WO2018137334A1 - 一种安全保护协商方法及网元 - Google Patents

一种安全保护协商方法及网元 Download PDF

Info

Publication number
WO2018137334A1
WO2018137334A1 PCT/CN2017/097671 CN2017097671W WO2018137334A1 WO 2018137334 A1 WO2018137334 A1 WO 2018137334A1 CN 2017097671 W CN2017097671 W CN 2017097671W WO 2018137334 A1 WO2018137334 A1 WO 2018137334A1
Authority
WO
WIPO (PCT)
Prior art keywords
security protection
message
user plane
smf
protection
Prior art date
Application number
PCT/CN2017/097671
Other languages
English (en)
French (fr)
Inventor
吴�荣
张博
甘露
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17894273.6A priority Critical patent/EP3557836A4/en
Priority to JP2019536226A priority patent/JP6769014B2/ja
Priority to KR1020197022631A priority patent/KR20190097278A/ko
Publication of WO2018137334A1 publication Critical patent/WO2018137334A1/zh
Priority to US16/520,369 priority patent/US10856141B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
    • H04W12/0433—Key management protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/18—Management of setup rejection or failure

Definitions

  • the present application relates to the field of wireless communications, and in particular, to a security protection negotiation method and a network element.
  • 3GPP 5G proposed new network architecture, network-based architecture and 5G proposed session establishment process.
  • the security protection negotiation refers to the algorithm for negotiating and synchronizing the security protection key and security protection between the security layers. The process of protection.
  • the technical solution for security protection negotiation proposed by 2G/3G/4G is not based on the session granularity, and does not consider the security requirements of the service. Therefore, the security protection negotiation proposed by 2G/3G/4G The technical solution can not meet the 5G network architecture.
  • the embodiment of the present application provides a security protection negotiation method and a network element, which is used to implement security protection for the user plane of the session by negotiating between the UE and the UPF based on the 5G network architecture.
  • a security protection negotiation method provided by an embodiment of the present application includes:
  • the session management network element SMF determines the security protection information used by the user plane during the session, and the security protection information includes an algorithm for security protection, an index for identifying a context of security protection, and a message authentication code, where the security protection includes Encryption protection and integrity protection, the message authentication code refers to the SMF using integrity protection algorithm and the integrity protection key of the security protection context identified by the index to protect the first message integrity protection Generated authentication code;
  • the SMF sends the first message including the security protection information used by the user plane to the UE, and the security protection information used by the user plane is used by the UE according to the security of the user plane.
  • the protection information activates the security protection of the user plane after the integrity protection authentication of the first message is successful;
  • the SMF receives a second message sent by the UE to indicate that the UE successfully authenticates the first message, and sends an algorithm to the user plane gateway UPF that includes the security protection used by the user plane during the session. And a third message for the context of the security protection, the third message is used to trigger the UPF to initiate security protection of the user plane according to the security protection algorithm and the security protection context.
  • the security protection information used by the user plane during the session includes the following information: the encryption and decryption protection algorithm used by the user plane during the session, and the integrity protection used by the user plane during the session.
  • the algorithm an index for identifying the context of the encryption and decryption protection used by the user plane during the session, an index for identifying the context of the integrity protection used by the user plane during the session, and a message verification code.
  • the SMF determines and sends to the UE the security protection information used by the user plane during the session, including the security protection algorithm, the index for identifying the security protection context, and the message authentication code, etc., after the UE is successfully authenticated.
  • the UE initiates the security protection of the user plane.
  • the UPF initiates the security protection of the user plane, and the UE and the UPF negotiate to start the security protection of the respective user planes.
  • the foregoing method can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the above method can satisfy the 5G network architecture for the user plane.
  • the need for security protection can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the above method can satisfy the 5G network architecture for the user plane. The need for security protection.
  • the SMF may determine the security protection algorithm in the following two manners:
  • Manner 1 The SMF obtains the security protection algorithm determined by the SPCF negotiation from the security policy control network element SPCF.
  • the SPCF is deployed on any one of the SMF, the security anchor network element SEAF, and the authentication service network element AUSF, or the SPCF is independently deployed in the network.
  • the security protection algorithm is determined based on the algorithm of the security protection supported by the UE, the security protection algorithm supported by the network, and the security protection algorithm supported by the service to which the session belongs.
  • the SMF can be used to determine the security protection algorithm used by the user plane during the session, including the encryption and decryption protection algorithm and the integrity protection algorithm.
  • the SMF establishes the current session before the SMF determines the security protection information used by the user plane.
  • the SMF receives a session establishment request message sent by the UE for requesting to establish the current session;
  • the SMF receives the session establishment request message sent by the UE for requesting to establish the current session, and determines that the security endpoint of the user plane is The UPF notifies the radio access network RAN, and the SMF performs the security protection negotiation method.
  • the endpoint of the user plane refers to the network element that needs to start the security protection of the user plane in addition to the UE.
  • the termination point of the user plane may also be a gNB, where it can be understood that, when the gNB is a network element of the RAN, where the termination point of the user plane is UPF, the foregoing security protection negotiation method
  • the SMF determines that the end point of the user plane is the gNB, and the SMF sends a notification message to the RAN, where the SMF is used to instruct the RAN to perform the UE and the gNB, after the SMF receives the session establishment request message for requesting to establish the current session.
  • the security protection negotiation method of the user plane after receiving the notification message, the RAN replies with the confirmation information to the SMF, and the UE and the gNB perform the negotiation of the security protection of the user plane.
  • the termination point for the user plane is the case of the gNB.
  • the UE may complete the security protection negotiation of the user plane through the security protection negotiation process between the UE and the gNB during the initial access.
  • the method further includes:
  • the SMF determines, according to the indication of the fourth message, that the UPF does not need to trigger the security protection of the user plane.
  • the SMF determines that the UE fails to authenticate the first message, and determines to end the security protection negotiation method.
  • a security protection negotiation method provided by an embodiment of the present application includes:
  • the user equipment UE receives the first message that is sent by the session management network element SMF, including the security protection information used by the user plane during the session, and the security protection information includes: a security protection algorithm, and a context for identifying the security protection.
  • An index and a message authentication code the security protection including encryption and decryption protection and integrity protection, wherein the message authentication code refers to an algorithm for integrity protection of the SMF and an integrity protection included by the context of the security protection identified by the index
  • the authentication code generated by the integrity protection of the first message by the key;
  • the UE authenticates the first message according to security protection information used by the user plane
  • the UE When the UE successfully authenticates the first message, the UE initiates security protection of the user plane, and sends a second message to the SMF to indicate that the UE successfully authenticates the first message.
  • the UE after receiving the first message sent by the SMF, including the security protection information used by the user plane during the session, the UE authenticates the first message according to the security protection information used by the user plane during the session; When the UE successfully authenticates the first message, the UE initiates security protection of the user plane, and sends a second message to the SMF to indicate that the UE successfully authenticates the first message. Then, after receiving the second message, the SMF triggers the UPF to start the security protection of the user plane. Therefore, the foregoing method can implement the security protection of the UE and the UPF to initiate the respective user planes.
  • the foregoing method can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the above method can satisfy the 5G network architecture for the user plane.
  • the need for security protection can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the above method can satisfy the 5G network architecture for the user plane. The need for security protection.
  • the UE initiates security protection of the user plane, and sends a second message to the SMF, which is used to indicate that the UE successfully authenticates the first message, and includes:
  • the UE initiates encryption and decryption protection and integrity protection of the user plane, and then sends a second message to the SMF to indicate that the UE successfully authenticates the first message.
  • the UE can start encryption and decryption protection and integrity protection at the same time.
  • the UE initiates security protection of the user plane, and sends a second message to the SMF, which is used to indicate that the UE successfully authenticates the first message, and includes:
  • the UE initiates downlink decryption protection and integrity protection of the user plane, and then sends a second message to the SMF to indicate that the UE successfully authenticates the first message, and finally initiates uplink encryption protection of the user plane.
  • the UE can start downlink decryption protection, integrity protection, and uplink encryption protection at different times.
  • the method further includes:
  • the UE determines not to initiate security protection of the user plane, and sends a fourth message to the SMF to indicate that the UE fails to authenticate the first message. .
  • the security protection negotiation method ends.
  • a security protection negotiation method provided by an embodiment of the present application includes:
  • the user plane gateway UPF receives a third message sent by the session management network element SMF, including an algorithm for security protection used by the user plane during the session, and a context for security protection, where the third message is used to indicate the UPF.
  • a third message sent by the session management network element SMF, including an algorithm for security protection used by the user plane during the session, and a context for security protection, where the third message is used to indicate the UPF.
  • the UPF initiates security protection of the user plane according to the indication of the third message.
  • the UPF when the UPF receives the third message including the security protection used by the user plane and the context of the security protection during the session, the UPF indicates that the UE authentication succeeds, and the UE starts after the authentication succeeds. User side security protection. Therefore, after receiving the third message sent by the SMF, the UPF needs to start the security protection of the user plane according to the indication of the third message, so that the UE and the UPF negotiate to start the security protection of the respective user planes.
  • the foregoing method can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the above method can satisfy the 5G network architecture for the user plane. The need for security protection.
  • the UPF receives an algorithm sent by the SMF, including an algorithm for security protection used by the user plane during the session, and a third message for security protection, including:
  • the UPF After the SMF determines that the UE initiates security protection of the user plane, the UPF receives the third message sent by the SMF.
  • the UPF can start the security protection of the user plane at the same time, that is, after the SMF determines that the UE initiates the security protection of the user plane, the UPF receives the third message sent by the SMF and initiates the security protection of the user plane.
  • Security protection includes downlink encryption protection, integrity protection, and uplink decryption protection.
  • the UPF receives an algorithm sent by the SMF, including an algorithm for security protection used by the user plane during the session, and a third message for security protection, including:
  • the UPF After the SMF sends the security protection information used by the user plane in the session to the UE, the UPF receives a first trigger message sent by the SMF, where the first trigger message is used to trigger the UPF to start the user.
  • the UPF After the SMF determines that the UE initiates the security protection of the user plane, the UPF receives a second trigger message sent by the SMF, where the second trigger message is used to trigger the UPF to initiate uplink decryption protection of the user plane.
  • the security protection of the user plane initiated by the UPF at different times can be realized. That is, after the SMF sends the security protection information used by the user plane in the session to the UE, the UPF receives the first trigger message sent by the SMF and starts downlink encryption protection and integrity protection. After the SMF determines that the UE initiates the security protection of the user plane, the UPF receives the second trigger message sent by the SMF and starts the uplink decryption protection.
  • the session management network element SMF provided by the embodiment of the present application includes:
  • a processing unit configured to determine security protection information used by the user plane during the session, where the security protection information includes an algorithm for security protection, an index for identifying a context of security protection, and a message authentication code, where the security protection includes Encryption protection and integrity protection, the message authentication code refers to an authentication generated by using an integrity protection algorithm and an integrity protection key included in the context of the security protection identified by the index to perform integrity protection on the first message. code;
  • a sending unit configured to send, to the UE, the first message that includes the security protection information used by the user plane determined by the processing unit, where the security protection information used by the user plane is used by the UE according to the UE
  • the security protection information used by the user plane initiates security protection of the user plane after performing integrity protection authentication on the first message
  • a receiving unit configured to receive a second message that is sent by the UE to indicate that the UE successfully authenticates the first message
  • the sending unit is further configured to send, to the user plane gateway UPF, an algorithm including a security protection used by the user plane during the current session determined by the processing unit, and a third message for a context of security protection, where The three messages are used to trigger the UPF to initiate security protection of the user plane according to the security protection algorithm and the security protection context.
  • the processing unit determines the algorithm of the security protection, specifically:
  • the algorithm of the security protection is determined by self-negotiation.
  • the SPCF is deployed on any one of the SMF, the security anchor network element SEAF, and the authentication service network element AUSF, or the SPCF is independently deployed in the network.
  • the security protection algorithm is determined based on an algorithm of the security protection supported by the UE, an algorithm supported by the network, and an algorithm for security protection supported by the service to which the session belongs.
  • the processing unit is further configured to: establish the current session before determining the security protection information used by the user plane; or
  • the receiving unit is further configured to: before the processing unit determines the security protection information used by the user plane, receive a session establishment request message sent by the UE for requesting to establish the current session;
  • the sending unit When the sending unit sends the first message including the security protection information used by the user plane to the UE, the sending unit is specifically configured to: send a session establishment including the security protection information used by the user plane to the UE. Complete the message.
  • the processing unit is further configured to: after the receiving unit receives the session establishment request message sent by the UE for requesting to establish the current session, determine that the security endpoint of the user plane is The UPF;
  • the sending unit is further configured to: after the processing unit determines that the security endpoint of the user plane is the UPF, send a notification message to the radio access network RAN to instruct the SMF to perform a security protection negotiation method.
  • the receiving unit is further configured to: after the sending unit sends the first message including the security protection information used by the user plane to the UE, receive the UE And sending, by the UE, a fourth message that the UE fails to authenticate the first message;
  • the processing unit is further configured to: according to the indication of the fourth message received by the receiving unit, determine that the security protection of the user plane is not required to be triggered by the UPF.
  • an SMF provided by an embodiment of the present application includes: a processor, a memory, and a transceiver;
  • the transceiver is configured to receive and send data
  • the memory is for storing instructions
  • the processor is configured to execute the instructions in the memory to perform the method provided by the first aspect.
  • the embodiment of the present application further provides a computer storage medium for storing computer software instructions for use in the SMF in the above aspect, which includes a program for performing the above aspects.
  • the user equipment UE provided by the embodiment of the present application includes:
  • the receiving unit is configured to receive, by the session management network element SMF, a first message that includes the security protection information used by the user plane during the session, where the security protection information includes: a security protection algorithm, and a security protection identifier.
  • An integrity-protected key generates an authentication code generated by integrity protection of the first message;
  • a processing unit configured to authenticate the first message according to security protection information used by the user plane received by the receiving unit; when the first message is successfully authenticated, start a user plane of the UE safety protection;
  • a sending unit configured to send, to the SMF, a second message used to indicate that the UE successfully authenticates the first message, when the processing unit successfully authenticates the first message.
  • the processing unit when the security unit of the user plane is activated, is specifically configured to: initiate encryption and decryption protection and integrity protection of the user plane, and then control the sending unit to send the SMF to the SMF. Said second message; or,
  • the processing unit is specifically configured to: initiate downlink decryption protection and integrity protection of the user plane, and then control the sending unit to send the second message to the SMF, and finally start the user plane.
  • Upstream encryption protection When the security unit of the user plane is activated, the processing unit is specifically configured to: initiate downlink decryption protection and integrity protection of the user plane, and then control the sending unit to send the second message to the SMF, and finally start the user plane.
  • Upstream encryption protection is specifically configured to: initiate downlink decryption protection and integrity protection of the user plane, and then control the sending unit to send the second message to the SMF, and finally start the user plane.
  • Upstream encryption protection When the security unit of the user plane is activated, the processing unit is specifically configured to: initiate downlink decryption protection and integrity protection of the user plane, and then control the sending unit to send the second message to the SMF, and finally start the user plane. Upstream encryption protection.
  • the processing unit is further configured to: after authenticating the first message according to the security protection information used by the user plane, when the first message fails to be authenticated, Determine that the security of the user plane is not activated;
  • the sending unit is further configured to: when the processing unit fails to authenticate the first message, send a fourth message to the SMF to indicate that the UE fails to authenticate the first message.
  • a UE provided by the embodiment of the present application includes: a processor, a memory, and a transceiver;
  • the transceiver is configured to receive and send data
  • the memory is for storing instructions
  • the processor is configured to execute the instructions in the memory and perform the method provided by the second aspect.
  • the embodiment of the present application further provides a computer storage medium for storing computer software instructions used by the UE in the above aspect, which includes a program for performing the foregoing aspect.
  • a user plane gateway UPF provided by the embodiment of the present application includes:
  • a receiving unit configured to receive, by the session management network element SMF, an algorithm including a security protection used by the user plane during the session and a third message for security protection, where the third message is used to indicate the
  • the UPF initiates security protection of the user plane according to the security protection algorithm and the context for security protection, the security protection including encryption and decryption protection and integrity protection;
  • a processing unit configured to initiate security protection of the user plane according to the indication of the third message received by the receiving unit.
  • the receiving unit when the receiving unit receives the third message that is sent by the SMF, including the security protection used by the user plane during the session and the context for security protection, the receiving unit is specifically configured to:
  • the SMF After the SMF determines that the UE initiates security protection of the user plane, receiving the third message sent by the SMF; or
  • the first trigger message is used to trigger the downlink of the user plane initiated by the UPF.
  • the second trigger message sent by the SMF is received, where the second trigger message is used to trigger the UPF to initiate uplink decryption protection of the user plane.
  • a UPF provided by the embodiment of the present application includes: a processor, a memory, and a transceiver;
  • the transceiver is configured to receive and send data
  • the memory is for storing instructions
  • the processor is configured to execute the instructions in the memory to perform the method provided by the first aspect.
  • a computer storage medium for storing the computer software instructions used by the UPF in the above aspect, including the program designed to perform the above aspects, is further provided in the embodiment of the present application.
  • 1 is a schematic diagram of a 5G network architecture
  • FIG. 2 is a schematic diagram of a session establishment process based on a 5G network architecture
  • FIG. 3 is a schematic flowchart of a security protection negotiation method according to an embodiment of the present disclosure
  • FIG. 4 to FIG. 21 are schematic diagrams showing a flow of a security protection negotiation method provided by each of the descriptions in the first embodiment of the present application;
  • FIG. 22 is a schematic flowchart of another security protection negotiation method according to an embodiment of the present disclosure.
  • FIG. 23 is a schematic flowchart of a security protection negotiation method provided in conjunction with FIG. 3 and FIG. 22 according to an embodiment of the present application;
  • FIG. 24 is a schematic structural diagram of an SMF according to an embodiment of the present application.
  • FIG. 25 is a schematic structural diagram of another SMF according to an embodiment of the present disclosure.
  • FIG. 26 is a schematic structural diagram of a UE according to an embodiment of the present application.
  • FIG. 27 is a schematic structural diagram of another UE according to an embodiment of the present application.
  • FIG. 29 is a schematic structural diagram of another UPF according to an embodiment of the present application.
  • FIG. 1 is a schematic diagram of a 5G network architecture, where the network element included in the 5G network architecture and the network elements are used in FIG. Communication interface.
  • the technical solution provided by the embodiment of the present application is applicable to a session establishment process of a 5G-based network architecture
  • FIG. 2 is a schematic diagram of a session establishment process proposed by a 5G-based network architecture.
  • the technical solutions of all embodiments of the present application are also applicable to a 5G-based slicing network architecture.
  • a user plane security protection negotiation process for implementing service-based slicing is considered. The process is consistent, except that the execution network element corresponds to the 5G slice structure.
  • the SMF may be deployed in the slice, and the UPF/SPCF and the like are intra-slice network elements.
  • the embodiment of the present application provides a security protection negotiation method and a network element, which is used to implement user equipment (User Equipment, UE) and user plane based on the 5G network architecture.
  • User Equipment User Equipment
  • UPF User Plane Function
  • Security protection includes encryption and decryption protection and integrity protection.
  • Encryption protection refers to the process of calculating plaintext into ciphertext using encryption-protected keys and algorithms.
  • Decryption protection is the reverse process of encryption protection.
  • Integrity protection refers to the use of integrity protection. The process of generating a Message Authentication Code (MAC) by the key and algorithm.
  • MAC Message Authentication Code
  • the security protection negotiation of the user plane refers to the process in which the UE and the UPF performing data security protection negotiate and synchronize the security protection key and security protection algorithm at each security layer, and initiate the security protection of the user plane. It should be noted that, the embodiment of the present application further provides a security protection negotiation method and a network element, which is used to implement security protection for the user plane of the session, and the gNB is implemented by the negotiation between the UE and the gNB based on the 5G network architecture. Can be understood as the next generation base station (the next generation Node Base station).
  • the method and the network element are based on the same inventive concept. Since the method and the network element solve the problem are similar in principle, the implementation of the network element and the method can be referred to each other, and the repeated description is not repeated.
  • the technical solution provided by the embodiment of the present application may occur after the session establishment process, or may occur during the session establishment process.
  • the network elements mainly involved in the embodiments of the present application mainly include a UE, a Session Management Function (SMF), an UPF, and a Security Policy Control Function (SPCF).
  • SMF Session Management Function
  • UPF User Plane Function
  • SPCF Security Policy Control Function
  • the UE is a terminal device that can access the network.
  • the UE can be a smart terminal device such as a mobile phone or a tablet computer.
  • the UE can be a communication device such as a server, a gateway, a base station, a controller, etc., for example, the UE can be a sensor or an electric meter.
  • IoT equipment such as water meters.
  • the SMF is used to control the relevant signaling in the process during the establishment, deletion or modification of the session for the UE.
  • the SMF in the embodiment of the present application may be located in the handover. In this case, one or more SMFs may exist in one slice.
  • the SMF in this embodiment may also be located outside the slice, that is, between the switch and the slice.
  • the UPF may also be referred to as a data plane gateway, such as an egress gateway.
  • User data is accessed through the network element to a data network (DN), and the UPF may be an Internet or a third-party service server.
  • DN data network
  • the SPCF is used for the acquisition, negotiation, and decision making of the security policy.
  • the specific selection may be the security protection algorithm. For example, according to the security capability list of the UE and the list of security algorithms on the network side acquired or stored in advance, the priority of the intersection is selected. Security algorithms used, including encryption algorithms and integrity protection algorithms.
  • the embodiment of the present application provides a security protection negotiation method, and the interaction process between each network element is as follows:
  • the SMF determines the security protection information used by the user plane during the session.
  • the security protection information in S301 includes, but is not limited to, an algorithm for security protection, an index for identifying a context of security protection, and a message authentication code.
  • the security protection includes encryption and decryption protection and integrity protection;
  • the message authentication code refers to the authentication code that the SMF uses the integrity protection algorithm and the integrity protection algorithm to calculate the first message; since the security protection context includes encryption and decryption
  • the context of protection context and integrity protection the context of encryption and decryption protection includes the key protected by encryption and decryption, and the context of integrity protection includes the key of integrity protection, so the index used to identify the context of security protection can be identified as complete. Sexually protected key.
  • the security protection information used by the user plane during the session determined by the SMF in S301 specifically includes the following information: an encryption and decryption protection algorithm used by the user plane during the session, and during the session An algorithm for integrity protection used by the user plane, an index for identifying the context of the encryption and decryption protection used by the user plane during the session, and a context for identifying the integrity protection used by the user plane during the session Index, and message verification code.
  • the index for identifying the context of the encryption and decryption protection used by the user plane during the session and the index for identifying the context of the integrity protection used by the user plane during the session may be the same index, or may be Is a different index, for example, the identifier/slice identifier of the session can be used as an index for identifying the context of the encryption and decryption protection used by the user plane during the session, and is used to identify the user plane used in the session.
  • the security protection information in S301 may also include the security capability of the UE, and the security capability of the UE is used for the security capability authentication of the UE.
  • the SMF determines the algorithm for security protection used by the user plane during the session in the following two ways, including an encryption and decryption protection algorithm and an integrity protection algorithm.
  • Manner 1 The SMF obtains, from the SPCF, an algorithm for security protection used by the user plane during the session determined by the SPCF negotiation.
  • the SPCF stores all the original security protection algorithms of the user plane.
  • the SPCF determines the security protection algorithm used by the user plane during the session based on the original security protection algorithm of the user plane; the SMF obtains the SPCF from the SPCF.
  • Negotiation determines the algorithm for security protection used by the user plane during this session.
  • Manner 2 The SMF negotiates itself to determine the security protection algorithm used by the user plane during the session.
  • the second method may include: the SPCF stores all the original security protection algorithms of the user plane, the SMF obtains the original security protection algorithm of the user plane from the SPCF, and determines the current session by itself based on the obtained original security protection algorithm of the user plane.
  • the algorithm of security protection used by the user plane in the process may include: the SPCF stores all the original security protection algorithms of the user plane, the SMF obtains the original security protection algorithm of the user plane from the SPCF, and determines the current session by itself based on the obtained original security protection algorithm of the user plane.
  • the algorithm of security protection used by the user plane in the process may include: the SPCF stores all the original security protection algorithms of the user plane, the SMF obtains the original security protection algorithm of the user plane from the SPCF, and determines the current session by itself based on the obtained original security protection algorithm of the user plane.
  • the algorithm of security protection used by the user plane in the process may include: the SPCF stores all the original security protection algorithms of the user plane, the SMF obtains the original security protection algorithm of
  • the second method may also include that the SMF has obtained the algorithm/security capability of the security protection supported by the UE, the algorithm/security capability of the network protection security protection, and the SPCF obtains the algorithm/security capability of the security protection supported by the service to which the session belongs.
  • the SMF then negotiates based on all the foregoing security algorithms to determine the security protection algorithm used by the user plane during the session.
  • the SPCF when the SPCF is deployed on the network, the SPCF may be an independently deployed network element, or may be deployed in a security anchor function (SEAF) or an authentication service network element (Authentication Server Function, AUSF) and any network element in the SMF.
  • SEAF security anchor function
  • AUSF authentication service network element
  • SEAF and AUSF are both network elements with security authentication function.
  • the above method 1 can be understood as an algorithm for the SMF to obtain the security protection used by the user plane during the session from the SEAF or the AUSF.
  • the second mode can be understood as the SMF obtaining from the SEAF or the AUSF.
  • the original security protection algorithm of the user plane, or the foregoing mode 2 is understood as the algorithm/security capability of the SMF to obtain the security protection of the service to which the session belongs from the SEAF or AUSF.
  • the above method 1 can be understood as an algorithm for determining the security protection used by the user plane during the session by the SMF.
  • the second method can be understood as the SMF storing all the original security of the user plane.
  • the protection algorithm, or the above method 2 is understood as the algorithm/security capability that the SMF has obtained the security protection of the service supported by the session.
  • the method for negotiating and determining the security protection algorithm used by the user plane in the current session is the same, that is, the algorithm/security capability based on the security protection supported by the UE, and the security protection of the network support.
  • the algorithm/security capability and the algorithm/security capability negotiation of the security protection supported by the service of the session determine the security protection algorithm used by the user plane during the session. For example, determining an algorithm for security protection supported by the UE, an algorithm for security protection supported by the network, and an algorithm for security protection supported by the service to which the session belongs, and selecting the algorithm with the highest priority among the determined intersection algorithms The algorithm used as the security protection used by the user plane during this session.
  • the SMF may initiate a security protection negotiation process of the user plane after obtaining or self-deriving the root key Kup of the user plane, or may generate and distribute the encryption and decryption key and integrity protection of the user plane. After the key is used, the security protection negotiation process of the user plane is initiated.
  • the security protection negotiation process of the user plane refers to the security protection negotiation method provided by this embodiment. It should be noted that the SMF obtains or derives the user's root key Kup by itself, and the method of generating and distributing the user plane's encryption and decryption key and integrity protection key based on the user polygon root key Kup. See the prior art, and will not be described here.
  • the SMF sends, to the UE, a first message including the security protection information used by the user plane during the session.
  • the first message in S302 may refer to a Security Mode Command message of the user plane.
  • the SMF establishes the current session before executing S301.
  • the UE sends a session establishment request message for requesting to establish the current session to the SMF; the SMF receives the After the session establishment request message, it is necessary to determine which network element the user plane endpoint is.
  • the user plane termination point refers to the network element that needs to start the user plane security protection except for the UE; the user determined by the SMF in the method shown in FIG. The endpoint is the UPF; after determining that the endpoint of the user plane is the UPF, the SMF sends a notification message to the radio access network (Radio Access NetWork, RAN), the notification message is used to indicate that the SMF will perform the user between the UE and the UPF.
  • the method of security protection negotiation and then the SMF executes S301.
  • the SMF sends the session establishment response message to the UE, and sends the security protection information used by the user plane during the session to the UE.
  • the end point of the user plane may also be a gNB.
  • the security protection negotiation method for implementing the user plane between the UE and the gNB will be under Description of the embodiments in the text.
  • the UE authenticates the first message according to the security protection information used by the user plane during the session.
  • the method for the UE to authenticate the first message in the S303 includes: the UE needs to calculate the first message according to the integrity protection algorithm and the integrity-protected key derived by the UE, and obtain the message verification code, and the UE calculates the message.
  • the message verification code is compared with the message verification code sent by the receiving SMF. When the two message verification codes are the same, it indicates that the first message has not been tampered with, the UE successfully authenticates the first message integrity protection; when the two message verification codes are not the same, the UE determines the integrity protection of the first message. Authentication failed.
  • the UE needs to perform security capability authentication before performing integrity protection authentication on the first message, that is, the security capability of the UE including the security protection information by the UE.
  • the security capabilities of the storage are compared. If the two are the same, the security capability is successfully authenticated. Otherwise, the security capability fails.
  • the UE performs the security capability authentication to prevent the degraded attack.
  • the process of the UE performing the security capability authentication can be referred to the prior art, and details are not described herein again.
  • the UE If the above-mentioned integrity protection authentication and security capability authentication are successful, the UE is considered to have successfully authenticated the first message; if there is one authentication failure in the integrity protection authentication and the security capability authentication, the UE is considered to authenticate the first message. failure.
  • the security protection of the user plane initiated by the UE includes the UE starting the encryption and decryption protection and integrity protection for the user plane of the session, and the encryption and decryption protection includes uplink encryption protection and downlink decryption protection.
  • the UE When the UE successfully authenticates the first message, the UE sends a second message to the SMF to indicate that the UE successfully authenticates the first message.
  • the second message in S305 may refer to a Security Mode Complete message of the user plane.
  • the second message may carry a message authentication code, where the message authentication code is an authentication code calculated by the UE according to the integrity protection key and the integrity protection algorithm used by the user plane during the session, and the second message is calculated.
  • the second message has been encrypted and signed by the uplink cipher protected key and the upstream cipher protection algorithm used by the user plane during the session.
  • the UE when the UE successfully authenticates the first message, the UE initiates encryption and decryption protection and integrity protection of the user plane, and then sends an indication to the SMF to indicate that the UE successfully authenticates the first message.
  • the second message, the encryption and decryption protection includes uplink encryption protection and downlink decryption protection.
  • the UE may start downlink decryption protection and integrity protection of the user plane, and then send a second message to the SMF to indicate that the UE successfully authenticates the first message; the UE sends the second After the message, the user's upstream encryption protection is activated.
  • the UE when performing S304 and S305, when the UE successfully authenticates the first message, the UE first sends a second message to the SMF to indicate that the UE successfully authenticates the first message, and then starts the encryption and decryption of the user plane. Protection and integrity protection.
  • the S303 UE After the S303 UE authenticates the first message according to the security protection information used by the user plane in the current session, when the UE fails to authenticate the first message, the UE determines that the user plane security protection is not activated, and A fourth message for instructing the UE to fail the authentication of the first message is sent to the SMF. That is, in the case that the UE fails to authenticate the first message, the flow of the security protection negotiation method shown in FIG. 3 ends.
  • the SMF sends, to the UPF, an algorithm including a security protection used by the user plane during the session and a third message for security protection.
  • the third message is used to trigger the UPF according to the user plane during the session.
  • the security protection algorithm used and the security protection of the user plane for the context of security protection.
  • the context for security protection includes encryption and decryption protected keys and integrity protected keys.
  • the UPF initiates security protection of the user plane according to the indication of the third message.
  • the security protection of the user plane initiated by the UPF includes the encryption and decryption protection and integrity protection of the user plane initiated by the UPF for the session, and the encryption and decryption protection includes downlink encryption protection and uplink decryption protection.
  • the SMF can trigger the UPF to initiate the security protection of the user plane by using a message.
  • the UPF in S307 can start the security protection of the user plane at the same time according to a message sent by the SMF.
  • the SMF sends, to the UPF, an algorithm including the security protection used by the user plane during the session and a third message for the context of the security protection;
  • the UPF starts downlink encryption protection, integrity protection, and uplink decryption protection according to the indication of the third message.
  • the SMF may also trigger the UPF to initiate the security protection of the user plane by using multiple messages.
  • the sending timing of the multiple messages may be different.
  • the UPF in S307 may start the user plane at different times according to multiple messages sent by the SMF.
  • Security protection For example, in S306, after the SMF sends the security protection information used by the user plane during the session to the UE, the SMF sends an algorithm including the security protection used by the user plane during the session to the UPF and the security protection for the user.
  • the SMF sends the information to the UPF, including during the session.
  • the algorithm for security protection used by the user plane and the second trigger message for the context of the security protection is used to trigger the UPF to initiate the uplink decryption protection of the user plane.
  • the UPF starts downlink encryption protection and integrity protection according to the indication of the first trigger message, and starts uplink decryption protection according to the indication of the second trigger message.
  • the first trigger message may include only the algorithm and key for downlink encryption used by the user plane during the session, and the algorithm and key for integrity protection.
  • the second trigger message may include only the session process. The algorithm and key for the uplink decryption used by the user plane.
  • the UE and the UPF can initiate the security protection of the respective user planes.
  • the method shown in FIG. 3 can implement the security protection of the user plane based on the session granularity of the UE and the UPF negotiation, so the method shown in FIG. 3 can be Meet the needs of the 5G network architecture for the security protection of the user plane.
  • FIG. 4 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 4 and the method shown in FIG. 3 is that the timing of the UE starting the security protection of the user plane is different.
  • the UE after successfully authenticating the first message, the UE first sends a second message, that is, a Security Mode Complete message, to the SMF, indicating that the UE successfully authenticates the first message, and then the UE initiates the user plane. safety protection.
  • a second message that is, a Security Mode Complete message
  • FIG. 5 is a schematic flowchart of a method for negotiating a security protection according to the embodiment.
  • the main difference between the method shown in FIG. 5 and the method shown in FIG. 3 is that the security of the user plane of the UPF is different.
  • the SMF triggers the UPF to initiate security protection of the user plane at different times. Specifically, after the SMF sends the security protection information used by the user plane in the session to the UE, the SMF sends an algorithm including the security protection used by the user plane during the session and the context for security protection to the UPF.
  • the first trigger message is used to trigger the UPF to initiate downlink encryption protection and integrity protection of the user plane, and the UPF starts the downlink encryption protection and integrity protection of the user plane after receiving the first trigger message;
  • the SMF is determining
  • the UE successfully authenticates the first message the UE sends an algorithm including the security protection used by the user plane and the second trigger message for the security protection to the UPF, and the second trigger message is used to trigger the UPF startup.
  • the uplink decryption protection of the user plane the UPF starts the uplink decryption protection of the user plane after receiving the second trigger message.
  • FIG. 6 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 6 and the method shown in FIG. 3 is that the UE and the UPF start the security protection of the user plane at different timings. .
  • the UE after the UE successfully authenticates the first message, the UE initiates downlink decryption protection and integrity protection of the user plane, and then sends a second message to the SMF for indicating that the UE successfully authenticates the first message, that is, Security Mode Complete message; the UE initiates uplink encryption protection of the user plane after transmitting the second message.
  • the method for starting the security protection of the user plane by the UPF refer to the method shown in FIG. 5.
  • FIG. 3 For other steps of the method shown in FIG. 6, refer to the method shown in FIG. 3, and details are not described herein again.
  • FIG. 7 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 6 and the method shown in FIG. 3 is that the SPCF negotiation is added to determine the user plane during the session. The process of using the algorithm of security protection.
  • the SMF first triggers the SPCF negotiation to determine the security protection algorithm used by the user plane during the session, including the encryption and decryption protection algorithm and integrity protection used by the user plane during the session.
  • Algorithm SPCF determines the user during the session based on the algorithm/security capability supported by the UE, the algorithm/security capability of the network-protected security protection, and the algorithm/security capability negotiation of the security protection supported by the service to which the session belongs.
  • the algorithm for security protection used by the surface; the SPCF sends the algorithm for security protection used by the user plane during the session determined by the negotiation to the SMF.
  • the method shown in FIG. 3 is executed.
  • the method shown in FIG. 7 can be appropriately expanded and changed in this embodiment.
  • the SMF after the SMF receives the security protection algorithm used by the user plane during the session sent by the SPCF, the SMF triggers the UPF to start the security protection of the user plane.
  • FIG. 8 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 8 and the method shown in FIG. 3 is that the SPCF negotiation is added to determine the user plane during the session.
  • the process of using the security protection algorithm and the timing of the UE launching the security protection of the user plane are different.
  • the process of the SPCF negotiation in the method shown in FIG. 8 for determining the security protection algorithm used by the user plane during the session may refer to the corresponding part in the method shown in FIG. 7, and the UE is started in the method shown in FIG.
  • For the timing of the security protection of the user plane refer to the corresponding part in the method shown in FIG. 4.
  • the other steps of the method shown in FIG. 8 refer to the method shown in FIG. 3, and details are not described herein again.
  • FIG. 9 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 9 and the method shown in FIG. 3 is that the SPCF negotiation is added to determine the user plane during the session.
  • the process of using the security-protected algorithm and the timing of the security protection of the UPF-enabled user plane are different.
  • the process of the SPCF negotiation in the method shown in FIG. 9 for determining the security protection algorithm used by the user plane during the session may refer to the corresponding part in the method shown in FIG. 7, and the UPF is started in the method shown in FIG.
  • For the timing of the security protection of the user plane refer to the corresponding part in the method shown in FIG. 5.
  • the other steps of the method shown in FIG. 9 refer to the method shown in FIG. 3, and details are not described herein again.
  • FIG. 10 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 10 and the method shown in FIG. 3 is that the SPCF negotiation is added to determine the user plane during the session.
  • the process of the SPCF negotiation in the method shown in FIG. 10 to determine the security protection algorithm used by the user plane during the session may refer to the corresponding part in the method shown in FIG. 7.
  • the UE starts.
  • the timing of the security protection of the user plane refer to the corresponding part in the method shown in FIG. 4.
  • the timing of the security protection of the user plane initiated by the UPF can be referred to the corresponding part in the method shown in FIG.
  • FIG. 11 is a schematic flowchart of a security protection negotiation method according to the embodiment. The main difference between the method shown in FIG. 11 and the method shown in FIG. 10 is that the user plane security protection negotiation method and signaling are performed. The security protection negotiation method is integrated.
  • the SMF determines the security protection information used by the signaling plane of the current session, such as a key.
  • the SMF sends the security protection information used by the signaling plane in the session to the UE by using the first message.
  • the UE successfully authenticates the first message according to the security protection information used by the signaling plane in the session.
  • the security protection information used by the signaling plane during the session is sent to the SMF through the second message.
  • the method for negotiating the security of the signaling plane can be referred to the prior art.
  • the method for negotiating the security of the user plane in the method shown in FIG. 11 is shown in the method shown in FIG. 10, and details are not described herein again.
  • FIG. 12 is a schematic flowchart of a security protection negotiation method according to the embodiment. The main difference between the method shown in FIG. 12 and the method shown in FIG. 7 is that the user plane security protection negotiation during the session The method is integrated with the establishment process of this session.
  • the UE before performing the security protection negotiation process of the user plane in the current session, the UE sends a session establishment request message for requesting to establish the current session to the SMF; during the execution of the session, the user During the security negotiation negotiation process, the SMF sends the security protection information of the user plane to the UE during the session.
  • the SMF establishes the session and triggers the UPF after determining that the UE successfully authenticates the first message. Initiate user plane security.
  • the method for negotiating the security of the user plane during the session refer to the method shown in Figure 7, and no further details are provided here.
  • FIG. 13 is a schematic flowchart of a method for negotiating a security protection according to the embodiment.
  • the main difference between the method shown in FIG. 13 and the method shown in FIG. 3 is that an algorithm for storing a user plane security protection in an SPCF is clarified.
  • the SMF obtains the security protection algorithm of the user plane from the SPCF, the SMF negotiates itself to determine the security protection algorithm used by the user plane of the session.
  • the security protection negotiation method of the user plane in the method shown in Figure 13 refer to the method shown in Figure 3, and details are not described herein.
  • FIG. 14 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the SMF triggers the SEAF to perform user session during the session.
  • the SEAF and the UE negotiate the security protection information used by the user plane during the session.
  • the SEAF will send the security protection information used by the user plane to the SMF during the session.
  • the SMF triggers the UPF to initiate the security protection of the user plane.
  • the method for negotiating the user plane security of the SEAF is described in the SMF in the method shown in Figure 3, and the method for negotiating the security of the user plane is not described here.
  • FIG. 15 is a schematic flowchart of a method for negotiating a security protection according to the embodiment.
  • the main difference between the method shown in FIG. 15 and the method shown in FIG. 14 is that an algorithm for storing a user plane security protection in an SPCF is clarified.
  • the SEAF obtains the security protection algorithm of the user plane from the SPCF, the SEAF negotiates itself to determine the security protection algorithm used by the user plane during the session.
  • the security protection negotiation method of the user plane in the method shown in FIG. 13 refer to the method shown in FIG. 14, and details are not described herein again.
  • FIG. 16 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 16 and the method shown in FIG. 3 is that the UPF triggers the SMF to perform a security protection negotiation process of the user plane.
  • the method for performing the security negotiation of the user plane by the SMF in the method shown in FIG. 16 refers to the method shown in FIG. 3, and details are not described herein again.
  • FIG. 17 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 17 and the method shown in FIG. 15 is that the UPF triggers the SMF to perform a security protection negotiation process on the user plane. Then, the SMF triggers the SEAF to perform the security protection negotiation process of the user plane.
  • the method shown in FIG. 15 is not described here.
  • FIG. 18 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the main difference between the method shown in FIG. 18 and the method shown in FIG. 15 is that the SMF triggers access and the mobile control network element (Access). And Mobility Function (AMF) performs the security protection negotiation process of the user plane.
  • the AMF and the UE negotiate the security protection information used by the user plane during the session. After the negotiation, the AMF will negotiate the user plane during the session.
  • the security protection information used is sent to the SMF, and the SMF triggers the UPF to initiate the security protection of the user plane.
  • the AMF performs the user plane security protection negotiation method. Referring to the SMF in the method shown in FIG. 15, the user plane security protection negotiation method is performed, and details are not described herein again.
  • AMF serves as the termination point of Network Authentication Server (NAS) signaling for processing signaling in the network.
  • NAS Network Authentication Server
  • FIG. 19 is a schematic flowchart of a method for negotiating a security protection according to the embodiment.
  • the main difference between the method shown in FIG. 19 and the method shown in FIG. 3 is that the SMF triggers the AMF to perform a security protection negotiation process for the user plane. Then, the AMF triggers the SEAF to perform the security protection negotiation process of the user plane. The SEAF and the UE negotiate the security protection information used by the user plane during the session. After the negotiation, the SEAF will negotiate the user plane during the session. The security protection information used is sent to the SMF through the AMF, and the SMF triggers the UPF to initiate the security protection of the user plane.
  • the method for negotiating the security of the user plane is performed by using the SMF in the method shown in FIG. 3, and the method for negotiating the security of the user plane is not described here.
  • FIG. 20 is a schematic flowchart of a security protection negotiation method according to the embodiment.
  • the SMF triggers a security gateway (SeGW).
  • SeGW security gateway
  • the SeGW and the UE negotiate the security protection information used by the user plane during the session.
  • the SeGW will send the security protection information used by the user plane during the session.
  • the SMF triggers the UPF to initiate the security protection of the user plane.
  • the method for negotiating the security of the user plane is performed by the SeGW.
  • the SeGW may also trigger the UPF to initiate security protection of the user plane.
  • FIG. 21 is a schematic flowchart of a method for negotiating a security protection according to the present embodiment.
  • the main difference between the method shown in FIG. 21 and the method shown in FIG. 3 is that the UPF triggers the SMF to perform a security protection negotiation process for the user plane.
  • the SGW triggers the SeGW to perform the security protection negotiation process of the user plane.
  • the SeGW and the UE negotiate the security protection information used by the user plane during the session. After the negotiation, the SeGW will negotiate the user plane during the session.
  • the security protection information used is sent to the SMF, and the SMF triggers the UPF to initiate the security protection of the user plane.
  • the method for negotiating the security of the user plane is performed by the SeGW.
  • the method for negotiating the security of the user plane is performed, and details are not described herein again.
  • the method shown in FIG. 21 may also be that the SeGW triggers the UPF to initiate security protection of the user plane of the session.
  • the SMF determines and sends to the UE the security protection information used by the user plane during the session, including an algorithm for security protection, an index for identifying a context of security protection, and The message authentication code, etc., after the UE is successfully authenticated, triggers the UE and the UPF to initiate the security protection of the respective user planes respectively.
  • the security protection includes encryption and decryption protection and integrity protection, thereby enabling the UE and the UPF to initiate the security protection of the respective user planes. .
  • the embodiment of the present application provides The method provided by the UE and the UPF can initiate the security protection of the user plane based on the session granularity. Therefore, the method provided by the embodiment of the present application can meet the requirement of the 5G network architecture for the security protection of the user plane.
  • the relevant network element such as SMF, SEAF, or SPCF may determine the endpoint of the user plane in the session, and the endpoint of the user plane refers to the security protection of the user plane in addition to the UE.
  • Network element the termination point of the user plane may be UPF or gNB, and the gNB may be understood as the next generation Node Base station, where a gNB belongs to the RAN when the end point of the user plane is UPF.
  • the method for implementing the security protection between the UE and the UPF to initiate the user plane has been described in detail above. The following is the case where the termination point of the user plane is the gNB, and the detailed description is used to implement the negotiation between the UE and the gNB.
  • the method of security protection for the user side is described in detail above. The following is the case where the termination point of the user plane is the gNB, and the detailed description is used to implement the negotiation between the UE and the gNB.
  • the embodiment of the present application further provides a security protection negotiation method, which is used to implement security protection between the UE and the gNB to initiate user plane negotiation.
  • the method occurs in the session establishment process.
  • the interaction process between the network elements in the method is as shown in FIG. 22.
  • the main difference between the method shown in FIG. 22 and the method shown in FIG. 3 is that the SMF receives the UE for sending. After the request to establish the session establishment request message of the current session, the SMF determines that the endpoint of the user plane is the gNB, and the SMF sends a notification message to the RAN, where the notification message is used to instruct the RAN to perform security protection negotiation between the UE and the gNB.
  • the RAN after receiving the notification message, the RAN returns an acknowledgement message to the SMF, and performs a negotiation method of security protection of the user plane between the UE and the gNB.
  • the termination point for the user plane is the case of the gNB.
  • the UE may complete the security protection negotiation of the user plane through the security protection negotiation process between the UE and the gNB during the initial access.
  • the negotiation method of the user plane security protection between the UE and the gNB in the method shown in FIG. 22 refer to the method SMF shown in FIG. 3 to perform the negotiation method of the user plane security protection between the UE and the UPF, but the difference is
  • the network element in which the negotiation method is implemented is gNB, and the network element that needs to start the security protection of the user plane in addition to the UE is gNB.
  • the method may be appropriately extended and changed in this embodiment, and the solution for expanding and changing the method shown in FIG. 22 may be referred to above.
  • the method shown in Figure 3 is a solution for expansion and variation.
  • the extension and change can be made in the following aspects: the UE and the gNB initiate the security protection of the user plane, and negotiate the network element (which may be SPCF, SEAF or AUSF) of the algorithm for determining the security protection used by the user plane during the session. And a network element that triggers the RAN to perform a security protection negotiation method of the user plane between the UE and the gNB, and the like.
  • the network element which may be SPCF, SEAF or AUSF
  • the UE and the gNB can negotiate to start the security protection of the respective user planes.
  • the method shown in FIG. 22 can implement the security protection of the user plane based on the session granularity of the UE and the gNB negotiation, so the method shown in FIG. 22 can be Meet the needs of the 5G network architecture for the security protection of the user plane.
  • FIG. 23 a security protection negotiation method provided by the embodiment of the present application is shown in FIG. 23, and the specific content of the method shown in FIG. 23 can be seen in FIG. 3 and FIG. I will not repeat them here.
  • the embodiment of the present application further provides a session management network element (SMF), which can perform the method on the SMF side in a security protection negotiation method provided in Embodiment 1.
  • SMF session management network element
  • the SMF 2400 includes a processing unit 2401, a transmitting unit 2402, and a receiving unit 2403. among them,
  • the processing unit 2401 is configured to determine security protection information used by the user plane during the session, where the security protection information includes an algorithm for security protection, an index for identifying a context of security protection, and a message authentication code, and the security protection includes encryption and decryption protection.
  • the message authentication code refers to an authentication code generated by using an integrity protection algorithm and an integrity protection key of the integrity protection key included in the index to perform integrity protection on the first message;
  • the sending unit 2402 is configured to send, to the UE, a first message that includes the security protection information used by the user plane determined by the processing unit 2401, and the security protection information used by the user plane is used by the UE according to the security protection information used by the user plane.
  • the security protection of the user plane is initiated after a message is successfully authenticated by the integrity protection;
  • the receiving unit 2403 is configured to receive a second message that is sent by the UE to indicate that the UE successfully authenticates the first message.
  • the sending unit 2402 is further configured to send, to the user plane gateway UPF, an algorithm including a security protection used by the user plane and a context for security protection, which is determined by the processing unit 2401, and a third message is used.
  • the UPF is triggered to initiate user plane security protection according to the security protection algorithm and the context of security protection.
  • processing unit 2401 determines an algorithm for security protection, specifically:
  • the algorithm for security protection is determined by self-negotiation.
  • the SPCF is deployed on any one of the SMF, the security anchor network element SEAF, and the authentication service network element AUSF, or the SPCF is independently deployed in the network.
  • the security protection algorithm is determined based on an algorithm supported by the UE, a security protection algorithm supported by the network, and an algorithm for security protection supported by the service to which the session belongs.
  • the processing unit 2401 is further configured to: establish the current session before determining the security protection information used by the user plane; or,
  • the receiving unit 2403 is further configured to: before the processing unit 2401 determines the security protection information used by the user plane, receive a session establishment request message sent by the UE for requesting to establish the current session;
  • the sending unit 2402 When the sending unit 2402 sends the first message including the security protection information used by the user plane to the UE, the sending unit 2402 is specifically configured to: send a session establishment complete message including the security protection information used by the user plane to the UE.
  • the processing unit 2401 is further configured to: after the receiving unit 2403 receives the session establishment request message sent by the UE for requesting to establish the current session, determine that the security endpoint of the user plane is an UPF;
  • the sending unit 2402 is further configured to: after the processing unit 2401 determines that the security endpoint of the user plane is the UPF, send a notification message to the radio access network RAN to instruct the SMF to perform the security protection negotiation method.
  • the receiving unit 2403 is further configured to: after the sending unit 2402 sends the first message including the security protection information used by the user plane to the UE, the receiving UE sends the UE to notify the UE that the first message fails to be authenticated. Fourth message;
  • the processing unit 2401 is further configured to: according to the indication of the fourth message received by the receiving unit 2403, determine that the security protection of the user plane is not required to be triggered by the UPF.
  • each unit refers to a security protection negotiation method provided in Embodiment 1, and details are not described herein again.
  • the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • An integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, can be stored in a computer readable storage medium.
  • the technical solution of the present application in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) or a processor to perform all or part of the steps of the various embodiments of the present application.
  • the foregoing storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like.
  • ROM read-only memory
  • RAM random access memory
  • magnetic disk or an optical disk and the like.
  • the embodiment of the present application further provides an SMF, which may perform the method on the SMF side in the security protection negotiation method provided in the first embodiment, and may be the same network element as the SMF shown in FIG. .
  • the SMF 2500 includes a processor 2501, a transceiver 2502, and a memory 2503. among them,
  • the processor 2501 is configured to read a program in the memory 2503 and perform the following process:
  • the processor 2501 is configured to determine security protection information used by the user plane during the session.
  • the security protection information includes an algorithm for security protection, an index for identifying a context of security protection, and a message authentication code, and the security protection includes encryption and decryption protection.
  • the message authentication code refers to an authentication code generated by using an integrity protection algorithm and an integrity protection key of the integrity protection key included in the index to perform integrity protection on the first message;
  • the processor 2501 is further configured to control the transceiver 2502 to send a first message of the security protection information used by the user plane to the UE, where the security protection information used by the user plane is used for security protection used by the UE according to the user plane. After the information is integrity-protected and authenticated, the user initiates security protection of the user plane;
  • the processor 2501 is further configured to: control the transceiver 2502 to receive a second message sent by the UE to indicate that the UE successfully authenticates the first message, and control the transceiver 2502 to send the user plane gateway UPF, including the user plane during the session.
  • the security protection algorithm used and the third message for the context of the security protection, the third message is used to trigger the UPF to initiate the security protection of the user plane according to the security protection algorithm and the security protection context.
  • the processor 2501 when determining the algorithm of the security protection, is specifically configured to:
  • the algorithm for security protection is determined by self-negotiation.
  • the SPCF is deployed on any one of the SMF, the security anchor network element SEAF, and the authentication service network element AUSF, or the SPCF is independently deployed in the network.
  • the security protection algorithm is determined based on an algorithm supported by the UE, a security protection algorithm supported by the network, and an algorithm for security protection supported by the service to which the session belongs.
  • the processor 2501 is further configured to: establish the current session before determining the security protection information used by the user plane; or
  • the processor 2501 is further configured to: before determining the security protection information used by the user plane, the control transceiver 2502 receives a session establishment request message sent by the UE for requesting to establish the current session;
  • the processor 2501 is configured to: when the control transceiver 2502 sends the first message including the security protection information used by the user plane to the UE, specifically, the control transceiver 2502 sends the session establishment completion including the security protection information used by the user plane to the UE. Message.
  • the processor 2501 is further configured to: after the control transceiver 2502 receives the session establishment request message sent by the UE for requesting to establish the current session, determine that the security endpoint of the user plane is the UPF, and control the sending and receiving.
  • the router 2502 sends a notification message to the radio access network RAN for instructing the SMF to perform a security negotiation method.
  • the processor 2501 is further configured to: after the control transceiver 2502 sends the first message including the security protection information used by the user plane to the UE, the control transceiver 2502 receives the UE sent by the UE to indicate the UE pair.
  • the fourth message that the first message fails to be authenticated; according to the indication of the fourth message, it is determined that the security protection of the user plane is not required to be triggered by the UPF.
  • the memory 2503 may store data used by the processor 2501 in performing operations, and the memory 2503 may be a memory of a physical host carrying an SDN controller, such as a hard disk, a USB flash drive, a Secure Digital (SD) card, or the like.
  • SDN controller such as a hard disk, a USB flash drive, a Secure Digital (SD) card, or the like.
  • Also provided in this embodiment is a computer storage medium for storing computer software instructions for use in the SMF of the above embodiment, comprising programs for performing the above embodiments.
  • the embodiment of the present application further provides a user equipment UE, and the UE may perform the UE side method in a security protection negotiation method provided in Embodiment 1.
  • the UE 2600 includes a receiving unit 2601, a processing unit 2602, and a transmitting unit 2603. among them,
  • the receiving unit 2601 is configured to receive, by the session management network element SMF, a first message that includes the security protection information used by the user plane during the session, where the security protection information includes: a security protection algorithm, and is used to identify the security protection.
  • the index of the context and the message authentication code the security protection includes encryption and decryption protection and integrity protection
  • the message authentication code refers to the SMF using integrity protection algorithm and the security of the index identification includes the integrity protection key
  • the processing unit 2602 is configured to: according to the security protection information used by the user plane received by the receiving unit 2601, to authenticate the first message; when the first message is successfully authenticated, initiate security protection of the user plane;
  • the sending unit 2603 is configured to, when the processing unit 2602 successfully authenticates the first message, send a second message to the SMF to indicate that the UE successfully authenticates the first message.
  • the processing unit 2602 when the security unit of the user plane is activated, the processing unit 2602 is specifically configured to: initiate encryption and decryption protection and integrity protection of the user plane, and then control the sending unit 2603 to send a second message to the SMF; or
  • the processing unit 2602 is specifically configured to: initiate downlink decryption protection and integrity protection of the user plane, and then control the sending unit 2603 to send a second message to the SMF, and finally initiate uplink encryption protection of the user plane.
  • the processing unit 2602 is further configured to: after the first message is authenticated according to the security protection information used by the user plane, determine that the security protection of the user plane is not activated when the first message fails to be authenticated;
  • the sending unit 2603 is further configured to: when the processing unit 2602 fails to authenticate the first message, send a fourth message to the SMF to indicate that the UE fails to authenticate the first message.
  • each unit refers to a security protection negotiation method provided in Embodiment 1, and details are not described herein again.
  • the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the embodiment of the present application further provides a UE, where the UE may perform the UE side method in a security protection negotiation method provided in Embodiment 1, and may be the same device as the UE shown in FIG.
  • the UE 2700 includes a processor 2701, a transceiver 2702, and a memory 2703. among them,
  • the processor 2701 is configured to read a program in the memory 2703 and perform the following process:
  • the processor 2701 is configured to receive, by the transceiver 2702, a first message sent by the session management network element SMF, including the security protection information used by the user plane during the session, where the security protection information includes: an algorithm for security protection, For identifying the context of the security protection and the message authentication code, the security protection includes encryption and decryption protection and integrity protection, and the message authentication code refers to the integrity of the SMF using integrity protection algorithm and the security of the index identification.
  • the authentication code generated by the protected key for integrity protection of the first message is configured to receive, by the transceiver 2702, a first message sent by the session management network element SMF, including the security protection information used by the user plane during the session, where the security protection information includes: an algorithm for security protection, For identifying the context of the security protection and the message authentication code, the security protection includes encryption and decryption protection and integrity protection, and the message authentication code refers to the integrity of the SMF using integrity protection algorithm and the security of the index identification.
  • the processor 2701 is further configured to: authenticate the first message according to the security protection information used by the user plane; when the first message is successfully authenticated, initiate security protection of the user plane, and control the transceiver 2702 to send to the SMF. And a second message indicating that the UE successfully authenticates the first message.
  • the processor 2701 when the processor 2701 is configured to initiate security protection of the user plane, and the control transceiver 2702 sends a second message to the SMF to indicate that the UE successfully authenticates the first message, specifically, the processor 2701 is configured to: initiate a user plane. Encryption protection and integrity protection, and then controlling the transceiver 2702 to send a second message to the SMF; or,
  • the processor 2701 is configured to: initiate a downlink decryption protection and integrity protection of the user plane when the second layer of the user plane is activated, and the control transceiver 2702 sends a second message to the SMF to indicate that the UE successfully authenticates the first message. Then, the control transceiver 2702 sends a second message to the SMF, and finally initiates the upstream encryption protection of the user plane.
  • the processor 2701 is further configured to: after the first message is authenticated according to the security protection information used by the user plane, determine that the user plane is not activated when the first message fails to be authenticated, And the control transceiver 2702 sends a fourth message to the SMF to indicate that the UE fails to authenticate the first message.
  • the memory 2703 can store data used by the processor 2701 in performing operations, and the memory 2703 can be a memory of a physical host carrying an SDN controller, such as a hard disk, a USB flash drive, an SD card, and the like.
  • Also provided in this embodiment is a computer storage medium for storing computer software instructions for the UE of the above embodiment, which includes a program for executing the above embodiment.
  • the embodiment of the present application further provides a user plane gateway UPF, and the UPF can perform the method on the UPF side in the security protection negotiation method provided in the first embodiment.
  • the UPF 2800 includes a receiving unit 2801 and a processing unit 2802. among them,
  • the receiving unit 2801 is configured to receive, by the session management network element SMF, an algorithm including a security protection used by the user plane during the session and a third message for security protection, where the third message is used to indicate that the UPF is secure.
  • the protected algorithm and the context for security protection initiate user-side security protection, including encryption and decryption protection and integrity protection;
  • the processing unit 2802 is configured to initiate security protection of the user plane according to the indication of the third message received by the receiving unit 2801.
  • the receiving unit 2801 when the receiving unit 2801 receives the third message that is sent by the SMF, including the security protection used by the user plane during the session and the context for security protection, the receiving unit 2801 is specifically configured to:
  • the SMF After the SMF determines that the UE initiates security protection of the user plane, receiving a third message sent by the SMF; or
  • the first trigger message is sent by the SMF, and the first trigger message is used to trigger the UPF to start the downlink encryption protection and integrity protection of the user plane.
  • the second trigger message sent by the SMF is received, and the second trigger message is used to trigger the UPF to start the uplink decryption protection of the user plane.
  • each unit refers to a security protection negotiation method provided in Embodiment 1, and details are not described herein again.
  • the division of the unit in the embodiment of the present application is schematic, and is only a logical function division. In actual implementation, there may be another division manner.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the embodiment of the present application further provides a UPF.
  • the UPF may perform the method on the UPF side in the security protection negotiation method provided in the first embodiment, and may be the same network element as the UPF shown in FIG. .
  • the UPF 2900 includes a processor 2901, a transceiver 2902, and a memory 2903. among them,
  • the processor 2901 is configured to read a program in the memory 2903 and perform the following process:
  • the processor 2901 is configured to control the transceiver 2902 to receive the session management network element SMF and send the session process.
  • the processor 2901 is further configured to start security protection of the user plane according to the indication of the third message.
  • the processor 2901 controls the transceiver 2902 to receive, when the SMF sends an algorithm including an algorithm for security protection used by the user plane during the session and a third message for security protection, specifically for:
  • control transceiver 2902 After the SMF determines that the UE initiates the security protection of the user plane, the control transceiver 2902 receives the third message sent by the SMF; or
  • the control transceiver 2902 receives the first trigger message sent by the SMF, where the first trigger message is used to trigger the UPF to start the downlink encryption protection and completeness of the user plane.
  • the control transceiver 2902 After the SMF determines that the UE initiates the security protection of the user plane, the control transceiver 2902 receives the second trigger message sent by the SMF, and the second trigger message is used to trigger the UPF to initiate the uplink decryption protection of the user plane.
  • the memory 2903 can store data used by the processor 2901 in performing operations, and the memory 2903 can be a memory of a physical host that carries the SDN controller, such as a hard disk, a USB flash drive, an SD card, and the like.
  • Also provided in this embodiment is a computer storage medium for storing computer software instructions for use in the UPF of the above embodiment, comprising programs for executing the above-described embodiments.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种安全保护协商方法及网元，用以基于5G的网络架构实现UE和UPF之间协商启动针对本次会话的用户面的安全保护。方法包括：SMF确定本次会话过程中用户面所使用的安全保护信息；SMF向UE发送包括所述用户面所使用的安全保护信息的第一消息；UE根据所述用户面所使用的安全保护信息对第一消息进行完整性保护认证；当UE对第一消息认证成功时，UE启动用户面的安全保护，以及向SMF发送用于指示UE对第一消息认证成功的第二消息；SMF接收所述第二消息后，向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息；UPF根据安全保护的算法和安全保护的上下文启动用户面的安全保护。

Description

一种安全保护协商方法及网元
本申请要求于2017年01月24日提交中国专利局、申请号为201710060035.8、申请名称为“一种安全保护协商方法及网元”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信领域，尤其涉及一种安全保护协商方法及网元。
背景技术
目前，相比于第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)2G/3G/4G的网络架构，3GPP 5G提出了新的网络架构，并且基于5G的网络架构提出了会话建立过程。但目前标准中并没有针对5G的网络架构提出安全保护协商的技术方案，安全保护协商是指执行安全保护的双方在各安全层协商并同步安全保护的密钥和安全保护的算法，并启动安全保护的过程。
由于5G的用户面连接建立是基于会话的，2G/3G/4G提出的安全保护协商的技术方案没有基于会话的粒度，并且没有考虑业务的安全需求，因此2G/3G/4G提出的安全保护协商的技术方案也不能满足5G的网络架构。
综上所述，亟需针对5G的网络架构设计一种安全保护协商的技术方案。
发明内容
本申请实施例提供了一种安全保护协商方法及网元，用以基于5G的网络架构实现UE和UPF之间协商启动针对本次会话的用户面的安全保护。
第一方面，本申请实施例提供的一种安全保护协商方法，包括：
会话管理网元SMF确定本次会话过程中用户面所使用的安全保护信息，所述安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息，所述用户面所使用的安全保护信息用于所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行完整性保护认证成功后启动用户面的安全保护；
所述SMF接收所述UE发送的用于指示所述UE对所述第一消息认证成功的第二消息，以及向用户面网关UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于触发所述UPF根据所述安全保护的算法和所述安全保护的上下文启动用户面的安全保护。
其中，本次会话过程中用户面所使用的安全保护信息具体包括如下信息：本次会话过程中用户面所使用的加解密保护的算法、本次会话过程中用户面所使用的完整性保护的算法、用于识别本次会话过程中用户面所使用的加解密保护的上下文的索引、用于识别本次会话过程中用户面所使用的完整性保护的上下文的索引、以及消息验证码。
上述方法中，SMF确定并向UE发送本次会话过程中用户面所使用的安全保护信息，包括安全保护的算法、用于识别安全保护的上下文的索引和消息认证码等，在UE认证成功后，UE会启动用户面的安全保护，SMF确定UE认证成功后触发UPF启动用户面的安全保护，进而实现UE和UPF协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，上述方法可以实现UE和UPF协商启动各自的基于会话粒度的用户面的安全保护，因此上述方法可以满足5G的网络架构对于用户面的安全保护的需求。
在一种可能的实现方式中，所述SMF可以通过如下两种方式确定所述安全保护的算法：
方式一：所述SMF从安全策略控制网元SPCF获取所述SPCF协商确定的所述安全保护的算法；
方式二：所述SMF自行协商确定所述安全保护的算法。
上述两种方式中，所述SPCF部署在所述SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者所述SPCF独立部署于网络中。
无论上述方式一还是方式二，所述安全保护的算法都是基于所述UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
这样，通过上述两种方式中的任意一种方式可以实现SMF确定本次会话过程中用户面所使用的安全保护的算法，包括加解密保护的算法和完整性保护的算法。
在一种可能的实现方式中，所述SMF确定所述用户面所使用的安全保护信息之前，所述SMF建立本次会话。
这样，上述安全保护协商方法是发生在本次会话建立之后的。
在一种可能的实现方式中，所述SMF确定所述用户面所使用的安全保护信息之前，所述SMF接收所述UE发送的用于请求建立本次会话的会话建立请求消息；
所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的第一消息，包括：所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的会话建立完成消息。
这样，上述安全保护协商方法是发生在本次会话的建立过程中的。
在上述安全保护协商方法发生在本次会话的建立过程中的情况下，所述SMF接收所述UE发送的用于请求建立本次会话的会话建立请求消息之后，确定用户面的安全终结点为所述UPF，并通知无线接入网络RAN，所述SMF执行所述安全保护协商方法。
其中，用户面的终结点是指除UE外需要启动用户面的安全保护的网元。
需要说明的是，本申请实施例中用户面的终结点还可以是gNB，其中可以理解的是，gNB为RAN的一个网元在用户面的终结点是UPF的情况下，上述安全保护协商方法包括：SMF接收UE发送的用于请求建立本次会话的会话建立请求消息后，SMF确定用户面的终结点是gNB，SMF向RAN发送通知消息，该通知消息用于指示RAN执行UE与gNB之间的用户面的安全保护协商方法；RAN接收到该通知消息后，向SMF回复确认信息，UE与gNB执行用户面的安全保护的协商。
针对用户面的终结点是gNB的情况，UE可能在初始接入时已经通过UE和gNB之间的安全保护协商流程完成了用户面的安全保护协商。
这样，通过上述方法可以实现UE与gNB之间协商启动各自的用户面的安全保护。
在一种可能的实现方式中，所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息之后，还包括：
所述SMF接收所述UE发送的用于指示所述UE对所述第一消息认证失败的第四消息；
所述SMF根据所述第四消息的指示，确定不需要触发所述UPF启动用户面的安全保护。
这样，SMF确定UE对第一消息认证失败后，确定结束本次安全保护协商方法。
第二方面，本申请实施例提供的一种安全保护协商方法，包括：
用户设备UE接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对所述第一消息进行完整性保护生成的认证码；
所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行认证；
当所述UE对所述第一消息认证成功时，所述UE启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息。
上述方法中，UE接收SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息之后，根据本次会话过程中用户面所使用的安全保护信息对第一消息进行认证；当UE对第一消息认证成功时，UE启动用户面的安全保护，以及向SMF发送用于指示UE对所述第一消息认证成功的第二消息。进而使得SMF在接收到第二消息后，触发UPF启动用户面的安全保护。因此上述方法可以实现UE和UPF协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，上述方法可以实现UE和UPF协商启动各自的基于会话粒度的用户面的安全保护，因此上述方法可以满足5G的网络架构对于用户面的安全保护的需求。
在一种可能的实现方式中，所述UE启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息，包括：
所述UE启动用户面的加解密保护和完整性保护，然后向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息。
这样，可以实现UE在同一时机启动加解密保护和完整性保护。
在一种可能的实现方式中，所述UE启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息，包括：
所述UE启动用户面的下行解密保护和完整性保护，然后向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息，最后启动用户面的上行加密保护。
这样，可以实现UE在不同时机分别启动下行解密保护、完整性保护以及上行加密保护。
在一种可能的实现方式中，所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行认证之后，还包括：
当所述UE对所述第一消息认证失败时，所述UE确定不启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证失败的第四消息。
这样，当UE对第一消息认证失败时，本次安全保护协商方法结束。
第三方面，本申请实施例提供的一种安全保护协商方法，包括：
用户面网关UPF接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于指示所述UPF根据所述安全保护的算法和所述用于安全保护的上下文启动用户面的安全保护，所述安全保护包括加解密保护和完整性保护；
所述UPF根据所述第三消息的指示，启动用户面的安全保护。
上述方法中，UPF接收到SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息时，说明UE认证成功，UE在认证成功之后会启动用户面的安全保护。因此，UPF接收到SMF发送的上述第三消息后，需要根据该第三消息的指示启动用户面的安全保护，进而实现UE和UPF协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，上述方法可以实现UE和UPF协商启动各自的基于会话粒度的用户面的安全保护，因此上述方法可以满足5G的网络架构对于用户面的安全保护的需求。
在一种可能的实现方式中，所述UPF接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，包括：
在所述SMF确定所述UE启动用户面的安全保护之后，所述UPF接收SMF发送的所述第三消息。
这样，可以实现UPF在同一时机启动用户面的安全保护，即在SMF确定UE启动用户面的安全保护之后，UPF接收SMF发送的第三消息并启动用户面的安全保护。安全保护包括下行加密保护、完整性保护以及上行解密保护。
在一种可能的实现方式中，所述UPF接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，包括：
在所述SMF向所述UE发送本次会话过程中用户面所使用的安全保护信息之后，所述UPF接收SMF发送的第一触发消息，所述第一触发消息用于触发所述UPF启动用户面的下行加密保护和完整性保护；
在所述SMF确定所述UE启动用户面的安全保护之后，所述UPF接收SMF发送的第二触发消息，所述第二触发消息用于触发所述UPF启动用户面的上行解密保护。
这样，可以实现UPF在不同时机启动用户面的安全保护。即在SMF向UE发送本次会话过程中用户面所使用的安全保护信息之后，UPF接收SMF发送的第一触发消息并启动下行加密保护和完整性保护。在SMF确定UE启动用户面的安全保护之后，UPF接收SMF发送的第二触发消息并启动上行解密保护。
第四方面，本申请实施例提供的一种会话管理网元SMF，包括：
处理单元，用于确定本次会话过程中用户面所使用的安全保护信息，所述安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
发送单元，用于向所述UE发送包括所述处理单元确定的所述用户面所使用的安全保护信息的所述第一消息，所述用户面所使用的安全保护信息用于所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行完整性保护认证成功后启动用户面的安全保护；
接收单元，用于接收所述UE发送的用于指示所述UE对所述第一消息认证成功的第二消息；
所述发送单元，还用于向用户面网关UPF发送包括所述处理单元确定的本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于触发所述UPF根据所述安全保护的算法和所述安全保护的上下文启动用户面的安全保护。
在一种可能的实现方式中，所述处理单元确定所述安全保护的算法时，具体用于：
从安全策略控制网元SPCF获取所述SPCF协商确定的所述安全保护的算法；或者，
自行协商确定所述安全保护的算法。
在一种可能的实现方式中，所述SPCF部署在所述SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者所述SPCF独立部署于网络中。
在一种可能的实现方式中，所述安全保护的算法是基于所述UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
在一种可能的实现方式中，所述处理单元还用于：在确定所述用户面所使用的安全保护信息之前，建立本次会话；或者，
所述接收单元还用于：在所述处理单元确定所述用户面所使用的安全保护信息之前，接收所述UE发送的用于请求建立本次会话的会话建立请求消息；
所述发送单元在向所述UE发送包括所述用户面所使用的安全保护信息的第一消息时，具体用于：向所述UE发送包括所述用户面所使用的安全保护信息的会话建立完成消息。
在一种可能的实现方式中，所述处理单元还用于：在所述接收单元接收所述UE发送的用于请求建立本次会话的会话建立请求消息之后，确定用户面的安全终结点为所述UPF；
所述发送单元还用于：在所述处理单元确定用户面的安全终结点为所述UPF之后，向无线接入网络RAN发送用于指示所述SMF执行安全保护协商方法的通知消息。
在一种可能的实现方式中，所述接收单元还用于：在所述发送单元向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息之后，接收所述UE发送的用于指示所述UE对所述第一消息认证失败的第四消息；
所述处理单元还用于：根据所述接收单元接收的所述第四消息的指示，确定不需要触发所述UPF启动用户面的安全保护。
第五方面，本申请实施例提供的一种SMF，包括：处理器、存储器和收发器；
所述收发器，用于接收和发送数据；
所述存储器用于存储指令；
所述处理器用于执行所述存储器中的所述指令，执行第一方面提供的方法。
第六方面，本申请实施例中还提供了一种计算机存储介质，用于储存为上述方面中SMF所用的计算机软件指令，其包含用于执行上述方面中所设计的程序。
第七方面，本申请实施例提供的一种用户设备UE，包括：
接收单元，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的 完整性保护的密钥对所述第一消息进行完整性保护生成的认证码；
处理单元，用于根据所述接收单元接收的所述用户面所使用的安全保护信息对所述第一消息进行认证；当对所述第一消息认证成功时，启动所述UE的用户面的安全保护；
发送单元，用于当所述处理单元对所述第一消息认证成功时，向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息。
在一种可能的实现方式中，所述处理单元在启动用户面的安全保护时，具体用于：启动用户面的加解密保护和完整性保护，然后控制所述发送单元向所述SMF发送所述第二消息；或者，
所述处理单元在启动用户面的安全保护时，具体用于：启动用户面的下行解密保护和完整性保护，然后控制所述发送单元向所述SMF发送所述第二消息，最后启动用户面的上行加密保护。
在一种可能的实现方式中，所述处理单元还用于：在根据所述用户面所使用的安全保护信息对所述第一消息进行认证之后，当对所述第一消息认证失败时，确定不启动用户面的安全保护；
所述发送单元还用于：当所述处理单元对所述第一消息认证失败时，向所述SMF发送用于指示所述UE对所述第一消息认证失败的第四消息。
第八方面，本申请实施例提供的一种UE，包括：处理器、存储器和收发器；
所述收发器，用于接收和发送数据；
所述存储器用于存储指令；
所述处理器用于执行所述存储器中的所述指令，执行第二方面提供的方法。
第九方面，本申请实施例中还提供了一种计算机存储介质，用于储存为上述方面中UE所用的计算机软件指令，其包含用于执行上述方面中所设计的程序。
第十方面，本申请实施例提供的一种用户面网关UPF，包括：
接收单元，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于指示所述UPF根据所述安全保护的算法和所述用于安全保护的上下文启动用户面的安全保护，所述安全保护包括加解密保护和完整性保护；
处理单元，用于根据所述接收单元接收的所述第三消息的指示，启动用户面的安全保护。
在一种可能的实现方式中，所述接收单元接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息时，具体用于：
在所述SMF确定所述UE启动用户面的安全保护之后，接收SMF发送的所述第三消息；或者，
在所述SMF向所述UE发送本次会话过程中用户面所使用的安全保护信息之后，接收SMF发送的第一触发消息，所述第一触发消息用于触发所述UPF启动用户面的下行加密保护和完整性保护；
在所述SMF确定所述UE启动用户面的安全保护之后，接收SMF发送的第二触发消息，所述第二触发消息用于触发所述UPF启动用户面的上行解密保护。
第十一方面，本申请实施例提供的一种UPF，包括：处理器、存储器和收发器；
所述收发器，用于接收和发送数据；
所述存储器用于存储指令；
所述处理器用于执行所述存储器中的所述指令，执行第一方面提供的方法。
第十二方面，本申请实施例中还提供了一种计算机存储介质，用于储存为上述方面中UPF所用的计算机软件指令，其包含用于执行上述方面中所设计的程序。
附图说明
图1为一种5G的网络架构的示意图；
图2为基于5G的网络架构的一种会话建立过程的示意图；
图3为本申请实施例提供的一种安全保护协商方法流程示意图；
图4至图21为本申请实施例中举例说明一至举例说明十八中各个举例说明提供的一种安全保护协商方法流程示意图；
图22为本申请实施例提供的另一种安全保护协商方法流程示意图；
图23为本申请实施例中结合图3和图22提供的一种安全保护协商方法流程示意图；
图24为本申请实施例提供的一种SMF的结构示意图；
图25为本申请实施例提供的另一种SMF的结构示意图；
图26为本申请实施例提供的一种UE的结构示意图；
图27为本申请实施例提供的另一种UE的结构示意图；
图28为本申请实施例提供的一种UPF的结构示意图；
图29为本申请实施例提供的另一种UPF的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
本申请实施例提供的技术方案适用于5G的网络架构，如图1所示为一种5G的网络架构的示意图，图1中包括5G的网络架构包括的网元以及各个网元之间用于通信的接口。本申请实施例提供的技术方案适用于基于5G的网络架构的会话建立流程，如图2所示为基于5G的网络架构提出的一种会话建立过程的示意图。需要说明的是，本申请的所有实施例的技术方案也适用于基于5G的切片网络架构，针对端到端切片的基于业务的切片，考虑实现基于业务的切片的用户面安全保护协商流程，核心流程一致，只是执行网元根据5G的切片结构相对应。特别的，SMF可能部署于切片中，且UPF/SPCF等为切片内网元。
针对5G的网络架构以及基于5G的网络架构的会话建立过程，本申请实施例提供一种安全保护协商方法及网元，用以基于5G的网络架构实现用户设备(User Equipment，UE)和用户面网关(User Plane Function，UPF)之间协商启动针对本次会话的用户面的安全保护。安全保护包括加解密保护和完整性保护，加密保护是指使用加密保护的密钥和算法将明文计算成密文的过程，解密保护是加密保护的逆过程，完整性保护是指使用完整性保护的密钥和算法生成消息认证码(Message Authentication Code，MAC)的过程。用户面的安全保护协商是指，执行数据安全保护的UE和UPF在各安全层协商并同步安全保护的密钥和安全保护算法，并启动用户面的安全保护的过程。需要说明的是，本申请实施例还提供一种能够实现安全保护协商方法及网元，用以基于5G的网络架构实现UE和gNB之间协商启动针对本次会话的用户面的安全保护，gNB可理解为下一代基站(the next generation  Node Base station)。
其中，方法和网元是基于同一发明构思的，由于方法及网元解决问题的原理相似，因此网元与方法的实施可以相互参见，重复之处不再赘述。本申请实施例提供的技术方案可以发生在会话建立过程之后，也可以发生在会话建立过程中。
本申请实施例主要涉及的网元主要有UE、会话管理网元(Session Management Function，SMF)、UPF以及安全策略控制网元(Security Policy Control Function，SPCF)。
其中，UE是可以接入网络的终端设备，例如UE可以是手机、平板电脑等智能终端设备，又例如UE可以是服务器、网关、基站、控制器等通信设备，再例如UE可以是传感器、电表、水表等物联网设备。
SMF用于在为UE建立、删除或者修改会话过程中控制该过程中的相关信令。本申请实施例涉及的SMF可以位于切换内，在此情况下，一个切片内可能存在一个或多个SMF；本申请实施例涉及的SMF也可以位于切片外，即位于切换与切片之间。
UPF也可称为数据面网关，比如出口网关，用户数据通过此网元后接入到数据网络(Data Network，DN)，UPF可以是互联网或者第三方的业务服务器等。
SPCF用于安全策略的获取、协商和决策，具体的可能为安全保护算法的选择，比如，根据UE的安全能力列表和事先获取或存储的网络侧的安全算法列表，取交集排优先级选择最终使用的安全算法，包括加密算法和完整性保护算法。
下面结合说明书附图对本申请的各个实施例进行详细描述。需要说明的是，本申请实施例的展示顺序仅代表实施例的先后顺序，并不代表实施例所提供的技术方案的优劣。
实施例一
如图3所示，本申请实施例提供了一种安全保护协商方法，各个网元之间的交互流程如下：
S301、SMF确定本次会话过程中用户面所使用的安全保护信息。
S301中的安全保护信息包括但不限于安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码。其中，安全保护包括加解密保护和完整性保护；消息认证码是指SMF使用完整性保护的算法和完整性保护的算法对第一消息进行计算得到的认证码；由于安全保护的上下文包括加解密保护的上下文和完整性保护的上下文，加解密保护的上下文包括加解密保护的密钥，完整性保护的上下文包括完整性保护的密钥，因此用于识别安全保护的上下文的索引可以识别到完整性保护的密钥。
通过上述描述应理解，S301中SMF确定的本次会话过程中用户面所使用的安全保护信息具体包括如下信息：本次会话过程中用户面所使用的加解密保护的算法、本次会话过程中用户面所使用的完整性保护的算法、用于识别本次会话过程中用户面所使用的加解密保护的上下文的索引、用于识别本次会话过程中用户面所使用的完整性保护的上下文的索引、以及消息验证码。其中，用于识别本次会话过程中用户面所使用的加解密保护的上下文的索引和用于识别本次会话过程中用户面所使用的完整性保护的上下文的索引可以为同一索引，也可以是不同的索引，例如可以将本次会话的标识/切片标识作为用于识别本次会话过程中用户面所使用的加解密保护的上下文的索引和用于识别本次会话过程中用户面所使用的完整性保护的上下文的索引
S301中的安全保护信息还可以包括UE的安全能力，该UE的安全能力用于UE作安全能力认证。
本实施例中可以通过以下两种方式实现S301中SMF确定本次会话过程中用户面所使用的安全保护的算法，包括加解密保护的算法和完整性保护的算法。
方式一：SMF从SPCF获取SPCF协商确定的本次会话过程中用户面所使用的安全保护的算法。
方式一中，SPCF存储有用户面的所有原始安全保护的算法，SPCF基于用户面的原始安全保护的算法自行协商确定本次会话过程中用户面所使用的安全保护的算法；SMF从SPCF获取SPCF协商确定的本次会话过程中用户面所使用的安全保护的算法。
方式二：SMF自行协商确定本次会话过程中用户面所使用的安全保护的算法。
方式二中可以包括，SPCF存储有用户面的所有原始安全保护的算法，SMF从SPCF获取用户面的原始安全保护的算法，并基于获取的用户面的原始安全保护的算法自行协商确定本次会话过程中用户面所使用的安全保护的算法。
方式二中还可以包括，SMF已经获取了UE支持的安全保护的算法/安全能力、网络支持的安全保护的算法/安全能力，SPCF获取本次会话所属业务支持的安全保护的算法/安全能力并返回给SMF，SMF再基于前述所有安全算法自行协商确定本次会话过程中用户面所使用的安全保护的算法。
上述方式一和方式二中，网络在部署SPCF时，SPCF可以是独立部署的网元，也可以是部署在安全锚点网元(Security Anchor Function，SEAF)、认证服务网元(Authentication Server Function，AUSF)以及SMF中的任意一个网元上。其中，SEAF和AUSF都是具有安全认证功能的网元。
若SPCF部署在SEAF或者AUSF上，可将上述方式一理解为SMF从SEAF或者AUSF获取本次会话过程中用户面所使用的安全保护的算法，可将上述方式二理解为SMF从SEAF或者AUSF获取用户面的原始安全保护的算法，或者将上述方式二理解为SMF从SEAF或者AUSF获取本次会话所属业务支持的安全保护的算法/安全能力。若SPCF部署在SMF上，可将上述方式一理解为由SMF自行协商确定本次会话过程中用户面所使用的安全保护的算法，可将上述方式二理解为SMF存储有用户面的所有原始安全保护的算法，或者将上述方式二理解为SMF已经获取本次会话所属业务支持的安全保护的算法/安全能力。
无论是上述方式一还是方式二，协商确定本次会话过程中用户面所使用的安全保护的算法的方法是相同的，即基于UE支持的安全保护的算法/安全能力、网络支持的安全保护的算法/安全能力、以及本次会话所属业务支持的安全保护的算法/安全能力协商确定本次会话过程中用户面所使用的安全保护的算法。例如，确定UE支持的安全保护的算法、网络支持的安全保护的算法以及本次会话所属业务支持的安全保护的算法的之间的交集算法，并在确定的交集算法中选取优先级最高的算法作为本次会话过程中用户面所使用的安全保护的算法。
本实施例中，SMF可以在获得或者自身推衍出用户面的根密钥Kup之后发起用户面的安全保护协商过程，也可以是在生成并分发用户面的加解密的密钥和完整性保护的密钥之后发起用户面的安全保护协商过程，用户面的安全保护协商过程即是指执行本实施例提供的安全保护协商方法。需要说明的是，SMF获得或者自身推衍出用户面的根密钥Kup的方法，和基于用户面根密钥Kup生成并分发用户面的加解密的密钥和完整性保护的密钥的方法均可参见现有技术，此处不再赘述。
S302、SMF向UE发送包括本次会话过程中用户面所使用的安全保护信息的第一消息。
S302中的第一消息可以是指用户面的安全模式请求(Security Mode Command)消息。
在本实施例提供的一种安全保护协商方法发生在本次会话的建立过程之后的情况下，在执行S301之前SMF建立了本次会话。
在本实施例提供的一种安全保护协商方法发生在本次会话的建立过程中的情况下，在执行S301之前，UE向SMF发送用于请求建立本次会话的会话建立请求消息；SMF接收该会话建立请求消息后，需要判断用户面的终结点是哪个网元，用户面的终结点是指除UE外需要启动用户面的安全保护的网元；图3所示的方法中SMF确定的用户面的终结点为UPF；SMF确定用户面的终结点为UPF后，向无线接入网络(Radio Access NetWork，RAN)发送通知消息，该通知消息用于指示SMF将执行UE与UPF之间的用户面的安全保护协商方法，随后SMF执行S301。在执行S302时，SMF通过向UE发送会话建立响应消息，将本次会话过程中用户面所使用的安全保护信息发送给UE。
需要说明的是，上述过程中，SMF接收UE发送的会话建立请求消息后确定用户面的终结点也可能是gNB，此场景下用以实现UE与gNB之间用户面的安全保护协商方法将在下文中的实施例描述。
S303、UE根据本次会话过程中用户面所使用的安全保护信息对第一消息进行认证。
S303中UE对第一消息进行认证的方法包括：UE需要根据完整性保护的算法和自身推衍生成的完整性保护的密钥对第一消息进行计算得到消息验证码，UE将自己计算得到的消息验证码与接收SMF发送的消息验证码进行比较。当两个消息验证码相同时，说明第一消息没有被篡改，UE对第一消息完整性保护的认证成功；当两个消息验证码不相同时，UE确定对第一消息的完整性保护的认证失败。
在SMF向UE发送的安全保护信息还包括UE的安全能力的情况下，UE对第一消息进行完整性保护认证之前还需要进行安全能力认证，即UE将安全保护信息包括的UE的安全能力与自身存储的安全能力进行比较，两者相同即为安全能力认证成功，否则为安全能力认证失败。UE进行安全能力认证可以防止降质攻击，UE进行安全能力认证的过程可参见现有技术，此处不再赘述。
上述完整性保护认证和安全能力认证均认证成功的情况下，则认为UE对第一消息认证成功；若完整性保护认证和安全能力认证中存在一种认证失败，则认为UE对第一消息认证失败。
S304、当UE对第一消息认证成功时，UE启动用户面的安全保护。
其中，UE启动用户面的安全保护包括UE启动针对本次会话过程的用户面的加解密保护和完整性保护，加解密保护包括上行加密保护和下行解密保护。
S305、当UE对第一消息认证成功时，UE向SMF发送用于指示UE对第一消息认证成功的第二消息。
S305中的第二消息可以是指用户面的安全模式完成(Security Mode Complete)消息。第二消息可以携带消息认证码，该消息认证码是UE根据本次会话过程中用户面所使用的完整性保护的密钥和完整性保护的算法对该第二消息计算得到的认证码，该第二消息已被本次会话过程中用户面所使用的上行加密保护的密钥和上行加密保护的算法进行加密并签名。
需要说明的是，本实施例中并不限定执行S304和S305的先后顺序。
例如，在执行S304和S305时，可以是：当UE对第一消息认证成功时，UE启动用户面的加解密保护和完整性保护，然后向SMF发送用于指示UE对第一消息认证成功的第二消息，加解密保护包括上行加密保护和下行解密保护。又例如，在执行S304和S305时，可以是：UE启动用户面的下行解密保护和完整性保护，然后向SMF发送用于指示UE对第一消息认证成功的第二消息；UE发送上述第二消息后再启动用户面的上行加密保护。还例如，在执行S304和S305时，可以是：当UE对第一消息认证成功时，UE先向SMF发送用于指示UE对第一消息认证成功的第二消息，然后启动用户面的加解密保护和完整性保护。
本实施例中，在S303UE根据本次会话过程中用户面所使用的安全保护信息对第一消息进行认证之后，当UE对第一消息认证失败时，UE确定不启动用户面的安全保护，以及向SMF发送用于指示UE对第一消息认证失败的第四消息。即在UE对第一消息认证失败的情况下，图3所示的安全保护协商方法的流程结束。
S306、SMF向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，该第三消息用于触发UPF根据本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的启动用户面的安全保护。
其中，用于安全保护的上下文包括加解密保护的密钥和完整性保护的密钥。
S307、UPF根据第三消息的指示，启动用户面的安全保护。
本实施例中，UPF启动用户面的安全保护包括针对本次会话过程UPF启动用户面的加解密保护和完整性保护，加解密保护包括下行加密保护和上行解密保护。
S306中SMF可以通过一个消息触发UPF启动用户面的安全保护，在此情况下，S307中UPF可以根据SMF发送的一个消息在同一时机启动用户面的安全保护。例如，S306中，在SMF确定UE启动用户面的安全保护之后，SMF向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息；S307中，UPF根据第三消息的指示，启动下行加密保护、完整性保护和上行解密保护。
S306中SMF也可以通过多个消息触发UPF启动用户面的安全保护，这个多个消息的发送时机可以不同，在此情况下，S307中UPF可以根据SMF发送的多个消息在不同时机启动用户面的安全保护。例如，S306中，在SMF向UE发送本次会话过程中用户面所使用的安全保护信息之后，SMF向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第一触发消息，该第一触发消息用于触发UPF启动用户面的下行加密保护和完整性保护；在SMF确定UE启动用户面的安全保护之后，SMF向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第二触发消息，该第二触发消息用于触发UPF启动用户面的上行解密保护。S307中，UPF根据第一触发消息的指示启动下行加密保护和完整性保护，以及根据第二触发消息的指示启动上行解密保护。其中，第一触发消息中可以仅包括本次会话过程中用户面所使用的下行加密的算法和密钥、以及完整性保护的算法和密钥，第二触发消息中可以仅包括本次会话过程中用户面所使用的上行解密的算法和密钥。
通过图3所示的一种安全保护协商方法，可以实现UE和UPF协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，图3所示的方法可以实现UE和UPF协商启动各自的基于会话粒度的用户面的安全保护，因此图3所示的方法可以满足5G的网络架构对于用户面的安全保护的需求。
基于图3所示的一种安全保护协商方法，本实施例中对该方法进行适当扩展和变化，下面以举例说明的方式进行阐述。
举例说明一
如图4所示为本实施例提供的一种安全保护协商方法的流程示意图，图4所示的方法与图3所示的方法的主要区别在于UE启动用户面的安全保护的时机不同。在图4所示的方法中，UE在对第一消息认证成功之后，先向SMF发送用于指示UE对第一消息认证成功的第二消息，即Security Mode Complete消息，然后UE启动用户面的安全保护。图4所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明二
如图5所示为本实施例提供的一种安全保护协商方法的流程示意图，图5所示的方法与图3所示的方法的主要区别在于UPF启动用户面的安全保护的时机不同。在图5所示的方法中，SMF在不同时机触发UPF启动用户面的安全保护。具体包括：SMF在向UE发送本次会话过程中用户面所使用的安全保护信息之后，向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第一触发消息，该第一触发消息用于触发UPF启动用户面的下行加密保护和完整性保护，UPF在接收到该第一触发消息后启动用户面的下行加密保护和完整性保护；SMF在确定UE对第一消息认证成功后，向UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第二触发消息，该第二触发消息用于触发UPF启动用户面的上行解密保护，UPF在接收到该第二触发消息后启动用户面的上行解密保护。图5所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明三
如图6所示为本实施例提供的一种安全保护协商方法的流程示意图，图6所示的方法与图3所示的方法的主要区别在于UE和UPF启动用户面的安全保护的时机不同。在图6所示的方法中，UE在对第一消息认证成功之后启动用户面的下行解密保护和完整性保护，然后向SMF发送用于指示UE对第一消息认证成功的第二消息，即Security Mode Complete消息；UE在发送上述第二消息之后启动用户面的上行加密保护。UPF启动用户面的安全保护的方法参见图5所示的方法，图6所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明四
如图7所示为本实施例提供的一种安全保护协商方法的流程示意图，图6所示的方法与图3所示的方法的主要区别在于增加了SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程。
在图7所示的方法中，首先SMF触发SPCF协商确定本次会话过程中用户面所使用的安全保护的算法，包括本次会话过程中用户面所使用的加解密保护的算法和完整性保护的算法；SPCF基于UE支持的安全保护的算法/安全能力、网络支持的安全保护的算法/安全能力、以及本次会话所属业务支持的安全保护的算法/安全能力协商确定本次会话过程中用户面所使用的安全保护的算法；SPCF将协商确定的本次会话过程中用户面所使用的安全保护的算法发送给SMF。在图7所示的方法中，执行上述过程后再执行图3所示的方法，应理解SMF从SPCF获取本次会话过程中用户面所使用的安全保护的算法的过程，应属于SMF确定本次会话过程中用户面所使用的安全保护信息的过程的一部分。图7所示的方法 的其他步骤参见图3所示的方法，此处不再赘述。
需要说明的是，本实施例中可将图7所示的方法做适当的扩展和变化。例如，SMF接收SPCF发送的本次会话过程中用户面所使用的安全保护的算法之后，SMF触发UPF启动用户面的安全保护。
举例说明五
如图8所示为本实施例提供的一种安全保护协商方法的流程示意图，图8所示的方法与图3所示的方法的主要区别在于增加了SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程，以及UE启动用户面的安全保护的时机不同。图8所示的方法中增加的SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程可参见图7所示的方法中的相应部分，图8所示的方法中UE启动用户面的安全保护的时机可参见图4所示的方法中的相应部分，图8所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明六
如图9所示为本实施例提供的一种安全保护协商方法的流程示意图，图9所示的方法与图3所示的方法的主要区别在于增加了SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程，以及UPF启动用户面的安全保护的时机不同。图9所示的方法中增加的SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程可参见图7所示的方法中的相应部分，图9所示的方法中UPF启动用户面的安全保护的时机可参见图5所示的方法中的相应部分，图9所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明七
如图10所示为本实施例提供的一种安全保护协商方法的流程示意图，图10所示的方法与图3所示的方法的主要区别在于增加了SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程，以及UE和UPF分别启动用户面的安全保护的时机不同。图10所示的方法中增加的SPCF协商确定本次会话过程中用户面所使用的安全保护的算法的过程可参见图7所示的方法中的相应部分，图10所示的方法中UE启动用户面的安全保护的时机可参见图4所示的方法中的相应部分，图10所示的方法中UPF启动用户面的安全保护的时机可参见图5所示的方法中的相应部分，图10所示的方法的其他步骤参见图3所示的方法，此处不再赘述。
举例说明八
如图11所示为本实施例提供的一种安全保护协商方法的流程示意图，图11所示的方法与图10所示的方法的主要区别在于，将用户面的安全保护协商方法与信令面的安全保护协商方法相融合。
在图11所示的方法中，除用户面的安全保护协商方法之外，在信令面的安全保护协商方法中，SMF确定本次会话的信令面所使用的安全保护信息，例如密钥、算法等；SMF通过第一消息将本次会话过程中信令面所使用的安全保护信息发送给UE，UE根据本次会话过程中信令面所使用的安全保护信息对第一消息认证成功后，通过第二消息将本次会话过程中信令面所使用的安全保护信息发送给SMF。需要说明的是，信令面的安全保护协商方法可参见现有技术，图11所示的方法中用户面的安全保护协商方法参见图10所示的方法，此处不再赘述。
举例说明九
如图12所示为本实施例提供的一种安全保护协商方法的流程示意图，图12所示的方法与图7所示的方法的主要区别在于，本次会话过程中用户面的安全保护协商方法与本次会话的建立过程相融合。
在图12所示的方法中，在执行本次会话过程中用户面的安全保护协商过程之前，UE向SMF发送用于请求建立本次会话的会话建立请求消息；在执行本次会话过程中用户面的安全保护协商过程中，SMF通过会话建立响应消息将本次会话过程中用户面的安全保护信息发送给UE，SMF在确定UE对第一消息认证成功后，建立本次会话，并触发UPF启动用户面的安全保护。图12所示的方法中本次会话过程中用户面的安全保护协商方法参见图7所示的方法，此处不再赘述。
举例说明十
如图13所示为本实施例提供的一种安全保护协商方法的流程示意图，图13所示的方法与图3所示的方法的主要区别在于明确了SPCF存储有用户面的安全保护的算法，SMF从SPCF获取用户面的安全保护的算法之后，由SMF自行协商确定本次会话的用户面所使用的安全保护的算法。图13所示的方法中用户面的安全保护协商方法参见图3所示的方法，此处不再赘述。
举例说明十一
如图14所示为本实施例提供的一种安全保护协商方法的流程示意图，图14所示的方法与图3所示的方法的主要区别在于，SMF触发SEAF进行本次会话过程中用户面的安全保护协商过程，SEAF与UE之间协商本次会话过程中用户面所使用的安全保护信息，在协商之后，SEAF将协商的本次会话过程中用户面所使用的安全保护信息发送给SMF，由SMF触发UPF启动用户面的安全保护。图14所示的方法中SEAF进行用户面的安全保护协商方法参见图3所示的方法中的SMF进行用户面的安全保护协商方法，此处不再赘述。
举例说明十二
如图15所示为本实施例提供的一种安全保护协商方法的流程示意图，图15所示的方法与图14所示的方法的主要区别在于明确了SPCF存储有用户面的安全保护的算法，SEAF从SPCF获取用户面的安全保护的算法之后，由SEAF自行协商确定本次会话过程中用户面所使用的安全保护的算法。图13所示的方法中用户面的安全保护协商方法参见图14所示的方法，此处不再赘述。
举例说明十三
如图16所示为本实施例提供的一种安全保护协商方法的流程示意图，图16所示的方法与图3所示的方法的主要区别在于UPF触发SMF进行用户面的安全保护协商过程。图16所示的方法中SMF进行用户面的安全保护协商方法参见图3所示的方法，此处不再赘述。
举例说明十四
如图17所示为本实施例提供的一种安全保护协商方法的流程示意图，图17所示的方法与图15所示的方法的主要区别在于，UPF触发SMF进行用户面的安全保护协商过程，再由SMF触发SEAF进行用户面的安全保护协商过程。图17所示的方法中SEAF进行用户面的安全保护协商方法参见图15所示的方法，此处不再赘述。
举例说明十五
如图18所示为本实施例提供的一种安全保护协商方法的流程示意图，图18所示的方法与图15所示的方法的主要区别在于，SMF触发接入和移动控制网元(Access and Mobility Function，AMF)进行用户面的安全保护协商过程，AMF与UE之间协商本次会话过程中用户面所使用的安全保护信息，在协商之后，AMF将协商的本次会话过程中用户面所使用的安全保护信息发送给SMF，由SMF触发UPF启动用户面的安全保护。图18所示的方法中AMF进行用户面的安全保护协商方法参见图15所示的方法中的SMF进行用户面的安全保护协商方法，此处不再赘述。其中，AMF作为网络认证服务器(Network Authentication Server，NAS)信令的终结点，用于处理网络中的信令。
举例说明十六
如图19所示为本实施例提供的一种安全保护协商方法的流程示意图，图19所示的方法与图3所示的方法的主要区别在于，SMF触发AMF进行用户面的安全保护协商过程，再由AMF触发SEAF进行用户面的安全保护协商过程，SEAF与UE之间协商本次会话过程中用户面所使用的安全保护信息，在协商之后，SEAF将协商的本次会话过程中用户面所使用的安全保护信息通过AMF发送给SMF，由SMF触发UPF启动用户面的安全保护。图19所示的方法中SEAF进行用户面的安全保护协商方法参见图3所示的方法中的SMF进行用户面的安全保护协商方法，此处不再赘述。
举例说明十七
如图20所示为本实施例提供的一种安全保护协商方法的流程示意图，图20所示的方法与图3所示的方法的主要区别在于，SMF触发安全网关(Security Gateway，SeGW)进行用户面的安全保护协商过程，SeGW与UE之间协商本次会话过程中用户面所使用的安全保护信息，在协商之后，SeGW将协商的本次会话过程中用户面所使用的安全保护信息发送给SMF，由SMF触发UPF启动用户面的安全保护。图20所示的方法中SeGW进行用户面的安全保护协商方法参见图3所示的方法中的SMF进行用户面的安全保护协商方法，此处不再赘述。图20所示的方法中也可以是SeGW触发UPF启动用户面的安全保护。
举例说明十八
如图21所示为本实施例提供的一种安全保护协商方法的流程示意图，图21所示的方法与图3所示的方法的主要区别在于，UPF触发SMF进行用户面的安全保护协商过程，再由SMF触发SeGW进行用户面的安全保护协商过程，SeGW与UE之间协商本次会话过程中用户面所使用的安全保护信息，在协商之后，SeGW将协商的本次会话过程中用户面所使用的安全保护信息发送给SMF，由SMF触发UPF启动用户面的安全保护。图21所示的方法中SeGW进行用户面的安全保护协商方法参见图3所示的方法中的SMF进行用户面的安全保护协商方法，此处不再赘述。图21所示的方法中也可以是SeGW触发UPF启动本次会话的用户面的安全保护。
需要说明的是，本实施例中提供的针对用户面的安全保护协商方法的各种扩展和变化的实现方式可以互相结合使用，并局限于本实施例中已经展示的实现方式。
本申请实施例提供的一种安全保护协商方法中，SMF确定并向UE发送本次会话过程中用户面所使用的安全保护信息，包括安全保护的算法、用于识别安全保护的上下文的索引和消息认证码等，在UE认证成功后，触发UE和UPF分别启动各自的用户面的安全保护，安全保护包括加解密保护和完整性保护，进而实现UE和UPF协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，本申请实施例提 供的方法可以实现UE和UPF协商启动各自的基于会话粒度的用户面的安全保护，因此本申请实施例提供的方法可以满足5G的网络架构对于用户面的安全保护的需求。
需要说明的是，本实施例中可以由SMF、SEAF或者SPCF等相关网元决策针对本次会话过程中用户面的终结点，用户面的终结点是指除UE外需要启动用户面的安全保护的网元。本实施例中用户面的终结点可以是UPF或者gNB，gNB可理解为下一代基站(the next generation Node Base station)，gNB属于RAN的一个网元在用户面的终结点是UPF的情况下，用以实现UE与UPF之间协商启动用户面的安全保护的方法已经在上文中做了详尽说明，下面针对用户面的终结点是gNB的情况，详细说明用以实现UE与gNB之间协商启动用户面的安全保护的方法。
本申请实施例还提供一种安全保护协商方法，用以实现UE与gNB之间协商启动用户面的安全保护。该方法发生在会话建立过程中，该方法中各个网元之间的交互流程如图22所示，图22所示的方法与图3所示的方法的主要区别在于：SMF接收UE发送的用于请求建立本次会话的会话建立请求消息后，SMF确定用户面的终结点是gNB，SMF向RAN发送通知消息，该通知消息用于指示RAN执行UE与gNB之间的用户面的安全保护协商方法；RAN接收到该通知消息后，向SMF回复确认信息，并执行UE与gNB之间的用户面的安全保护的协商方法。针对用户面的终结点是gNB的情况，UE可能在初始接入时已经通过UE和gNB之间的安全保护协商流程完成了用户面的安全保护协商。
图22所示的方法中RAN执行UE与gNB之间的用户面的安全保护的协商方法可参见图3所示的方法SMF执行UE与UPF之间的用户面的安全保护的协商方法，但区别在于执行协商方法的网元为gNB，以及除UE外需要启动用户面的安全保护的网元是gNB。
需要说明的是，基于图22所示的一种安全保护协商方法，本实施例中对该方法可以进行适当扩展和变化，对图22所示的方法进行扩展和变化的方案可参见上文中对图3所示的方法进行扩展和变化的方案。例如可以在以下方面进行扩展和变化：UE和gNB启动用户面的安全保护的时机、协商确定本次会话过程中用户面所使用的安全保护的算法的网元(可以是SPCF、SEAF或AUSF)、触发RAN执行UE与gNB之间的用户面的安全保护协商方法的网元，等等。
通过图22所示的一种安全保护协商方法，可以实现UE和gNB协商启动各自的用户面的安全保护。考虑到5G的网络架构中用户面的连接建立是基于会话的，图22所示的方法可以实现UE和gNB协商启动各自的基于会话粒度的用户面的安全保护，因此图22所示的方法可以满足5G的网络架构对于用户面的安全保护的需求。
结合图3所示的方法和图22所述的方法，本申请实施例提供的一种安全保护协商方法如图23所示，图23所示的方法的具体内容可参见图3和图22，此处不再赘述。
实施例二
基于同一发明构思，本申请实施例还提供了一种会话管理网元SMF，该SMF可以执行实施例一提供的一种安全保护协商方法中SMF侧的方法。参阅图24所示，SMF2400包括：处理单元2401、发送单元2402以及接收单元2403。其中，
处理单元2401，用于确定本次会话过程中用户面所使用的安全保护信息，安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，安全保护包括加解密保护和完整性保护，消息认证码是指使用完整性保护的算法和索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
发送单元2402，用于向UE发送包括处理单元2401确定的用户面所使用的安全保护信息的第一消息，用户面所使用的安全保护信息用于UE根据用户面所使用的安全保护信息对第一消息进行完整性保护认证成功后启动用户面的安全保护；
接收单元2403，用于接收UE发送的用于指示UE对第一消息认证成功的第二消息；
发送单元2402，还用于向用户面网关UPF发送包括处理单元2401确定的本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，第三消息用于触发UPF根据安全保护的算法和安全保护的上下文启动用户面的安全保护。
在一种实现方式中，处理单元2401确定安全保护的算法时，具体用于：
从安全策略控制网元SPCF获取SPCF协商确定的安全保护的算法；或者，
自行协商确定安全保护的算法。
在一种实现方式中，SPCF部署在SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者SPCF独立部署于网络中。
在一种实现方式中，安全保护的算法是基于UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
在一种实现方式中，处理单元2401还用于：在确定用户面所使用的安全保护信息之前，建立本次会话；或者，
接收单元2403还用于：在处理单元2401确定用户面所使用的安全保护信息之前，接收UE发送的用于请求建立本次会话的会话建立请求消息；
发送单元2402在向UE发送包括用户面所使用的安全保护信息的第一消息时，具体用于：向UE发送包括用户面所使用的安全保护信息的会话建立完成消息。
在一种实现方式中，处理单元2401还用于：在接收单元2403接收UE发送的用于请求建立本次会话的会话建立请求消息之后，确定用户面的安全终结点为UPF；
发送单元2402还用于：在处理单元2401确定用户面的安全终结点为UPF之后，向无线接入网络RAN发送用于指示SMF执行安全保护协商方法的通知消息。
在一种实现方式中，接收单元2403还用于：在发送单元2402向UE发送包括用户面所使用的安全保护信息的第一消息之后，接收UE发送的用于指示UE对第一消息认证失败的第四消息；
处理单元2401还用于：根据接收单元2403接收的第四消息的指示，确定不需要触发UPF启动用户面的安全保护。
需要说明的是，上述各个单元的具体功能说明可参见实施例一提供的一种安全保护协商方法，此处不再赘述。本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等 各种可以存储程序代码的介质。
基于同一发明构思，本申请实施例还提供了一种SMF，该SMF可以执行实施例一提供的一种安全保护协商方法中SMF侧的方法，可以是与图24所示的SMF相同的网元。参阅图25所示，SMF2500包括：处理器2501、收发器2502以及存储器2503。其中，
处理器2501，用于读取存储器2503中的程序，执行下列过程：
处理器2501，用于确定本次会话过程中用户面所使用的安全保护信息，安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，安全保护包括加解密保护和完整性保护，消息认证码是指使用完整性保护的算法和索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
处理器2501，还用于控制收发器2502向UE发送所述用户面所使用的安全保护信息的第一消息，所述用户面所使用的安全保护信息用于UE根据用户面所使用的安全保护信息对第一消息进行完整性保护认证成功后启动用户面的安全保护；
处理器2501，还用于控制收发器2502接收UE发送的用于指示UE对第一消息认证成功的第二消息，以及控制收发器2502向用户面网关UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，第三消息用于触发UPF根据安全保护的算法和安全保护的上下文启动用户面的安全保护。
在一种实现方式中，处理器2501在确定所述安全保护的算法时，具体用于：
从安全策略控制网元SPCF获取SPCF协商确定的安全保护的算法；或者，
自行协商确定安全保护的算法。
在一种实现方式中，SPCF部署在SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者SPCF独立部署于网络中。
在一种实现方式中，安全保护的算法是基于UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
在一种实现方式中，处理器2501还用于：在确定所述用户面所使用的安全保护信息之前，建立本次会话；或者，
处理器2501还用于：在确定所述用户面所使用的安全保护信息之前，控制收发器2502接收UE发送的用于请求建立本次会话的会话建立请求消息；
处理器2501在控制收发器2502向UE发送包括用户面所使用的安全保护信息的第一消息时，具体用于：控制收发器2502向UE发送包括用户面所使用的安全保护信息的会话建立完成消息。
在一种实现方式中，处理器2501还用于：在控制收发器2502接收UE发送的用于请求建立本次会话的会话建立请求消息之后，确定用户面的安全终结点为UPF，并控制收发器2502向无线接入网络RAN发送用于指示SMF执行安全保护协商方法的通知消息。
在一种实现方式中，处理器2501还用于：在控制收发器2502向UE发送包括用户面所使用的安全保护信息的第一消息之后，控制收发器2502接收UE发送的用于指示UE对第一消息认证失败的第四消息；根据第四消息的指示，确定不需要触发UPF启动用户面的安全保护。
存储器2503可以存储处理器2501在执行操作时所使用的数据，存储器2503可以是承载SDN控制器的物理主机的内存，例如硬盘、U盘、安全数码(Secure Digital，SD)卡等等。
本实施例中还提供了一种计算机存储介质，用于储存为上述实施例的SMF所用的计算机软件指令，其包含用于执行上述实施例所设计的程序。
实施例三
基于同一发明构思，本申请实施例还提供了一种用户设备UE，该UE可以执行实施例一提供的一种安全保护协商方法中UE侧的方法。参阅图26所示，UE2600包括：接收单元2601、处理单元2602以及发送单元2603。其中，
接收单元2601，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，消息认证码是指SMF使用完整性保护的算法和索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
处理单元2602，用于根据接收单元2601接收的所述用户面所使用的安全保护信息对第一消息进行认证；当对第一消息认证成功时，启动用户面的安全保护；
发送单元2603，用于当处理单元2602对第一消息认证成功时，向SMF发送用于指示UE对第一消息认证成功的第二消息。
在一种实现方式中，处理单元2602在启动用户面的安全保护时，具体用于：启动用户面的加解密保护和完整性保护，然后控制发送单元2603向SMF发送第二消息；或者，
处理单元2602在启动用户面的安全保护时，具体用于：启动用户面的下行解密保护和完整性保护，然后控制发送单元2603向SMF发送第二消息，最后启动用户面的上行加密保护。
在一种实现方式中，处理单元2602还用于：在根据用户面所使用的安全保护信息对第一消息进行认证之后，当对第一消息认证失败时，确定不启动用户面的安全保护；
发送单元2603还用于：当处理单元2602对第一消息认证失败时，向SMF发送用于指示UE对第一消息认证失败的第四消息。
需要说明的是，上述各个单元的具体功能说明可参见实施例一提供的一种安全保护协商方法，此处不再赘述。本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
基于同一发明构思，本申请实施例还提供了一种UE，该UE可以执行实施例一提供的一种安全保护协商方法中UE侧的方法，可以是与图26所示的UE相同的设备。参阅图27所示，UE2700包括：处理器2701、收发器2702以及存储器2703。其中，
处理器2701，用于读取存储器2703中的程序，执行下列过程：
处理器2701，用于控制收发器2702接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，消息认证码是指SMF使用完整性保护的算法和索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
处理器2701，还用于根据所述用户面所使用的安全保护信息对第一消息进行认证；当对第一消息认证成功时，启动用户面的安全保护，以及控制收发器2702向SMF发送用于指示UE对第一消息认证成功的第二消息。
在一种实现方式中，处理器2701在启动用户面的安全保护，以及控制收发器2702向SMF发送用于指示UE对第一消息认证成功的第二消息时，具体用于：启动用户面的加解密保护和完整性保护，然后控制收发器2702向SMF发送第二消息；或者，
处理器2701在启动用户面的安全保护，以及控制收发器2702向SMF发送用于指示UE对第一消息认证成功的第二消息时，具体用于：启动用户面的下行解密保护和完整性保护，然后控制收发器2702向SMF发送第二消息，最后启动用户面的上行加密保护。
在一种实现方式中，处理器2701还用于：在根据用户面所使用的安全保护信息对第一消息进行认证之后，当对第一消息认证失败时，确定不启动用户面的安全保护，以及控制收发器2702向SMF发送用于指示UE对第一消息认证失败的第四消息。
存储器2703可以存储处理器2701在执行操作时所使用的数据，存储器2703可以是承载SDN控制器的物理主机的内存，例如硬盘、U盘、SD卡等等。
本实施例中还提供了一种计算机存储介质，用于储存为上述实施例的UE所用的计算机软件指令，其包含用于执行上述实施例所设计的程序。
实施例四
基于同一发明构思，本申请实施例还提供了一种用户面网关UPF，该UPF可以执行实施例一提供的一种安全保护协商方法中UPF侧的方法。参阅图28所示，UPF2800包括：接收单元2801和处理单元2802。其中，
接收单元2801，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，第三消息用于指示UPF根据安全保护的算法和用于安全保护的上下文启动用户面的安全保护，安全保护包括加解密保护和完整性保护；
处理单元2802，用于根据接收单元2801接收的第三消息的指示，启动用户面的安全保护。
在一种实现方式中，接收单元2801接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息时，具体用于：
在SMF确定UE启动用户面的安全保护之后，接收SMF发送的第三消息；或者，
在SMF向UE发送本次会话过程中用户面所使用的安全保护信息之后，接收SMF发送的第一触发消息，第一触发消息用于触发UPF启动用户面的下行加密保护和完整性保护；
在SMF确定UE启动用户面的安全保护之后，接收SMF发送的第二触发消息，第二触发消息用于触发UPF启动用户面的上行解密保护。
需要说明的是，上述各个单元的具体功能说明可参见实施例一提供的一种安全保护协商方法，此处不再赘述。本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
基于同一发明构思，本申请实施例还提供了一种UPF，该UPF可以执行实施例一提供的一种安全保护协商方法中UPF侧的方法，可以是与图28所示的UPF相同的网元。参阅图29所示，UPF2900包括：处理器2901、收发器2902以及存储器2903。其中，
处理器2901，用于读取存储器2903中的程序，执行下列过程：
处理器2901，用于控制收发器2902接收会话管理网元SMF发送的包括本次会话过程 中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，第三消息用于指示UPF根据安全保护的算法和用于安全保护的上下文启动用户面的安全保护，安全保护包括加解密保护和完整性保护；
处理器2901，还用于根据第三消息的指示，启动用户面的安全保护。
在一种实现方式中，处理器2901控制收发器2902接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息时，具体用于：
在SMF确定UE启动用户面的安全保护之后，控制收发器2902接收SMF发送的第三消息；或者，
在SMF向UE发送本次会话过程中用户面所使用的安全保护信息之后，控制收发器2902接收SMF发送的第一触发消息，第一触发消息用于触发UPF启动用户面的下行加密保护和完整性保护；
在SMF确定UE启动用户面的安全保护之后，控制收发器2902接收SMF发送的第二触发消息，第二触发消息用于触发UPF启动用户面的上行解密保护
存储器2903可以存储处理器2901在执行操作时所使用的数据，存储器2903可以是承载SDN控制器的物理主机的内存，例如硬盘、U盘、SD卡等等。
本实施例中还提供了一种计算机存储介质，用于储存为上述实施例的UPF所用的计算机软件指令，其包含用于执行上述实施例所设计的程序。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (24)

  1. 一种安全保护协商方法，其特征在于，包括：
    会话管理网元SMF确定本次会话过程中用户面所使用的安全保护信息，所述安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认证码；
    所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息，所述用户面所使用的安全保护信息用于所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行完整性保护认证成功后启动用户面的安全保护；
    所述SMF接收所述UE发送的用于指示所述UE对所述第一消息认证成功的第二消息，以及向用户面网关UPF发送包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于触发所述UPF根据所述安全保护的算法和所述安全保护的上下文启动用户面的安全保护。
  2. 如权利要求1所述的方法，其特征在于，所述SMF确定所述安全保护的算法，包括：
    所述SMF从安全策略控制网元SPCF获取所述SPCF协商确定的所述安全保护的算法；或者，
    所述SMF自行协商确定所述安全保护的算法。
  3. 如权利要求2所述的方法，其特征在于，所述SPCF部署在所述SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者所述SPCF独立部署于网络中。
  4. 如权利要求1至3任一所述的方法，其特征在于，所述安全保护的算法是基于所述UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
  5. 如权利要求1至4任一所述的方法，其特征在于，所述SMF确定所述用户面所使用的安全保护信息之前，还包括：所述SMF建立本次会话；或者，
    所述SMF确定所述用户面所使用的安全保护信息之前，还包括：所述SMF接收所述UE发送的用于请求建立本次会话的会话建立请求消息；
    所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的第一消息，包括：所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的会话建立完成消息。
  6. 如权利要求5所述的方法，其特征在于，所述SMF接收所述UE发送的用于请求建立本次会话的会话建立请求消息之后，还包括：
    所述SMF确定用户面的安全终结点为所述UPF，并通知无线接入网络RAN，所述SMF执行所述安全保护协商方法。
  7. 如权利要求1至6任一所述的方法，其特征在于，所述SMF向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息之后，还包括：
    所述SMF接收所述UE发送的用于指示所述UE对所述第一消息认证失败的第四消息；
    所述SMF根据所述第四消息的指示，确定不需要触发所述UPF启动用户面的安全保 护。
  8. 一种安全保护协商方法，其特征在于，包括：
    用户设备UE接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对所述第一消息进行完整性保护生成的认证码；
    所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行认证；
    当所述UE对所述第一消息认证成功时，所述UE启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息。
  9. 如权利要求8所述的方法，其特征在于，所述UE启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息，包括：
    所述UE启动用户面的加解密保护和完整性保护，然后向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息；或者，
    所述UE启动用户面的下行解密保护和完整性保护，然后向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息，最后启动用户面的上行加密保护。
  10. 如权利要求8所述的方法，其特征在于，所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行认证之后，还包括：
    当所述UE对所述第一消息认证失败时，所述UE确定不启动用户面的安全保护，以及向所述SMF发送用于指示所述UE对所述第一消息认证失败的第四消息。
  11. 一种安全保护协商方法，其特征在于，包括：
    用户面网关UPF接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于指示所述UPF根据所述安全保护的算法和所述用于安全保护的上下文启动用户面的安全保护，所述安全保护包括加解密保护和完整性保护；
    所述UPF根据所述第三消息的指示，启动用户面的安全保护。
  12. 如权利要求11所述的方法，其特征在于，所述UPF接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，包括：
    在所述SMF确定所述UE启动用户面的安全保护之后，所述UPF接收SMF发送的所述第三消息；或者，
    在所述SMF向所述UE发送本次会话过程中用户面所使用的安全保护信息之后，所述UPF接收SMF发送的第一触发消息，所述第一触发消息用于触发所述UPF启动用户面的下行加密保护和完整性保护；
    在所述SMF确定所述UE启动用户面的安全保护之后，所述UPF接收SMF发送的第二触发消息，所述第二触发消息用于触发所述UPF启动用户面的上行解密保护。
  13. 一种会话管理网元SMF，其特征在于，包括：
    处理单元，用于确定本次会话过程中用户面所使用的安全保护信息，所述安全保护信息包括安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对第一消息进行完整性保护生成的认 证码；
    发送单元，用于向所述UE发送包括所述处理单元确定的所述用户面所使用的安全保护信息的所述第一消息，所述用户面所使用的安全保护信息用于所述UE根据所述用户面所使用的安全保护信息对所述第一消息进行完整性保护认证成功后启动用户面的安全保护；
    接收单元，用于接收所述UE发送的用于指示所述UE对所述第一消息认证成功的第二消息；
    所述发送单元，还用于向用户面网关UPF发送包括所述处理单元确定的本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于触发所述UPF根据所述安全保护的算法和所述安全保护的上下文启动用户面的安全保护。
  14. 如权利要求13所述的SMF，其特征在于，所述处理单元确定所述安全保护的算法时，具体用于：
    从安全策略控制网元SPCF获取所述SPCF协商确定的所述安全保护的算法；或者，
    自行协商确定所述安全保护的算法。
  15. 如权利要求14所述的SMF，其特征在于，所述SPCF部署在所述SMF、安全锚点网元SEAF和认证服务网元AUSF中的任意一个网元上，或者所述SPCF独立部署于网络中。
  16. 如权利要求13至15任一所述的SMF，其特征在于，所述安全保护的算法是基于所述UE支持的安全保护的算法、网络支持的安全保护的算法和本次会话所属业务支持的安全保护的算法协商确定的。
  17. 如权利要求13至16任一所述的SMF，其特征在于，所述处理单元还用于：在确定所述用户面所使用的安全保护信息之前，建立本次会话；或者，
    所述接收单元还用于：在所述处理单元确定所述用户面所使用的安全保护信息之前，接收所述UE发送的用于请求建立本次会话的会话建立请求消息；
    所述发送单元在向所述UE发送包括所述用户面所使用的安全保护信息的第一消息时，具体用于：向所述UE发送包括所述用户面所使用的安全保护信息的会话建立完成消息。
  18. 如权利要求17所述的SMF，其特征在于，所述处理单元还用于：在所述接收单元接收所述UE发送的用于请求建立本次会话的会话建立请求消息之后，确定用户面的安全终结点为所述UPF；
    所述发送单元还用于：在所述处理单元确定用户面的安全终结点为所述UPF之后，向无线接入网络RAN发送用于指示所述SMF执行安全保护协商方法的通知消息。
  19. 如权利要求13至18任一所述的SMF，其特征在于，所述接收单元还用于：在所述发送单元向所述UE发送包括所述用户面所使用的安全保护信息的所述第一消息之后，接收所述UE发送的用于指示所述UE对所述第一消息认证失败的第四消息；
    所述处理单元还用于：根据所述接收单元接收的所述第四消息的指示，确定不需要触发所述UPF启动用户面的安全保护。
  20. 一种用户设备UE，其特征在于，包括：
    接收单元，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的 安全保护信息的第一消息，所述安全保护信息包括：安全保护的算法、用于识别安全保护的上下文的索引以及消息认证码，所述安全保护包括加解密保护和完整性保护，所述消息认证码是指所述SMF使用完整性保护的算法和所述索引识别的安全保护的上下文包括的完整性保护的密钥对所述第一消息进行完整性保护生成的认证码；
    处理单元，用于根据所述接收单元接收的所述用户面所使用的安全保护信息对所述第一消息进行认证；当对所述第一消息认证成功时，启动所述UE的用户面的安全保护；
    发送单元，用于当所述处理单元对所述第一消息认证成功时，向所述SMF发送用于指示所述UE对所述第一消息认证成功的第二消息。
  21. 如权利要求20所述的UE，其特征在于，所述处理单元在启动用户面的安全保护时，具体用于：启动用户面的加解密保护和完整性保护，然后控制所述发送单元向所述SMF发送所述第二消息；或者，
    所述处理单元在启动用户面的安全保护时，具体用于：启动用户面的下行解密保护和完整性保护，然后控制所述发送单元向所述SMF发送所述第二消息，最后启动用户面的上行加密保护。
  22. 如权利要求20所述的UE，其特征在于，所述处理单元还用于：在根据所述用户面所使用的安全保护信息对所述第一消息进行认证之后，当对所述第一消息认证失败时，确定不启动用户面的安全保护；
    所述发送单元还用于：当所述处理单元对所述第一消息认证失败时，向所述SMF发送用于指示所述UE对所述第一消息认证失败的第四消息。
  23. 一种用户面网关UPF，其特征在于，包括：
    接收单元，用于接收会话管理网元SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息，所述第三消息用于指示所述UPF根据所述安全保护的算法和所述用于安全保护的上下文启动用户面的安全保护，所述安全保护包括加解密保护和完整性保护；
    处理单元，用于根据所述接收单元接收的所述第三消息的指示，启动用户面的安全保护。
  24. 如权利要求23所述的UPF，其特征在于，所述接收单元接收SMF发送的包括本次会话过程中用户面所使用的安全保护的算法和用于安全保护的上下文的第三消息时，具体用于：
    在所述SMF确定所述UE启动用户面的安全保护之后，接收SMF发送的所述第三消息；或者，
    在所述SMF向所述UE发送本次会话过程中用户面所使用的安全保护信息之后，接收SMF发送的第一触发消息，所述第一触发消息用于触发所述UPF启动用户面的下行加密保护和完整性保护；
    在所述SMF确定所述UE启动用户面的安全保护之后，接收SMF发送的第二触发消息，所述第二触发消息用于触发所述UPF启动用户面的上行解密保护。
PCT/CN2017/097671 2017-01-24 2017-08-16 一种安全保护协商方法及网元 WO2018137334A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP17894273.6A EP3557836A4 (en) 2017-01-24 2017-08-16 METHOD FOR TREATING SECURITY PROTECTION AND NETWORK ELEMENT
JP2019536226A JP6769014B2 (ja) 2017-01-24 2017-08-16 セキュリティ保護ネゴシエーション方法およびネットワークエレメント
KR1020197022631A KR20190097278A (ko) 2017-01-24 2017-08-16 보안 보호 협상 방법 및 네트워크 엘리먼트
US16/520,369 US10856141B2 (en) 2017-01-24 2019-07-24 Security protection negotiation method and network element

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710060035.8A CN108347416B (zh) 2017-01-24 2017-01-24 一种安全保护协商方法及网元
CN201710060035.8 2017-01-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/520,369 Continuation US10856141B2 (en) 2017-01-24 2019-07-24 Security protection negotiation method and network element

Publications (1)

Publication Number Publication Date
WO2018137334A1 true WO2018137334A1 (zh) 2018-08-02

Family

ID=62962896

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/097671 WO2018137334A1 (zh) 2017-01-24 2017-08-16 一种安全保护协商方法及网元

Country Status (6)

Country Link
US (1) US10856141B2 (zh)
EP (1) EP3557836A4 (zh)
JP (1) JP6769014B2 (zh)
KR (1) KR20190097278A (zh)
CN (1) CN108347416B (zh)
WO (1) WO2018137334A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3820181A4 (en) * 2018-08-10 2021-07-21 Huawei Technologies Co., Ltd. PROCESS AND DEVICE ALLOWING SECURE CONVERSATIONS
US11330475B2 (en) 2018-12-28 2022-05-10 Samsung Electronics Co., Ltd. Method and apparatus for providing rule information in wireless communication system
US12089045B2 (en) 2019-09-16 2024-09-10 Huawei Technologies Co., Ltd. Air interface information security protection method and apparatus

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110830993B (zh) * 2018-08-10 2021-08-20 华为技术有限公司 一种数据处理的方法、装置和计算机可读存储介质
CN110831249B (zh) * 2018-08-13 2021-10-01 华为技术有限公司 通信方法和装置
CN110913389B (zh) 2018-09-15 2022-04-05 华为技术有限公司 获取安全上下文的方法和装置
CN110943964B (zh) * 2018-09-21 2022-07-22 华为技术有限公司 数据校验方法、装置及存储介质
CN111491394B (zh) * 2019-01-27 2022-06-14 华为技术有限公司 用户面安全保护的方法和装置
CN111669750B (zh) * 2019-03-07 2021-08-03 华为技术有限公司 一种pdu会话二次验证的方法及装置
CN112351431B (zh) * 2019-08-09 2023-06-30 华为技术有限公司 一种安全保护方式确定方法及装置
CN114303438B (zh) * 2019-08-22 2024-01-09 Lg电子株式会社 根据5g中的应用服务器的重定位的高效处理方法
CN112492584B (zh) * 2019-08-23 2022-07-22 华为技术有限公司 终端设备和用户面网元之间的安全通信方法、装置及系统
KR102266409B1 (ko) * 2019-10-30 2021-06-18 에스케이텔레콤 주식회사 무결성 검사의 대상이 되는 세션 관련 메시지를 생성하는 방법 및 상기 세션 관련 메시지에 대한 무결성 검사를 수행하는 방법
CN111224970A (zh) * 2019-12-31 2020-06-02 中移（杭州）信息技术有限公司 Sdn网络系统、网络攻击防御方法、设备及存储介质
CN112788594B (zh) * 2020-06-03 2023-06-27 中兴通讯股份有限公司 数据传输方法、装置和系统、电子设备、存储介质
EP4184978A4 (en) * 2020-07-30 2023-08-30 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND DEVICE
WO2022027696A1 (zh) * 2020-08-07 2022-02-10 华为技术有限公司 一种安全信息的配置方法和装置
CN114499821A (zh) * 2020-11-12 2022-05-13 华为技术有限公司 加解密系统、光模块和相关装置、系统
KR102418470B1 (ko) 2022-01-03 2022-07-08 (주)유엠로직스 연산기법을 이용한 비대면 서비스 보안정책 협상 시스템 및 그 방법
CN116939588A (zh) * 2022-03-31 2023-10-24 华为技术有限公司 通信方法及装置
CN117376900A (zh) * 2022-06-29 2024-01-09 华为技术有限公司 一种通信方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101001252A (zh) * 2006-06-25 2007-07-18 华为技术有限公司 一种注册方法和一种用户面安全算法的协商方法及装置
CN101072092A (zh) * 2006-05-11 2007-11-14 华为技术有限公司 一种实现控制面和用户面密钥同步的方法
CN101873586A (zh) * 2009-04-24 2010-10-27 华为技术有限公司 非接入层安全上下文的同步方法及相关设备
US20170013453A1 (en) * 2015-07-12 2017-01-12 Qualcomm Incorporated Network architecture and security with encrypted client device contexts

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103220674B (zh) * 2007-09-03 2015-09-09 华为技术有限公司 一种终端移动时防止降质攻击的方法、系统及装置
US8429399B2 (en) * 2007-10-02 2013-04-23 Telefonaktiebolaget Lm Ericsson (Publ) Method and arrangement for security activation detection in a telecommunication system
CN101355809B (zh) * 2008-09-12 2013-03-20 中兴通讯股份有限公司 一种协商启用安全上下文的方法和系统
CN101505479B (zh) * 2009-03-16 2014-04-30 中兴通讯股份有限公司 一种认证过程中安全上下文协商方法和系统
CN102006294B (zh) * 2010-11-25 2014-08-20 中兴通讯股份有限公司 Ims多媒体通信方法和系统、终端及ims核心网
CN102448058B (zh) * 2011-01-10 2014-04-30 华为技术有限公司 一种Un接口上的数据保护方法与装置
CN104160777B (zh) * 2013-03-13 2018-01-23 华为技术有限公司 数据的传输方法、装置和系统
US9590962B2 (en) * 2014-07-07 2017-03-07 Alcatel-Lucent Usa Inc. Using cookies to identify security contexts for connectionless service
CN104796887B (zh) 2015-04-14 2018-08-21 大唐移动通信设备有限公司 一种安全信息交互的方法和装置
US10362011B2 (en) 2015-07-12 2019-07-23 Qualcomm Incorporated Network security architecture
JP6651613B2 (ja) * 2015-10-05 2020-02-19 テレフオンアクチーボラゲット エルエム エリクソン（パブル） ワイヤレス通信
US10298549B2 (en) * 2015-12-23 2019-05-21 Qualcomm Incorporated Stateless access stratum security for cellular internet of things
JPWO2018079690A1 (ja) 2016-10-26 2019-09-19 日本電気株式会社 システム、ネットワーク装置、端末、及び方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072092A (zh) * 2006-05-11 2007-11-14 华为技术有限公司 一种实现控制面和用户面密钥同步的方法
CN101001252A (zh) * 2006-06-25 2007-07-18 华为技术有限公司 一种注册方法和一种用户面安全算法的协商方法及装置
CN101873586A (zh) * 2009-04-24 2010-10-27 华为技术有限公司 非接入层安全上下文的同步方法及相关设备
US20170013453A1 (en) * 2015-07-12 2017-01-12 Qualcomm Incorporated Network architecture and security with encrypted client device contexts

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3557836A4

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3820181A4 (en) * 2018-08-10 2021-07-21 Huawei Technologies Co., Ltd. PROCESS AND DEVICE ALLOWING SECURE CONVERSATIONS
US11778459B2 (en) 2018-08-10 2023-10-03 Huawei Technologies Co., Ltd. Secure session method and apparatus
US11330475B2 (en) 2018-12-28 2022-05-10 Samsung Electronics Co., Ltd. Method and apparatus for providing rule information in wireless communication system
US12089045B2 (en) 2019-09-16 2024-09-10 Huawei Technologies Co., Ltd. Air interface information security protection method and apparatus

Also Published As

Publication number Publication date
EP3557836A1 (en) 2019-10-23
CN108347416A (zh) 2018-07-31
US10856141B2 (en) 2020-12-01
EP3557836A4 (en) 2019-11-20
US20190349763A1 (en) 2019-11-14
JP6769014B2 (ja) 2020-10-14
JP2020505805A (ja) 2020-02-20
CN108347416B (zh) 2021-06-29
KR20190097278A (ko) 2019-08-20

Similar Documents

Publication Publication Date Title
WO2018137334A1 (zh) 一种安全保护协商方法及网元
US11659393B2 (en) Method, apparatus, and system for performing an establishment of a security context between user equipment and an access node
US11064356B2 (en) Security framework for MSG3 and MSG4 in early data transmission
KR102024653B1 (ko) 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템
US9843575B2 (en) Wireless network authentication method and wireless network authentication apparatus
KR102245688B1 (ko) 키 생성 방법, 사용자 장비, 장치, 컴퓨터 판독가능 저장 매체, 및 통신 시스템
WO2012097723A1 (zh) 数据的安全保护方法、网络侧实体和通信终端
WO2016028530A1 (en) Secure provisioning of an authentication credential
WO2016134536A1 (zh) 密钥生成方法、设备及系统
JP7237200B2 (ja) パラメータ送信方法及び装置
WO2015096138A1 (zh) 分流方法、用户设备、基站和接入点
CN110583036A (zh) 网络认证方法、网络设备及核心网设备
WO2015131379A1 (zh) 一种信息保护方法、基站、用户设备和移动管理实体
CN109756324A (zh) 一种Mesh网络中的密钥协商方法、终端及网关
CN113170369A (zh) 用于在系统间改变期间的安全上下文处理的方法和装置
WO2018126791A1 (zh) 一种认证方法及装置、计算机存储介质
CN108270560B (zh) 一种密钥传输方法及装置
CN109586913B (zh) 安全认证方法、安全认证装置、通信设备及存储介质
WO2020173451A1 (zh) 一种前向安全实现方法、装置及存储介质
CN118803748A (zh) 通信网络算法协商方法、装置、设备、介质及程序产品
EP3879867B1 (en) Method, apparatus, and system for establishing security context
WO2012097725A1 (zh) 认证方法和认证设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17894273

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019536226

Country of ref document: JP

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017894273

Country of ref document: EP

Effective date: 20190715

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20197022631

Country of ref document: KR

Kind code of ref document: A