UPFs connected to the core network node is selected to support 128-bit encryption.
  • Algorithm, and the priority of the encryption algorithm is 5 levels of UPF nodes.
  • the UPF node whose security capability has higher priority than the above security capability requirement may also be selected, which is not limited herein.
  • one of the at least two UPF nodes is selected as the highest priority UPF node as the above-mentioned network node, or one of the at least two UPF nodes is randomly selected as the above-mentioned network node.
  • Manner 2 The core network node determines the network node according to the correspondence between the information associated with the service and the node performing security protection.
  • the information associated with the service may be a service type information or a slice type information, for example, a voice service, and the foregoing relationship is a voice service corresponding UPF node, and the network node is a UPF node.
  • one UPF node when there are at least two UPF nodes connected to the core network node, one UPF node may be selected according to at least one of a state parameter of the at least two UPF nodes and a priority of the security capability.
  • the foregoing network node may also randomly select a UPF node as the network node. For details, refer to the foregoing method 1 and no further details are provided.
  • the network node is a UPF node
  • the method further includes at least one of step 203 and step 204.
  • the core network node sends security related parameters to the UPF node.
  • the security-related parameters may include at least one of the following: a user plane root key K up , a security capability of the terminal device, and a security policy of the UPF node.
  • the security policy of the UPF node can be used to indicate the length of the security key used by the UPF node, for example, 128 bit or 256 bits.
  • the security policy of the UPF node may correspond to the information associated with the foregoing service, that is, the information associated with different services may correspond to different security policies of the UPF node, for example, when the service is a car network service.
  • the UPF node can adopt a 128-bit security key.
  • the security policy of the UPF node may be stored on the core network node or may be obtained from the PCF node, which is not limited herein.
  • the security capability of the terminal device may include only the encryption capability; or the security capability of the terminal device includes only the integrity protection capability; or the security capability of the terminal device includes the encryption capability and the integrity protection capability.
  • the core network node indicates, to the foregoing UPF node, an UP security protection mode of the data of the foregoing service; or the core network node indicates to the UPF node that the network node is a UPF node.
  • the foregoing UP security protection mode may include at least one of encryption protection and integrity protection.
  • the above-mentioned UP security protection mode may be determined by the core network node according to the correspondence between the service-related information and the security protection mode.
  • the voice service corresponds to the encryption protection
  • the vehicle network service corresponds to the integrity protection.
  • the UP security protection mode may be determined in step 202, that is, the determination of the foregoing network node may also be based on a security protection mode supported by the network node.
  • the UP security protection mode can be represented by 2 bit bits. For example, 01 indicates encryption protection, 10 indicates integrity protection, and 11 indicates encryption protection and integrity protection.
  • the core network node indicates to the UPF node that the network node is a UPF node, that is, the core network node indicates to the UPF node that the security protection of the UPF node is enabled or enabled or activated, and the security protection is for the data of the foregoing service. .
  • the foregoing method further includes:
  • the SMF node receives the UP security algorithm from the foregoing UPF node.
  • the UP security algorithm may be carried in the session establishment response message.
  • the above method may further include:
  • the SMF node sends an UP security algorithm to the terminal device.
  • the UP security algorithm may be carried in a security mode command (SMC) or may be carried in a non-access stratum (NAS) message.
  • SMC security mode command
  • NAS non-access stratum
  • the network node is a UPF node
  • the core network node is an SMF node
  • the method further includes:
  • the SMF node determines the UP security algorithm according to the security capability of the terminal device and the security capability of the UPF node.
  • the UP security algorithm may include at least one of an encryption algorithm and an integrity protection algorithm, and is used by the UPF node to perform security protection on data of the foregoing service.
  • the SMF node may select a security algorithm supported by the terminal device in the security algorithm supported by the UPF node as the UP security algorithm. For example, when there are at least two security algorithms supported by the terminal device in the security calculation supported by the UPF node, one security algorithm with the highest priority may be selected as the UP security algorithm.
  • the SMF node obtains a security key according to the foregoing UP security algorithm, K up, and the security policy of the UPF.
  • the security key is used by the UPF node to secure data of the foregoing service, and may include at least one of an encryption key and an integrity protection key, for example, an integrity key Kupfint and/or an encryption key. Key K upfenc .
  • the SMF node may derive a 256-bit security key according to the UP security algorithm and K up ; the SMF node performs truncation processing on the derived security key according to the UPF security policy.
  • the security policy of the UPF node indicates that the UPF node adopts a 128-bit security key, and the first 128 bits of the derived security key of the SMF node are used as the security key in the above step 204', that is, the security secret of the UFP node. key.
  • the SMF node sends an UP security algorithm, where the security key and the identifier associated with the service are sent to the UPF node.
  • the identifier of the service association may be used to indicate a path for transmitting data of the foregoing service between the terminal device and the UPF node, for example, an identifier of the session, or an identifier of the bearer.
  • the foregoing method may further include:
  • the SMF node sends an UP security algorithm to the terminal device.
  • the above method may further include:
  • the SMF node instructs the UPF node to perform security protection on the data of the service.
  • the above method may further include:
  • the SMF node indicates to the terminal device the UP security protection mode of the data of the foregoing service.
  • the foregoing method further includes at least one of steps 206 and 207.
  • the core network node sends the security policy of the access network node and the identifier associated with the service to the access network node.
  • the security policy of the access network node may be used to indicate the security key length of the access network node, and the security policy of the access network node may also be stored on the core network node or obtained from the PCF node.
  • the security policy of the access network node is similar to the security policy of the UPF node, and may be associated with the foregoing service. There is a correspondence between the information.
  • the core network node indicates, to the foregoing access network node, that the network node is not an access network node; or the core network node indicates to the access network node that the network node is a UPF node; or the core network node sends the access network node to the access network node.
  • the UP security protection mode indicating the data of the above service.
  • the core network node indicates to the foregoing access network node that the network node is not an access network node, or indicates that the network node is a UPF node, and may all adopt a manner of sending indication information. For example, if one bit is used, when the value of the bit is 1, it indicates that the network node is a UPF node, or indicates that the network node is not an access network node; or, when the value of the bit is 0, it indicates The above network node is not a UPF node, or indicates that the above network node is an access network node.
  • the core network node indicates the UP security protection mode of the data of the service to the access network node, and the implementation manner in step 204 may be adopted.
  • the UP security protection mode is represented by 2 bit bits, for example, 01. Indicates encryption protection, 10 indicates integrity protection, 11 indicates encryption protection and integrity protection, and the core network node sends the 2 bits to the access network node to indicate the UP security protection mode of the data of the foregoing service.
  • step 207 adopts a manner of indicating information, that is, the indication information is used to indicate the UP security protection mode or indicates that the network node is a UPF node or indicates that the network node is not an access network node.
  • the foregoing step in step 206 may be performed.
  • the security policy of the ingress network node and the identifier associated with the foregoing service, and the indication information are carried in the same message and sent to the access network node.
  • the network node is an access network node
  • the method further includes at least one of steps 204b and 205b.
  • the core network node sends the security policy of the access network node and the identifier associated with the service to the access network node.
  • the core network node indicates, to the access network node, that the network node is the access network node, or the access network node indicates to the access network node that the network node is not a UPF node.
  • the step 205b can be implemented in the manner provided by the step 204.
  • the UP security protection mode can be represented by 2 bit bits, and details are not described herein.
  • the two steps may be separately implemented, and also implemented by one action.
  • the step 205b is used to send the indication information, where the indication information is used to indicate that the network node is the access network node or not the UPF node.
  • the security policy of the access network node in step 204b and the foregoing service may be used.
  • the associated identifier, and the indication information in step 205b are carried in the same message and sent to the access network node.
  • the above method may further include:
  • the core network node instructs the serving UPF node of the terminal device not to perform security protection on the data of the foregoing service;
  • the core network node indicates to the service UPF node of the terminal device that the network node is not a UPF node;
  • the core network node indicates to the serving UPF node of the terminal device that the network node is an access network node.
  • the service UPF node refers to a UPF node that provides services for the foregoing services.
  • UPF node As shown in FIG. 3, another method for protecting data according to an embodiment of the present invention is implemented by a UPF node, as described below.
  • the UFP node receives, from the core network node, information about the network node that performs security protection on the data of the service of the terminal device, or information about the security protection mode.
  • the information of the network node may include:
  • the network node performing security protection on the data of the foregoing service is an access network node;
  • the network node performing security protection on the data of the foregoing service is not an access network node; or,
  • the network node that performs security protection on the data of the foregoing service is not a UPF node; or,
  • the network node that performs security protection on the data of the above service is a UPF node.
  • the security protection mode information may include: an UP security protection mode of the data of the foregoing service, where the UP security protection mode includes at least one of encryption protection and integrity protection, and specifically, step 207 in the embodiment shown in FIG. 2 may be used. The relevant description in the description will not be repeated.
  • the information about the network node and the UP security protection mode can be implemented in the manner provided by the step 204.
  • the UP security protection mode can be represented by two bit bits, and details are not described herein.
  • the UFP node determines whether to perform security protection on the data of the service according to the information of the foregoing network node or the foregoing security protection mode information.
  • the UPF node determines whether to perform security protection on the data of the foregoing service according to the information, which may include:
  • the UPF node When the information is used to indicate that the network node is an access network node or not a UPF node, the UPF node does not perform security protection on the data of the foregoing service; or
  • the UPF node When the information is used to indicate that the network node is not an access network node or a UPF node, the UPF node performs security protection on the data of the foregoing service.
  • the UPF node determines whether to perform security protection on the data of the foregoing service according to the information, which may include:
  • the UPF node performs security protection on the data of the foregoing service according to the security protection mode indicated by the UP security protection mode.
  • the UP security protection mode indicates encryption protection, and the UPF node performs encryption protection on the data of the foregoing service.
  • the UPF node receives information or security protection mode information of the network node that performs security protection on the data of the service of the terminal device from the core network node, and determines according to the information of the network node or the foregoing security protection mode information.
  • the security protection is performed on the data of the service, so that the UPF node can flexibly perform security protection on the service of the terminal device according to the indication of the network node to meet the security requirements of the operator or the service.
  • the foregoing method may further perform step 303- 305, as follows:
  • the UPF node acquires the security capability of the terminal device, K up, and the security policy of the foregoing UPF node.
  • the security capability of the terminal device can be obtained from the core network node, for example, the security capability of the terminal device sent by the SMF node or the AMF node is received, and can also be obtained from the node on the other network side, and can be stored on the UPF node without limitation.
  • the security capability refer to the embodiment shown in FIG. 2, and details are not described herein again.
  • security policies and said K up UPF nodes may also be acquired using the above embodiment, moreover, the embodiment shown in FIG 2 described in the relevant security policy can UPF Referring to FIG, omitted.
  • the UPF node determines the UP security algorithm according to the security capability of the terminal device and the security capability of the UPF node.
  • the UPF node obtains a security key according to an UP security algorithm, a Kup and a security policy of the UPF node.
  • Steps 304 and 305 can refer to steps 203a and 204a in the embodiment shown in FIG. 2, respectively, and details are not described herein.
  • step 304 includes:
  • the UPF node determines the encryption algorithm according to the encryption capability of the terminal device and the encryption capability of the UPF node;
  • the UPF node determines the integrity protection algorithm according to the integrity protection capability of the terminal device and the integrity protection capability of the UPF node;
  • the UPF node determines the encryption algorithm and the integrity protection algorithm according to the security capability of the terminal device and the security capability of the UPF node.
  • the security protection mode information includes the foregoing UP security protection mode
  • step 304 includes:
  • the UFP node determines the UP security algorithm according to the above-mentioned UP security protection mode, the security capability of the end device, and the security capability of the UPF node.
  • the UPF node determines the encryption algorithm according to the encryption capability of the terminal device and the encryption capability of the UPF node; or, when the UP security protection mode is integrity protection, the UPF node is based on the terminal device.
  • the integrity protection capability and the integrity protection capability of the UPF node determine the integrity protection algorithm; or, when the UP security protection mode is encryption protection and integrity protection, the UPF node according to the security capability of the terminal device and the security capability of the UPF node, Determine the encryption algorithm and integrity protection algorithm.
  • step 305 the foregoing method further includes:
  • the UPF node sends the UP security algorithm to the terminal device.
  • the UPF node may send the UP security algorithm to the SMF node, and the SMF node carries the UP security algorithm in the SMC or NAS message and sends it to the terminal device.
  • the above method may further include:
  • the UPF node performs security protection on the data of the foregoing service according to the security key and the UP security algorithm.
  • the data and the security key of the foregoing service are used as the input of the security algorithm, and the output of the security algorithm is the ciphertext, thereby realizing the security protection of the data.
  • the identifier of the service association may be a session ID.
  • the execution sequence of the steps 306 and 307 may be adjusted.
  • the step 307 may further include: the UPF node receiving the security protection for the data of the foregoing service indicated by the SMF node.
  • the access network node obtains reference information.
  • the access network node determines, according to the obtained reference information, whether to perform security protection on data of the service of the terminal.
  • the reference information includes at least one of the following information: information related to the service of the terminal device, a local policy, an operator policy, and information about receiving, by the core network node, a network node that performs security protection on data of the service of the terminal device. Or security protection information.
  • the local policy may be used to indicate whether the access network node determines whether to perform security protection on the data of the foregoing service according to the information or security protection mode information of the foregoing network node; the local policy may also be information and security associated with the foregoing service.
  • the correspondence between protection methods In one example, the voice service corresponds to the encryption protection, and the vehicle networking service corresponds to the integrity protection.
  • the local policy may be a correspondence between the information related to the foregoing service and whether to perform security protection. In another example, the voice service performs security protection and the car networking service does not perform security protection.
  • the operator policy may be whether the operator allows the access network node to perform security protection, or the security protection mode that the operator allows the access network node to perform, or the security protection mode that the operator does not allow the access network node to perform. For example, an operator does not allow an access network node to perform encryption protection.
  • the core network node can be an SMF node or an AMF node.
  • the information of the network node may include:
  • the network node performing security protection on the data of the foregoing service is an access network node;
  • the network node performing security protection on the data of the foregoing service is not an access network node; or,
  • the network node that performs security protection on the data of the foregoing service is not a UPF node; or,
  • the network node that performs security protection on the data of the above service is a UPF node.
  • the security protection mode information may include: an UP security protection mode of the data of the foregoing service, where the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the information of the network node and the security protection mode of the UP can be implemented by using the method provided in the step 204 or 207.
  • the UP security protection mode can be represented by two bit bits, and details are not described herein.
  • the access network node obtains the reference information, and determines whether to perform security protection on the data of the service of the terminal according to the obtained reference information, so that the access network node independently determines whether to perform security protection, thereby
  • the decoupling between the security protection of the access network node and the security protection of the UPF node is realized, and the security of the network is improved.
  • the following is an example of the information associated with the service of the terminal device with reference information, as shown in FIG. 4a.
  • FIG. 4a another method for protecting data is provided by an embodiment of the present invention.
  • the method is performed by an access network node, as follows.
  • the access network node acquires information related to the service of the terminal device.
  • the access network node may obtain information related to the foregoing service from the terminal device, for example, receiving a message that is sent by the terminal device and carries the information associated with the service.
  • the access network node determines, according to the information associated with the foregoing service, whether to perform security protection on data of the foregoing service.
  • the local policy is a correspondence between the information associated with the service and the security protection mode, and the access network node performs the information associated with the service according to the information associated with the service and the local policy.
  • the security protection indicated by the security protection mode For example, if the service type of the service is voice service, and the security protection mode corresponding to the voice service is encryption protection, the data of the service is encrypted and protected.
  • the access network node determines whether to perform security protection on the data of the foregoing service according to the information associated with the service and the information indicated by the core network node.
  • the information indicated above may include:
  • the network node performing security protection on the data of the foregoing service is an access network node;
  • the network node performing security protection on the data of the foregoing service is not an access network node; or,
  • the network node that performs security protection on the data of the foregoing service is not a UPF node; or,
  • the network node that performs security protection on the data of the foregoing service is a UPF node; or,
  • the UP security protection mode of the data of the foregoing service where the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the information indicated above may be implemented in the manner provided in step 204 or 207, and details are not described herein.
  • the access network node obtains the information associated with the service of the terminal device, and determines whether to perform security protection on the data of the service of the terminal according to the information associated with the service, so that the access network node is independently determined. Whether it performs security protection, decoupling the security protection of the access network node from the security protection of the UPF node; in addition, whether the security protection is actually performed according to the information associated with the service can meet the security requirements of different services.
  • the information or security protection mode information of the network node that performs security protection on the data of the service of the terminal device from the core network node is referred to as reference information, see FIG. 4b.
  • the access network node receives information or security protection mode information of the network node that performs security protection on the data of the service of the terminal device from the core network node.
  • the access network node determines whether to perform security protection on the data of the foregoing service according to the information of the network node or the information about the security protection mode.
  • the access network node determines whether to perform security protection on the data of the service according to the information of the network node, and may include:
  • the access network node When the information of the network node is used to indicate that the network node is an access network node or is not a UPF node, the access network node performs security protection on data of the foregoing service; or
  • the access network node When the information of the network node is used to indicate that the network node is not an access network node or a UPF node, the access network node performs security protection on data of the foregoing service.
  • the access network node determines whether to perform security protection on the data of the foregoing service according to the information, which may include:
  • the access network node determines whether to perform security protection on the data of the foregoing service according to the security protection mode indicated by the UP security protection mode.
  • the UP security protection mode indicates encryption protection, and the access network node can perform integrity protection on the data of the foregoing service.
  • the foregoing step 402b may determine whether to perform security protection or the executed security protection manner according to the information related to the service or the local policy or the operator policy, and the information of the network node. For example, if the access network node is configured to indicate that the network node is an access network node according to the information of the network node, and the service type of the service is a voice service, determine to perform security protection on the data of the service; or The network access node determines that the network node is an access network node according to the information of the network node, and the service type of the service is the car network service, and determines that the data of the service is not performed.
  • the access network node performs data according to the service sent by the core network node to the terminal device. Performing information security or security protection mode information of the network node to ensure whether to perform security protection on the data of the service of the terminal, and realizing that the access network node can independently determine whether to perform security protection, thereby securing the access network node.
  • the protection is decoupled from the security protection of the UPF node to improve the security of the network.
  • the access network node determines whether the security protection of the service is performed by referring to the security protection of the service by the UPF node, which can make up for the security of the UPF node. Insufficient protection to improve the security of the network.
  • the method when it is determined that security protection is performed on data of the foregoing service, or before performing security protection on data of the foregoing service, the method further includes:
  • the access network node instructs the terminal device to perform security protection on the data of the foregoing service by the access network node;
  • An access stratum (AS) security protection mode for the access network node to indicate the data of the service to the terminal device, where the AS security protection mode includes at least one of encryption protection and integrity protection.
  • the foregoing method further includes:
  • the access network node obtains the security capability of the terminal device, the security policy of the access network node, and the identifier associated with the foregoing service;
  • the access network node determines the AS security algorithm according to the security capability of the terminal device and the security capability of the access network node;
  • the access network node obtains the security key according to the security policy of the access network node, the AS security algorithm, and the access network key K an ;
  • the access network node sends an AS security algorithm and an identifier associated with the foregoing service to the terminal device.
  • the AS security algorithm and the foregoing security key are used by the access network node to secure the data of the foregoing service;
  • the security key may include at least one of an encryption key and an integrity key, for example, integrity integrity.
  • the above AS security algorithm may include at least one of an encryption algorithm and an integrity protection algorithm
  • step 203a For the determination of the AS security algorithm, refer to step 203a.
  • step 204a For the method of obtaining the security key, refer to step 204a, and details are not described herein.
  • the above method may further include:
  • the access network node performs security protection on the data of the foregoing service according to the AS security algorithm, the security key, and the identifier associated with the service.
  • the method when it is determined that security is not performed on the data of the foregoing service, the method further includes:
  • the access network node instructs the terminal device that the access network node does not perform security protection on the data of the foregoing service.
  • an embodiment of the present invention provides another method for protecting data, which is performed by a terminal device, as described below.
  • the terminal device receives, from the access network node, an identifier of the AS security algorithm and the service association of the terminal device.
  • the terminal device obtains the first security key according to the AS security algorithm, the Kan and the AS security protection mode of the data of the service indicated by the access network node.
  • the terminal device performs the foregoing service according to the first security key, the AS security algorithm, and the identifier associated with the foregoing service. Data execution security protection.
  • the AS security protection mode in step 502 refers to the manner of AS security protection, for example, encryption protection.
  • the AS security algorithm refers to the security algorithm of the AS security protection.
  • the first security key refers to the key of the AS security protection and will not be described here.
  • the terminal device performs security protection on the data of the service of the terminal device according to the AS security protection mode indicated by the access network node, that is, performs AS security protection according to the indication of the access network node, and can implement the UPF node.
  • the security protection between the security protection and the access network node is successfully decoupled to improve the security of the communication system.
  • an embodiment of the present invention provides another method for protecting data, which is performed by a terminal device, as described below.
  • the terminal device receives, from the access network node, an identifier of the AS security algorithm and the service association of the terminal device.
  • the terminal device obtains the first security key according to the AS security algorithm and the access network key K an .
  • the terminal device performs security protection on the data of the service according to the first security key, the AS security algorithm, and the identifier associated with the service.
  • the security protection is the AS security protection, the AS security algorithm, and the first security key. For details, refer to the related description in Figure 5, and no further details are provided.
  • the terminal device performs AS security protection on the data of the service of the terminal device according to the indication of the access network node, and can successfully decouple the security protection between the UPF node and the security protection of the access network node. Improve the security of the communication system.
  • the foregoing method further includes:
  • the terminal device receives an UP security algorithm from the core network node.
  • the terminal device obtains the second security key according to the UP security algorithm and the user polygon root key K up .
  • the second security key is a key for the UP security protection; the UP security protection is a security protection between the UPF node and the terminal device, and is used to protect user plane data.
  • the UP security protection may include encryption protection and integrity protection. At least one.
  • the UP security algorithm in step 504 refers to the security algorithm of the UP security protection.
  • the terminal device obtains the second security key according to the UP security algorithm and the UP security protection mode of the data of the foregoing service indicated by the core network node.
  • the UP security protection mode of the data of the foregoing service indicated by the core network node may be implemented by sending the indication information.
  • the UP security algorithm and the indication information may be carried in the same message, for example, SMC. .
  • the network node that receives the security protection of the data of the foregoing service indicated by the core network node by the terminal device is a UPF node.
  • an embodiment of the present invention provides another method for protecting data, which is performed by a terminal device, as described below.
  • the terminal device receives the UP security algorithm from the core network node.
  • the UP security algorithm is used to secure data of the service of the terminal device, and may include at least one of an encryption algorithm and an integrity protection algorithm.
  • the terminal device performs security protection on data of the service of the terminal device according to the first security key and the UP security algorithm.
  • the security protection in step 503b is UP security protection, that is, security protection between the UPF node and the terminal device, and the security protection is used to protect user plane data, and may include at least one of encryption protection and integrity protection. .
  • the UP security algorithm in step 502b refers to the security algorithm of the UP security protection
  • the first security key refers to the key of the UP security protection, and will not be described again.
  • the method further includes: receiving, by the terminal device, an UP security protection manner of the data of the foregoing service indicated by the core network node.
  • the terminal device may obtain the first security key according to the UP security algorithm, the K up and the UP security protection mode.
  • the UP security protection method refers to the way of UP security protection, for example, encryption protection.
  • the UP security protection mode of the data of the service indicated by the core network node may be implemented by sending the indication information.
  • the UP security algorithm and the indication information may be carried in the same message.
  • Medium for example, SMC.
  • the network node that receives the security protection of the data of the foregoing service indicated by the core network node by the terminal device is a UPF node.
  • the terminal device performs the UP security protection according to the instruction of the core network node, performs security protection on the data of the service of the terminal device, and can implement the security protection between the UPF node and the security protection of the access network node. Successful decoupling.
  • the foregoing method further includes:
  • the terminal device receives, from the access network node, an identifier of the AS security algorithm and the service association of the terminal device.
  • the identifier associated with the service may be used to indicate a path of data for transmitting the service.
  • the terminal device obtains the second security key according to the AS security algorithm, Kan and the AS security protection mode of the data of the foregoing service indicated by the access network node.
  • the terminal device performs security protection on the data of the foregoing service according to the second security key, the AS security algorithm, and the identifier associated with the foregoing service.
  • the security protection in step 506b is AS security protection, that is, security protection between the access network node and the terminal device, and the security protection is used to protect user plane data, and may include at least one of encryption protection and integrity protection. .
  • the AS security protection mode in step 505b refers to the manner of AS security protection, for example, encryption protection.
  • the AS security algorithm refers to the security algorithm of the AS security protection.
  • the second security key refers to the key of the AS security protection and will not be described here.
  • the terminal device receives an identifier of the AS security algorithm and the service association of the terminal device from the access network node.
  • the terminal device obtains the first security key according to the AS security algorithm and K an .
  • the terminal device performs security protection on the data of the service according to the first security key, the AS security algorithm, and the identifier associated with the service.
  • the terminal device can perform UP security protection and AS security protection at the same time, which greatly improves the security of the network.
  • the core network nodes involved in FIG. 5, 5a or 5b may each be an SMF node or an AMF node.
  • the terminal device sends a 6a message to the SMF node.
  • the 6a message may be used to request a session for the terminal device, and may be a session establishment request.
  • the 6a message includes an identifier of the terminal device, and may also include information related to the service of the terminal device.
  • the SMF node receives the 6a message, and obtains information related to the service of the terminal device.
  • the SMF node determines, according to the service-related information, a network node that performs security protection on the data of the foregoing service.
  • step 603 For the implementation of the step 603, refer to step 202, and details are not described herein again.
  • steps 604-618 are performed; or when it is determined that the access network node performs security protection on the data of the foregoing service, steps 604a-605a and steps 612-618 are performed.
  • the order of execution of steps 604a-605a and 612-618 may be adjusted, for example, may be performed synchronously, and is not limited.
  • the SMF node sends a 6b message to the UPF node.
  • the UPF node is a service node of the terminal device, and the 6b message may be used to indicate that the network node that performs security protection on the data of the foregoing service is not a UPF node, or is used to indicate a network node that performs security protection on data of the foregoing service. It is an access network node, or is used to indicate that the data of the foregoing service is not protected.
  • the 6b message can be established for the session.
  • the UPF node receives the 6b message and sends a 6c message to the SMF node.
  • the 6c message can be used to respond to the 6b message.
  • the SMF node sends a 6b message to the UPF node.
  • the message may contain 6b security-related parameters, security-related parameters may comprise at least one security capabilities of the terminal device, and the security policy node UPF of K up.
  • the 6b message may further include an identifier of the foregoing service association, so that the UPF node can identify the data of the foregoing service, for example, the ID of the session.
  • the ID of the session may be allocated by the SMF node for the above service after receiving the 6a message.
  • the 6b message may specifically be a session establishment.
  • the 6b message may be used to display or implicitly indicate that the network node is a UPF node.
  • the 6b message further includes first indication information, where the first indication information is used to indicate the foregoing
  • the network node is a UPF node. For example, 1 bit is used to indicate that 1 indicates that the above network node is a UPF node, and 0 indicates that the above network node is not a UPF node.
  • the UPF node may determine whether the 6b message carries security-related parameters. If yes, it indicates that the network node is a UPF node, and vice versa, the network node is not a UPF node.
  • the 6b message may be used to display or implicitly indicate the UP security protection mode of the data of the foregoing service, that is, the security protection mode used by the UPF node to use the data of the foregoing service, for example, encryption protection, integrity protection.
  • the 6b message further includes second indication information, where the second indication information is used to indicate the UP security protection mode of the data of the foregoing service. For example, with a 2-bit indication, 01 indicates encryption protection, 10 indicates integrity protection, and 11 indicates encryption protection and integrity protection.
  • the UPF node can judge according to the security capability of the terminal device in the security-related parameters. For example, when the security capability of the terminal device only includes the encryption capability, it indicates that the UPF node performs only encryption protection on the data of the foregoing service; or, when the security capability of the terminal device includes the encryption capability and the integrity protection capability, indicating that the UPF node has the above The data of the service performs encryption protection and integrity protection.
  • the UPF node determines an UP security algorithm according to the 6b message, and obtains a security key according to the UP security algorithm and Kup .
  • the SMF node determines the UP security algorithm according to the security capabilities of the terminal device and the security capabilities of the UPF node.
  • the step 605 can be implemented in the manner provided by the embodiment shown in FIG. 3, and details are not described herein.
  • the UP security algorithm may include at least one of an encryption algorithm and an integrity protection algorithm
  • the security key may include at least one of an encryption key and an integrity key
  • the security key in step 605 may be a security key that is truncated by the security policy derived by the UP security algorithm and K up according to the security policy of the UPF node.
  • the UPF node sends a 6c message to the SMF node, where the 6c message includes an UP security algorithm.
  • the 6c message may be a response to the 6b message.
  • the SMF node receives the 6c message, and sends a 6d message to the terminal device, where the 6d message includes an UP security algorithm.
  • the 6d message may be an SMC or a NAS message.
  • the 6d message may further include a third indication information.
  • the third indication information may be used to indicate that the network node is a UPF node, or the third indication information may be used to indicate an UP security protection manner of data of the foregoing service.
  • the terminal device receives the 6d message, and obtains the security key according to the 6d message.
  • the security key in step 608 is used by the terminal device to perform security protection on the data of the foregoing service.
  • obtaining the security key according to the 6d message may include: obtaining, by the terminal device, the security key according to the UP security algorithm and Kup , specifically, the following manner may be adopted.
  • the terminal device is configured to obtain a security key according to the UP security algorithm and Kup .
  • obtaining the security key according to the 6d message may include: the terminal device according to the UP security protection mode, the UP security The algorithm and K up obtain the security key. For example, if the UP security protection mode is encryption protection, the terminal device obtains an encryption key according to the encryption algorithm and K up in the UP security algorithm.
  • the terminal device sends a 6e message to the SMF node.
  • the 6e message may be a Security Mode Command Complete (SMP).
  • SMP Security Mode Command Complete
  • the SMF node receives the 6e message and sends a 6f message to the UPF node.
  • the 6f message may be used to instruct the UPF node to perform security protection on the data of the foregoing service, in other words, the indication
  • the data of the foregoing service of the UPF node immediately performs security protection, or indicates that the data of the foregoing service of the UPF node starts to perform security protection, or indicates that the UPF node enables security protection of data of the foregoing service.
  • the UPF node sends a 6g message to the SMF node.
  • the 6g message may be a response to the 6f message.
  • the SMF node sends a 6h message to the AMF node.
  • the 6h message may include an identifier of the foregoing service association, for example, an ID of the session.
  • the 6h message may also include a security policy of the access network node.
  • the 6h message may further include a fourth indication information.
  • the fourth indication information may be used to indicate that the network node is the access network node, or the network node is not a UPF node.
  • the fourth indication information may be used to indicate that the network node is not an access network node; or the network node is a UPF node; or The UP security protection method of the data of the above services.
  • the AMF node receives the 6h message and sends the 6i message to the access network node.
  • the content of the 6i message may be the same as the content of the 6h message, and details are not described herein.
  • the access network node receives the 6i message, and determines, according to the 6i message, whether to perform security protection on the data of the foregoing service.
  • the 6i message may trigger the access network node to perform determining whether to perform security protection on the data of the foregoing service.
  • the access network node may also determine whether to perform security protection on the data of the foregoing service according to the content in the 6i message.
  • step 614 If it is determined in step 614 that security protection is performed on the data of the foregoing service, steps 615-617 are performed; otherwise, step 618 is performed.
  • the access network node determines an AS security algorithm, and obtains a security key according to the AS security algorithm and the Kan .
  • the access network node sends a 6j message to the terminal device, where the 6j message includes an AS security algorithm.
  • the 6j message may be used to indicate that the access network node performs security protection on the data of the foregoing service, or the AS security protection mode of the data of the foregoing service.
  • the 6j message may include a fifth indication information, where the fifth indication information is used to indicate that the access network node performs security protection on the data of the foregoing service, or an AS security protection mode of the data of the foregoing service.
  • the 6j message may be a radio resource control (RRC) message.
  • RRC radio resource control
  • the terminal device receives the 6j message, and obtains the security key according to the 6j message.
  • the access network node sends a 6j message to the terminal device.
  • the 6j message is used to indicate that the data of the foregoing service of the access network node does not perform security protection.
  • the message used to respond to the received message may not be executed in the foregoing embodiment; the execution sequence between steps 612-618 and 604-611 may be reversed, and is not limited.
  • the core network node obtains the information associated with the service of the terminal device, and determines the network node that performs security protection on the data of the service according to the information associated with the service, so that the network node can be flexibly customized for different services. Selecting different network nodes to perform security protection, which can meet the security requirements of operators or services; in addition, the access network nodes independently determine whether they perform security protection, and realize the security protection of the access network nodes and the UPF nodes. Decoupling between security protections improves network security.
  • step 605 the method further includes:
  • the UPF node obtains a first message authentication code (MAC) according to the K up and the first random number stored by the UPF node.
  • MAC message authentication code
  • the foregoing 6c message and the 6d message both include the first random number and the first MAC, and the step 608 further includes:
  • the terminal device If the first MAC verification is passed, the terminal device according to the second random number stored by itself, and K up, obtain a second MAC.
  • the above 6e message and 6f message carry the second random number and the second MAC.
  • step 611 Prior to step 611, further comprising: UPF up authentication node according to a second MAC and a second random number K stored in itself;
  • the UPF node performs security protection on the data of the foregoing service.
  • the method for verifying the MAC belongs to the prior art and will not be described again.
  • the foregoing implementation scenario is used to verify whether the user plane root key used by the terminal device and the UPF node is the same, and the security protection of the service data is performed only in the same situation.
  • the implementation scenario can be applied to other embodiments, such as the embodiment shown in FIG. 7-9, and the description is not repeated hereafter.
  • the upper step 616 may be replaced by the access network node separately transmitting the fifth indication information and the AS security algorithm to the terminal device.
  • the fifth indication information may be carried in the RRC message to send the terminal device
  • the AS security algorithm may be carried in the AS SMC and sent to the terminal.
  • the embodiment of the present invention provides another method for protecting data, and the core network node is an SMF node as an example, as follows.
  • steps 701-703 are the same as steps 601-603, and only the message name is adjusted accordingly.
  • step 704 is performed.
  • the SMF node determines an UP security algorithm, and obtains a security key according to the UP security algorithm and Kup .
  • Step 704 can be implemented by using steps 204a-205a, and details are not described herein.
  • the SMF node sends a 7b message to the terminal device, where the 7b message includes an UP security algorithm.
  • the 7b message may carry the third indication information in step 607 above, and details are not described herein.
  • the terminal device receives the second message, and obtains a security key according to the second message.
  • step 608 can be used to obtain the security key according to the 7b message, and details are not described herein.
  • the 7b message can be an SMC or NAS message.
  • the terminal device sends a 7c message to the SMF node.
  • the 7c message may be an SMP.
  • the SMF node receives the 7c message and sends a 7d message to the UPF node.
  • the 7d message may include an UP security algorithm, the security key and the identifier associated with the service, and may include the first indication information or the second indication information in step 604, and details are not described herein.
  • the 7d message can be used to instruct the UPF node to perform security protection on the data of the foregoing service.
  • the UPF node receives the 7d message and sends a 7e message to the SMF node.
  • the 7e message may be a response to the 7d message.
  • steps 710-716 are the same as steps 612-618 in the embodiment shown in FIG. 6, and only the message name is adjusted accordingly.
  • steps 710-716 and steps 704-709 may be adjusted, which is not limited.
  • the core network node obtains the information associated with the service of the terminal device, and determines the network node that performs security protection on the data of the service according to the information associated with the service, so that the network node can be flexibly customized for different services. Selecting different network nodes to perform security protection, which can meet the security requirements of operators or services; in addition, the access network nodes independently determine whether they perform security protection, and realize the security protection of the access network nodes and the security of the UPF nodes. Decoupling between protections improves network security.
  • the embodiment of the present invention provides another method for protecting data
  • the core network node is an SMF node as an example, as follows.
  • steps 801-803 are the same as steps 601-603, and only the message names are adjusted accordingly.
  • step 804 is performed.
  • steps 804-806 are the same as steps 604-606, with only the message names being adjusted accordingly.
  • the SMF node receives the 8c message and sends the 8d message to the AMF node.
  • the 8d message includes an UP security algorithm.
  • the UP security algorithm may be carried in a NAS container, and the NAS container is carried in an 8d message.
  • the third indication information in the embodiment shown in FIG. 6 may also be carried in the NAS container, and details are not described herein.
  • the 8d message may further include the fourth indication information in step 612, and may further include an identifier of the foregoing service association, for example, a session ID, and may further include a security policy of the access network node.
  • the AMF node receives the 8d message and sends an 8e message to the access network node.
  • the content of the 8e message may be the same as the content of the 8d message, and details are not described herein.
  • the access network node receives the 8e message, and determines, according to the 8e message, whether to perform security protection on the data of the foregoing service.
  • Step 809 is the same as step 614 and will not be described again.
  • step 810 If it is determined in step 809 that security protection is performed on the data of the foregoing service, step 810 is performed; otherwise, step 811 is directly performed.
  • the access network node determines an AS security algorithm, and obtains a security key according to the AS security algorithm and the Kan .
  • the access network node sends an 8f message to the terminal device, where the 8f message includes an UP security algorithm.
  • the 8f message may include the NAS container.
  • the 8f message further includes an AS security algorithm, and may further include the fifth indication information in step 616.
  • the 8f message may further include information used to indicate that the access network node does not perform security protection on the data of the foregoing service.
  • the terminal device obtains a security key according to the 8f message.
  • the terminal device obtains the first security key according to the UP security algorithm and K up .
  • step 812 further includes: the terminal device obtaining the second security key according to the AS security algorithm and K an .
  • the core network node acquires information related to the service of the terminal device, and according to the industry
  • the information associated with the service determines the network node that performs security protection on the data of the service, and implements flexible selection of different network nodes for different services to perform security protection, thereby meeting the security requirements of the operator or the service;
  • the access network node independently determines whether to perform security protection, and achieves decoupling between the security protection of the access network node and the security protection of the UPF node, thereby improving network security.
  • the embodiment of the present invention provides another method for protecting data, and the core network node is an AMF node as an example, as follows.
  • the terminal device sends a 9a message to the AMF node, where the 9a message includes an identifier of the terminal device.
  • the identifier of the terminal can be used to uniquely indicate a terminal device, which belongs to the prior art.
  • the 9a message may be used to request to establish a session for the terminal device, and may be a session establishment request.
  • the 9a message includes an identifier of the terminal device, and may also include information associated with the service of the terminal device.
  • the AMF node receives the 9a message, and obtains information related to the service of the terminal device.
  • the AMF node determines, according to the service-related information, a network node that performs security protection on the data of the foregoing service.
  • step 903 For the implementation of the step 903, refer to step 202, and details are not described herein again.
  • the AMF node sends a 9b message to the SMF node.
  • the 9b message includes the identifier of the foregoing terminal device, and the 9b message may be used to indicate that the network node that performs security protection on the data of the foregoing service is not a UPF node, or the 9b message is used to indicate that the data of the foregoing service is performed.
  • the network node is an access network node, or the 9b message is used to indicate that the data of the foregoing service is not performed.
  • the foregoing indication function of the 9b message can be implemented by indicating information, and details are not described herein.
  • the 9b message can be a session setup message.
  • the SMF node receives the 9b message and sends the 9c message to the UPF node.
  • the 9c message may include an identifier of the foregoing service association, for example, a session ID.
  • the 9c message has an indication function of the 9b message in 904a.
  • the 9c message can include the indication information in step 904a.
  • the 9c message may be a session establishment message.
  • the UPF node is a service node of the terminal device.
  • the SMF node may allocate a path for the service of the terminal device, where the path is used to transmit data of the service.
  • the session ID may be allocated for the service.
  • the AMF node sends a 9b message to the SMF node.
  • the 9b message may include the identifier of the terminal device, and may also include the first indication information or the second indication information in the embodiment shown in FIG. 6.
  • the 9b message can also contain security related parameters.
  • the security related parameter may include at least one of a security capability of the terminal device, a security policy of the UPF node, and K up .
  • the SMF node receives the 9b message and sends the 9c message to the UPF node.
  • the 9c message may include an identifier of the foregoing service association, for example, a session ID.
  • the 9c message when the first indication information is included in step 904, the 9c message further includes the first finger in step 904. Show information.
  • the 9c message further includes the second indication information in step 904.
  • the UPF node determines an UP security algorithm according to the 9c message, and obtains a security key according to the UP security algorithm and Kup .
  • the UPF node sends a 9d message to the SMF node, where the 9d message includes an UP security algorithm.
  • the SMF node receives the 9d message and sends a 9e message to the terminal device, where the 9e message includes an UP security algorithm.
  • the 9e message may be an SMC.
  • the 9e message may further include the first indication information or the second indication information in the foregoing step 904.
  • the terminal device obtains a security key according to the 9e message.
  • step 909 refers to the related description in step 608, and details are not described herein.
  • the terminal device sends a 9f message to the SMF node.
  • the 9f message may be an SMP.
  • the SMF node sends a 9g message to the AMF node.
  • the AMF node receives the 9g message and sends a 9h message to the access network node.
  • the 9h message may include the identifier of the foregoing service association, and may further include the fourth indication information in step 612, and may further include a security policy of the access network node.
  • the access network node determines, according to the 9h message, whether to perform security protection on the data of the foregoing service.
  • the step 913 can refer to the description in step 614, and details are not described herein.
  • step 913 If it is determined in step 913 that security protection is performed on the data of the foregoing service, steps 914-916 are performed; otherwise, step 917 is performed.
  • the access network node determines an AS security algorithm, and obtains a security key according to the AS security algorithm and Kan .
  • the access network node sends a 9i message to the terminal device, where the 9i message includes an AS security algorithm.
  • the 9i message may be used to indicate that the access network node performs security protection on the data of the foregoing service, or an AS security protection mode of the data of the foregoing service.
  • the 9i message may include the fifth indication information in the embodiment shown in FIG. 6.
  • the 9i message may be an RRC message.
  • the terminal device receives the 9i message, and obtains the security key according to the 9i message.
  • the access network node sends a 9i message to the terminal device.
  • the 9i message is used to indicate that the data of the foregoing service of the access network node does not perform security protection.
  • an embodiment of the present invention provides a core network node, which may be an AMF node or an SMF node, and may be used to perform actions or steps of a core network node in the embodiment shown in FIG. Can be used to perform Figure 6-8
  • the actions or steps of the SMF node in the illustrated embodiment may also be used to perform the actions or steps of the AMF node in the embodiment of FIG.
  • the core network node may include an obtaining unit 1001 and a determining unit 1002.
  • the obtaining unit 1001 is configured to acquire information related to the service of the terminal device.
  • the determining unit 1002 is further configured to:
  • the network node is determined according to a correspondence between the information associated with the service and a network node performing security protection.
  • the obtaining unit 1001 is further configured to:
  • the request message is used to request to establish a session for the service, and the request message includes information associated with the service;
  • the network node is a UPF node
  • the core network node further includes:
  • the sending unit 1003 is configured to send security related parameters to the UPF node.
  • the security related parameter may include: a user plane root key K up , a security capability of the terminal device, and a security policy of the UPF node.
  • the sending unit 1003 can also be used to:
  • an UP security protection mode of the data of the service where the UP security protection mode includes at least one of encryption protection and integrity protection;
  • the security capability of the terminal device may include only the encryption capability of the terminal device; or
  • the security capability of the terminal device may only include the integrity protection capability of the terminal device; or
  • the security capability of the terminal device may include an encryption capability of the terminal device and an integrity protection capability of the terminal device.
  • the core network node is an SMF node, and the core network node may further include:
  • the receiving unit 1004 is configured to receive an UP security algorithm from the UPF node.
  • the network node is a UPF node, and the core network node is an SMF node, where the core network node further includes a sending unit;
  • the sending unit 1003 is configured to send the UP security algorithm, where the security key and the identifier associated with the service are sent to the UPF node.
  • the sending unit 1003 is further configured to: send the UP security algorithm to the terminal device.
  • the sending unit 1003 is further configured to: instruct the UPF node to perform security protection on data of the service.
  • the sending unit 1003 is further configured to: indicate, to the terminal device, an UP security protection mode of the data of the service, where the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the sending unit 1003 is further configured to: send a security policy of the access network node and an identifier of the service association to The access network node.
  • the sending unit 1003 can also be used to:
  • the network node is an access network node
  • the core network node further includes:
  • the sending unit 1003 is configured to send the security policy of the access network node and the identifier of the service association to the access network node, and indicate to the access network node that the network node is an access network node, Alternatively, the core network node indicates to the access network node that the network node is not a UPF node.
  • the sending unit 1003 can also be used to:
  • the serving UPF node of the terminal device indicates that the network node is an access network node.
  • the core network node provided by the foregoing embodiment is configured to acquire information related to the service of the terminal device, and determine, according to the information associated with the service, a network node that performs security protection on the data of the service, and implements flexibility for different services. Selecting different network nodes to perform security protection, which can meet the security requirements of operators or services. For example, data for banking services can be protected at the UPF node, which greatly improves security.
  • the UPF node is used as a fixed
  • the method also solves the problem of resource waste caused by the security protection of the roaming user's data sent to the UPF node of the home network.
  • the embodiment of the present invention provides a UFP node, which can be used to perform the action or step of the UPF node in the embodiment shown in FIG. 3, and can also be used to perform the implementation shown in FIG. 6-9.
  • the action or step of the UPF node in the example, the UPF node may include: a receiving unit 1101 and a determining unit 1102.
  • the receiving unit 1101 is configured to receive information about the network node that performs security protection on the data of the service of the terminal device or security protection mode information from the core network node.
  • the determining unit 1102 is configured to determine whether to perform security protection on the data of the service according to the information of the network node or the security protection mode information received by the receiving unit 1101.
  • the information of the network node may include:
  • a network node that performs security protection on data of the service is an access network node;
  • the network node performing security protection on the data of the service is not an access network node;
  • the network node that performs security protection on the data of the service is not a UPF node; or,
  • the network node that performs security protection on the data of the service is a UPF node.
  • the security protection mode information includes: a user plane UP security protection mode of the data of the service, where the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the Kup and the security policy of the UPF node obtain a security key.
  • determining unit 1102 can also be used to:
  • the security capability of the terminal device only includes the integrity protection capability of the terminal device, determining an integrity protection algorithm according to the integrity protection capability of the terminal device and the integrity protection capability of the UPF node;
  • the security capability of the terminal device includes the encryption capability of the terminal device and the integrity protection capability of the terminal device, determining an encryption algorithm and integrity according to the security capability of the terminal device and the security capability of the UPF node. Sex protection algorithm.
  • the determining unit 1102 is further configured to:
  • determining unit 1102 can also be used to:
  • the UP security protection mode is encryption protection, determining an encryption algorithm according to the encryption capability of the terminal device and the encryption capability of the UPF node; or
  • the UP security protection mode is integrity protection, determining an integrity protection algorithm according to the integrity protection capability of the terminal device and the integrity protection capability of the UPF node; or
  • the encryption algorithm and the integrity protection algorithm are determined according to the security capability of the terminal device and the security capability of the UPF node.
  • the UFP node further includes:
  • the sending unit 1103 is configured to send the UP security algorithm to the terminal device.
  • the core network node is a session management function SMF node
  • the UFP node further includes:
  • the executing unit 1104 is configured to perform security protection on the data of the service according to the security key, the UP security algorithm, and the identifier associated with the service.
  • the UPF node provided in this embodiment is configured to receive information about the network node that performs security protection on the data of the service of the terminal device or security protection mode information from the core network node, and determine the information according to the network node or the foregoing security protection mode information.
  • the security protection of the data of the service is implemented, and the UPF node can flexibly perform security protection on the service of the terminal device according to the indication of the network node to meet the security requirements of the operator or the service.
  • an embodiment of the present invention provides an access network node, where the access network node may be used to perform an action or a step of an access network node in the embodiment shown in FIG. 4a, and may also be used to execute a map.
  • the access network node includes: an obtaining unit 1201 and a determining unit 1202.
  • the determining unit 1202 is configured to determine, according to the information associated with the service acquired by the obtaining unit 1201, whether to perform security protection on data of the service.
  • the obtaining unit 1201 is configured to perform step 401 in FIG. 4, the determining unit 1202 is configured to perform step 402; or the obtaining unit 1201 is configured to perform step 401b in FIG. 4b, and the determining unit 1202 is configured to perform step 402b.
  • the determining unit 1202 is further configured to:
  • Determining whether to perform security protection on the data of the service according to the information associated with the service and the information indicated by the core network node.
  • the information of the indication may include:
  • a network node that performs security protection on data of the service is an access network node;
  • the network node performing security protection on the data of the service is not an access network node;
  • the network node performing security protection on the data of the service is not a user plane function UPF node; or
  • the network node that performs security protection on the data of the service is a UPF node; or,
  • the user plane UP security protection mode of the data of the service where the UP security protection mode includes at least one of encryption protection and integrity protection.
  • the access network node when determining to perform security protection on the data of the service, the access network node further includes:
  • the sending unit 1203 is configured to instruct the terminal device to perform security protection on the data of the service by the access network node, or to indicate, to the terminal device, an access layer AS security protection mode of data of the service,
  • the AS security protection mode includes at least one of encryption protection and integrity protection.
  • the determining unit 1202 is further configured to: acquire a security capability of the terminal device, a security policy of the access network node, and an identifier associated with the service; and according to the security capability of the terminal device and the Determining an AS security algorithm by the security capability of the network access node; and obtaining the security key according to the security policy of the access network node, the AS security algorithm and the access network key K an ;
  • the sending unit 1203 is further configured to send, by the determining unit 1202, the AS security algorithm and the identifier of the service association to the terminal device.
  • the access network node may further include:
  • the executing unit 1204 is configured to perform security protection on the data of the service according to the AS security algorithm, the security key, and the identifier associated with the service.
  • the access network node when it is determined that the data of the service is not performing security protection, the access network node further includes:
  • the sending unit 1203 is configured to indicate to the terminal device that the access network node does not perform security protection on data of the service.
  • the embodiment of the present invention provides a terminal device, which can be used to perform the action or the step of the terminal device in the embodiment shown in FIG. 5, and can also be used to execute the terminal device in the embodiment shown in FIG. 6-9. Action or step.
  • the terminal device includes: a receiving unit 1301, a processing unit 1302, and an executing unit 1303.
  • the receiving unit 1301 is configured to receive, from the access network node, an access layer AS security algorithm and an identifier of a service association of the terminal device;
  • the processing unit 1302 is configured to obtain the first security secret according to the AS security algorithm received by the receiving unit 1301, the access network key Kan and the AS security protection mode of the data of the service indicated by the access network node.
  • the AS security protection mode includes at least one of encryption protection and integrity protection;
  • the executing unit 1303 is configured to perform security protection on the data of the service according to the first security key obtained by the processing unit 1302, the AS security algorithm, and the identifier associated with the service.
  • the receiving unit 1301 is further configured to perform step 504, and the processing unit 1302 is further configured to perform step 505.
  • the terminal device provided by the foregoing embodiment is configured to perform security protection on the data of the service of the terminal device according to the AS security protection mode indicated by the access network node, that is, perform AS security protection according to the indication of the access network node, and ensure that the UPF node is implemented.
  • the security protection is successfully decoupled from the security protection of the access network nodes to improve security.
  • the embodiment of the present invention provides another terminal device, which can be used to perform the actions or steps of the terminal device in the embodiment shown in FIG. 5a, and can also be used to execute the terminal in the embodiment shown in FIG. 6-9.
  • the action or step of the device such as As shown in FIG. 13, the terminal device includes a receiving unit 1301, a processing unit 1302, and an executing unit 1303.
  • the receiving unit 1301 is configured to receive, from the access network node, an access layer AS security algorithm and an identifier of a service association of the terminal device;
  • the processing unit 1302 is configured to: when the access network node instructs the access network node to perform security protection on the data of the service, according to the AS security algorithm and the access network key K an received by the receiving unit 1301 Obtaining the first security key;
  • the executing unit 1303 is configured to perform security protection on the data of the service according to the first security key obtained by the processing unit 1302, the AS security algorithm, and the identifier associated with the service.
  • the receiving unit 1301 is further configured to receive a user plane UP security algorithm from the core network node, and the processing unit 1302 is further configured to use the UP security algorithm and the user root.
  • the key K up is obtained to obtain a second security key.
  • the receiving unit 1301 is further configured to perform step 504, and the processing unit 1302 is further configured to perform step 505.
  • the terminal device provided by the foregoing embodiment is configured to perform AS security protection on the data of the service of the terminal device according to the indication of the access network node, and can successfully decouple the security protection between the UPF node and the security protection of the access network node. Improve security.
  • the embodiment of the present invention provides a terminal device.
  • the structure of the terminal device can be used to perform the actions or steps of the terminal device in the embodiment shown in FIG. 5b, and can also be used to perform the operations shown in FIG. The actions or steps of the terminal device in the illustrated embodiment.
  • the receiving unit 1301 is configured to perform step 501b
  • the processing unit 1302 is configured to perform step 502b
  • the executing unit 1303 is configured to execute 503b.
  • the receiving unit 1301 is further configured to perform step 504b
  • the processing unit 1302 is further configured to perform step 505b
  • the executing unit 1303 is further configured to execute 506b.
  • an embodiment of the present invention provides a core network node, which may be an AMF node or an SMF node, and may be used to perform actions or steps of a core network node in the embodiment shown in FIG.
  • the actions or steps of the SMF node in the embodiment shown in FIG. 6-8 may be used to perform the actions or steps of the AMF node in the embodiment shown in FIG.
  • it includes a processor 1401, a memory 1402, and a communication interface 1403.
  • a memory 1402 configured to store a program
  • the processor 1401 is configured to execute a program stored in the memory 1402 to implement the action of the core network node in the embodiment shown in FIG. 2, or the action of the SMF node in the embodiment shown in FIG. 6-8, or the implementation shown in FIG. The action of the AMF node in the example will not be described again.
  • the embodiment of the present invention provides a UPF node, which can be used to perform the action or the step of the UPF node in the embodiment shown in FIG. 3, and can also be used to perform the implementation shown in FIG. 6-9.
  • the action or step of the UPF node in the example. Specifically, it includes a processor 1501, a memory 1502, and a communication interface 1503.
  • a memory 1502 configured to store a program
  • the processor 1501 is configured to execute a program stored in the memory 1502 to implement the UPF node in the embodiment shown in FIG.
  • the action, or the action of the UPF node in the embodiment shown in FIG. 6-9, will not be described again.
  • an embodiment of the present invention provides an access network node, where the access network node can be used to perform an action or a step of an access network node in the embodiment shown in FIG. 4, or 4a or 4b, and It can be used to perform the actions or steps of the access network node in the embodiment shown in Figures 6-9.
  • the access network node includes a processor 1601, a memory 1602, and a communication interface 1603.
  • the processor 1601 is configured to execute a program stored in the memory 1602 to implement an action of an access network node in the embodiment shown in FIG. 4, or 4a or 4b, or an access network node in the embodiment shown in FIG. 6-9. Action, no longer repeat.
  • the embodiment of the present invention provides a terminal device, which can be used to perform the actions or steps of the terminal device in the embodiment shown in FIG. 5, or 5a or 5b, and can also be used to execute FIG.
  • the actions or steps of the terminal device in the embodiment shown in FIG. Specifically, it includes a processor 1701, a memory 1702, and a communication interface 1703.
  • a memory 1702 configured to store a program
  • the processor 1701 is configured to execute a program stored in the memory 1702 to implement the action of the terminal device in the embodiment shown in FIG. 5, or 5a or 5b, or the action of the terminal device in the embodiment shown in FIG. 6-9, no longer Narration.
  • Communication interface 1703 may specifically be a transceiver.
  • the embodiment of the present invention provides a system, including: a core network node and a UPF node, and the core network node is specifically shown in FIG. 10 or 14, and the UPF node is as shown in FIG. 11 or 15.
  • the method further includes: an access network node as shown in FIG. 12 or 16.
  • the above system may further include a terminal device as shown in FIG. 13 or 17.
  • An embodiment of the present invention provides another system, including: an access network node as shown in FIG. 12 or 16, and a terminal device as shown in FIG. 13 or 17.
  • the method further includes: a core network node as shown in FIG. 10 or 14, and a UPF node as shown in FIG. 11 or 15.
  • the network node may be a UPF node or an access network node;
  • the security protection may be at least one of integrity protection and encryption protection, and the security key may be It is at least one of an integrity key and an encryption key;
  • performing security protection on the data of the service may also be performing a security protection operation on the data of the service, or a security protection process, which is not limited.
  • the network node indicating that the core network node performs security protection on the data of the service to the UPF node or the access network node is a UPF node
  • the core network node indicates data to the service to the UPF node or the access network node.
  • the network node performing the security protection is not the access network node.
  • the core network node may indicate to the UPF node or the access network node that the UPF node starts or starts or activates or performs security protection, and the security protects the data for the service.
  • the network node indicating that the core network node performs security protection on the data of the service to the UPF node or the access network node is not a UPF node, and the network node that indicates that the core network node performs security protection on the data of the service to the UPF node or the access network node is The access network node may specifically be that the core network node indicates to the UPF node or the access network node that the access network node starts or starts or activates or performs security protection, and the security protection is for service data.
  • the network node that performs security protection on the data of the service is not in the UPF node, and the network node that performs security protection on the data of the service is a UPF node, and the UPF node may refer to a specific UPF node.
  • the service UPF node of the terminal device may refer to a specific UPF node.
  • the network node performing security protection on the data of the foregoing is an access network node, and the network node performing security protection on the data of the service is not an access network node, and the access network node may refer to the terminal device.
  • Service access network node is an access network node, and the network node performing security protection on the data of the service is not an access network node, and the access network node may refer to the terminal device. Service access network node.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transfer to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL), or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).

Abstract

本发明公开了一种通信系统中数据的保护方法、装置和系统。该方法包括：核心网节点获取终端设备的业务相关联的信息；所述核心网节点根据所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。该方法能够实现针对不同的业务能够灵活选择不同的网络节点来执行安全保护，满足运营商或业务的安全需求，提高系统的安全性。

Description

数据的保护方法、装置和系统 技术领域
本发明涉及通信系统，尤其涉及一种数据的保护方法、装置和系统。
背景技术
在长期演进(Long Term Evolution，简称LTE)系统中，为了保证数据传输的安全性，基站(evolved node-B，eNB)对终端设备的业务的下行数据执行安全保护，例如，加密保护，完整性保护，并将执行安全保护后的下行数据通过基站与终端设备之间的空口发送给终端设备；相应地，终端设备对业务的上行数据执行安全保护，并将执行安全保护后的上行数据通过空口发送给基站。经安全保护的数据在空口传输的过程中处于安全保护状态，能够有效防止攻击者劫取。
但随着3GPP标准的演进，通信系统的网络结构以及安全需求在不断变化，因此，数据的安全保护有待进一步优化。
发明内容
本发明实施例提供一种通信系统中数据的保护方法、装置和系统，能够实现灵活选择网络节点执行安全保护，满足运营商或业务的安全需求，提高网络的安全性。
第一方面，提供了一种通信系统中数据的保护方法，包括：核心网节点获取终端设备的业务相关联的信息；所述核心网节点根据所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。该方法实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求。
结合第一方面，在第一方面的第一种实施方式中，所述核心网节点根据所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点，包括：所述核心网节点根据所述核心网节点所连接的用户面功能UPF节点的安全能力，以及所述业务相关联的信息，确定所述网络节点；或者，所述核心网节点根据所述业务相关联的信息与执行安全保护的网络节点之间的对应关系，确定所述网络节点。
结合第一方面或第一方面的第一种实现方式，在第一方面的第二种实施方式中，所述核心网节点获取终端设备的业务相关联的信息，包括：所述核心网节点从所述终端设备接收请求消息，所述请求消息用于请求为所述业务建立会话，所述请求消息包含所述业务相关联的信息；或者，所述核心网节点根据所述核心网节点相关联的切片信息，获取所述业务相关联的信息。
结合第一方面或第一方面的任一种实现，在第一方面的第三种实施方式中，所述网络节点为UPF节点，所述方法还包括：所述核心网节点发送安全相关的参数给所述UPF节点。
结合第一方面的第三种实现，在第一方面的第四种实施方式中，所述安全相关的参数包括：用户面根密钥Kup，所述终端设备的安全能力和所述UPF节点的安全策略。
结合第一方面的第三种实现或第一方面的第四种实现，在第一方面的第五种实施方式中，所述核心网节点向所述UPF节点指示所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种；或者，所述核心网节点向所述UPF节点指示所述网络节点是UPF节点。
结合第一方面或第一方面的任一种实现，在第一方面的第六种实施方式中，所述终端设备的安全能力仅包括所述终端设备的加密能力；或者，所述终端设备的安全能力仅包括所述终端设备的完整性保护能力；或者，所述终端设备的安全能力包括所述终端设备的加密能力和所述终端设备的完整性保护能力。
结合第一方面或第一方面的任一种实现，在第一方面的第七种实施方式中，所述核心网节点为会话管理功能SMF节点，所述SMF节点从所述UPF节点接收UP安全算法。
结合第一方面或第一方面的第一种实现或第一方面的第二种实现的任一种实现，在第一方面的第八种实施方式中，所述网络节点为UPF节点，且所述核心网节点为SMF节点，所述SMF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；所述SMF节点根据所述UP安全算法，Kup和所述UPF的安全策略，获得安全密钥；所述SMF节点发送所述UP安全算法，所述安全密钥和所述业务关联的标识给所述UPF节点。
结合第一方面的第七种实现或第一方面的第八种实现，在第一方面的第九种实施方式中，所述SMF节点发送所述UP安全算法给所述终端设备。
结合第一方面的第九种实现，在第一方面的第十种实施方式中，所述SMF节点向所述UPF节点指示对所述业务的数据执行安全保护。
结合第一方面的第九种或第一方面的第十种实现，在第一方面的第十一种实施方式中，所述SMF节点向所述终端设备指示所述业务的数据的UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
结合第一方面或第一方面的任一种实现，在第一方面的第十二种实施方式中，所述核心网节点发送接入网节点的安全策略和所述业务关联的标识给所述接入网节点。
结合第一方面的第十二种实现，在第一方面的第十三种实施方式中，所述核心网节点向所述接入网节点指示所述网络节点不是接入网节点；或者，所述核心网节点向所述接入网节点指示所述网络节点是UPF节点；或者，所述核心网节点向所述接入网节点指示所述业务的数据的UP安全保护方式。
结合第一方面或第一方面的第一种实现或第一方面的第二种实现的任一种实现，在第一方面的第十四种实施方式中，所述网络节点为接入网节点，所述核心网节点发送所述接入网节点的安全策略和所述业务关联的标识给所述接入网节点；所述核心网节点向所述接入网节点指示所述网络节点是接入网节点，或者，所述核心网节点向所述接入网节点指示所述网络节点不是UPF节点。
结合第一方面的第十四种实现，在第一方面的第十五种实施方式中，所述核心网节点向所述终端设备的服务UPF节点指示对所述业务的数据不执行安全保护，或者，所述核心网节点向所述终端设备的服务UPF节点指示所述网络节点不是UPF节点；或者，所述核心网节点向所述终端设备的服务UPF节点指示所述网络节点是接入网节点。
第二方面，提供了一种通信系统中数据的保护方法，包括：UFP节点从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息；所述UFP节点根据所述网络节点的信息或所述安全保护方式信息，确定是否对所述业务的数据执行安全 保护。该方法使得UPF节点能够灵活地根据网络节点的指示对终端设备的业务执行安全保护，以满足运营商或业务的安全需求
结合第二方面，在第二方面的第一种实施方式中，所述网络节点的信息包括：对所述业务的数据执行安全保护的网络节点是接入网节点；或者，对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，对所述业务的数据执行安全保护的网络节点不是UPF节点；或者，对所述业务的数据执行安全保护的网络节点是UPF节点。
结合第二方面，在第二方面的第二种实施方式中，所述安全保护方式信息包括：所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
结合第二方面或第二方面的任一种实现，在第二方面的第三种实施方式中，当确定对所述终端设备的业务的数据执行安全保护时，所述方法还包括：所述UPF节点获取所述终端设备的安全能力，用户面根密钥Kup和所述UPF节点的安全策略；所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；所述UPF节点根据所述UP安全算法，所述Kup和所述UPF节点的安全策略，获得安全密钥。
结合第二方面的第三种实现，在第二方面的第四种实施方式中，所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定用户面UP安全算法，包括：当所述终端设备的安全能力仅包含所述终端设备的加密能力时，所述UPF节点根据所述终端设备的加密能力和所述UPF节点的加密能力,确定加密算法；或者，当所述终端设备的安全能力仅包含所述终端设备的完整性保护能力时，所述UPF节点根据所述终端设备的完整性保护能力和所述UPF节点的完整性保护能力,确定完整性保护算法；或者，当所述终端设备的安全能力包含所述终端设备的加密能力和所述终端设备的完整性保护能力时，所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力,确定加密算法和完整性保护算法。
结合第二方面的第三种实现，在第二方面的第五种实施方式中，所述安全保护方式信息包括所述UP安全保护方式，所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法，包括：所述UFP节点根据所述UP安全保护方式，所述终端设备的安全能力和所述UPF节点的安全能力，确定所述UP安全算法。
结合第二方面的第五种实现，在第二方面的第六种实施方式中，所述UFP节点根据所述UP安全保护方式，所述终端设备的安全能力和所述UPF节点的安全能力，确定所述UP安全算法，包括：当所述UP安全保护方式为加密保护时，所述UPF节点根据所述终端设备的加密能力和所述UPF节点的加密能力，确定加密算法；或者，当所述UP安全保护方式为完整性保护时，所述UPF节点根据所述终端设备的完整性保护能力和所述UPF节点的完整性保护能力，确定完整性保护算法；或者，当所述UP安全保护方式为加密保护和完整性保护时，所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定加密算法和完整性保护算法。
结合第二方面或第二方面的任一种实现，在第二方面的第七种实施方式中，所述UPF节点将所述UP安全算法发送给所述终端设备。
结合第二方面或第二方面的任一种实现，在第二方面的第八种实施方式中，所述核心网节点为会话管理功能SMF节点，所述方法还包括：所述UPF节点根据所述安全密钥，所述UP安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。
第三方面，提供了一种通信系统中数据的保护方法，其特征在于，所述方法包括：接入 网节点获取终端设备的业务相关联的信息；所述接入网节点根据所述业务相关联的信息，确定是否对所述业务的数据执行安全保护。该方法实现了接入网节点独立地确定自身是否执行安全保护，从而实现了接入网节点的安全保护与UPF节点的安全保护之间的解耦，提高了网络的安全性能。
结合第三方面，在第三方面的第一种实施方式中，所述接入网节点根据所述业务相关联的信息，确定是否对所述业务的数据的执行安全保护，包括：所述接入网节点根据所述业务相关联的信息和核心网节点所指示的信息，确定是否对所述业务的数据的执行安全保护；
其中，所述指示的信息包括：对所述业务的数据执行安全保护的网络节点是接入网节点；或者，对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，对所述业务的数据执行安全保护的网络节点不是用户面功能UPF节点；或者，对所述业务的数据执行安全保护的网络节点是UPF节点；或者，所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
结合第三方面或第三方面的第一种实现，在第三方面的第二种实施方式中，当确定对所述业务的数据执行安全保护时，所述方法还包括：所述接入网节点向所述终端设备指示所述接入网节点对所述业务的数据执行安全保护；或者，所述接入网节点向所述终端设备指示所述业务的数据的接入层AS安全保护方式，所述AS安全保护方式包括加密保护和完整性保护中的至少一种。
结合第三方面的第二种实施方式，在第三方面的第三种实施方式中，所述接入网节点获取所述终端设备的安全能力，所述接入网节点的安全策略和所述业务关联的标识；所述接入网节点根据所述终端设备的安全能力和所述接入网节点的安全能力，确定AS安全算法；所述接入网节点根据所述接入网节点的安全策略，所述AS安全算法和接入网密钥Kan，获得安全密钥；所述接入网节点发送所述AS安全算法和所述业务关联的标识给所述终端设备。
结合第三方面的第三种实施方式，在第三方面的第四种实施方式中，所述接入网节点根据所述AS安全算法，所述安全密钥和所述业务关联的标识，对所述业务的数据执行安全保护。
结合第三方面或第三方面的第一种实现，在第三方面的第五种实施方式中，当确定对所述业务的数据不执行安全保护时，所述方法还包括：所述接入网节点向所述终端设备指示所述接入网节点对所述业务的数据不执行安全保护。
第四方面，提供了一种通信系统中数据的保护方法，其特征在于，所述方法包括：终端设备从接入网节点接收接入层AS安全算法和所述终端设备的业务关联的标识；所述终端设备根据所述AS安全算法，接入网密钥Kan和所述接入网节点指示的所述业务的数据的AS安全保护方式，获得第一安全密钥，所述AS安全保护方式包括加密保护和完整性保护中的至少一种；所述终端设备根据所述第一安全密钥，所述AS安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。该方法能够保证实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升安全性能。
第五方面，提供了一种通信系统中数据的保护方法，其特征在于，所述方法包括：终端设备从接入网节点接收接入层AS安全算法和所述终端设备的业务关联的标识；当所述接入网节点指示所述接入网节点对所述业务的数据执行安全保护时，所述终端设备根据所述AS安全算法和接入网密钥Kan，获得第一安全密钥；所述终端设备根据所述第一安全密钥，所述AS安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。该方法能够实现 UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升安全性能。
结合第四方面或者第五方面，在一种可能的实现中，所述终端设备从核心网节点接收用户面UP安全算法；所述终端设备根据所述UP安全算法和用户面根密钥Kup，获得第二安全密钥。
结合第四方面或者第五方面的任一种实现，在另一种可能的实现中，所述终端设备根据所述UP安全算法和Kup，获得第二安全密钥，包括：所述终端设备根据所述UP安全算法，所述Kup和所述核心网节点指示的所述业务的数据的UP安全保护方式，获得所述第二安全密钥；
其中，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
第六方面，提供了一种核心网节点，包括用于执行以上第一方面的任一方法各个步骤的单元或者手段(means)。
第七方面，提供了一种核心网节点，包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第一方面的任一方法。
第八方面，提供了一种核心网节点，包括用于执行以上第一方面的任一方法的至少一个处理元件或芯片。
第九方面，提供了一种程序，该程序在被处理器执行时用于执行以上第一方面的任一方法。
第十方面，提供了一种计算机可读存储介质，包括第九方面的程序。
第十一方面，提供了一种用户面功能UFP节点，包括用于执行以上第二方面的任一方法各个步骤的单元或者手段(means)。
第十二方面，提供了一种UFP节点，包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第二方面的任一方法。
第十三方面，提供了一种UFP节点，包括用于执行以上第二方面的任一方法的至少一个处理元件或芯片。
第十四方面，提供了一种程序，该程序在被处理器执行时用于执行以上第二方面的任一方法。
第十五方面，提供了一种计算机可读存储介质，包括第十四方面的程序。
第十六方面，提供了一种接入网节点，包括用于执行以上第三方面的任一方法各个步骤的单元或者手段(means)。
第十七方面，提供了一种接入网节点，包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第三方面的任一方法。
第十八方面，提供了一种接入网节点，包括用于执行以上第三方面的任一方法的至少一个处理元件或芯片。
第十九方面，提供了一种程序，该程序在被处理器执行时用于执行以上第三方面的任一方法。
第二十方面，提供了一种计算机可读存储介质，包括第十九方面的程序。
第二十一方面，提供了一种终端设备，包括用于执行以上第四方面或者第五方面的任一 方法各个步骤的单元或者手段(means)。
第二十二方面，提供了一种终端设备，包括处理器和存储器，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第四方面或者第五方面的任一方法。
第二十三方面，提供了一种终端设备，包括用于执行以上第四方面或者第五方面的任一方法的至少一个处理元件或芯片。
第二十四方面，提供了一种程序，该程序在被处理器执行时用于执行以上第四方面或者第五方面的任一方法。
第二十五方面，提供了一种计算机可读存储介质，包括第二十四方面的程序。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图进行简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为一种网络结构图；
图2为本发明实施例提供的一种数据的保护方法的流程图；
图3为本发明实施例提供的又一种数据的保护方法的流程图；
图4为本发明实施例提供的另一种数据的保护方法的流程图；
图4a为本发明实施例提供的另一种数据的保护方法的流程图；
图4b为本发明实施例提供的另一种数据的保护方法的流程图；
图5为本发明实施例提供的再一种数据的保护方法的流程图；
图5a为本发明实施例提供的再一种数据的保护方法的流程图；
图5b为本发明实施例提供的再一种数据的保护方法的流程图；
图6为本发明实施例提供的一种数据的保护方法的示意图；
图7为本发明实施例提供的另一种数据的保护方法的示意图；
图8为本发明实施例提供的再一种数据的保护方法的示意图；
图9为本发明实施例提供的再一种数据的保护方法的示意图；
图10为本发明实施例提供的一种核心网节点的结构示意图；
图11为本发明实施例提供的一种UPF节点的结构示意图；
图12为本发明实施例提供的一种接入网节点的结构示意图；
图13为本发明实施例提供的一种终端设备的结构示意图；
图14为本发明实施例提供的一种核心网节点的硬件结构图；
图15为本发明实施例提供的一种UPF节点的硬件结构图；
图16为本发明实施例提供的一种接入网节点的硬件结构图；
图17为本发明实施例提供的一种终端设备的硬件结构图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行描述。图1提供了一种网络结构，该网络结构可以应用于下一代通信系统。下面对该网络结构中的各个组成 部分进行简单介绍如下：
终端设备：可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备，以及各种形式的终端，移动台(mobile station，MS)，终端(terminal)，用户设备(user equipment，UE)，软终端等等，例如水表、电表、传感器等。
接入网节点：类似于传统网络里面的基站，为特定区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等使用不同质量的传输隧道。接入网节点能够管理无线资源，为终端设备提供接入服务，进而完成控制信号和用户数据在终端设备和核心网之间的转发。
接入和移动管理功能(access and mobility management function，AMF)节点：负责移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能。
会话管理功能(session management function，SMF)节点：为终端设备建立会话，分配会话标识(ID)，以及管理或终止会话。
用户面功能(User plane function，UPF)节点：提供会话和承载管理，IP地址分配等功能。
策略控制功能(Policy Control Function，PCF)节点：为网络实体，例如，接入网节点或UPF节点，分配安全策略。
数据网络(data network，DN)：提供外部数据网络服务。
应用功能(application function，AF)实体：提供应用层服务。
如图1所示，上述各个组成部分通过下一代(next generation，NG)路径通信，例如，接入网节点与UPF节点通过NG3路径通信。此外，SMF节点和AMF节点可以集成在一个实体设备中，也可以分布在不同的实体设备上，本申请对此不作具体限定。
如图2所示，本发明实施例提供的一种数据的保护方法，该方法由核心网节点来执行，该核心网节点可以为SMF节点或AMF节点，该方法具体如下所述。
201、核心网节点获取终端设备的业务相关联的信息。
其中，终端设备的业务可以是物联网(internet of things，IOT)业务，语音业务或车联网业务，不予限制。
进一步的，业务相关联的信息可以包括业务类型信息，切片类型(slice type)信息，接入点名称(access point name，APN)信息，DN名称信息或其他可以表征终端设备业务的信息。
例如，核心网节点可以通过如下方式获取终端设备的业务相关联的信息：
方式一、核心网节点接收终端设备发送的请求消息，所述请求消息用于请求为所述业务建立会话，所述请求消息包含所述业务相关联的信息。其中，请求消息可以是会话建立请求消息。
方式二、核心网节点根据所述核心网节点的切片信息，获取所述业务相关联的信息。
本发明实施例中，切片可以是基于云计算、虚拟化、软件定义网络、分布式云架构等几大技术群，通过上层统一的编排让网络具备管理、协同的能力，从而实现基于一个通用的物理网络基础架构平台，能够同时支持多个逻辑网络的功能。对于每个切片而言其具有如下特点，例如，提供相同的业务类型，或，共同一个租户(tenant)使用；核心网节点的切片信 息可以包括切片类型，切片类型可以是核心网节点所属切片提供的业务类型；其中，核心网节点的切片信息也可以包括tenant信息。
202、核心网节点根据业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。
其中，上述网络节点可以是特定的网络节点，例如，终端设备的服务接入网节点，或终端设备的服务UPF节点。上述网络节点也可以是一种类型的网络节点，例如，当存在多个UPF节点时，上述网络节点为UPF节点不是指某一个UPF节点，而是指安全保护是在UPF节点这个位置来执行。
例如，步骤202可以采用如下方式实现：
方式一、核心网节点根据该核心网节点所连接的UPF节点的安全能力，以及上述业务相关联的信息，确定上述网络节点。
其中，UPF节点的安全能力可以包括加密能力和完整性保护能力中的至少一种。
进一步地，加密能力可以包括UPF节点支持的加密算法，以及加密算法的优先级等。完整性保护能力包括UPF节点支持的完整性保护算法，以及完整性保护算法的优先级等。
例如，核心网节点可以根据所述业务相关联的信息与安全能力需求之间的对应关系，获得与上述业务相关联的信息对应的安全能力需求，该安全能力需求可以是安全能力的优先级。在核心网所连接的UPF节点中选择一个安全能力的优先级满足该安全能力需求的UPF节点作为上述网络节点，例如，选择一个安全能力的优先级高于或等于该安全能力需求的UPF节点作为上述网络节点。
一个示例中，假设上述业务相关联的信息对应的安全能力需求为128比特(bit)的加密算法，且加密算法的优先级为5级，在核心网节点所连接的UPF中选择一个支持128bit加密算法，且该加密算法的优先级为5级的UPF节点。显然，也可以选择安全能力的优先级高于上述安全能力需求的UPF节点，此处不予限制。
在本发明实施例中，当核心网节点所连接的UPF节点中存在至少两个UPF节点满足上述安全能力需求时，可以根据该至少两个UPF节点的状态参数和安全能力的优先级中的至少一种来选择一个UPF节点作为上述网络节点，也可以随机选择一个UPF节点作为上述网络节点。其中，上述状态参数可以包括负荷，运算能力等。
例如，在至少两个UPF节点中选择一个安全能力的优先级最高的UPF节点作为上述网络节点，或者，在至少两个UPF节点中随机选择一个UFP节点作为上述网络节点。
方式二、核心网节点根据所述业务相关联的信息与执行安全保护的节点之间的对应关系，确定上述网络节点。
一个示例中，假设上述业务相关联的信息可以为业务类型信息或切片类型信息，例如，语音业务，且上述对应关系为语音业务对应UPF节点，则上述网络节点为UPF节点。
其中，上述方式二中的对应关系可以从第三方应用或第三方服务器接收，也可以是运营商通过通信接口配置到核心网节点中，不予限制。
在本发明实施例中，当核心网节点所连接的UPF节点存在至少两个时，可以根据该至少两个UPF节点的状态参数和安全能力的优先级中的至少一种来选择一个UPF节点作为上述网络节点，也可以随机选择一个UPF节点作为上述网络节点，详细描述可以参见上述方式一，不再赘述。
此外，可以采用上述方式一和方式二可以结合使用，以确定上述网络节点，不再赘述。
采用上述实施例提供的方法，核心网节点获取终端设备的业务相关联的信息，并根据业务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求。例如，对于银行业务的数据可以在UPF节点执行安全保护，大大提高了安全性。
可选地，在上述实施例的第一种实施场景下，上述网络节点为UPF节点，上述方法还包括步骤203和步骤204中的至少一个。
203、核心网节点发送安全相关的参数给UPF节点。
其中，安全相关的参数可以包括以下至少一种：用户面根密钥Kup，终端设备的安全能力和UPF节点的安全策略。UPF节点的安全策略可以用于指示UPF节点使用的安全密钥的长度，例如，128bit或256bit。
在本发明实施例中，上述UPF节点的安全策略可以与上述业务相关联的信息对应，即不同的业务相关联的信息可以对应不同的UPF节点的安全策略，例如，上述业务为车联网业务时，UPF节点可以采用128bit的安全密钥。此外，UPF节点的安全策略可以存储在核心网节点上，也可以从PCF节点获取，此处不予限制。
其中，终端设备的安全能力可以仅包括加密能力；或者，终端设备的安全能力仅包括完整性保护能力；或者，终端设备的安全能力包括加密能力和完整性保护能力。
204、核心网节点向上述UPF节点指示上述业务的数据的UP安全保护方式；或者，核心网节点向上述UPF节点指示上述网络节点是UPF节点。
其中，上述UP安全保护方式可以包括加密保护和完整性保护中的至少一种。
一个示例中，上述UP安全保护方式可以由核心网节点根据上述业务相关的信息与安全保护方式之间的对应关系确定，例如，语音业务对应加密保护，车联网业务对应完整性保护。
此外，UP安全保护方式可以在步骤202中确定，即上述网络节点的确定也可以根据网络节点支持的安全保护方式。
例如，UP安全保护方式可以采用2个bit位来表示，例如，01表示加密保护，10表示完整性保护，11表示加密保护和完整性保护。
其中，核心网节点向上述UPF节点指示上述网络节点是UPF节点，即核心网节点向上述UPF节点指示开启或启动或使能或激活UPF节点的安全保护，该安全保护是针对上述业务的数据的。
一个示例中，核心网节点向上述UPF节点指示上述网络节点是UPF节点可以采用发送指示信息的方式，例如，采用一个bit位，当该bit位的值为1时，表明对上述业务的数据执行安全保护的网络节点是UPF节点；当该bit位的值为0时，表明上述网络节点不是UPF节点，或者表明上述网络节点是接入网节点。
在本发明实施例中，当上述方法包括步骤203和204时，两个步骤可以分别实现，也通过一个动作实现，例如，步骤204采用指示信息的方式，即指示信息用于指示UP安全保护方式或指示上述网络节点是UPF节点，此时，可以将步骤203中的安全相关的参数和该指示信息携带在同一个消息中发送给上述UPF节点，该消息可以为会话建立消息。
可选地，当核心网节点为SMF节点时，上述方法还包括：
205、SMF节点从上述UPF节点接收UP安全算法。
其中，UP安全算法可以携带在会话建立响应消息中。
进一步地，上述方法还可以包括：
SMF节点发送UP安全算法给终端设备。
其中，UP安全算法可以携带在安全模式命令(security mode command，SMC)中，也可以携带在非接入层(non-access stratum，NAS)消息中。
可选地，在上述实施例的第二种实施场景下，上述网络节点为UPF节点，且核心网节点为SMF节点，上述方法还包括：
203a、SMF节点根据终端设备的安全能力和上述UPF节点的安全能力，确定UP安全算法。
其中，UP安全算法可以包括加密算法和完整性保护算法中的至少一种，用于UPF节点对上述业务的数据执行安全保护。
例如,SMF节点可以在上述UPF节点支持的安全算法中选择终端设备支持的安全算法，作为UP安全算法。再例如，当上述UPF节点支持的安全算中存在至少两个终端设备支持的安全算法时，可以选择优先级最高的一个安全算法作为UP安全算法。
204a、SMF节点根据上述UP安全算法，Kup和上述UPF的安全策略，获得安全密钥。
其中，上述安全密钥用于上述UPF节点对上述业务的数据进行安全保护，可以包括加密密钥和完整性保护密钥中的至少一种，例如，完整性密钥Kupfint和/或加密密钥Kupfenc。
例如，SMF节点可以根据UP安全算法和Kup推导出256bit的安全密钥；SMF节点根据UPF的安全策略对推导出的安全密钥进行截短处理。
一个示例中，假设UPF节点的安全策略指示UPF节点采用128bit的安全密钥，SMF节点将推导出的安全密钥中前128bit作为上述步骤204’中的安全密钥，即该UFP节点的安全密钥。
205a、SMF节点发送UP安全算法，上述安全密钥和上述业务关联的标识给UPF节点。
其中，上述业务关联的标识可以指示用于在终端设备和UPF节点之间传输上述业务的数据的路径，例如，会话的标识，或者，承载的标识。
可选地，上述方法还可以包括：
SMF节点发送UP安全算法给终端设备。
进一步地，上述方法还可以包括：
SMF节点向UPF节点指示对业务的数据执行安全保护。
进一步地，上述方法还可以包括：
SMF节点向终端设备指示上述业务的数据的UP安全保护方式。
其中，UP安全保护方式可以参见步骤204中的相关描述，不再赘述。
可选地，结合上述第一种实施场景或上述第二种实施场景，上述方法还包括步骤206和207中至少一个步骤。
206、核心网节点发送上述接入网节点的安全策略和上述业务关联的标识给上述接入网节点。
其中，上述接入网节点的安全策略可以用于指示上述接入网节点的安全密钥长度，该接入网节点的安全策略也可以存储在核心网节点上，或从PCF节点获取。
此外，该接入网节点的安全策略与UPF节点的安全策略类似，可以与上述业务相关联的 信息存在对应关系。
207、核心网节点向上述接入网节点指示上述网络节点不是接入网节点；或者，核心网节点向接入网节点指示上述网络节点是UPF节点；或者，核心网节点向上述接入网节点指示上述业务的数据的UP安全保护方式。
其中，核心网节点向上述接入网节点指示上述网络节点不是接入网节点，或，指示上述网络节点是UPF节点，均可以采用发送指示信息的方式。例如，采用一个bit位，当该bit位的值为1时，表明对上述网络节点是UPF节点，或表明上述网络节点不是接入网节点；或者，当该bit位的值为0时，表明上述网络节点不是UPF节点，或者表明上述网络节点是接入网节点。
此外，步骤207中核心网节点向上述接入网节点指示上述业务的数据的UP安全保护方式可以采用步骤204中的实现方式，例如，UP安全保护方式采用2个bit位来表示，例如，01表示加密保护，10表示完整性保护，11表示加密保护和完整性保护，核心网节点将该2个bit位发送给接入网节点，以指示上述业务的数据的UP安全保护方式。
在本发明实施例中，当上述方法包括步骤206和207时，两个步骤可以分别实现，也通过一个动作实现。例如，步骤207采用指示信息的方式，即指示信息用于指示UP安全保护方式或指示上述网络节点是UPF节点或指示上述网络节点不是接入网节点，此时，可以将步骤206中的上述接入网节点的安全策略和上述业务关联的标识，以及该指示信息携带在同一个消息中发送给上述接入网节点。
在上述实施例的第三种实施场景下，上述网络节点为接入网节点，上述方法还包括步骤204b和205b中的至少一个。
204b、核心网节点发送上述接入网节点的安全策略和上述业务关联的标识给上述接入网节点。
205b、核心网节点向上述接入网节点指示上述网络节点是上述接入网节点，或者，上述接入网节点向上述接入网节点指示上述网络节点不是UPF节点。
其中，步骤205b可以采用步骤204提供的方式来实现，例如，UP安全保护方式可以采用2个bit位来表示，不再赘述。
在本发明实施例中，当上述方法包括步骤204b和205b时，两个步骤可以分别实现，也通过一个动作实现。例如，步骤205b采用发送指示信息的方式，该指示信息用于指示上述网络节点是上述接入网节点或者不是UPF节点，此时，可以将步骤204b中的接入网节点的安全策略和上述业务关联的标识，以及步骤205b中的指示信息携带在同一个消息中发送给接入网节点。
进一步地，上述方法还可以包括：
核心网节点向终端设备的服务UPF节点指示对上述业务的数据不执行安全保护；或者，
核心网节点向终端设备的服务UPF节点指示上述网络节点不是UPF节点；或者，
核心网节点向终端设备的服务UPF节点指示上述网络节点是接入网节点。
其中，服务UPF节点指的是为上述业务提供服务的UPF节点。
如图3所示，本发明实施例提供的又一种数据的保护方法，该方法由UPF节点执行，具体如下所述。
301、UFP节点从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息。
其中，网络节点的信息可以包括：
对上述业务的数据执行安全保护的网络节点是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是UPF节点；或者，
对上述业务的数据执行安全保护的网络节点是UPF节点。
其中，安全保护方式信息可以包括：上述业务的数据的UP安全保护方式，该UP安全保护方式包括加密保护和完整性保护中的至少一种，具体可以采用图2所示实施例中的步骤207中的相关描述，不再赘述。
其中，网络节点的信息以及UP安全保护方式可以采用步骤204提供的方式来实现，例如，UP安全保护方式可以采用2个bit位来表示，不再赘述。
302、UFP节点根据上述网络节点的信息或上述安全保护方式信息，确定是否对所述业务的数据执行安全保护。
其中，安全保护的详细描述可以参见图2所示实施例，不再赘述。
例如，当步骤301中接收的是上述网络节点的信息时，UPF节点根据该信息来确定是否对上述业务的数据执行安全保护，可以包括：
当该信息用于指示上述网络节点是接入网节点或不是UPF节点时，UPF节点对上述业务的数据不执行安全保护；或者，
当该信息用于指示上述网络节点不是接入网节点或是UPF节点时，UPF节点对上述业务的数据执行安全保护。
例如，当步骤301中接收的是上述UP安全保护方式时，UPF节点根据该信息来确定是否对上述业务的数据执行安全保护，可以包括：
UPF节点根据UP安全保护方式指示的安全保护方式对上述业务的数据执行安全保护。
一个实例中，UP安全保护方式指示加密保护，UPF节点对上述业务的数据执行加密保护。
采用本实施例提供的方法，UPF节点从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息，并根据上述网络节点的信息或上述安全保护方式信息确定是否对所述业务的数据执行安全保护，使得UPF节点能够灵活地根据网络节点的指示对终端设备的业务执行安全保护，以满足运营商或业务的安全需求。
可选地，在一种实施场景下，当确定对所述终端设备的业务的数据执行安全保护时，或者，在UPF节点对上述业务的数据执行安全保护之前，上述方法还可以执行步骤303-305，如下：
303、UPF节点获取终端设备的安全能力，Kup和上述UPF节点的安全策略。
其中，终端设备的安全能力可以从核心网节点获取，例如，接收SMF节点或AMF节点发送的终端设备的安全能力，也可以从其它网络侧的节点获取，可以存储在UPF节点上，不予限制；安全能力的相关描述可以参见图2所示实施例，不再赘述。
类似地，Kup和上述UPF节点的安全策略同样可以采用上面的方式获取，此外，UPF的安全策略可以参见图2所示实施例中的相关描述，不再赘述。
304、UPF节点根据终端设备的安全能力和UPF节点的安全能力，确定UP安全算法。
305、UPF节点根据UP安全算法，Kup和UPF节点的安全策略，获得安全密钥。
步骤304和305均可以分别参考图2所示实施例中的步骤203a和204a，不再赘述。
可选地，步骤304包括：
当终端设备的安全能力仅包含终端设备的加密能力时，UPF节点根据终端设备的加密能力和UPF节点的加密能力,确定加密算法；或者，
当终端设备的安全能力仅包含终端设备的完整性保护能力时，UPF节点根据终端设备的完整性保护能力和UPF节点的完整性保护能力,确定完整性保护算法；或者，
当终端设备的安全能力包含终端设备的加密能力和终端设备的完整性保护能力时，UPF节点根据终端设备的安全能力和UPF节点的安全能力,确定加密算法和完整性保护算法。
可选地，安全保护方式信息包括上述UP安全保护方式，步骤304包括：
UFP节点根据上述UP安全保护方式，端设备的安全能力和UPF节点的安全能力，确定UP安全算法。
例如，当UP安全保护方式为加密保护时，UPF节点根据终端设备的加密能力和UPF节点的加密能力，确定加密算法；或者，当UP安全保护方式为完整性保护时，UPF节点根据终端设备的完整性保护能力和UPF节点的完整性保护能力，确定完整性保护算法；或者，当UP安全保护方式为加密保护和完整性保护时，UPF节点根据终端设备的安全能力和UPF节点的安全能力，确定加密算法和完整性保护算法。
进一步地，在步骤305之后，上述方法还包括：
306、UPF节点将UP安全算法发送给终端设备。
例如，UPF节点可以将UP安全算法发送给SMF节点，SMF节点将该UP安全算法携带在SMC或NAS消息中发送给终端设备。
进一步地，上述方法还可以包括：
307、UPF节点根据安全密钥和UP安全算法，对上述业务的数据执行安全保护。
例如，将上述业务的数据和安全密钥作为安全算法的输入，安全算法的输出为密文，实现了数据的安全保护。
其中，UPF节点可以通过所述业务关联的标识或终端设备的标识来识别上述业务的数据；上述业务关联的标识或终端设备的标识可以在步骤301中从核心网节点接收。UPF节点可以根据安全密钥，UP安全算法和上述业务关联的标识，对上述业务的数据执行安全保护。
在本发明实施例中，当核心网节点为SMF节点，业务关联的标识可以为会话ID。
在本发明实施例中，步骤306和307的执行先后顺序可以调整，此外，步骤307之前还可以包括：UPF节点接收SMF节点指示的对上述业务的数据执行安全保护。
如图4所示，本发明实施例还提供一种数据的保护方法，该方法由接入网节点执行，该方法包括：
401、接入网节点获取参考信息。
402、接入网节点根据获取的参考信息，确定是否对终端的业务的数据执行安全保护。
其中，上述参考信息包括以下信息中至少一种：终端设备的业务相关联的信息，本地策略，运营商策略，以及从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息。
其中，业务相关联的信息，安全保护均可以参见图2所示实施例中的相关描述，不再赘 述。
其中，本地策略可以用于指示接入网节点在确定是否对上述业务的数据执行安全保护时是否依据上述网络节点的信息或安全保护方式信息；本地策略还可以是上述业务相关联的信息与安全保护方式之间的对应关系。一个示例中，语音业务与加密保护对应，车联网业务与完整性保护对应。本地策略又可以是上述业务相关的信息与是否执行安全保护之间的对应关系。在另一个示例中，语音业务执行安全保护，车联网业务不执行安全保护。
其中，运营商策略可以是运营商是否允许接入网节点执行安全保护，或者，运营商允许接入网节点执行的安全保护方式，或者，运营商不允许接入网节点执行的安全保护方式。例如，运营商不允许接入网节点执行加密保护。核心网节点可以为SMF节点或AMF节点。
其中，网络节点的信息可以包括：
对上述业务的数据执行安全保护的网络节点是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是UPF节点；或者，
对上述业务的数据执行安全保护的网络节点是UPF节点。
其中，安全保护方式信息可以包括：上述业务的数据的UP安全保护方式，该UP安全保护方式包括加密保护和完整性保护中的至少一种，具体可以参见图2所示实施例中的步骤207中的相关描述，不再赘述。
其中，网络节点的信息以及UP安全保护方式可以采用步骤204或207中提供的方式来实现，例如，UP安全保护方式可以采用2个bit位来表示，不再赘述。
采用本实施例提供的方法，接入网节点获取参考信息，并根据获取的参考信息确定是否对终端的业务的数据执行安全保护，实现了接入网节点独立地确定自身是否执行安全保护，从而实现了接入网节点的安全保护与UPF节点的安全保护之间的解耦，提高了网络的安全性。
下面以参考信息为终端设备的业务相关联的信息为例进行说明，参见图4a。
图4a所示，本发明实施例提供的又一种数据的保护方法，该方法由接入网节点执行，具体如下。
401a、接入网节点获取终端设备的业务相关联的信息。
其中，接入网节点可以从终端设备获取上述业务相关联的信息，例如，接收终端设备发送的携带有上述业务相关联的信息的消息。
402a、接入网节点根据上述业务相关联的信息，确定是否对上述业务的数据执行安全保护。
在步骤402a中，接入网节点具体可以根据本地策略或运营商的策略或核心网节点所指示的信息，以及上述业务相关联的信息确定是否对上述业务的数据执行安全保护。
一个示例中，假设本地策略为上述业务相关联的信息与安全保护方式之间的对应关系，接入网节点根据上述业务相关联的信息和本地策略，执行与上述业务相关联的信息相对应的安全保护方式所指示的安全保护，例如，若上述业务的业务类型为语音业务，且语音业务对应的安全保护方式为加密保护，则对上述业务的数据执行加密保护。
其中，接入网节点根据上述业务相关联的信息和核心网节点所指示的信息，确定是否对上述业务的数据的执行安全保护。
其中，上述指示的信息可以包括：
对上述业务的数据执行安全保护的网络节点是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是接入网节点；或者，
对上述业务的数据执行安全保护的网络节点不是UPF节点；或者，
对上述业务的数据执行安全保护的网络节点是UPF节点；或者，
上述业务的数据的UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
在本发明实施例中，上述指示的信息可以采用步骤204或207中提供的方式来实现，不予赘述。
采用本实施例提供的方法，接入网节点获取终端设备的业务相关联的信息，并根据业务相关联的信息确定是否对终端的业务的数据执行安全保护，实现了接入网节点独立地确定自身是否执行安全保护，将接入网节点的安全保护与UPF节点的安全保护解耦；此外，根据业务相关联的信息来确实是否执行安全保护，能够满足不同业务的安全需求。
下面以参考信息为从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息，参见图4b。
401b、接入网节点从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息。
402b、接入网节点根据网络节点的信息或安全保护方式信息，确定是否对上述业务的数据执行安全保护。
例如，当步骤401b中接收的是上述网络节点的信息时，接入网节点根据该网络节点的信息来确定是否对上述业务的数据执行安全保护，可以包括：
当该网络节点的信息用于指示上述网络节点是接入网节点或不是UPF节点时，接入网节点对上述业务的数据执行安全保护；或者，
当该网络节点的信息用于指示上述网络节点不是接入网节点或是UPF节点时，接入网节点对上述业务的数据执行安全保护。
其中，业务相关联的信息可以参见图2所示实施例中的相关描述。
例如，当步骤401b中接收的是上述UP安全保护方式时，接入网节点根据该信息来确定是否对上述业务的数据执行安全保护，可以包括：
接入网节点根据UP安全保护方式指示的安全保护方式，确定是否对上述业务的数据执行安全保护。
一个示例中，UP安全保护方式指示加密保护，接入网节点可以对上述业务的数据执行完整性保护。
上述步骤402b可以根据上述业务相关联的信息或本地策略或运营商策略，以及该网络节点的信息，确定是否执行安全保护或执行的安全保护方式。例如，若接入网节点根据该网络节点的信息用于指示上述网络节点是接入网节点，且上述业务的业务类型为语音业务，则确定对上述业务的数据执行安全保护；或者，若接入网节点根据该网络节点的信息用于指示上述网络节点是接入网节点，且上述业务的业务类型为车联网业务，则确定对上述业务的数据不执行安全保护。
采用本实施例提供的方法，接入网节点根据核心网节点发送的对终端设备的业务的数据 执行安全保护的网络节点的信息或安全保护方式信息，确定是否对终端的业务的数据执行安全保护，实现了接入网节点能够独立地确定自身是否执行安全保护，从而将接入网节点的安全保护与UPF节点的安全保护解耦，以提高网络的安全性；此外，接入网节点参考UPF节点对上述业务的安全保护情况来确定自身是否执行安全保护，可以弥补UPF节点对上述业务的安全保护的不足，提升网络的安全性。
在上述图4或图4a或图4b所示实施例的一种实施场景下，当确定对上述业务的数据执行安全保护时，或在对上述业务的数据执行安全保护之前，还包括：
接入网节点向终端设备指示接入网节点对上述业务的数据执行安全保护；或者，
接入网节点向终端设备指示上述业务的数据的接入层(access stratum，AS)安全保护方式，该AS安全保护方式包括加密保护和完整性保护中的至少一种。
可选地，上述方法还包括：
接入网节点获取终端设备的安全能力，接入网节点的安全策略和上述业务关联的标识；
接入网节点根据终端设备的安全能力和所述接入网节点的安全能力，确定AS安全算法；
接入网节点根据接入网节点的安全策略，AS安全算法和接入网密钥Kan，获得安全密钥；
接入网节点发送AS安全算法和上述业务关联的标识给终端设备。
其中，终端设备的安全能力可以从终端设备获取，也可以是核心网节点发送给接入网节点。接入网节点的安全策略可以用于指示接入网节点使用的安全密钥的长度，该接入网节点的安全策略可以与上述业务对应的，即不同的业务对应不同的接入网节点的安全策略。该安全策略可以从核心网节点获取，也可以存储在接入网节点上。
此外，上述业务关联的标识可以参见图2所示实施例中的相关描述，不再赘述。
其中，AS安全算法和上述安全密钥用于接入网节点对上述业务的数据进行安全保护；上述安全密钥可以包括加密密钥和完整性密钥中的至少一种，例如，完整性密钥Kanint和/或加密密钥Kanenc；上述AS安全算法可以包括加密算法和完整性保护算法中的至少一种
此外，AS安全算法的确定方式可以参见步骤203a，安全密钥的获取方式可以参见步骤204a，此处不再赘述。
进一步地，上述方法还可以包括：
接入网节点根据AS安全算法，安全密钥和业务关联的标识，对上述业务的数据执行安全保护。
在上述图4或图4a或图4b所示实施例的另一种实施场景下，当确定对上述业务的数据不执行安全保护时，上述方法还包括：
接入网节点向终端设备指示接入网节点对上述业务的数据不执行安全保护。
如图5所示，本发明实施例提供了另一种数据的保护方法，该方法由终端设备执行，如下所述。
501、终端设备从接入网节点接收AS安全算法和终端设备的业务关联的标识。
502、终端设备根据AS安全算法，Kan和接入网节点指示的上述业务的数据的AS安全保护方式，获得第一安全密钥。
503、终端设备根据第一安全密钥，AS安全算法和上述业务关联的标识，对上述业务的 数据执行安全保护。
其中，步骤503中的安全保护是AS安全保护，即接入网节点与终端设备之间的安全保护，该安全保护用于保护用户面数据，可以包括加密保护和完整性保护中的至少一种。
此外，步骤502中的AS安全保护方式指的是AS安全保护的方式，例如，加密保护。AS安全算法指的是AS安全保护的安全算法，第一安全密钥指的是AS安全保护的密钥，也不再赘述。
采用上述实施例提供的方法，终端设备根据接入网节点指示的AS安全保护方式对终端设备的业务的数据执行安全保护，即根据接入网节点的指示执行AS安全保护，能够保证实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升通信系统的安全性。
如图5a所示，本发明实施例提供了另一种数据的保护方法，该方法由终端设备执行，如下所述。
501a、终端设备从接入网节点接收AS安全算法和终端设备的业务关联的标识。
502a、当接入网节点指示接入网节点对上述业务的数据执行安全保护时，终端设备根据所述AS安全算法和接入网密钥Kan，获得第一安全密钥。
503a、终端设备根据所述第一安全密钥，AS安全算法和上述业务关联的标识，对上述业务的数据执行安全保护。
其中，安全保护是AS安全保护，AS安全算法，第一安全密钥等可以参见图5中的相关描述，不再赘述。
采用上述实施例提供的方法，终端设备根据接入网节点的指示对终端设备的业务的数据执行AS安全保护，能够实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升通信系统的安全性。
可选地，在图5或5a所示实施例的一种实施场景上，上述方法还包括：
504、终端设备从核心网节点接收UP安全算法。
505、终端设备根据UP安全算法和用户面根密钥Kup，获得第二安全密钥。
其中，第二安全密钥是UP安全保护的密钥；UP安全保护是UPF节点与终端设备之间的安全保护，用来保护用户面数据，UP安全保护可以包括加密保护和完整性保护中的至少一种。步骤504中的UP安全算法指的是UP安全保护的安全算法。
可选地，步骤505具体包括：
终端设备根据UP安全算法和核心网节点指示的上述业务的数据的UP安全保护方式，获得第二安全密钥。
其中，UP安全保护方式是UP安全保护的方式，可以包括加密保护和完整性保护中的至少一种。
此外，核心网节点指示的上述业务的数据的UP安全保护方式可以采用发送指示信息的方式来实现，具体可以参见步骤204，UP安全算法和该指示信息可以携带在同一个消息中，例如，SMC。
可选地，步骤505之前还包括终端设备接收核心网节点指示的对上述业务的数据执行安全保护的网络节点是UPF节点。
在上述实施场景下，终端设备可以同时执行UP安全保护和AS安全保护，大大提高了网 络的安全性。
如图5b所示，本发明实施例提供了另一种数据的保护方法，该方法由终端设备执行，如下所述。
501b、终端设备从核心网节点接收UP安全算法。
其中，该UP安全算法用于对终端设备的业务的数据进行安全保护，可以包括加密算法和完整性保护算法中的至少一种。
其中，UP安全算法可以携带在SMC或NAS消息中。
502b、终端设备根据UP安全算法和Kup，获得第一安全密钥。
503b、终端设备根据第一安全密钥和UP安全算法，对终端设备的业务的数据执行安全保护。
其中，步骤503b中的安全保护是UP安全保护，即UPF节点与终端设备之间的安全保护，该安全保护是用来保护用户面数据的，可以包括加密保护和完整性保护中的至少一种。
此外，步骤502b中的UP安全算法指的是UP安全保护的安全算法，第一安全密钥指的是UP安全保护的密钥，也不再赘述。
可选地，上述方法还包括：终端设备接收核心网节点指示的上述业务的数据的UP安全保护方式。步骤502b中，终端设备具体可以根据UP安全算法，Kup和UP安全保护方式，获得第一安全密钥。
其中，UP安全保护方式指的是UP安全保护的方式，例如，加密保护。
在本发明实施例中，核心网节点指示的上述业务的数据的UP安全保护方式可以采用发送指示信息的方式来实现，具体可以参见步骤204，UP安全算法和该指示信息可以携带在同一个消息中，例如，SMC。
可选地，步骤502之前还包括终端设备接收核心网节点指示的对上述业务的数据执行安全保护的网络节点是UPF节点。
采用上述实施例提供的方法，终端设备根据根据核心网节点的指示执行UP安全保护，对终端设备的业务的数据执行安全保护，能够实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦。
可选地，在一种实施场景下，上述方法还包括：
504b、终端设备从接入网节点接收AS安全算法和终端设备的业务关联的标识。
其中，上述业务关联的标识可以用来指示传输上述业务的数据的路径。
505b、终端设备根据AS安全算法，Kan和接入网节点指示的上述业务的数据的AS安全保护方式，获得第二安全密钥。
506b、终端设备根据第二安全密钥，AS安全算法和上述业务关联的标识，对上述业务的数据执行安全保护。
其中，步骤506b中的安全保护是AS安全保护，即接入网节点与终端设备之间的安全保护，该安全保护用于保护用户面数据，可以包括加密保护和完整性保护中的至少一种。
此外，步骤505b中的AS安全保护方式指的是AS安全保护的方式，例如，加密保护。AS安全算法指的是AS安全保护的安全算法，第二安全密钥指的是AS安全保护的密钥，也不再赘述。
可选地，在另一种实施场景下，上述方法还包括：
504b’、终端设备从接入网节点接收AS安全算法和终端设备的业务关联的标识。
505b’、当接入网节点指示接入网节点对上述业务的数据执行安全保护时，终端设备根据AS安全算法和Kan，获得第一安全密钥。
506b’、终端设备根据第一安全密钥，AS安全算法和上述业务关联的标识，对上述业务的数据执行安全保护。
在上述实施场景下，终端设备可以同时执行UP安全保护和AS安全保护，大大提高了网络的安全性。
在本发明实施例中，图5,5a或5b所涉及的核心网节点均可以是SMF节点或AMF节点。
如图6所示，本发明实施例提供了另一种数据的保护方法，以核心网节点为SMF节点为例，如下所述。
601、终端设备向SMF节点发送6a消息。
其中，该6a消息可以用于请求为终端设备建立会话，具体可以为会话建立请求，该6a消息包含终端设备的标识，还可以包含终端设备的业务相关联的信息。
其中，业务相关联的信息可以参见图2所示实施例中的相关描述，不再赘述。
602、SMF节点接收6a消息，获取终端设备的业务相关联的信息。
其中，获取终端设备的业务相关联的信息具体可以参见图2所示实施例中的相关描述，不再赘述。
603、SMF节点根据业务相关的信息，确定对上述业务的数据执行安全保护的网络节点。
其中，步骤603的实现方式可以参见步骤202，此处不再赘述。
当确定UPF节点对上述业务的数据执行安全保护时，执行步骤604-618；或者，当确定接入网节点对上述业务的数据执行安全保护时，执行步骤604a-605a，以及步骤612-618。步骤604a-605a与612-618执行先后顺序可以调整，例如，可以同步执行，不予限定。
604a、SMF节点向UPF节点发送6b消息。
其中，该UPF节点为终端设备的服务节点，该6b消息可以用于指示对上述业务的数据执行安全保护的网络节点不是UPF节点，或者，用于指示对上述业务的数据执行安全保护的网络节点是接入网节点，或者，用于指示对上述业务的数据不执行安全保护。
其中，该6b消息可以为会话建立。
605a、UPF节点接收6b消息，向SMF节点发送6c消息。
其中，6c消息可以用于对6b消息进行响应。
604、SMF节点向UPF节点发送6b消息。
其中，该6b消息可以包含安全相关的参数，安全相关的参数可以包括终端设备的安全能力，UPF节点的安全策略和Kup中的至少一种。
此外，该6b消息还可以包含上述业务关联的标识，使得UPF节点能够识别上述业务的数据，例如，会话的ID。例如，该会话的ID可以由SMF节点在接收到6a消息后，为上述业务分配的。
其中，该6b消息具体可以是会话建立。
可选地，该6b消息可以用于显示或隐式地指示上述网络节点是UPF节点。
当采用显示的方式时，该6b消息还包含第一指示信息，该第一指示信息用于指示上述 网络节点是UPF节点。例如，采用1bit来表示，1表明上述网络节点是UPF节点，0表明上述网络节点不是UPF节点。
当采用隐式的方式时，UPF节点可以根据6b消息中是否携带有安全相关的参数来判断，若是，则表明上述网络节点是UPF节点，反之，上述网络节点不是UPF节点。
可选地，该6b消息可以用于显示或隐式地指示上述业务的数据的UP安全保护方式，即指示UPF节点对上述业务的数据采用的安全保护方式，例如，加密保护，完整性保护。
当采用显示的方式时，该6b消息还包含第二指示信息，该第二指示信息用于指示上述业务的数据的UP安全保护方式。例如，采用2bit指示，01表示加密保护，10表示完整性保护，11表示加密保护和完整性保护。
当采用隐式的方式时，UPF节点可以根据安全相关的参数中的终端设备的安全能力来判断。例如，当终端设备的安全能力仅包含加密能力时，表明UPF节点对上述业务的数据仅执行加密保护；或者，当终端设备的安全能力包含加密能力和完整性保护能力时，表明UPF节点对上述业务的数据执行加密保护和完整性保护。
605、UPF节点根据6b消息确定UP安全算法，并根据UP安全算法和Kup，获得安全密钥。
其中，SMF节点根据终端设备的安全能力和UPF节点的安全能力，确定UP安全算法。
其中，步骤605可以参见图3所示实施例提供的方式来实现，不再赘述。
此外，UP安全算法可以包括加密算法和完整性保护算法中的至少一种，安全密钥可以包括加密密钥和完整性密钥中的至少一种。
进一步地，步骤605中的安全密钥可以是根据UPF节点的安全策略，对由UP安全算法和Kup推导出的安全密钥进行截短后的安全密钥。
606、UPF节点向SMF节点发送6c消息，该6c消息包含UP安全算法。
其中，6c消息可以是对6b消息的响应。
607、SMF节点接收6c消息，并发送6d消息给终端设备，6d消息包含UP安全算法。
其中，该6d消息可以是SMC，也可以是NAS消息；此外，该6d消息还可以包含第三指示信息。该第三指示信息可以用于指示上述网络节点是UPF节点，或者，该第三指示信息可以用于指示上述业务的数据的UP安全保护方式。
608、终端设备接收6d消息，并根据6d消息获得安全密钥。
其中，步骤608中的安全密钥用于终端设备对上述业务的数据执行安全保护。
例如，根据6d消息获得安全密钥可以包括：终端设备根据UP安全算法和Kup获得安全密钥，具体可以采用如下方式。
方式一，当6d消息包含第三指示信息，且第三指示信息用于指示上述网络节点是UPF节点时，执行上述终端设备根据UP安全算法和Kup获得安全密钥。
方式二，当6d消息包含第三指示信息，且第三指示信息用于上述业务的数据的UP安全保护方式时，根据6d消息获得安全密钥可以包括：终端设备根据UP安全保护方式，UP安全算法和Kup获得安全密钥。例如，若UP安全保护方式为加密保护，则终端设备根据UP安全算法中的加密算法和Kup获得加密密钥。
609、终端设备向SMF节点发送6e消息。
其中，该6e消息可以为安全模式命令完成(Security Mode Command Complete，SMP)。
610、SMF节点接收6e消息，向UPF节点发送6f消息。
其中，6f消息可以用于指示UPF节点对上述业务的数据执行安全保护，换言之，指示 UPF节点上述业务的数据立即执行安全保护，或者，指示UPF节点上述业务的数据开始执行安全保护，或者，指示UPF节点使能对上述业务的数据的安全保护。
611、UPF节点向SMF节点发送6g消息。
其中，该6g消息可以是对6f消息的响应。
612、SMF节点发送6h消息给AMF节点。
其中，6h消息可以包含上述业务关联的标识，例如，会话的ID。6h消息还可以包括接入网节点的安全策略。
此外，6h消息还可以包含第四指示信息。
例如，若步骤603中确定接入网节点对上述业务的数据执行安全保护时，则该第四指示信息可以用于指示上述网络节点是上述接入网节点，或者，上述网络节点不是UPF节点。
再例如，若步骤603中确定UPF节点对上述业务的数据执行安全保护时，则该第四指示信息可以用于指示上述网络节点不是接入网节点；或者，上述网络节点是UPF节点；或者，上述业务的数据的UP安全保护方式。
613、AMF节点接收6h消息，并发送6i消息给接入网节点。
其中，6i消息包含的内容可以与6h消息包含的内容相同，不再赘述。
614、接入网节点接收6i消息，并根据6i消息确定是否对上述业务的数据执行安全保护。
其中，6i消息可以触发接入网节点执行确定是否对上述业务的数据执行安全保护。接入网节点也可以根据6i消息中的内容确定是否对上述业务的数据执行安全保护，具体可以参见图4或4a或4b所示实施例中的相关描述，不再赘述。
若步骤614中确定对上述业务的数据执行安全保护，则执行步骤615-617；否则，执行步骤618。
615、接入网节点确定AS安全算法，并根据AS安全算法和Kan获得安全密钥。
具体可以参见图4或4a或4b所示实施例中的相关描述。
616、接入网节点向终端设备发送6j消息，6j消息包含AS安全算法。
其中，该6j消息可以用于指示接入网节点对上述业务的数据执行安全保护，或者，上述业务的数据的AS安全保护方式。
例如，6j消息可以包含第五指示信息，该第五指示信息用于指示接入网节点对上述业务的数据执行安全保护，或者，上述业务的数据的AS安全保护方式。
其中，该6j消息可以是无线资源控制(radio resource control，RRC)消息。
617、终端设备接收6j消息，并根据6j消息获得安全密钥。
具体可以参见图5或5a或5b所示实施例中的相关描述，不再赘述。
618、接入网节点向终端设备发送6j消息。
其中，该6j消息用于指示接入网节点上述业务的数据不执行安全保护。
在本发明实施例中，上述实施例中用于对接收消息进行响应的消息可以不执行；步骤612-618与步骤604-611之间的执行顺序可以调换，不予限定。
采用上述实施例提供的方法，核心网节点获取终端设备的业务相关联的信息，并根据业务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求；此外，接入网节点独立地确定自身是否执行安全保护，实现了接入网节点的安全保护与UPF节点的 安全保护之间的解耦，提高网络的安全性。
可选地，在一种实施场景下，在步骤605之后，还包括：
UPF节点根据自身存储的Kup和第一随机数，获得第一消息认证码(message authentication code，MAC)。
此时，上述6c消息和6d消息均包含上述第一随机数和第一MAC，步骤608中还包括：
终端设备根据上述第一随机数和自身存储的Kup，验证第一MAC；
若第一MAC验证通过，则终端设备根据第二随机数和自身存储的Kup，获得第二MAC。
上述6e消息和6f消息携带有上述第二随机数和第二MAC。
在步骤611之前，还包括：UPF节点根据第二随机数和自身存储的Kup验证第二MAC；
若第二MAC验证通过，UPF节点执行对上述业务的数据执行安全保护。
其中，MAC的验证方法属于现有技术，不再赘述。
上述实施场景用于验证终端设备和UPF节点使用的用户面根密钥是否相同，只有在相同的情况下才执行对业务的数据的安全保护。
在本发明实施例中，该实施场景均可以应用于其它实施例，例如图7-9所示的实施例，后续不再重复描述。
在一个示例中，上步骤616可以替换为接入网节点分别发送上述第五指示信息和AS安全算法给终端设备。例如，第五指示信息可以携带在RRC消息中发送终端设备，AS安全算法可以携带在AS SMC中发送给终端。
如图7所示，本发明实施例提供了另一种数据的保护方法，以核心网节点为SMF节点为例，如下所述。
在该方法中，步骤701-703与步骤601-603相同，仅消息名称进行相应地调整。
当步骤703确定UPF节点对上述业务的数据执行安全保护时，执行步骤704。
704、SMF节点确定UP安全算法，并根据UP安全算法和Kup获得安全密钥。
其中，步骤704可以采用步骤204a-205a来实现，不再赘述。
705、SMF节点向终端设备发送7b消息，该7b消息包含UP安全算法。
可选地，7b消息可以携带上述步骤607中的第三指示信息，不再赘述。
706、终端设备接收第二消息，并根据第二消息获得安全密钥。
其中，根据7b消息获得安全密钥可以采用步骤608中的两种方式，不再赘述。
此外，该7b消息可以为SMC或NAS消息。
707、终端设备向SMF节点发送7c消息。
其中，该7c消息可以是SMP。
708、SMF节点接收7c消息，向UPF节点发送7d消息。
其中，该7d消息可以包含UP安全算法，上述安全密钥和上述业务关联的标识；还可以包含步骤604中的第一指示信息或第二指示信息，不再赘述。
此外，7d消息可以用于指示UPF节点对上述业务的数据执行安全保护。
709、UPF节点接收7d消息，向SMF节点发送7e消息。
其中，7e消息可以是对7d消息的响应。
上述方法还包括步骤710-716。其中，步骤710-716与图6所示实施例中的步骤612-618相同，仅消息名称进行相应地调整。
此外，步骤710-716与步骤704-709之间的执行先后顺序可以调整，不予限定。
采用上述实施例提供的方法，核心网节点获取终端设备的业务相关联的信息，并根据业务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求；此外，接入网节点独立地确定自身是否执行安全保护，实现了接入网节点的安全保护与UPF节点的安全保护之间的解耦，提高网络的安全性。
如图8所示，本发明实施例提供了另一种数据的保护方法，以核心网节点为SMF节点为例，如下所述。
在该方法中，步骤801-803与步骤601-603相同，仅消息名称进行相应地调整。
当步骤803确定UPF节点对上述业务的数据执行安全保护时，执行步骤804。
此外，步骤804-806与步骤604-606相同，仅消息名称进行相应地调整。
807、SMF节点接收8c消息，并发送8d消息给AMF节点。
其中，8d消息包含UP安全算法，例如，该UP安全算法可以携带在NAS容器中，该NAS容器携带在8d消息中。
一个示例中，该NAS容器中还可以携带图6所示实施例中的第三指示信息，不再赘述。
此外，该8d消息还可以包含步骤612中的第四指示信息，还可以包含上述业务关联的标识，例如，会话ID，还可以包括接入网节点的安全策略。
808、AMF节点接收8d消息，向接入网节点发送8e消息。
其中，8e消息包含的内容可以与8d消息包含的内容相同，不再赘述。
809、接入网节点接收8e消息，并根据8e消息确定是否对上述业务的数据执行安全保护。
步骤809与步骤614相同，不再赘述。
若步骤809中确定对上述业务的数据执行安全保护，则执行步骤810；否则，直接执行步骤811。
810、接入网节点确定AS安全算法，并根据AS安全算法和Kan获得安全密钥。
具体可以参见图4或4a或4b所示实施例中的相关描述。
811、接入网节点向终端设备发送8f消息，该8f消息包含UP安全算法。
其中，该8f消息可以包含上述NAS容器。
可选地，当步骤809中确定对上述业务的数据执行安全保护时，8f消息还包含AS安全算法，且还可以包含步骤616中的第五指示信息。
可选地，当步骤809中确定对上述业务的数据不执行安全保护时，8f消息还可以包含用于指示接入网节点对上述业务的数据不执行安全保护的信息。
812、终端设备根据8f消息，获得安全密钥。
具体可以参见图5或5a或5b所示实施例中的相关描述。
其中，终端设备根据UP安全算法和Kup,获得第一安全密钥。
可选地，步骤812还包括：终端设备根据AS安全算法和Kan,获得第二安全密钥。
采用上述实施例提供的方法，核心网节点获取终端设备的业务相关联的信息，并根据业 务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求；此外，接入网节点独立地确定自身是否执行安全保护，实现了接入网节点的安全保护与UPF节点的安全保护之间的解耦，提高网络的安全性。
如图9所示，本发明实施例提供了另一种数据的保护方法，以核心网节点为AMF节点为例，如下所述。
901、终端设备向AMF节点发送9a消息，该9a消息包含终端设备的标识。
其中，终端的标识可以用于唯一指示一个终端设备，属于现有技术。
其中，该9a消息可以用于请求为终端设备建立会话，具体可以为会话建立请求，该9a消息包含终端设备的标识，还可以包含终端设备的业务相关联的信息。
其中，业务相关联的信息可以参见图2所示实施例中的相关描述，不再赘述。
902、AMF节点接收9a消息，获取终端设备的业务相关联的信息。
其中，获取终端设备的业务相关联的信息具体可以参见图2所示实施例中的相关描述，不再赘述。
903、AMF节点根据业务相关的信息，确定对上述业务的数据执行安全保护的网络节点。
其中，步骤903的实现方式可以参见步骤202，此处不再赘述。
当确定UPF节点对上述业务的数据执行安全保护时，执行步骤904-917；或者，当确定接入网节点对上述业务的数据执行安全保护时，执行步骤904a-905a，以及步骤911-917。
904a、AMF节点向SMF节点发送9b消息。
其中，该9b消息包含上述终端设备的标识，该9b消息可以用于指示对上述业务的数据执行安全保护的网络节点不是UPF节点，或者，该9b消息用于指示对上述业务的数据执行安全保护的网络节点是接入网节点，或者，该9b消息用于指示对上述业务的数据不执行安全保护。
一个示例中，9b消息的上述指示功能可以通过指示信息来实现，不再赘述。
此外，该9b消息可以是会话建立消息。
905a、SMF节点接收9b消息，向UPF节点发送9c消息。
其中，该9c消息可以包含上述业务关联的标识，例如，会话ID。此外，该9c消息具备904a中9b消息的指示功能。一个示例中，9c消息可以包含步骤904a中的指示信息。
其中，该9c消息可以是会话建立消息。
其中，该UPF节点为终端设备的服务节点。
在本发明实施例中，SMF节点在接收到9b消息后，可以为终端设备的业务分配路径，该路径用于传输该业务的数据，例如，可以为该业务分配会话ID。
904、AMF节点向SMF节点发送9b消息。
其中，该9b消息可以包含上述终端设备的标识，还可以包含图6所示实施例中的第一指示信息或第二指示信息。该9b消息还可以包含安全相关的参数。其中，安全相关的参数可以包括终端设备的安全能力，UPF节点的安全策略和Kup中的至少一种。
905、SMF节点接收9b消息，向UPF节点发送9c消息。
其中，该9c消息可以包含上述业务关联的标识，例如，会话ID。
一个示例中，当步骤904中包含第一指示信息时，9c消息还包含步骤904中的第一指 示信息。
另一个示例中，当步骤904中包含第二指示信息时，9c消息还包含步骤904中的第二指示信息。
906、UPF节点根据9c消息确定UP安全算法，并根据UP安全算法和Kup，获得安全密钥。
具体可以参见图3所示实施例提供的方式来实现，不再赘述
907、UPF节点向SMF节点发送9d消息，该9d消息包含UP安全算法。
908、SMF节点接收9d消息，并发送9e消息给终端设备，9e消息包含UP安全算法。
其中，该9e消息可以是SMC。该9e消息还可以包含上述904步骤中的第一指示信息或第二指示信息。
909、终端设备根据9e消息获得安全密钥。
步骤909可以参见步骤608中的相关描述，不再赘述。
910、终端设备向SMF节点发送9f消息。
其中，该9f消息可以为SMP。
911、SMF节点向AMF节点发送9g消息。
912、AMF节点接收9g消息，向接入网节点发送9h消息。
其中，该9h消息可以包含上述业务关联的标识，还可以包含步骤612中的第四指示信息，还可以包含接入网节点的安全策略。
913、接入网节点根据9h消息确定是否对上述业务的数据执行安全保护。
其中，步骤913可以参考步骤614中的描述，不再赘述。
若步骤913中确定对上述业务的数据执行安全保护，则执行步骤914-916；否则，执行步骤917。
914、接入网节点确定AS安全算法，并根据AS安全算法和Kan获得安全密钥。
具体可以参见图4或4a或4b所示实施例中的相关描述。
915、接入网节点向终端设备发送9i消息，9i消息包含AS安全算法。
其中，该9i消息可以用于指示接入网节点对上述业务的数据执行安全保护，或者，上述业务的数据的AS安全保护方式。例如，9i消息可以包含图6所示实施例中的第五指示信息。
其中，该9i消息可以是RRC消息。
916、终端设备接收9i消息，并根据9i消息获得安全密钥。
具体可以参见图5或5a或5b所示实施例中的相关描述，不再赘述。
917、接入网节点向终端设备发送9i消息。
其中，该9i消息用于指示接入网节点上述业务的数据不执行安全保护。
采用上述实施例提供的方法，核心网节点获取终端设备的业务相关联的信息，并根据业务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求；此外，接入网节点独立地确定自身是否执行安全保护，实现了接入网节点的安全保护与UPF节点的安全保护之间的解耦，提高网络的安全性。
如图10所示，本发明实施例提供了一种核心网节点，该核心网节点可以为AMF节点或SMF节点，可以用于执行图2所示实施例中核心网节点的动作或步骤，还可以用于执行图6-8 所示实施例中SMF节点的动作或步骤，还可以用于执行图9所示实施例中AMF节点的动作或步骤。该核心网节点可以包括：获取单元1001和确定单元1002。
获取单元1001，用于获取终端设备的业务相关联的信息。
确定单元1002，用于根据获取单元1001获取的所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。
可选地，确定单元1002还用于：
根据所述核心网节点所连接的UPF节点的安全能力，以及所述业务相关联的信息，确定所述网络节点；或者，
根据所述业务相关联的信息与执行安全保护的网络节点之间的对应关系，确定所述网络节点。
可选地，获取单元1001还用于：
从所述终端设备接收请求消息，所述请求消息用于请求为所述业务建立会话，所述请求消息包含所述业务相关联的信息；或者，
根据所述核心网节点相关联的切片信息，获取所述业务相关联的信息。
可选地，在一种实施场景下，所述网络节点为UPF节点，核心网节点还包括：
发送单元1003，用于发送安全相关的参数给所述UPF节点。
其中，所述安全相关的参数可以包括：用户面根密钥Kup，所述终端设备的安全能力和所述UPF节点的安全策略。
进一步地，发送单元1003还可以用于：
向所述UPF节点指示所述业务的数据的UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种；或者，
向所述UPF节点指示所述网络节点是UPF节点。
其中，所述终端设备的安全能力可以仅包括所述终端设备的加密能力；或者，
所述终端设备的安全能力可以仅包括所述终端设备的完整性保护能力；或者，
所述终端设备的安全能力可以包括所述终端设备的加密能力和所述终端设备的完整性保护能力。
进一步地，所述核心网节点为SMF节点，所述核心网节点还可以包括：
接收单元1004，用于从所述UPF节点接收UP安全算法。
可选地，在另一种实施场景下，所述网络节点为UPF节点，且所述核心网节点为SMF节点，所述核心网节点还包括发送单元；
确定单元1002用于：根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；根据所述UP安全算法，Kup和所述UPF的安全策略，获得安全密钥；
发送单元1003，用于发送所述UP安全算法，所述安全密钥和所述业务关联的标识给所述UPF节点。
进一步地，发送单元1003还可以用于：发送所述UP安全算法给所述终端设备。
进一步地，发送单元1003还可以用于：向所述UPF节点指示对所述业务的数据执行安全保护。
进一步地，发送单元1003还可以用于：向所述终端设备指示所述业务的数据的UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
可选地，发送单元1003还用于：发送接入网节点的安全策略和所述业务关联的标识给 所述接入网节点。
进一步地，发送单元1003还可以用于：
向所述接入网节点指示所述网络节点不是接入网节点；或者，
向所述接入网节点指示所述网络节点是UPF节点；或者，
向所述接入网节点指示所述业务的数据的UP安全保护方式。
可选地，在另一种实施场景下，所述网络节点为接入网节点，所述核心网节点还包括：
发送单元1003，用于发送所述接入网节点的安全策略和所述业务关联的标识给所述接入网节点；以及向所述接入网节点指示所述网络节点是接入网节点，或者，所述核心网节点向所述接入网节点指示所述网络节点不是UPF节点。
进一步地，发送单元1003还可以用于：
向所述终端设备的服务UPF节点指示对所述业务的数据不执行安全保护，或者，
向所述终端设备的服务UPF节点指示所述网络节点不是UPF节点；或者，
向所述终端设备的服务UPF节点指示所述网络节点是接入网节点。
上述实施例提供的核心网节点，用于获取终端设备的业务相关联的信息，并根据业务相关联的信息确定对所述业务的数据执行安全保护的网络节点，实现了针对不同的业务能够灵活选择不同的网络节点来执行安全保护，进而可以满足运营商或业务的安全需求，例如，对于银行业务的数据可以在UPF节点执行安全保护，大大提高了安全性；此外，在使用UPF节点作为固定执行安全保护的网络节点的情况下，该方法还解决了漫游用户的数据发送到归属网络的UPF节点进行安全保护而造成的资源浪费问题。
如图11所示，本发明实施例提供了一种UFP节点，该UPF节点可以用于执行图3所示实施例中UPF节点的动作或步骤，还可以用于执行图6-9所示实施例中UPF节点的动作或步骤,该UPF节点可以包括：接收单元1101和确定单元1102。
接收单元1101，用于从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息。
确定单元1102，用于根据接收单元1101接收的所述网络节点的信息或所述安全保护方式信息，确定是否对所述业务的数据执行安全保护。
其中，所述网络节点的信息可以包括：
对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
对所述业务的数据执行安全保护的网络节点不是UPF节点；或者，
对所述业务的数据执行安全保护的网络节点是UPF节点。
其中，所述安全保护方式信息包括：所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
可选地，当确定对所述终端设备的业务的数据执行安全保护时，确定单元1102还用于：
获取所述终端设备的安全能力，用户面根密钥Kup和所述UPF节点的安全策略；
根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；
根据所述UP安全算法，所述Kup和所述UPF节点的安全策略，获得安全密钥。
进一步地，确定单元1102还可以用于：
当所述终端设备的安全能力仅包含所述终端设备的加密能力时，根据所述终端设备的加 密能力和所述UPF节点的加密能力,确定加密算法；或者，
当所述终端设备的安全能力仅包含所述终端设备的完整性保护能力时，根据所述终端设备的完整性保护能力和所述UPF节点的完整性保护能力,确定完整性保护算法；或者，
当所述终端设备的安全能力包含所述终端设备的加密能力和所述终端设备的完整性保护能力时，根据所述终端设备的安全能力和所述UPF节点的安全能力,确定加密算法和完整性保护算法。
可选地，当所述安全保护方式信息包括所述UP安全保护方式时，确定单元1102还用于：
根据所述UP安全保护方式，所述终端设备的安全能力和所述UPF节点的安全能力，确定所述UP安全算法。
进一步地，确定单元1102还可以用于：
当所述UP安全保护方式为加密保护时，根据所述终端设备的加密能力和所述UPF节点的加密能力，确定加密算法；或者，
当所述UP安全保护方式为完整性保护时，根据所述终端设备的完整性保护能力和所述UPF节点的完整性保护能力，确定完整性保护算法；或者，
当所述UP安全保护方式为加密保护和完整性保护时，根据所述终端设备的安全能力和所述UPF节点的安全能力，确定加密算法和完整性保护算法。
可选地，UFP节点还包括：
发送单元1103，用于将所述UP安全算法发送给所述终端设备。
可选地，所述核心网节点为会话管理功能SMF节点，所述UFP节点还包括：
执行单元1104，用于根据所述安全密钥，所述UP安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。
本实施例提供的UPF节点，用于从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息，并根据上述网络节点的信息或上述安全保护方式信息确定是否对所述业务的数据执行安全保护，实现了UPF节点能够灵活地根据网络节点的指示对终端设备的业务执行安全保护，以满足运营商或业务的安全需求。
如图12所示，本发明实施例提供了一种接入网节点，该接入网节点可以用于执行图4a所示实施例中接入网节点的动作或步骤，还可以用于执行图6-9所示实施例中接入网节点的动作或步骤。该接入网节点包括：获取单元1201和确定单元1202。
获取单元1201，用于获取终端设备的业务相关联的信息。
确定单元1202，用于根据获取单元1201获取的所述业务相关联的信息，确定是否对所述业务的数据执行安全保护。
可替换地，获取单元1201用于执行图4中的步骤401，确定单元1202用于执行步骤402；或者，获取单元1201用于执行图4b中的步骤401b，确定单元1202用于执行步骤402b。
可选地，确定单元1202还用于：
根据所述业务相关联的信息和核心网节点所指示的信息，确定是否对所述业务的数据的执行安全保护。
其中，所述指示的信息可以包括：
对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
对所述业务的数据执行安全保护的网络节点不是用户面功能UPF节点；或者，
对所述业务的数据执行安全保护的网络节点是UPF节点；或者，
所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
可选地，在一种实施场景下，当确定对所述业务的数据执行安全保护时，所述接入网节点还包括：
发送单元1203，用于向所述终端设备指示所述接入网节点对所述业务的数据执行安全保护；或者，向所述终端设备指示所述业务的数据的接入层AS安全保护方式，所述AS安全保护方式包括加密保护和完整性保护中的至少一种。
进一步可选地，确定单元1202还用于：获取所述终端设备的安全能力，所述接入网节点的安全策略和所述业务关联的标识；根据所述终端设备的安全能力和所述接入网节点的安全能力，确定AS安全算法；以及根据所述接入网节点的安全策略，所述AS安全算法和接入网密钥Kan，获得安全密钥；
发送单元1203，还用于发送确定单元1202确定的所述AS安全算法和所述业务关联的标识给所述终端设备。
进一步地，所述接入网节点还可以包括：
执行单元1204，用于根据所述AS安全算法，所述安全密钥和所述业务关联的标识，对所述业务的数据执行安全保护。
可选地，在另一种实施场景下，当确定对所述业务的数据不执行安全保护时，所述接入网节点还包括：
发送单元1203，用于向所述终端设备指示所述接入网节点对所述业务的数据不执行安全保护。
本发明实施例提供了一种终端设备，该终端设备可以用于执行图5所示实施例中的终端设备的动作或步骤，还可以用于执行图6-9所示实施例中的终端设备的动作或步骤。如图13所示，该终端设备包括：接收单元1301，处理单元1302和执行单元1303。
接收单元1301，用于从接入网节点接收接入层AS安全算法和所述终端设备的业务关联的标识；
处理单元1302，用于根据接收单元1301接收的所述AS安全算法，接入网密钥Kan和所述接入网节点指示的所述业务的数据的AS安全保护方式，获得第一安全密钥，所述AS安全保护方式包括加密保护和完整性保护中的至少一种；
执行单元1303，用于根据处理单元1302获得的所述第一安全密钥，所述AS安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。
可选地，接收单元1301还用于执行步骤504，处理单元1302还用于执行步骤505。
上述实施例提供的终端设备，用于根据接入网节点指示的AS安全保护方式对终端设备的业务的数据执行安全保护，即根据接入网节点的指示执行AS安全保护，能够保证实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升安全性。
本发明实施例提供了另一种终端设备，该终端设备可以用于执行图5a所示实施例中的终端设备的动作或步骤，还可以用于执行图6-9所示实施例中的终端设备的动作或步骤，如 图13所示，该终端设备包括接收单元1301，处理单元1302和执行单元1303。
接收单元1301，用于从接入网节点接收接入层AS安全算法和所述终端设备的业务关联的标识；
处理单元1302，用于当所述接入网节点指示所述接入网节点对所述业务的数据执行安全保护时，根据接收单元1301接收的所述AS安全算法和接入网密钥Kan，获得第一安全密钥；
执行单元1303，用于根据处理单元1302获得的所述第一安全密钥，所述AS安全算法和所述业务关联的标识，对所述业务的数据执行安全保护。
可选地，结合上述两个实施例中的终端设备，接收单元1301，还用于从核心网节点接收用户面UP安全算法；处理单元1302，还用于根据所述UP安全算法和用户面根密钥Kup，获得第二安全密钥。
进一步地，处理单元1302还用于：根据所述UP安全算法，所述KUP和所述核心网节点指示的所述业务的数据的UP安全保护方式，获得所述第二安全密钥；其中，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
可选地，接收单元1301还用于执行步骤504，处理单元1302还用于执行步骤505。
上述实施例提供的终端设备，用于根据接入网节点的指示对终端设备的业务的数据执行AS安全保护，能够实现UPF节点的安全保护与接入网节点的安全保护之间成功解耦，提升安全性。
本发明实施例提供了再一种终端设备，该终端设备的结构可以参看图13，可以用于执行图5b所示实施例中的终端设备的动作或步骤，还可以用于执行图6-9所示实施例中的终端设备的动作或步骤。其中，接收单元1301用于执行步骤501b，处理单元1302用于执行步骤502b，执行单元1303用于执行503b。
可选地，接收单元1301还用于执行步骤504b，处理单元1302还用于执行步骤505b，执行单元1303还用于执行506b。
如图14所示，本发明实施例提供了一种核心网节点，该核心网节点可以为AMF节点或SMF节点，可以用于执行图2所示实施例中核心网节点的动作或步骤，还可以用于执行图6-8所示实施例中SMF节点的动作或步骤，还可以用于执行图9所示实施例中AMF节点的动作或步骤。具体包括：处理器1401，存储器1402和通信接口1403。
存储器1402，用于存储程序；
处理器1401，用于执行存储器1402中存储的程序，以实现图2所示实施例中核心网节点的动作，或图6-8所示实施例中SMF节点的动作，或图9所示实施例中AMF节点的动作，不再赘述。
如图15所示，本发明实施例提供了一种UPF节点，该UPF节点可以用于执行图3所示实施例中UPF节点的动作或步骤，还可以用于执行图6-9所示实施例中UPF节点的动作或步骤。具体包括：处理器1501，存储器1502和通信接口1503。
存储器1502，用于存储程序；
处理器1501，用于执行存储器1502中存储的程序，以实现图3所示实施例中UPF节点 的动作，或图6-9所示实施例中UPF节点的动作，不再赘述。
如图16所示，本发明实施例提供了一种接入网节点，该接入网节点可以用于执行图4，或4a或4b所示实施例中接入网节点的动作或步骤，还可以用于执行图6-9所示实施例中接入网节点的动作或步骤。具体包括：处理器1601，存储器1602和通信接口1603。
存储器1602，用于存储程序；
处理器1601，用于执行存储器1602中存储的程序，以实现图4，或4a或4b所示实施例中接入网节点的动作，或图6-9所示实施例中接入网节点的动作，不再赘述。
如图17所示，本发明实施例提供了一种终端设备，该终端设备可以用于执行图5，或5a或5b所示实施例中终端设备的动作或步骤，还可以用于执行图6-9所示实施例中终端设备的动作或步骤。具体包括：处理器1701，存储器1702和通信接口1703。
存储器1702，用于存储程序；
处理器1701，用于执行存储器1702中存储的程序，以实现图5，或5a或5b所示实施例中终端设备的动作，或图6-9所示实施例中终端设备的动作，不再赘述。
通信接口1703具体可以是收发器。
在本发明实施例中，上述各实施例之间可以相互参考和借鉴，相同或相似的步骤以及名词均不再一一赘述。
本发明实施例提供一种系统，包括：核心网网节点和UPF节点，核心网节点具体如图10或14所示，UPF节点如图11或15所示。可选地，还包括：如图12或16所示的接入网节点。进一步地，上述系统还可以包括如图13或17所示的终端设备。
本发明实施例提供另一种系统，包括：如图12或16所示的接入网节点和如图13或17所示的终端设备。可选地，还包括：如图10或14所示的核心网节点，以及如图11或15所示的UPF节点。
在本发明实施例中，在本申请的上述各实施例中，网络节点均可以为UPF节点或接入网节点；安全保护可以是完整性保护和加密保护中的至少一种，安全密钥可以是完整性密钥和加密密钥中的至少一种；对业务的数据执行安全保护也可以是对业务的数据执行安全保护操作，或安全保护流程，不予限定。
在本发明实施例中，核心网节点向UPF节点或接入网节点指示对业务的数据执行安全保护的网络节点是UPF节点，以及核心网节点向UPF节点或接入网节点指示对业务的数据执行安全保护的网络节点不是接入网节点，具体均可以是核心网节点向UPF节点或接入网节点指示UPF节点启动或开启或激活或执行安全保护，该安全保护针对业务的数据的方式。
核心网节点向UPF节点或接入网节点指示对业务的数据执行安全保护的网络节点不是UPF节点，以及核心网节点向UPF节点或接入网节点指示对业务的数据执行安全保护的网络节点是接入网节点，具体均可以是核心网节点向UPF节点或接入网节点指示接入网节点启动或开启或激活或执行安全保护，该安全保护针对业务的数据。
此外，在上述对业务的数据执行安全保护的网络节点不是UPF节点中，以及在上述对业务的数据执行安全保护的网络节点是UPF节点中，UPF节点可以指的是特定的UPF节点， 例如，终端设备的服务UPF节点。
在上述对业务的数据执行安全保护的网络节点是接入网节点中，以及在上述对业务的数据执行安全保护的网络节点不是接入网节点中，接入网节点可以指的是终端设备的服务接入网节点。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。

Claims (38)

  1. 一种通信系统中数据的保护方法，其特征在于，所述方法包括：
    核心网节点获取终端设备的业务相关联的信息；
    所述核心网节点根据所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。
  2. 根据权利要求1所述的方法，所述核心网节点根据所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点，包括：
    所述核心网节点根据所述核心网节点所连接的用户面功能UPF节点的安全能力，以及所述业务相关联的信息，确定所述网络节点；或者，
    所述核心网节点根据所述业务相关联的信息与执行安全保护的网络节点之间的对应关系，确定所述网络节点。
  3. 根据权利要求1或2所述的方法，所述核心网节点获取终端设备的业务相关联的信息，包括：
    所述核心网节点从所述终端设备接收请求消息，所述请求消息用于请求为所述业务建立会话，所述请求消息包含所述业务相关联的信息；或者，
    所述核心网节点根据所述核心网节点相关联的切片信息，获取所述业务相关联的信息。
  4. 根据权利要求1-3任一项所述的方法，所述网络节点为UPF节点，所述方法还包括：
    所述核心网节点发送安全相关的参数给所述UPF节点。
  5. 根据权利要求4所述的方法，所述安全相关的参数包括：用户面根密钥Kup，所述终端设备的安全能力和所述UPF节点的安全策略。
  6. 根据权利要求4或5所述的方法，所述方法还包括：
    所述核心网节点向所述UPF节点指示所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种；或者，
    所述核心网节点向所述UPF节点指示所述网络节点是UPF节点。
  7. 根据权利要求1-3任一项所述的方法，所述网络节点为UPF节点，且所述核心网节点为SMF节点，所述方法还包括：
    所述SMF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；
    所述SMF节点根据所述UP安全算法，Kup和所述UPF的安全策略，获得安全密钥；
    所述SMF节点发送所述UP安全算法，所述安全密钥和所述业务关联的标识给所述UPF节点。
  8. 根据权利要求4-7任一项所述的方法，所述方法还包括：
    所述核心网节点发送接入网节点的安全策略和所述业务关联的标识给所述接入网节点。
  9. 根据权利要求4-8任一项所述的方法，所述方法还包括：
    所述核心网节点向所述接入网节点指示所述网络节点不是接入网节点；或者，
    所述核心网节点向所述接入网节点指示所述网络节点是UPF节点；或者，
    所述核心网节点向所述接入网节点指示所述业务的数据的UP安全保护方式。
  10. 根据权利要求1-3任一项所述的方法，所述网络节点为接入网节点，所述方法还包括：
    所述核心网节点发送所述接入网节点的安全策略和所述业务关联的标识给所述接入网节点；
    所述核心网节点向所述接入网节点指示所述网络节点是接入网节点，或者，所述核心网节点向所述接入网节点指示所述网络节点不是UPF节点。
  11. 根据权利要求10所述的方法，所述方法还包括：
    所述核心网节点向所述终端设备的服务UPF节点指示对所述业务的数据不执行安全保护，或者，
    所述核心网节点向所述终端设备的服务UPF节点指示所述网络节点不是UPF节点；或者，
    所述核心网节点向所述终端设备的服务UPF节点指示所述网络节点是接入网节点。
  12. 一种通信系统中数据的保护方法，其特征在于，所述方法包括：
    用户面功能UFP节点从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息；
    所述UFP节点根据所述网络节点的信息或所述安全保护方式信息，确定是否对所述业务的数据执行安全保护。
  13. 根据权利要求12所述的方法，所述网络节点的信息包括：
    对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是UPF节点；或者，
    对所述业务的数据执行安全保护的网络节点是UPF节点。
  14. 根据权利要求12所述的方法，所述安全保护方式信息包括：所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
  15. 根据权利要求14所述的方法，所述UPF节点根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法，包括：
    所述UFP节点根据所述UP安全保护方式，所述终端设备的安全能力和所述UPF节点的安全能力，确定所述UP安全算法。
  16. 一种通信系统中数据的保护方法，其特征在于，所述方法包括：
    接入网节点获取终端设备的业务相关联的信息；
    所述接入网节点根据所述业务相关联的信息，确定是否对所述业务的数据执行安全保护。
  17. 根据权利要求16所述的方法，所述接入网节点根据所述业务相关联的信息，确定是否对所述业务的数据的执行安全保护，包括：
    所述接入网节点根据所述业务相关联的信息和核心网节点所指示的信息，确定是否对所述业务的数据的执行安全保护；
    其中，所述指示的信息包括：
    对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是用户面功能UPF节点；或者，
    对所述业务的数据执行安全保护的网络节点是UPF节点；或者，
    所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
  18. 根据权利要求16或17所述的方法，当确定对所述业务的数据执行安全保护时，所述方法还包括：
    所述接入网节点向所述终端设备指示所述接入网节点对所述业务的数据执行安全保护；或者，
    所述接入网节点向所述终端设备指示所述业务的数据的接入层AS安全保护方式，所述AS安全保护方式包括加密保护和完整性保护中的至少一种。
  19. 根据权利要求16或17所述的方法，当确定对所述业务的数据不执行安全保护时，所述方法还包括：
    所述接入网节点向所述终端设备指示所述接入网节点对所述业务的数据不执行安全保护。
  20. 一种核心网节点，其特征在于，包括：
    获取单元，用于获取终端设备的业务相关联的信息；
    确定单元，用于根据所述获取单元获取的所述业务相关联的信息，确定对所述业务的数据执行安全保护的网络节点。
  21. 根据权利要求20所述的核心网节点，所述确定单元还用于：
    根据所述核心网节点所连接的用户面功能UPF节点的安全能力，以及所述业务相关联的信息，确定所述网络节点；或者，
    根据所述业务相关联的信息与执行安全保护的网络节点之间的对应关系，确定所述网络节点。
  22. 根据权利要求20或21所述的核心网节点，所述获取单元还用于：
    从所述终端设备接收请求消息，所述请求消息用于请求为所述业务建立会话，所述请求消息包含所述业务相关联的信息；或者，
    根据所述核心网节点相关联的切片信息，获取所述业务相关联的信息。
  23. 根据权利要求20-22任一项所述的核心网节点，所述网络节点为UPF节点，所述核心网节点还包括：
    发送单元，用于发送安全相关的参数给所述UPF节点。
  24. 根据权利要求23所述的核心网节点，所述安全相关的参数包括：用户面根密钥Kup，所述终端设备的安全能力和所述UPF节点的安全策略。
  25. 根据权利要求23或24所述的核心网节点，所述发送单元还用于：
    向所述UPF节点指示所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种；或者，
    向所述UPF节点指示所述网络节点是UPF节点。
  26. 根据权利要求20-22任一项所述的核心网节点，所述网络节点为UPF节点，且所述核心网节点为SMF节点，所述核心网节点还包括发送单元；
    所述确定单元用于：根据所述终端设备的安全能力和所述UPF节点的安全能力，确定UP安全算法；根据所述UP安全算法，Kup和所述UPF的安全策略，获得安全密钥；
    所述发送单元，用于发送所述UP安全算法，所述安全密钥和所述业务关联的标识给所述UPF节点。
  27. 根据权利要求23-26任一项所述的核心网节点，所述发送单元还用于：
    发送接入网节点的安全策略和所述业务关联的标识给所述接入网节点。
  28. 根据权利要求23-27任一项所述的核心网节点，所述发送单元还用于：
    向所述接入网节点指示所述网络节点不是接入网节点；或者，
    向所述接入网节点指示所述网络节点是UPF节点；或者，
    向所述接入网节点指示所述业务的数据的UP安全保护方式。
  29. 根据权利要求20-22任一项所述的核心网节点，所述网络节点为接入网节点，所述核心网节点还包括：
    发送单元，用于发送所述接入网节点的安全策略和所述业务关联的标识给所述接入网节点；以及向所述接入网节点指示所述网络节点是接入网节点，或者，所述核心网节点向所述接入网节点指示所述网络节点不是UPF节点。
  30. 根据权利要求29所述的核心网节点，所述发送单元还用于：
    向所述终端设备的服务UPF节点指示对所述业务的数据不执行安全保护，或者，
    向所述终端设备的服务UPF节点指示所述网络节点不是UPF节点；或者，
    向所述终端设备的服务UPF节点指示所述网络节点是接入网节点。
  31. 一种用户面功能UFP节点，其特征在于，包括：
    接收单元，用于从核心网节点接收对终端设备的业务的数据执行安全保护的网络节点的信息或安全保护方式信息；
    确定单元，用于根据所述接收单元接收的所述网络节点的信息或所述安全保护方式信息，确定是否对所述业务的数据执行安全保护。
  32. 根据权利要求31所述的UFP节点，所述网络节点的信息包括：
    对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是UPF节点；或者，
    对所述业务的数据执行安全保护的网络节点是UPF节点。
  33. 根据权利要求31所述的UFP节点，所述安全保护方式信息包括：所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
  34. 根据权利要求33所述的UFP节点，所述确定单元还用于：
    根据所述UP安全保护方式，所述终端设备的安全能力和所述UPF节点的安全能力，确定所述UP安全算法。
  35. 一种接入网节点，其特征在于，包括：
    获取单元，用于获取终端设备的业务相关联的信息；
    确定单元，用于根据所述获取单元获取的所述业务相关联的信息，确定是否对所述业务的数据执行安全保护。
  36. 根据权利要求35所述的接入网节点，所述确定单元还用于：
    根据所述业务相关联的信息和核心网节点所指示的信息，确定是否对所述业务的数据的执行安全保护；
    其中，所述指示的信息包括：
    对所述业务的数据执行安全保护的网络节点是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是接入网节点；或者，
    对所述业务的数据执行安全保护的网络节点不是用户面功能UPF节点；或者，
    对所述业务的数据执行安全保护的网络节点是UPF节点；或者，
    所述业务的数据的用户面UP安全保护方式，所述UP安全保护方式包括加密保护和完整性保护中的至少一种。
  37. 根据权利要求35或36所述的接入网节点，当确定对所述业务的数据执行安全保护时，所述接入网节点还包括：
    发送单元，用于向所述终端设备指示所述接入网节点对所述业务的数据执行安全保护；或者，向所述终端设备指示所述业务的数据的接入层AS安全保护方式，所述AS安全保护方式包括加密保护和完整性保护中的至少一种。
  38. 根据权利要求35或36所述的接入网节点，当确定对所述业务的数据不执行安全保护时，所述接入网节点还包括：
    发送单元，用于向所述终端设备指示所述接入网节点对所述业务的数据不执行安全保护。
PCT/CN2017/072782 2017-01-26 2017-01-26 数据的保护方法、装置和系统 WO2018137255A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201780074415.5A CN110024331B (zh) 2017-01-26 2017-01-26 数据的保护方法、装置和系统
EP17894055.7A EP3567802A4 (en) 2017-01-26 2017-01-26 METHOD, DEVICE AND SYSTEM FOR PROTECTING DATA
PCT/CN2017/072782 WO2018137255A1 (zh) 2017-01-26 2017-01-26 数据的保护方法、装置和系统
US16/522,278 US11140545B2 (en) 2017-01-26 2019-07-25 Method, apparatus, and system for protecting data

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/072782 WO2018137255A1 (zh) 2017-01-26 2017-01-26 数据的保护方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/522,278 Continuation US11140545B2 (en) 2017-01-26 2019-07-25 Method, apparatus, and system for protecting data

Publications (1)

Publication Number Publication Date
WO2018137255A1 true WO2018137255A1 (zh) 2018-08-02

Family

ID=62978944

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/072782 WO2018137255A1 (zh) 2017-01-26 2017-01-26 数据的保护方法、装置和系统

Country Status (4)

Country Link
US (1) US11140545B2 (zh)
EP (1) EP3567802A4 (zh)
CN (1) CN110024331B (zh)
WO (1) WO2018137255A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830991A (zh) * 2018-08-10 2020-02-21 华为技术有限公司 安全会话方法和装置
KR20210012035A (ko) * 2018-08-10 2021-02-02 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 평면 무결성 보호 방법, 장치, 및 디바이스
KR20210051486A (ko) * 2019-10-30 2021-05-10 에스케이텔레콤 주식회사 무결성 검사의 대상이 되는 세션 관련 메시지를 생성하는 방법 및 상기 세션 관련 메시지에 대한 무결성 검사를 수행하는 방법
CN112560061B (zh) * 2020-12-18 2024-05-03 国家工业信息安全发展研究中心 工业互联网数据安全防护能力评估方法及设备部署方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
IL272881B2 (en) * 2017-09-04 2024-01-01 Guangdong Oppo Mobile Telecommunications Corp Ltd Method and device for wireless communication
CN114079919B (zh) * 2020-08-17 2024-02-27 中国电信股份有限公司 安全模式配置方法、装置、系统和计算机可读存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102257851A (zh) * 2008-12-19 2011-11-23 爱立信电话股份有限公司 Gre用户平面
CN102630376A (zh) * 2011-12-08 2012-08-08 华为技术有限公司 控制业务的传输的方法、装置和系统
CN103248521A (zh) * 2013-04-28 2013-08-14 华为技术有限公司 一种业务策略规则配置的方法、装置及通信系统
CN103888890A (zh) * 2014-03-10 2014-06-25 京信通信系统（广州）有限公司 一种数据传输的方法和设备

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7506370B2 (en) * 2003-05-02 2009-03-17 Alcatel-Lucent Usa Inc. Mobile security architecture
CA2642822C (en) * 2006-03-31 2013-01-15 Samsung Electronics Co., Ltd. System and method for optimizing authentication procedure during inter access system handovers
US20080076425A1 (en) * 2006-09-22 2008-03-27 Amit Khetawat Method and apparatus for resource management
US20080076392A1 (en) * 2006-09-22 2008-03-27 Amit Khetawat Method and apparatus for securing a wireless air interface
CN101304600B (zh) * 2007-05-08 2011-12-07 华为技术有限公司 安全能力协商的方法及系统
CN101854625B (zh) * 2009-04-03 2014-12-03 华为技术有限公司 安全算法选择处理方法与装置、网络实体及通信系统
CN101877665B (zh) * 2009-04-29 2013-12-18 华为技术有限公司 环网保护方法、网络节点及环网络
US8438389B2 (en) * 2009-08-17 2013-05-07 Intel Corporation Method and system for dynamic service negotiation with a uniform security control plane in a wireless network
CN103686709B (zh) * 2012-09-17 2017-09-08 中兴通讯股份有限公司 一种无线网格网认证方法和系统
EP2995164B1 (en) * 2013-05-08 2019-07-10 Telefonaktiebolaget LM Ericsson (publ) Packet data transfer re-establishment
WO2015085273A1 (en) * 2013-12-06 2015-06-11 Interdigital Patent Holdings, Inc. Layered connectivity in wireless systems
US10455414B2 (en) * 2014-10-29 2019-10-22 Qualcomm Incorporated User-plane security for next generation cellular networks
US10341239B2 (en) * 2015-05-21 2019-07-02 Qualcomm Incorporated Efficient policy enforcement for downlink traffic using network access tokens—control-plane approach
CN106375989B (zh) * 2015-07-20 2019-03-12 中兴通讯股份有限公司 实现接入层安全的方法及用户设备和无线接入小节点
US10129235B2 (en) * 2015-10-16 2018-11-13 Qualcomm Incorporated Key hierarchy for network slicing
US10390331B2 (en) * 2016-04-20 2019-08-20 Convida Wireless, Llc System information provisioning and light weight connection signaling

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102257851A (zh) * 2008-12-19 2011-11-23 爱立信电话股份有限公司 Gre用户平面
CN102630376A (zh) * 2011-12-08 2012-08-08 华为技术有限公司 控制业务的传输的方法、装置和系统
CN103248521A (zh) * 2013-04-28 2013-08-14 华为技术有限公司 一种业务策略规则配置的方法、装置及通信系统
CN103888890A (zh) * 2014-03-10 2014-06-25 京信通信系统（广州）有限公司 一种数据传输的方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3567802A4 *

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830991A (zh) * 2018-08-10 2020-02-21 华为技术有限公司 安全会话方法和装置
KR20210012035A (ko) * 2018-08-10 2021-02-02 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 평면 무결성 보호 방법, 장치, 및 디바이스
EP3820181A4 (en) * 2018-08-10 2021-07-21 Huawei Technologies Co., Ltd. PROCESS AND DEVICE ALLOWING SECURE CONVERSATIONS
KR102436449B1 (ko) 2018-08-10 2022-08-24 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 평면 무결성 보호 방법, 장치, 및 디바이스
KR20220123555A (ko) * 2018-08-10 2022-09-07 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 평면 무결성 보호 방법, 장치, 및 디바이스
CN110830991B (zh) * 2018-08-10 2023-02-03 华为技术有限公司 安全会话方法和装置
US11778459B2 (en) 2018-08-10 2023-10-03 Huawei Technologies Co., Ltd. Secure session method and apparatus
KR102605962B1 (ko) 2018-08-10 2023-11-23 후아웨이 테크놀러지 컴퍼니 리미티드 사용자 평면 무결성 보호 방법, 장치, 및 디바이스
KR20210051486A (ko) * 2019-10-30 2021-05-10 에스케이텔레콤 주식회사 무결성 검사의 대상이 되는 세션 관련 메시지를 생성하는 방법 및 상기 세션 관련 메시지에 대한 무결성 검사를 수행하는 방법
KR102266409B1 (ko) 2019-10-30 2021-06-18 에스케이텔레콤 주식회사 무결성 검사의 대상이 되는 세션 관련 메시지를 생성하는 방법 및 상기 세션 관련 메시지에 대한 무결성 검사를 수행하는 방법
CN112560061B (zh) * 2020-12-18 2024-05-03 国家工业信息安全发展研究中心 工业互联网数据安全防护能力评估方法及设备部署方法

Also Published As

Publication number Publication date
EP3567802A1 (en) 2019-11-13
CN110024331B (zh) 2021-11-19
CN110024331A (zh) 2019-07-16
EP3567802A4 (en) 2019-12-25
US11140545B2 (en) 2021-10-05
US20190349406A1 (en) 2019-11-14

Similar Documents

Publication Publication Date Title
US10798579B2 (en) Communication method and related apparatus
CN109104394B (zh) 会话处理方法和设备
KR102263336B1 (ko) 보안 구현 방법, 기기 및 시스템
WO2018137255A1 (zh) 数据的保护方法、装置和系统
CN108702624B (zh) 移动通信方法、装置及设备
US11570617B2 (en) Communication method and communications apparatus
US11533610B2 (en) Key generation method and related apparatus
JP6936393B2 (ja) パラメータ保護方法及びデバイス、並びに、システム
CN110493774A (zh) 密钥配置方法、装置以及系统
CN112449315B (zh) 一种网络切片的管理方法及相关装置
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
CN111654862B (zh) 终端设备的注册方法及装置
CN113518315B (zh) 一种配置无线承载的方法、装置及系统
JP5804209B2 (ja) 無線アクセスネットワーク装置、制御方法、移動通信システム、およびプログラム
CN115643560A (zh) 一种接入网系统、接入方法及其装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17894055

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017894055

Country of ref document: EP

Effective date: 20190805