WO2018137689A1 - 一种数据安全传输的方法及接入网、终端、核心网设备 - Google Patents

一种数据安全传输的方法及接入网、终端、核心网设备 Download PDF

Info

Publication number
WO2018137689A1
WO2018137689A1 PCT/CN2018/074201 CN2018074201W WO2018137689A1 WO 2018137689 A1 WO2018137689 A1 WO 2018137689A1 CN 2018074201 W CN2018074201 W CN 2018074201W WO 2018137689 A1 WO2018137689 A1 WO 2018137689A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
access network
terminal device
user plane
data
Prior art date
Application number
PCT/CN2018/074201
Other languages
English (en)
French (fr)
Inventor
娄崇
刘星
黄曲芳
曾清海
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018137689A1 publication Critical patent/WO2018137689A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information

Definitions

  • the present invention relates to the field of wireless communication technologies, and in particular, to a method for secure transmission of data, and an access network, a terminal, and a core network device.
  • the fifth generation mobile communication system proposes a network slice (NS) network architecture, software defined network (SDN) and network function virtualization (network) in response to differences in user requirements.
  • Function virtualization (NFV) technology is the core technology of the network slicing architecture. NFV technology implements the virtualization of the underlying physical resources and loads the virtual network function (NF) to the common platform. For example, virtual machines, SDN technology implements logical connections between virtual machines and constructs paths for carrying signaling and data flows.
  • the end-to-end service chain is configured through a dynamic connection between the radio access network (RAN) and the NF of the core network (CN) to construct a network slice.
  • RAN radio access network
  • CN core network
  • the operator can form a specific set of network functions and the network resources needed to run these network functions according to the requirements of key performance indicators (KPIs) such as capacity, coverage, rate, delay and reliability of each user. It can provide the required telecommunication service business as well as network capability services to meet specific market scenarios and needs.
  • KPIs key performance indicators
  • the third generation partnership project (3GPP) divides the main types of 5G network slicing into the following three categories: enhanced mobile broadband (eMBB), massive Machine type communication (mMTC) and ultra-reliable and low latency services (URLLC).
  • eMBB is mainly for terminals with high demand for speed and mobility, such as mobile phones and multimedia devices.
  • mMTC is mainly for IoT devices, with large-scale, low mobility and low speed requirements
  • URLLC mainly refers to car networking.
  • Business and equipment types that have stringent requirements for delay and reliability, such as security information.
  • a mobile phone user can access an eMBB type network slice for high-speed download or watch 4K high-definition video, and the sensor device can access the mMTC network slice for small data packet transmission and system configuration update. Users can simultaneously access one or more or all network slices to meet business needs and achieve a better user experience.
  • the 3GPP discussion on the network architecture of network slicing mainly focuses on network slice selection.
  • the purpose of network slice selection is to select a suitable network slice for user equipment (UE) and associate the UE with a specific network slice.
  • CP control plane
  • UP user plane
  • the UE In order to ensure the security of communication, the UE needs to use a secure channel in the process of communicating with the network slice.
  • the existing security mechanism is on the RAN device side.
  • the eNB maintains a primary key, and three sub-keys are derived respectively, which are applicable to all radio bearers established by the UE. The impact of other network slicing is not considered at this time. Since the security levels of different network slices are different, for the network slice with high security level, the encryption/decryption function can be moved from the RAN device side to the CN device side, thereby improving the security of communication. If the eNB maintains a master key, the NIC on the RAN side is attacked, which may cause the master key maintained by the eNB to be cracked, which may threaten the security of other network slices. Sex.
  • the embodiment of the invention provides a method for data security transmission, an access network, a terminal, and a core network device, which are used to improve the security and reliability of the data transmission process under the network structure of the network slice, and improve the compatibility of data encryption. Sex.
  • a method of secure transmission of data is provided.
  • the first access network device includes a request message sent by the terminal device, where the request message includes one or more network slice selection information, and the first access network device sends the one or more to the first core network device. a network slice selection information; the first access network device receives a response message sent by the first core network device; the first access network device wants the terminal device to send the response message, the first The access network device receives the encrypted data transmitted by the terminal device, and transmits the encrypted data to the first core network device.
  • the response message includes user plane security information configured by the first core network device for the terminal device;
  • the network device wants the terminal device to send the response message, and the first access network device sends the user plane security information to the terminal device.
  • the user plane security information includes user plane encryption/decryption location indication information, and is used for adding / Decrypting the user plane data packet of the service transmission associated with the network slice selected by the terminal device.
  • the encrypted data is the terminal device Data processed according to the user plane security information.
  • the first access network device Receiving, by the first access network device, the user plane security information sent by the first core network device, so that the first access network device can obtain related user plane security information of the service associated with the network slice, for example, whether the first access network pair is needed.
  • the user plane data packet of the service transmission is added/decrypted, and the first access network device sends the user plane security information configured by the first core network device to the terminal device to the terminal device, so that the terminal device transmits the data according to the user plane security information.
  • Time-plus/decryption which can realize the security and reliability of the data transmission process under the network structure of the network slice, and the first core network device can satisfy different user plane security information according to one or more network slice selection information.
  • the different requirements of network slicing on user plane security improve the flexibility and difference of data encryption/decryption.
  • the method further includes: the first access network device sending a handover request message to the second access network device, where the The second access network device is a device to be switched to by the terminal device; the first access network device receives a handover request acknowledgement message sent by the second access network device; The terminal device sends a handover command and buffers the encrypted data to be transmitted to the second access network device, where the encrypted data to be transmitted to the second access network device is encrypted by the first core network device.
  • the handover instruction is used to indicate that the terminal device switches from the first access network device to the second access network device; the first access network device The second access network Sending a sequence number (SN) status transmission message for indicating one or more uplink and downlink SN states in a Radio Link Control (RLC) mode; the first access network device The second access network device sends the cached encrypted data.
  • SN sequence number
  • RLC Radio Link Control
  • the data packet loss during the handover process can be resolved, and the encrypted data is forwarded by the first access network device.
  • the cached data sent by the second access network device to the terminal device can continue to be decrypted on the terminal device side, thereby ensuring the security of data transmission.
  • the second access network device communicates with the second core network device; And sending, by the access network device, the cached encrypted data to the second access network device, where: the first access network device sends the cached encrypted to the first core network device data.
  • the second access network device can solve the data loss in the handover process, and the first core network device can transmit the unencrypted data to the second core network device, so that the second core network device can use the new device applicable to the device.
  • the security mechanism performs data encryption, so that the data packet transmitted by the second access network device to the terminal device can use the security mechanism applicable to the second core network device, thereby ensuring the security of the data transmission and the smooth replacement of the security mechanism after the handover.
  • the first access network device sends the first core network device to the first core network device Before the cached encrypted data, the method further includes: the first access network device sending the SN state transmission message to the first core network device.
  • the cache encryption The subsequent data includes data to be sent by the first access network device to be sent to the terminal device, and data that has been sent to the terminal device and has not received feedback from the terminal device.
  • the security information also includes a header compression function location indication information and an integrity protection function location indication information.
  • the method further includes: the first access network device receiving the network slice management message sent by the operation and the management device, where the network slice management message includes a basic User plane security information of the network slice; the first access network device stores user plane security information of the basic network slice.
  • a method of secure transmission of data is provided.
  • the method includes: the terminal device sends a request message to the first access network device, where the request message includes one or more network slice selection information; the terminal device receives the first core sent by the first access network device User plane security information configured by the network device for the terminal device, the user plane security information includes user face encryption/decryption location indication information; the terminal device processes the data to be transmitted according to the user plane security information, and generates an encrypted Data and transmitting the encrypted data to the first access network device.
  • the terminal device uses the user plane security information configured by the first core network device sent by the first access network device to encrypt the data that needs to be transmitted to the first core network device, and improves the data transmission process under the network structure of the network slice. Safety and reliability.
  • the method further includes: receiving, by the terminal device a handover command sent by the first access network device; the terminal device establishes an RRC connection with the second access network device, and sends a handover complete message to the second access network device.
  • the terminal device sends the handover complete message to the second access network device
  • the terminal device receives the SN indication message sent by the second access network device, and is used to indicate an SN boundary value of data received or sent by the terminal device.
  • a method of secure transmission of data is provided.
  • the method includes: receiving, by the first core network device, one or more network slice selection information sent by the first access network device;
  • the first core network device configures user plane security information of the terminal device according to the one or more network slice selection information; the first core network device sends the user plane security to the first access network device information.
  • the method further includes: The first core network device receives the SN state transmission message sent by the first access network device and the buffered encrypted data to be transmitted to the second access network device.
  • a method of secure transmission of data is provided.
  • the method includes: the second access network device receives a handover request message sent by the first access network device; the second access network device sends a handover request acknowledgement message to the first access network device, and receives the The serial number SN status transmission message sent by the first access network device; the second access network device receives the encrypted data sent by the first access network device.
  • the first access network device communicates with a first core network device
  • the second access network device communicates with a second core network device
  • the second access network device receives the encrypted data sent by the first access network device
  • the second access network device receives the data sent by the second core network device.
  • the first access network device communicates with the first core network device, where The second access network device communicates with the second core network device; after the second access network device receives the encrypted data sent by the first access network device, the method further includes: the second access network device Establishing an RRC connection with the terminal device; the second access network device sends SN indication information to the terminal device, and is used to indicate an SN boundary value of data received or sent by the terminal device.
  • an access network device is provided.
  • the access network device includes: a receiver, a processor, and a transmitter, and the processor, configured to control the receiver to receive a request message sent by the terminal device; the request message includes one or more network slice selections And controlling the transmitter to send the one or more network slice selection information to the first core network device; the processor is further configured to control the receiver to receive the response sent by the first core network device
  • the message includes: user plane security information configured by the first core network device for the terminal device; the user plane security information includes user face encryption/decryption location indication information, for adding/decrypting the a user plane data packet of the service transmission associated with the network slice selected by the terminal device; the processor further configured to control the sender to send the user plane security information to the terminal device; and control the receiver receiving station Decoding the encrypted data transmitted by the terminal device, and controlling the transmitter to transmit the encrypted data to the first core network device, where the adding After the data terminal equipment user plane data processing in accordance with said security information.
  • the access network device further includes a memory
  • the processor is further configured to: after transmitting the encrypted data to the first core network device, control the sender to send a handover request message to the second access network device, where the second access
  • the network device is a device to which the terminal device is to be switched; controlling the receiver to receive a handover request acknowledgement message sent by the second access network device; controlling the sender to send a handover instruction to the terminal, and controlling the
  • the memory buffers the encrypted data to be transmitted to the second access network device, and the encrypted data to be transmitted to the second access network device is encrypted by the first core network device and transmitted to the terminal Data of the device, the switching instruction is used to indicate that the terminal device switches from the first access network device to the second access network device; and the transmitter is controlled to send to the second access network device
  • the SN status transmission message is used to indicate one or more uplink and downlink SN states in the RLC mode;
  • the second access network device communicates with the second core network device;
  • the device is specifically configured to: control the sender to send the cached encrypted data to the first core network device.
  • the processor is further configured to: control the transmitter to the first Before the core network device sends the cached encrypted data, the sender is controlled to send the SN state transmission message to the first core network device.
  • the cached The encrypted data includes data to be sent by the access network device to be sent to the terminal device and data that has been sent to the terminal device and has not received feedback from the terminal device.
  • the security information also includes a header compression function location indication information and an integrity protection function location indication information.
  • the processor And the method is further configured to: before controlling the receiver to receive the encrypted data transmitted by the terminal device, to control the receiver to receive a network slice management message sent by the management device, where the network slice management message includes a basic User plane security information of the network slice; controlling the memory to store user plane security information of the underlying network slice.
  • a terminal device is provided.
  • the terminal device includes: a receiver, a processor, and a transmitter, and the transmitter, configured to send a request message to the first access network device, where the request message includes one or more network slice selection information;
  • the receiver is configured to receive user plane security information configured by the first core network device that is sent by the first access network device, where the user plane security information includes user plane encryption/decryption location indication information;
  • the processor is configured to process the data to be transmitted according to the user plane security information, generate encrypted data, and control the transmitter to transmit the encrypted data to the first access network device.
  • the processor is further configured to: after controlling the transmitter to transmit the encrypted data to the first access network device Controlling, by the receiver, a handover instruction sent by the first access network device; establishing an RRC connection with the second access network device, and controlling the sender to send a handover to the second access network device Complete the message.
  • the processor is further configured to: control the transmitter to the second After the access network device sends the handover complete message, the receiver controls the receiver to receive the sequence number SN indication message sent by the second access network device, and is used to indicate the SN boundary value of the data received or sent by the terminal device.
  • a core network device is provided.
  • the core network device includes: a receiver, a processor, and a transmitter, and the receiver, configured to receive one or more network slice selection information sent by the first access network device; the processor, configured to The one or more network slice selection information, the user plane security information of the terminal device is configured; the sender is configured to send the user plane security information to the first access network device.
  • the processor is further configured to: after controlling the sender to send the user plane security information to the first access network device And controlling the receiver to receive the SN state transmission message sent by the first access network device and the buffered encrypted data to be transmitted to the second access network device.
  • an access network device is provided.
  • the access network device includes: a receiver, a processor, and a transmitter, and the processor, configured to control the receiver to receive a handover request message sent by the first access network device; And controlling the sender to send a handover request acknowledgement message to the first access network device, and receiving an SN state transmission message sent by the first access network device; and controlling the receiver to receive the first access network.
  • the encrypted data sent by the device is: a receiver, a processor, and a transmitter, and the processor, configured to control the receiver to receive a handover request message sent by the first access network device; And controlling the sender to send a handover request acknowledgement message to the first access network device, and receiving an SN state transmission message sent by the first access network device; and controlling the receiver to receive the first access network.
  • the first access network device communicates with the first core network device, and the access network device communicates with the second core network device;
  • the processor is specifically configured to: control the receiver to receive data sent by the second core network device.
  • the first access network device is in communication with the first core network device,
  • the network access device is in communication with the second core network device;
  • the processor is further configured to: after controlling the receiver to receive the encrypted data sent by the first access network device, establish an RRC connection with the terminal device And controlling the sender to send the SN indication information to the terminal device, to indicate an SN boundary value of data received or sent by the terminal device.
  • an access network device comprises a receiving unit, a processing unit and a transmitting unit, the receiving unit performing the steps performed by the receiver in the fifth aspect or any implementation thereof, the processing unit performing the fifth aspect or any of the above The steps performed by the processor in the implementation, the transmitting unit performing the steps performed by the transmitter in the fifth aspect or any implementation thereof.
  • a terminal device comprises a receiving unit, a processing unit and a transmitting unit, the receiving unit performing the steps performed by the receiver in the sixth aspect or any implementation thereof, the processing unit performing the sixth aspect or any implementation thereof The step performed by the processor in the above, the transmitting unit performing the steps performed by the transmitter in the sixth aspect or any implementation thereof.
  • a core network device in an eleventh aspect, includes a receiving unit, a processing unit, and a transmitting unit, the receiving unit performing the steps performed by the receiver in the seventh aspect or any implementation thereof, the processing unit performing the seventh aspect or any implementation thereof The steps performed by the processor in the manner, the transmitting unit performing the steps performed by the transmitter in the seventh aspect or any implementation thereof.
  • an access network device receiving unit, the processing unit, and the transmitting unit, the receiving unit performing the steps performed by the receiver in the eighth aspect or any implementation thereof, the processing unit performing the foregoing eighth aspect or any implementation thereof.
  • an embodiment of the present application provides an access network device, where the access network device includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to execute an instruction stored in the memory, and Controlling the transceiver for signal reception and signaling, the method by which the access network device performs the implementation of any of the first or first aspects described above when the processor executes the instructions stored in the memory.
  • the embodiment of the present application provides a terminal device, where the terminal device includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to execute the instruction stored in the memory, and control the transceiver to perform Signal reception and signal transmission, when the processor executes an instruction stored in the memory, the terminal device is configured to perform the method of any of the above-mentioned second aspect or the second aspect.
  • the embodiment of the present application provides a core network device, where the core network device includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to control, according to an instruction for executing the memory, and control the sending and receiving.
  • the apparatus performs signal reception and signal transmission, and the method used by the core network device to perform any of the possible implementations of the third aspect or the third aspect described above when the processor executes the instruction stored in the memory.
  • an embodiment of the present application provides an access network device, where the access network device includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to execute an instruction stored in the memory, and The control transceiver performs signal reception and signal transmission, and when the processor executes the memory storage instruction, the access network device is configured to perform the method of any of the above fourth aspect or the fourth aspect.
  • a seventeenth aspect a computer storage medium having program code stored thereon, the program code comprising a method for implementing the first aspect, the second aspect, the third aspect, or the fourth aspect Any possible implementation of the instructions.
  • 1 is a schematic diagram of a network slice classification
  • FIG. 2 is a schematic diagram of a system architecture according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a method for data security transmission according to an embodiment of the present invention.
  • FIG. 4 is a schematic flowchart of a terminal device handover according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart diagram of a method for data transmission according to an embodiment of the present disclosure
  • FIG. 6 is a schematic flowchart diagram of a method for data transmission according to an embodiment of the present disclosure
  • FIG. 7 is a schematic flowchart of user plane security information transmission according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a data security transmission apparatus according to an embodiment of the present invention.
  • FIG. 2 exemplarily shows a system architecture to which the embodiment of the present invention is applied.
  • the system architecture for implementing data security transmission according to the system architecture may include the network device 110 and Terminal device 120.
  • the network device 110 may include a Radio Access Network (RAN) device that communicates with the terminal device 120 and a Core Network (CN) device, and the RAN device may be an access point (ACCESS POINT) in the WLAN.
  • RAN Radio Access Network
  • CN Core Network
  • AP Base Transceiver Station
  • BTS Base Transceiver Station
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNodeB evolved Node B
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNB evolved Node B
  • eNodeB evolved Node B
  • eNodeB evolved Node B
  • a wearable device and a network device in a future 5G network or a network device in
  • the CN device may be a Mobile Management Entity (MME) in LTE, a gateway, or a Control Plan (CP) Network Function (NF) and a user plane in the 5G network.
  • User Plan, UP network functions, such as Common Control System (CCNF), Session Management (NF), and SSF.
  • Each network slice includes a RAN device and a CN device, wherein multiple network slices can share the network function of one RAN device; the CN device can include network functions shared between network slices and network functions unique to the network slice, part of The network slice can share the shared network function in the CN device.
  • Some network slices can also use the network function unique to the network slice in the CN device, such as Slice A and Slice B. The two slices share the network in the CN device.
  • Function; network slicing can also share network functions with other network slices, such as Slice C, which has the network function of the CN device alone.
  • the terminal device 120 may be a device with a wireless fidelity (WiFi) module, such as a mobile phone, a wristband, a tablet computer, a notebook computer, or a super mobile personal computer (English: Ultra- Mobile Personal Computer (UMPC), Personal Digital Assistant (PDA) device, in-vehicle device, wearable device, sensor with network access function, etc., and is not limited to communication terminals.
  • WiFi wireless fidelity
  • UMPC Ultra- Mobile Personal Computer
  • PDA Personal Digital Assistant
  • the encryption/decryption function of the network slice with high security level is moved from the RAN device side to the CN device side, and the data sent by the CN device to the terminal device 120 needs to be in the CN.
  • the device is encrypted, encrypted, and then sent to the terminal device 120 through the RAN device.
  • the terminal device 120 needs to know the encryption and decryption key and the location information of the encryption and decryption function when receiving or transmitting data.
  • the terminal device 120 initiates the user plane data packet of the service transmission to the CN device, it is necessary to determine the encryption and decryption key of the received or transmitted data to implement secure transmission of the data.
  • FIG. 3 exemplarily shows a flow of a method for data security transmission provided by an embodiment of the present invention, which can implement secure transmission of data in a 5G system, which will be described below in conjunction with FIG. 2 and FIG. A method of secure data transmission.
  • Step 301 The terminal device sends a request message to the first RAN device.
  • the request message sent to the first RAN device includes one or more network slice selection information, which is used to indicate a network slice in which the terminal device is to initiate a connection.
  • the request message may carry a non-access stratum (NAS) message, where the NAS message includes the one or more network slice selection information, so that the first RAN device, after receiving the request message, One or more network slice selection information in the request message is forwarded to the first CN device for initiating a network slice selection or Protocol Data Unit (PDU) session establishment.
  • the request message may be an RRC message, a MAC message or a physical layer message.
  • the above network slice selection information includes but is not limited to the following related information: network slice type, such as enhanced mobile broadband service (eMBB), ultra-reliable low-latency communication (URLLC), massive machine
  • the information of the network slice type is used to indicate the network slice type.
  • the network slice type may be an end-to-end network slice type, including the RAN side and the CN side, and may also be a RAN side network slice type. Or CN side network slice type.
  • the service type is related to a specific service, such as a video service, a car network service, a voice service, and the like, indicating service characteristics or specific service information.
  • Tenant information used to indicate the customer information for creating or renting the network slice, such as Tencent, State Grid, etc.
  • User group information which is used to indicate grouping information for grouping users according to certain characteristics, such as the level of the user.
  • Slice group information used to indicate grouping information grouped according to a certain feature, such as a network slice accessed by a user.
  • the network slice instance information is used to indicate the instance identifier and the feature information created for the network slice.
  • the network slice instance is assigned an identifier to indicate the network slice instance, or a network slice instance identifier may be mapped.
  • a new identifier is associated with the network slice instance, and the receiver can identify the specific network slice instance represented by the identifier.
  • a Dedicated Core Network (DCN) identifier which is used to uniquely indicate a proprietary core network, such as an IoT-specific core network.
  • the DCN identifier can be mapped to a network slice identifier by DCN.
  • the identifier can map out the network slice identifier, and the DCN identifier can also be mapped through the network slice identifier.
  • DCN
  • Step 302 The first RAN device receives the request message sent by the terminal device, and sends one or more network slice selection information to the first CN device.
  • the first RAN device may send the NAS message carried in the received request message to the first CN device by using the interface message of the first RAN device and the first CN device, so that the first RAN device sends the first message to the first CN device.
  • the CN device configures the user plane security information for the terminal device according to one or more network slice selection information in the request message.
  • Step 303 The first CN device receives one or more network slice selection information sent by the first RAN device, and configures user plane security information of the terminal device according to one or more network slice selection information.
  • the first CN device may send the network slice selection information to the network slice security related CN device.
  • the network device related to the network slice may select information according to the one or more network slices.
  • the network slice of different security levels may be configured with different user plane security information, or may be configured according to different service configurations that the network slice can be associated with.
  • the user plane security information configured for the terminal device may include at least user plane encryption/decryption location indication information, and is used by the terminal device to decrypt the received data or encrypt the transmitted data, thereby improving the security of data transmission.
  • the user plane security information may include, but is not limited to, the following related information: the encryption/decryption function location information, that is, the encryption/decryption function location anchor point, for example, located on the RAN side, on the CN side, on the RAN and the CN side, etc.
  • the encryption/decryption function location information that is, the encryption/decryption function location anchor point, for example, located on the RAN side, on the CN side, on the RAN and the CN side, etc.
  • the encryption/decryption function location anchor point for example, located on the RAN side, on the CN side, on the RAN and the CN side, etc.
  • the RAN side needs to add/decrypt the user plane data packet.
  • the RAN side may not add/decrypt the user plane data packet, if The decryption function is located on the RAN side and the CN side.
  • the RAN side also needs to encrypt/decrypt the user plane data packet.
  • the RAN side may be located in the Packet Data Convergence Protocol (PDCP) layer or in the radio resource control.
  • Protocol Radio Resource Control, RRC
  • the encryption/decryption function enables switch information, such as enabling or disabling the RAN side, the CN side, or the RAN and CN side encryption/decryption functions.
  • the encryption/decryption key for example, an encryption/decryption key to be used on the RAN side and the UE side, or an encryption/decryption key to be used on the UE side and the CN side, and the like.
  • An encryption/decryption function algorithm such as an algorithm used by the RAN side, the CN side, or the RAN and CN side encryption/decryption functions.
  • Header Compression (ROHC) function location information for example, located on the RAN side, on the CN side, on the RAN and CN side, etc. Further, if the header compression function is located on the RAN side, the RAN side needs to perform headers on the user plane data packet. Compression, if the encryption/decryption function is located on the CN side, the RAN side may not perform header compression on the user plane data packet.
  • ROHC Header Compression
  • the RAN side also needs to perform header compression on the user plane data packet; further
  • the RAN side may be located at the PDCP layer or at the RRC layer; the CN side may be located at a control plane or user plane network function for performing security functions, such as a session management network function, or a network management.
  • the header compression function enables switch information, such as turning the RAN side, the CN side, or the RAN and CN side header compression functions on or off.
  • Head compression function algorithm such as the algorithm used by the RAN side, CN side, or RAN and CN side header compression functions.
  • Head compression type such as Real-time Transport Protocol (RTP) packet header, User Datagram Protocol (UDP) packet, and Internet Protocol (IP) packet header, or compressed UDP/ IP packet header, or only compressed IP packet headers.
  • RTP Real-time Transport Protocol
  • UDP User Datagram Protocol
  • IP Internet Protocol
  • the user plane security information may also include, but is not limited to, related information: integrity protection function location information, such as located on the RAN side, on the CN side, on the RAN and CN side, etc., further, if the integrity protection function is located On the RAN side, the RAN side needs to perform integrity protection on the user plane data packet. If the integrity protection function is located on the CN side, the RAN side may not perform integrity protection on the user plane data packet. If the encryption/decryption function is located on the RAN side and CN. On the RAN side, the RAN side needs to perform integrity protection on the user plane data packet.
  • integrity protection function location information such as located on the RAN side, on the CN side, on the RAN and CN side, etc.
  • the RAN side may be located at the PDCP layer or at the RRC layer; the CN side may be located at the control plane or user plane network for the security function.
  • the integrity protection function enables switch information, such as turning the RAN side, CN side, or RAN and CN side integrity functions on or off.
  • Integrity protection function algorithm information such as the algorithm used by the RAN side, CN side, or RAN and CN side integrity protection functions.
  • the key update function information for example, an algorithm used by the terminal device to update the key in the handover or RRC Connection Re-establishment process.
  • the algorithm may indicate whether the UE is in the handover or RRC connection re-establishment process. Using or deriving a new key may also indicate whether the UE does not need to derive a new key during the handover or RRC connection re-establishment process.
  • Step 304 The first CN device sends user plane security information to the first RAN device.
  • the first CN device notifies the first RAN device of the user equipment security information configured by the first RAN device for the terminal device by using the interface message, where the user plane security information may enable the first RAN device to obtain user plane security information, where the user plane security information may be It is carried in the interface message explicitly or implicitly. It can be applied to the following service-related configuration information:
  • the CN side is the user plane security information corresponding to the at least one network slice selected by the UE, and is used for the user plane data of the network slice transmission; the RAN side needs the user plane security information corresponding to the at least one radio bearer established by the UE.
  • the user plane data for the radio bearer transmission the CN side is the user plane security information corresponding to the at least one PDU session established by the UE, and the user plane data for the PDU session transmission; the CN side is included in the PDU session established by the UE.
  • User plane security information corresponding to at least one flow for user plane data of the stream is the user plane security information corresponding to the at least one flow for user plane data of the stream.
  • the first RAN device can learn the network slice, the radio bearer, the PDU session, or the user plane security information of the stream included in the PDU session, for example, whether the first RAN device needs to perform encryption and/or header compression, and the like.
  • the interface message may also carry the identifier of the network slice selected by the first CN device for the terminal device, and may also carry the PDU session information established by the first CN device for the terminal device.
  • Step 305 The first RAN device receives the response message sent by the first CN device, and sends the user plane information to the terminal device.
  • the response message includes user plane security information configured by the first CN device for the terminal device, where the user plane security information includes at least user face encryption/decryption location indication information, and then the first RAN device sends the user plane security information to the terminal device,
  • the terminal device processes the data to be transmitted according to the user plane security information, and generates encrypted data, such as decrypting the received data or encrypting the transmitted data, thereby improving the security of data transmission.
  • the first CN device sends the user plane security information to the terminal device, and the air interface configuration message may be sent by using an air interface configuration message, where the air interface configuration message may be an RRC message, a MAC message, or a physical layer message, where the user plane may be carried in an explicit or implicit manner.
  • the air interface configuration message may be an RRC message, a MAC message, or a physical layer message, where the user plane may be carried in an explicit or implicit manner.
  • the security key, the user plane security key may be applicable to one or more radio bearers, one or more PDU sessions, or one or more flows included in the PDU session, or a network slice corresponding to the PDU session, the terminal device Obtaining, by the message, the radio bearer, the PDU session, or the stream included in the PDU session, or the security information of the network slice corresponding to the PDU session, for example, whether the UE side needs to perform encryption/decryption and/or header compression at the PDCP layer. .
  • Step 306 The terminal device receives the user plane security information configured by the first CN device that is sent by the first RAN device, and the terminal device can process the data to be transmitted according to the user plane security information according to the received user plane security information.
  • the encrypted data is transmitted to the first RAN device, and the data transmitted by the first RAN device can be decrypted using the user plane security information.
  • the terminal device After receiving the user plane security information configured by the first CN device sent by the first RAN device, the terminal device saves the user plane security information.
  • the terminal device initiates the user plane data packet of the service transmission, the terminal device encrypts the user plane data packet of the service transmission by using the stored user plane security information, and transmits the encrypted data to the first RAN device.
  • Step 307 The first RAN device receives the encrypted data transmitted by the terminal device, and transmits the encrypted data to the first CN device.
  • the first RAN device receives the encrypted data transmitted by the terminal device and then forwards it to the first CN device.
  • the encrypted data is configured by the terminal device using the first CN device for the terminal device.
  • the terminal device When the user plane's encryption/decryption function is moved from the RAN device side to the CN device side, if the terminal device needs to switch from the first RAN device to the second RAN device, or add the second RAN device to perform multiple connection operations, the terminal device is commonly used. Providing a network connection service, in which the first RAN device and the second RAN device are both connected to the same CN device, and if the terminal device needs to switch from the first RAN device to the second RAN device, the first RAN device needs to transmit to the second RAN device. Encrypted data.
  • the first RAN device is a source RAN node and the second RAN device is a target RAN node.
  • Step 401 The first RAN device sends a handover request message to the second RAN device.
  • the handover request message is used to instruct the second RAN device to initiate handover preparation. Further, the handover request message includes but is not limited to the following information: a handover reason, which is used to indicate the cause of the handover, such as a wireless network layer cause (a handover triggered due to a signal, a resource-based optimization, etc.).
  • the target cell identifier is used to uniquely indicate the identity of the target cell. Switching restriction list, including service PLMN, equivalent PLMN, prohibited service area, etc.
  • the temporary identifier corresponding to the terminal device is used by the CN device to search for the context of the saved terminal device.
  • the core network control function entity identifier associated with the terminal device.
  • the network slice identifier corresponding to one or more or all network slices selected by the terminal device.
  • One or more or all network slices selected by the terminal device respectively need to establish radio bearer information, such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel end point, a radio bearer corresponding user plane security information, and a specific message content.
  • radio bearer information such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel end point, a radio bearer corresponding user plane security information, and a specific message content.
  • radio bearer information such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel end point, a radio bearer corresponding user plane security information, and a specific message content.
  • the flow information that needs to be established by the one or more or all the network segments that are selected by the terminal device may refer to step 304.
  • Interface message The radio bearer information, for example, the radio bearer identifier, the QoS parameter of the radio bearer level, the tunnel end point, and the user plane security information corresponding to the radio bearer.
  • the specific message content refer to the interface message of step 304.
  • Other session information that needs to be established such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • For the specific message content refer to the interface message of step 304.
  • Other information about the flow that needs to be established such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow.
  • Context information of the terminal device for example, a network slice identifier corresponding to one or more or all network slices that the terminal device subscribes to.
  • the first RAN device may send a RAN device add request to the second RAN device, to request the second RAN device to establish a multi-connection operation, thereby allocating the radio resource to the terminal device.
  • the RAN device addition request includes but is not limited to the following information: one or more or all network slices selected by the terminal device respectively need to establish radio bearer information, such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel
  • radio bearer information such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel
  • the endpoint, the radio bearer corresponding user plane security information, the specific message content can refer to the interface message of step 304.
  • One or more or all network slices selected by the terminal device respectively need to be established, such as a session identifier, a session level QoS parameter, a tunnel endpoint, and a user plane security information corresponding to the session.
  • a session identifier For specific message content, refer to step 304.
  • Interface message The flow information that needs to be established by the one or more or all the network segments that are selected by the terminal device, such as the flow identifier, the QoS parameter of the flow level, the tunnel end point, and the user plane security information corresponding to the flow, and the specific message content may refer to step 304. Interface message.
  • Radio bearer identifier the radio bearer identifier
  • QoS parameter of the radio bearer level the tunnel end point
  • user plane security information corresponding to the radio bearer For the specific message content, refer to the interface message of step 304.
  • Other session information that needs to be established such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • For the specific message content refer to the interface message of step 304.
  • Other information about the flow that needs to be established such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow.
  • the interface message of step 304 For the specific message content, refer to the interface message of step 304.
  • the first RAN device may send a RAN device modification request to the second RAN device, to request to modify the context information of the current terminal device of the second RAN device and the radio resource allocation prepared by the second RAN device for the terminal device, thereby allocating Radio resources to terminal devices.
  • the RAN device modification request includes, but is not limited to, the following information: one or more or all network segments selected by the terminal device, respectively, radio bearer information that needs to be established, modified, and released, such as a radio bearer identifier, a radio bearer level.
  • the QoS parameters, the tunnel termination point, and the user plane security information corresponding to the radio bearer For the specific message content, refer to the interface message of step 304.
  • One or more or all network slices selected by the terminal device respectively need to establish, modify, and release session information, such as session identifier, session level QoS parameters, tunnel endpoint, user plane security information corresponding to the session, and specific message content. Reference may be made to the interface message of step 304.
  • One or more or all network slices selected by the terminal device respectively need to establish, modify, and release flow information, such as a flow identifier, a flow level QoS parameter, a tunnel termination point, a user plane security information corresponding to the flow, and a specific message content. Reference may be made to the interface message of step 304.
  • the radio bearer information that needs to be established, modified, and released such as the radio bearer identifier, the QoS parameter of the radio bearer level, the tunnel end point, and the user plane security information corresponding to the radio bearer.
  • the interface message of step 304 refers to the interface message of step 304.
  • Other session information that needs to be established, modified, and released such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • For the specific message content refer to the interface message of step 304.
  • Other information about the flow that needs to be established, modified, and released such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow.
  • the interface message of step 304 refers the interface message of step 304.
  • the first RAN device may send the RAN device modification requirement to the second RAN device, where the RRC device modification request is triggered, the modification of the primary serving cell, the PDCP SN number is about to be reversed, and the like.
  • the RAN device modification requirement includes, but is not limited to, the following information: one or more or all network slices selected by the terminal device respectively need to release radio bearer information, such as a radio bearer identifier, a radio bearer level QoS parameter, and a tunnel
  • radio bearer information such as a radio bearer identifier, a radio bearer level QoS parameter, and a tunnel
  • the endpoint, the radio bearer corresponding user plane security information, the specific message content can refer to the interface message of step 304.
  • One or more or all network segments selected by the terminal device respectively need to release the session information, such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • session information such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • step 304. Interface message One or more or all network segments selected by the terminal device respectively need to release the flow information, such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow.
  • the specific message content refer to step 304.
  • Interface message For the specific message content, refer to step 304.
  • Radio bearer identifier the radio bearer identifier
  • QoS parameter of the radio bearer level the tunnel end point
  • user plane security information corresponding to the radio bearer For the specific message content, refer to the interface message of step 304.
  • Other session information that needs to be released such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • For the specific message content refer to the interface message of step 304.
  • Other information about the flow that needs to be released such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow.
  • the interface message of step 304 For the specific message content, refer to the interface message of step 304.
  • Step 402 The second RAN device receives the handover request message sent by the first RAN device, and sends a handover request acknowledgement message to the first RAN device.
  • the second RAN device sends a handover request acknowledgement message to the first RAN device to indicate that the second RAN device has prepared resources and prepares for handover.
  • the handover request acknowledgement message includes but is not limited to the following information: an identifier of the first RAN device.
  • the transparent container of the second RAN device to the first RAN device includes a handover command of the RRC.
  • the unreceived radio bearer information corresponding to one or more or all network slices selected by the terminal device, such as a radio bearer identifier, a radio bearer level QoS parameter, a tunnel end point, a radio bearer corresponding user plane security information, a specific message
  • the content can refer to the interface message of step 304.
  • the one or more or all network segments selected by the terminal device respectively correspond to unaccepted session information, such as session identifier, session level QoS parameter, tunnel endpoint, user plane security information corresponding to the session, and specific message content may refer to steps.
  • 304 interface message The unreceived flow information corresponding to one or more or all network slices selected by the terminal device, for example, the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow, and the specific message content may refer to the step. 304 interface message.
  • the other unreceived radio bearer information such as the radio bearer identifier, the QoS parameter of the radio bearer level, the tunnel endpoint, and the user plane security information corresponding to the radio bearer.
  • the other unreceived session information such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session.
  • the other unreceived flow information such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow, may refer to the interface message of step 304 for the specific message content.
  • the second RAN device may send a RAN device add request acknowledgement to the first RAN device, to indicate that the second RAN device has prepared the resource, thereby allocating the radio resource to the terminal device.
  • the RAN device addition request acknowledgement includes but is not limited to the following information: one or more or all network slices selected by the terminal device are respectively unaccepted and accepted radio bearer information, such as a radio bearer identifier, a radio bearer level.
  • the QoS parameter, the tunnel termination point, and the user plane security information corresponding to the radio bearer For the specific message content, refer to the interface message of step 304.
  • One or more or all network slices selected by the terminal device respectively corresponding to the unaccepted and admitted session information such as session identifier, session level QoS parameters, tunnel endpoint, user plane security information corresponding to the session, specific message content Reference may be made to the interface message of step 304.
  • the flow information of the one or more or all network slices selected by the terminal device that are not accepted and accepted respectively such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, the user plane security information corresponding to the flow, and the specific message content Reference may be made to the interface message of step 304.
  • the radio bearer information that is not accepted and accepted may refer to the interface message of step 304 for the specific message content.
  • Other session information that is not accepted and accepted such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session, may be referred to the interface message of step 304.
  • Other information that is not accepted and accepted such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow, may be referred to the interface message of step 304.
  • the second RAN device may send a RAN device modification request acknowledgement to the first RAN device, in response to the modification request of the first RAN device.
  • the RAN device modification request acknowledgement includes but is not limited to the following information: one or more or all network slices selected by the terminal device respectively corresponding to the unaccepted and admitted radio bearer information, such as a radio bearer identifier, a radio bearer level The QoS parameters, the tunnel termination point, and the user plane security information corresponding to the radio bearer.
  • the interface message of step 304 refer to the interface message of step 304.
  • One or more or all network slices selected by the terminal device respectively corresponding to the unaccepted and admitted session information such as session identifier, session level QoS parameter, tunnel endpoint, user plane security information corresponding to the session, and specific message content may be Refer to the interface message of step 304.
  • the flow information of the one or more or all network segments selected by the terminal device that are not accepted and accepted respectively, such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, the user plane security information corresponding to the flow, and the specific message content may be Refer to the interface message of step 304.
  • the radio bearer information that is not accepted and accepted may refer to the interface message of step 304 for the specific message content.
  • Other session information that is not accepted and accepted such as the session identifier, the QoS parameter of the session level, the tunnel endpoint, and the user plane security information corresponding to the session, may be referred to the interface message of step 304.
  • Other information that is not accepted and accepted such as the flow identifier, the QoS parameter of the flow level, the tunnel endpoint, and the user plane security information corresponding to the flow, may refer to the interface message of step 304 for the specific message content.
  • Step 403 The first RAN device receives the handover request acknowledgement message sent by the second RAN device, sends a handover instruction to the terminal device, and buffers the encrypted data to be transmitted to the second RAN device.
  • the first RAN device After receiving the handover request acknowledgement message, the first RAN device sends a handover instruction to the terminal device for indicating the handover of the terminal device, where the handover instruction may be carried in the RRC message.
  • the RRC message may also include, but is not limited to, the following information: a target cell identifier, and a new temporary identifier of the terminal device.
  • Bearer configuration such as PDCP, Radio Link Control (RLC), Media Access Control (MAC), and physical layer configuration.
  • the first RAN device also needs to buffer the encrypted data to be transmitted to the second RAN device, and the encrypted data to be transmitted to the second RAN device may be the data to be sent to the terminal device buffered by the first RAN device and The data sent to the terminal device has not received feedback from the terminal device.
  • Step 404 The first RAN device sends a Sequence Number (SN) status transmission message to the second RAN device, and sends the buffered encrypted data to the second RAN device.
  • SN Sequence Number
  • the SN status transmission message is used to indicate an uplink PDCP SN reception status corresponding to one or more bearers, sessions, flows, and/or a downlink PDCP SN transmission status applicable in the RLC acknowledgement mode.
  • the uplink PDCP SN receiving state includes at least the SN number of the first lost Service Data Unit (SDU), and may include a received status bit map of the out-of-order uplink SDU, which is used to indicate which uplink SDUs.
  • the UE is required to retransmit at RAN Node 2.
  • the downlink PDCP SN transmission status is used to indicate the next new PDCP SN number that the RAN node 2 needs to allocate.
  • the first RAN device sends the cached encrypted data to the second RAN device, and the data packet loss during the handover process can be resolved, and the second RAN device sends the encrypted data to the UE.
  • the cached data can continue to be decrypted on the UE side, ensuring the security of data transmission.
  • Step 405 The terminal device receives the handover instruction sent by the first RAN device, establishes an RRC connection with the second RAN device, and sends a handover complete message to the second RAN device.
  • the terminal device After receiving the handover instruction, the terminal device establishes an RRC connection with the second RAN device, and then sends a handover complete message, such as an RRC connection reconfiguration complete message, to the second RAN device, indicating that the handover has been completed.
  • a handover complete message such as an RRC connection reconfiguration complete message
  • the terminal device needs to switch from the first RAN device to the second RAN device, the first RAN device and the second RAN at this time
  • the devices are all connected to different CN devices, and the first RAN device needs to transmit the encrypted data to the second RAN device.
  • the first RAN device is a source RAN node and the second RAN device is a target RAN node.
  • the handover request message may be forwarded by the first core network device, for example, the first RAN device sends the handover request message to the first core network device, and the content of the specific handover request message may refer to the handover request message of step 401, and then The first core network device sends the handover request message to the second RAN device, so that the first RAN device sends a handover request message to the second RAN device.
  • the second RAN device sends a handover request acknowledgement message to the first core network device.
  • the specific handover request acknowledgement message may refer to the handover request acknowledgement message of step 402, and then the first core network device sends the handover request acknowledgement message to the second RAN.
  • the device thereby enabling the second RAN device to send a handover request acknowledgement message to the first RAN device.
  • the first RAN device receives the handover request acknowledgement message sent by the second RAN device, sends a handover instruction to the terminal device, and buffers the encrypted data to be transmitted to the second RAN device.
  • the first RAN device sends a sequence number SN) status transmission message to the second RAN device, and sends the buffered encrypted data to the first core network, and then the first core network device sends the received data to the second RAN.
  • the device thereby enabling the first RAN device to send the buffered encrypted data to the second RAN device.
  • the specific steps of the data transmission process include:
  • Step 501 The first RAN device sends an SN state transmission message to the second RAN device.
  • the SN status transmission message is used to indicate an uplink PDCP SN reception status corresponding to one or more bearers, sessions, flows, and/or a downlink PDCP SN transmission status applicable in the RLC acknowledgement mode.
  • the uplink PDCP SN receiving state includes at least the SN number of the first lost uplink SDU, and may include a received status bit map of the out-of-order uplink SDU for indicating which uplink SDUs require the UE to retransmit at the RAN node 2.
  • the downlink PDCP SN transmission status is used to indicate the next new PDCP SN number that the RAN node 2 needs to allocate.
  • Step 502 The first RAN device sends the buffered encrypted data to the first CN device.
  • the first RAN device sends an SN status transmission message to the second CN device.
  • Step 503 The first CN device receives the encrypted data sent by the first RAN device, and decrypts the encrypted data, and sends unencrypted data to the second CN device.
  • the data is data that can be sent to the terminal device that can be buffered by the first RAN device and data that has been sent to the terminal device that has not received feedback from the terminal device.
  • Step 504 The second CN device receives unencrypted data sent by the first CN device, and sends unencrypted data to the second RAN device.
  • the data loss in the handover process can be resolved by using the first CN device and the second CN device to transmit the encrypted data buffered by the first RAN device to the second RAN device, and the unencrypted data can be transmitted by the first CN device. Giving the second CN device, so that the second CN device can perform data encryption using a new security mechanism applicable to the device, so that the data packet transmitted by the second RAN device to the UE can use the security mechanism applicable to the second CN device to ensure data The security of the transmission and the smooth replacement of the security mechanism after the handover.
  • the terminal device needs to switch from the first RAN device to the second RAN device, the first RAN device and the second RAN at this time
  • the devices are all connected to different CN devices, and the first RAN device needs to transmit the encrypted data to the second RAN device.
  • the first RAN device is a source RAN node and the second RAN device is a target RAN node.
  • Step 601 The first RAN device sends an SN state transmission message to the second RAN device.
  • the SN status transmission message is used to indicate an uplink PDCP SN reception status corresponding to one or more bearers, sessions, flows, and/or a downlink PDCP SN transmission status applicable in the RLC acknowledgement mode.
  • the uplink PDCP SN receiving state includes at least the SN number of the first lost uplink SDU, and may include a received status bit map of the out-of-order uplink SDU for indicating which uplink SDUs require the UE to retransmit at the RAN node 2.
  • the downlink PDCP SN transmission status is used to indicate the next new PDCP SN number that the RAN node 2 needs to allocate.
  • Step 602 The first RAN device sends an SN status transmission message to the first CN device.
  • the first RAN device sends the buffered encrypted data to the first CN device.
  • the data is data that can be sent to the terminal device that can be buffered for the first RAN device and data that has been sent to the terminal device that has not received feedback from the terminal device.
  • Step 603 The first CN device receives the encrypted data sent by the first RAN device, and decrypts the encrypted data, and sends unencrypted data to the second CN device.
  • Step 604 The second CN device receives unencrypted data sent by the first CN device, and sends unencrypted data to the second RAN device.
  • the data loss in the handover process can be resolved by using the first CN device and the second CN device to transmit the encrypted data buffered by the first RAN device to the second RAN device, and the unencrypted data can be transmitted by the first CN device. Giving the second CN device, so that the second CN device can perform data encryption using a new security mechanism applicable to the device, so that the data packet transmitted by the second RAN device to the UE can use the security mechanism applicable to the second CN device to ensure data The security of the transmission and the smooth replacement of the security mechanism after the handover.
  • the terminal device switches from the first RAN device to the second RAN device, if the first RAN device and the second RAN device are connected to different CN devices, in the foregoing process shown in FIG. 4, the second RAN After receiving the handover complete message sent by the terminal device, the device sends an SN indication message to the terminal device, where the SN indication message may be an RRC message, a MAC message or a physical layer message, including but not limited to the following related information: the SN boundary value, Instructing the UE which received and transmitted data packets need to use the original encryption and decryption key, and which need to use a new encryption and decryption key, for example, if the SN number of the PDCP SDU corresponding to the data packet needs to be before the SN boundary value The original encryption and decryption key is used, and the subsequent data packet needs to use the new encryption and decryption key.
  • the SN indication message may be an RRC message, a MAC message or a physical layer message, including but not limited
  • the SN indication message may also be used to notify the terminal device that the key used for encryption and decryption of the data packet has changed by adding a secret key indication in the data packet, and the channel key is needed to be used.
  • the SN indication message may also start to use the new key by sending an end-marker data packet in the form of an end-marker data packet to indicate that the encryption and decryption key saved before the UE side is invalid.
  • the first RAN device may also receive an operation and management plane (OAM) transmission.
  • OAM operation and management plane
  • the process shown in FIG. 7 includes the following steps:
  • Step 701 The OAM device sends a network slice management message to the first RAN device.
  • the network slice management message includes user plane security information of the underlying network slice.
  • the OAM may be a Slice Manager device, and/or a slice management device in the RAN domain, and/or a Network Element Management System (EMS) on the RAN side.
  • EMS Network Element Management System
  • the content that is also included in the message may be described in the user plane security information in the foregoing embodiment, and details are not described herein again.
  • the specific form of the message is not limited, and may be encoded according to specific information content. Different fields may be used to represent different user plane security information, or may be encoded by an index.
  • Step 702 The first RAN device receives the network slice management message sent by the OAM device, and sends an acknowledgement message to the OAM device.
  • the first RAN device may send an acknowledgement message to the OAM device, or may not send.
  • the acknowledgment message may include one or more of the following information combinations: an acknowledgment success message, which is used to indicate that the RAN device agrees to generate and/or modify the configuration of the network slice instance sent by the OAM device through the message 1.
  • the acknowledgement failure message is used to indicate that the RAN device rejects the network slice instance generation and/or modification configuration sent by the OAM device by using the network slice management message. Further, the message may further indicate a cause of the failure, for example, the network slice management message cannot be completed.
  • One or more configuration requirements such as the inability to complete the encryption/decryption function algorithm configuration.
  • Step 703 The first RAN device stores the user plane security information of the basic network slice.
  • the first RAN device may send the user plane security information of the network slice to the UE by using an air interface message.
  • the air interface message may be an RRC message, such as an RRC connection setup message, an RRC connection reconfiguration message, or the like.
  • the foregoing embodiment shows that the first access network device receives the request message sent by the terminal device, and the first access network device selects information from the one or more network slices of the first core network device, and the first access network device receives the request message.
  • the user plane security information includes user plane encryption/decryption location indication information, and is used for adding/decrypting the user plane data packet of the service transmission associated with the network slice selected by the terminal device, and the first access
  • the network device sends the user plane security information to the terminal device, and the first access network device receives the encrypted data transmitted by the terminal device, and transmits the encrypted data to the first core network device, where the encrypted data is the terminal device according to the The data after the user plane security information processing.
  • the first access network device Receiving, by the first access network device, the user plane security information sent by the first core network device, so that the first access network device can obtain related user plane security information of the service associated with the network slice, for example, whether the first access network pair is needed.
  • the user plane data packet of the service transmission is added/decrypted, and the first access network device sends the user plane security information configured by the first core network device to the terminal device to the terminal device, so that the terminal device transmits the data according to the user plane security information.
  • Time-plus/decryption which can realize the security and reliability of the data transmission process under the network structure of the network slice, and the first core network device can satisfy different user plane security information according to one or more network slice selection information.
  • the different requirements of network slicing on user plane security improve the flexibility and difference of data encryption/decryption.
  • the terminal device mentioned in the embodiment of the present invention may be a wireless terminal device or a wired terminal device, and the wireless terminal device may be a device that provides voice and/or other service data connectivity to the user, and has a wireless connection function.
  • the wireless terminal device can communicate with one or more core networks via a radio access network (English: Radio Access Network; RAN), and the wireless terminal device can be a mobile terminal, such as a mobile phone (or "cellular" phone).
  • a computer having a mobile terminal for example, can be a portable, pocket, handheld, computer built-in or in-vehicle mobile device that exchanges language and/or data with the wireless access network.
  • the wireless terminal device may also be referred to as a system, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, or a remote terminal. Access Terminal, User Terminal, User Agent, User Device or User Equipment.
  • the term “and/or” in the embodiment of the present invention is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A exists at the same time. And B, there are three cases of B alone.
  • the character "/" in the embodiment of the present invention generally indicates that the context related object is an "or" relationship.
  • FIG. 8 is a schematic structural diagram of a data security transmission apparatus according to an embodiment of the present invention.
  • the device is, for example, a possible structural diagram of the foregoing first access network device, second access network device, first core network device, second core network device, and terminal device.
  • the apparatus includes a processor 10, a transmitter 20, a receiver 30, a memory 40, and an antenna 50.
  • the memory 40, the transmitter 20 and the receiver 30 and the processor 10 can be connected via a bus.
  • the memory 40, the transmitter 20, and the receiver 30 and the processor 10 may not be a bus structure, but may be other structures, such as a star structure, which is not specifically limited herein.
  • the processor 10 may be a general-purpose central processing unit or an application specific integrated circuit (ASIC), and may be one or more integrated circuits for controlling program execution, and may be A hardware circuit developed using a Field Programmable Gate Array (FPGA) can be a baseband processor.
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • processor 10 may include at least one processing core.
  • the memory 40 may include one or more of a read only memory (English: Read Only Memory, ROM for short), a random access memory (English: Random Access Memory, RAM), and a disk storage.
  • Memory 40 is used to store data and/or instructions needed by processor 10 to operate.
  • the number of memories 40 may be one or more. Portions of memory 40 may be integrated with the processor or may be set independently of the processor.
  • the transmitter 20 and the receiver 30 may be physically independent of each other or integrated.
  • Transmitter 20 can transmit data via antenna 50.
  • Receiver 30 can receive data via antenna 50.
  • an embodiment of the present invention further provides a data security transmission device (shown in FIG. 8), which is used to implement any one of the foregoing methods.
  • the processor 10 is configured to control the receiver 30 to receive a request message sent by the terminal device; the request message includes one or Multi-network slice selection information; and controlling the transmitter 20 to transmit the one or more network slice selection information to the first core network device;
  • the processor 10 is further configured to control the receiver 30 to receive a response message sent by the first core network device, where the response message includes a user plane configured by the first core network device for the terminal device
  • the user plane security information includes user plane encryption/decryption location indication information, and is used for adding/decrypting the user plane data packet of the service transmission associated with the network slice selected by the terminal device;
  • the processor 10 is further configured to control the transmitter 20 to send the user plane security information to the terminal device, and control the receiver 30 to receive the encrypted data transmitted by the terminal device, and control the The transmitter 20 transmits the encrypted data to the first core network device, and the encrypted data is data processed by the terminal device according to the user plane security information.
  • the access network device further includes a memory 40;
  • the processor 10 is further configured to:
  • the transmitter 20 After transmitting the encrypted data to the first core network device, the transmitter 20 is controlled to send a handover request message to the second access network device, where the second access network device is the terminal device The device to be switched to;
  • the encrypted data is encrypted by the first core network device and transmitted to the terminal device, and the switching instruction is used to indicate that the terminal device switches from the first access network device to the second access Network equipment;
  • the transmitter 20 is controlled to send the cached encrypted data to the second access network device.
  • the second access network device communicates with the second core network device
  • the processor 10 is specifically configured to:
  • the transmitter 20 is controlled to send the cached encrypted data to the first core network device.
  • processor 10 is further configured to:
  • the cached encrypted data includes data to be sent by the access network device to be sent to the terminal device, and data that has been sent to the terminal device and has not received feedback from the terminal device.
  • the user plane security information further includes a header compression function location indication information and an integrity protection function location indication information.
  • processor 10 is further configured to:
  • the receiver 30 Before controlling the receiver 30 to receive the encrypted data transmitted by the terminal device, the receiver 30 is controlled to receive a network slice management message sent by the management device, where the network slice management message includes a basic network slice.
  • the network slice management message includes a basic network slice.
  • the memory 40 is controlled to store user plane security information of the underlying network slice.
  • the transmitter 20 is configured to send a request message to the first access network device, where the request message includes one or more network slice selection information;
  • the receiver 30 is configured to receive user plane security information configured by the first core network device that is sent by the first access network device, where the user plane security information includes a user plane encryption/decryption location indication. information;
  • the processor 10 is configured to process data to be transmitted according to the user plane security information, generate encrypted data, and control the transmitter 20 to transmit the encrypted data to the first access network device. .
  • processor 10 is further configured to:
  • controlling the transmitter 20 to transmit the encrypted data to the first access network device controlling the receiver 30 to receive a handover instruction sent by the first access network device;
  • processor 10 is further configured to:
  • the receiver 30 After controlling the transmitter 20 to send a handover complete message to the second access network device, the receiver 30 is controlled to receive the SN indication message sent by the second access network device, and is used to indicate the terminal device.
  • the receiver 30 is configured to receive one or more network slice selection information sent by the first access network device;
  • the processor 10 is configured to configure user plane security information of the terminal device according to the one or more network slice selection information.
  • the transmitter 20 is configured to send the user plane security information to the first access network device.
  • processor 10 is further configured to:
  • the receiver 30 After controlling the transmitter 20 to send the user plane security information to the first access network device, the receiver 30 is controlled to receive the SN state transmission message sent by the first access network device and the buffered to be sent. The encrypted data transmitted to the second access network device.
  • the processor 10 is configured to control the receiver 30 to receive a handover request message sent by the first access network device;
  • the processor 10 is further configured to control the transmitter 20 to send a handover request acknowledgement message to the first access network device, and receive an SN state transmission message sent by the first access network device;
  • the receiver 30 receives the encrypted data transmitted by the first access network device.
  • the first access network device communicates with the first core network device, and the access network device communicates with the second core network device;
  • the processor 10 is specifically configured to:
  • the receiver 30 is controlled to receive data transmitted by the second core network device.
  • the first access network device communicates with the first core network device, and the access network device communicates with the second core network device;
  • the processor 10 is further configured to:
  • an embodiment of the present invention further provides a data security transmission apparatus, where the data transmission apparatus includes a functional module for performing the foregoing method steps.
  • embodiments of the present application can be provided as a method, or a computer program product. Accordingly, the application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware. Moreover, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.

Abstract

一种数据安全传输的方法及接入网、终端、核心网设备，该方法包括第一接入网设备接收终端设备发送的请求消息，向第一核心网设备所述一个或多个网络切片选择信息，接收第一核心网设备发送的响应消息，向终端设备发送用户面安全信息，第一接入网设备接收终端设备传输的加密后的数据，并向第一核心网设备传输所述加密后的数据。通过第一接入网设备将第一核心网设备为终端设备配置的用户面安全信息发送给终端设备，使得终端设备依据该用户面安全信息在数据传输时加密，从而可以提高网络切片的网络架构下的数据传输过程的安全性、可靠性，由于第一核心网设备是依据一个或多网络切片选择信息配置的用户面安全信息，提高了数据加密的灵活性和安全性。

Description

一种数据安全传输的方法及接入网、终端、核心网设备
本申请要求在2017年01月26日提交中华人民共和国知识产权局、申请号为201710064248.8、发明名称为“一种数据安全传输的方法及接入网、终端、核心网设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及无线通信技术领域，特别涉及一种数据安全传输的方法及接入网、终端、核心网设备。
背景技术
第五代移动通信系统(the fifth generation，5G)为了应对用户需求的差异提出了网络切片(network slice，NS)的网络架构，软件定义网络(software defined network，SDN)与网络功能虚拟化(network function virtualization，NFV)技术是网络切片架构的核心技术，NFV技术实现底层物理资源的虚拟化，加载虚拟的网络功能(network function，NF)到通用平台。如虚拟机，SDN技术则实现虚拟机之间的逻辑连接，构建承载信令和数据流的通路。通过接入网(radio access network，RAN)以及核心网(core network，CN)的NF之间动态连接，配置端到端的业务链，从而构建网络切片。运营商可以根据各个用户对容量，覆盖，速率，时延以及可靠性等关键性能指标(key performance indicator，KPI)的需求，组成一个特定网络功能集合以及包含运行这些网络功能所需网络资源，从而可以提供所需的电信服务业务以及网络能力服务，满足特定的市场场景以及需求。
如图1所示：第三代合作伙伴计划(the third generation partnership project，3GPP)将5G的网络切片的主要类型分为了以下三大类：增强的移动宽带业务(enhanced mobile broadband，eMBB)，海量机器类型连接业务(massive machine type communication，mMTC)以及超可靠低时延业务(ultra-reliable and low latency communications，URLLC)。其中eMBB主要面向对速率以及移动性有较高需求的终端，如手机，多媒体设备等，mMTC主要针对物联网设备，具有大规模，低移动性以及较低的速率需求，而URLLC主要指车联网，安全信息等对时延和可靠性有苛刻要求的业务和设备类型。例如，手机用户可以接入eMBB类型的网络切片，进行高速下载或者观看4K高清视频，传感器设备可以接入mMTC网络切片进行小数据包的传输以及系统配置的更新。用户可以同时接入一个或者多个或者全部网络切片，满足业务需求并达成较好的用户体验。
目前3GPP关于网络切片的网络架构的讨论主要集中在网络切片选择，网络切片选择的目的是为用户设备(user equipment，UE)选择合适的网络切片，并将UE与特定的网络切片进行关联，从而与该网络切片建立对应的控制面(control plane，CP)和/或用户面(user plane，UP)的连接。
UE在与网络切片通信的过程中，为了保证通信的安全，需要使用安全通道。现有的安全机制在RAN设备侧，如eNB维护一个主秘钥，分别衍生出三个子秘钥，适用于UE建立的所有无线承载，此时并没有考虑其它网络切片的影响。由于不同的网络切片的安全性等级不同，对于安全性等级高的网络切片，可以将加/解密功能从RAN设备侧上移到CN设备侧，从而提高通信的安全性。此时若还沿用现有的安全机制，由eNB维护一个主秘钥， 则在RAN侧网元受到攻击，可能会导致eNB维护的主秘钥被破解，从而可能威胁到其他的网络切片的安全性。
发明内容
本发明实施例提供一种数据安全传输的方法及接入网、终端、核心网设备，用以提高网络切片的网络架构下的数据传输过程的安全性、可靠性，并提高了数据加密的兼容性。
第一方面，提供一种数据安全传输的方法。
包括：第一接入网设备接收终端设备发送的请求消息；所述请求消息中包括一个或多网络切片选择信息；所述第一接入网设备向第一核心网设备发送所述一个或多个网络切片选择信息；所述第一接入网设备接收所述第一核心网设备发送的响应消息；所述第一接入网设备想所述终端设备发送所述响应消息，所述第一接入网设备接收所述终端设备传输的加密后的数据，并向所述第一核心网设备传输所述加密后的数据。
结合第一方面，在第一方面的第一种可能的实现方式中，所述响应消息中包括所述第一核心网设备为所述终端设备配置的用户面安全信息；所述第一接入网设备想所述终端设备发送所述响应消息，包括：所述第一接入网设备向所述终端设备发送所述用户面安全信息。
结合第一方面或第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包。
结合第一方面或第一方面的第一种可能的实现方式或第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述加密后的数据为所述终端设备根据所述用户面安全信息处理后的数据。
通过第一接入网设备接收第一核心网设备发送的用户面安全信息，使得第一接入网设备可以获知网络切片关联的业务的相关用户面安全信息，例如是否需要第一接入网对业务传输的用户面数据包进行加/解密，第一接入网设备将第一核心网设备为终端设备配置的用户面安全信息发送给终端设备，使得终端设备依据该用户面安全信息在数据传输时加/解密，从而可以实现网络切片的网络架构下的数据传输过程的安全性、可靠性，由于第一核心网设备是依据一个或多网络切片选择信息配置的用户面安全信息，可以满足不同网络切片对用户面安全的不同需求，提高了数据加/解密的灵活性和差异性。
结合第一方面或第一方面的第一种可能的实现方式至第三种可能的实现方式中任意一种可能的实现方式，在第一方面的第四种可能的实现方式中，在所述第一接入网设备将所述加密后的数据传输至所述第一核心网设备之后，还包括：所述第一接入网设备向第二接入网设备发送切换请求消息，所述第二接入网设备为所述终端设备待切换到的设备；所述第一接入网设备接收所述第二接入网设备发送的切换请求确认消息；所述第一接入网设备向所述终端设备发送切换指令并缓存待传输至所述第二接入网设备的加密后的数据，所述待传输至所述第二接入网设备的加密后的数据为第一核心网设备加密并传输至所述终端设备的数据，所述切换指令用于指示所述终端设备从所述第一接入网设备切换到所述第二接入网设备；所述第一接入网设备向所述第二接入网设备发送序列号(Sequence Number，SN)状态传输消息，用于指示无线链路层控制协议(Radio Link Control，RLC)模式下一个或多个上下行SN状态；所述第一接入网设备向所述第二接入网设备发送所述缓存的加 密后的数据。
通过第一接入网设备向第二核心网设备发送上述缓存的加密后的数据，可以解决解决切换过程中的数据包丢失，同时由于第一接入网设备前传的是加密后的数据，使得第二接入网设备发送给终端设备的该缓存数据可以在终端设备侧继续解密，保证了数据传输的安全性。
结合第一方面或第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述第二接入网设备与第二核心网设备通信；所述第一接入网设备向所述第二接入网设备发送所述缓存的加密后的数据，包括：所述第一接入网设备向所述第一核心网设备发送所述缓存的加密后的数据。
通过使用第一接入网设备将加密后的数据向第一核心网设备发送，从而使得通过第一核心网设备和第二核心网设备将第一接入网设备缓存的加密后的数据传输给第二接入网设备，可以解决切换过程中的数据丢失，并且通过第一核心网设备可以传输未加密的数据给第二核心网设备，使得第二核心网设备可以使用该设备适用的新的安全机制进行数据加密，使得第二接入网设备传输给终端设备的数据包可以使用第二核心网设备适用的安全机制，保证了数据传输的安全性以及切换后安全机制的顺利更换。
结合第一方面或第一方面的第五种可能的实现方式，在第一方面的第六种可能的实现方式中，在所述第一接入网设备向所述第一核心网设备发送所述缓存的加密后的数据之前，还包括：所述第一接入网设备向所述第一核心网设备发送所述SN状态传输消息。
结合第一方面或第一方面的第一种可能的实现方式至第六种可能的实现方式中任一可能的实现方式，在第一方面的七种可能的实现方式中，所述缓存的加密后的数据包括所述第一接入网设备缓存的待发送给所述终端设备的数据以及已发送给所述终端设备还未接收到所述终端设备反馈的数据。
结合第一方面或第一方面的第一种可能的实现方式至第七种可能的实现方式中任一可能的实现方式，在第一方面的第八种可能的实现方式中，所述用户面安全信息还包括头压缩功能位置指示信息、完整性保护功能位置指示信息。
结合第一方面或第一方面的第一种可能的实现方式至第八种可能的实现方式中任一可能的实现方式，在第一方面的九种可能的实现方式中，在所述第一接入网设备接收所述终端设备传输的加密后的数据之前，还包括：所述第一接入网设备接收操作与管理设备发送的网络切片管理消息，所述网络切片管理消息中包括基础的网络切片的用户面安全信息；所述第一接入网设备存储所述基础的网络切片的用户面安全信息。
第二方面，提供一种数据安全传输的方法。
该方法包括：终端设备向第一接入网设备发送请求消息，所述请求消息中包括一个或多个网络切片选择信息；所述终端设备接收所述第一接入网设备发送的第一核心网设备为所述终端设备配置的用户面安全信息，所述用户面安全信息包括用户面加/解密位置指示信息；所述终端设备根据所述用户面安全信息处理待传输数据，生成加密后的数据，并向所述第一接入网设备传输所述加密后的数据。
终端设备使用第一接入网设备发送的第一核心网设备为该终端设备配置的用户面安全信息对需要向第一核心网设备传输的数据加密，提高网络切片的网络架构下的数据传输过程的安全性、可靠性。
结合第二方面，在第二方面的第一种可能的实现方式中，在所述终端设备向所述第一 接入网设备传输所述加密后的数据之后，还包括：所述终端设备接收所述第一接入网设备发送的切换指令；所述终端设备与所述第二接入网设备建立RRC连接，并向所述第二接入网设备发送切换完成消息。
结合第二方面或第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，在所述终端设备向所述第二接入网设备发送切换完成消息之后，还包括：所述终端设备接收所述第二接入网设备发送的SN指示消息，用于指示所述终端设备接收或发送的数据的SN边界值。
第三方面，提供一种数据安全传输的方法。
该方法包括：第一核心网设备接收第一接入网设备发送的一个或多个网络切片选择信息；
所述第一核心网设备根据所述一个或多个网络切片选择信息，配置终端设备的用户面安全信息；所述第一核心网设备向所述第一接入网设备发送所述用户面安全信息。
结合第三方面，在第三方面的第一种可能的实现方式中，在所述第一核心网设备向所述第一接入网设备发送所述用户面安全信息之后，还包括：所述第一核心网设备接收所述第一接入网设备发送的SN状态传输消息以及缓存的待传输至第二接入网设备的加密后的数据。
第四方面，提供一种数据安全传输的方法。
该方法包括：第二接入网设备接收第一接入网设备发送的切换请求消息；所述第二接入网设备向所述第一接入网设备发送切换请求确认消息，并接收所述第一接入网设备发送的序列号SN状态传输消息；所述第二接入网设备接收第一接入网设备发送的加密后的数据。
结合第四方面，在第四方面的第一种可能的实现方式中，所述第一接入网设备与第一核心网设备通信，所述第二接入网设备与第二核心网设备通信；所述第二接入网设备接收第一接入网设备发送的加密后的数据，包括：所述第二接入网设备接收第二核心网设备发送的数据。
结合第四方面或第四方面的第一种可能的实现方式，在第四方面的第二种可能的实现方式中，所述第一接入网设备与第一核心网设备通信，所述第二接入网设备与第二核心网设备通信；在所述第二接入网设备接收所述第一接入网设备发送的加密后的数据之后，还包括：所述第二接入网设备与所述终端设备建立RRC连接；所述第二接入网设备向所述终端设备发送SN指示信息，用于指示所述终端设备接收或发送的数据的SN边界值。
第五方面，提供一种接入网设备。
所述接入网设备包括：接收器、处理器和发送器，以及所述处理器，用于控制所述接收器接收终端设备发送的请求消息；所述请求消息中包括一个或多网络切片选择信息；以及控制所述发送器向第一核心网设备发送所述一个或多个网络切片选择信息；所述处理器，还用于控制所述接收器接收所述第一核心网设备发送的响应消息；所述响应消息中包括所述第一核心网设备为所述终端设备配置的用户面安全信息；所述用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包；所述处理器，还用于控制所述发送器向所述终端设备发送所述用户面安全信息；以及控制所述接收器接收所述终端设备传输的加密后的数据，并控制所述发送器向所述第一核心网设备传输所述加密后的数据，所述加密后的数据为所述终端设备根据所 述用户面安全信息处理后的数据。
结合第五方面，在第五方面的第一种可能的实现方式中，所述接入网设备还包括存储器；
所述处理器还用于：在将所述加密后的数据传输至所述第一核心网设备之后，控制所述发送器向第二接入网设备发送切换请求消息，所述第二接入网设备为所述终端设备待切换到的设备；控制所述接收器接收所述第二接入网设备发送的切换请求确认消息；控制所述发送器向所述终端发送切换指令并控制所述存储器缓存待传输至所述第二接入网设备的加密后的数据，所述待传输至所述第二接入网设备的加密后的数据为第一核心网设备加密并传输至所述终端设备的数据，所述切换指令用于指示所述终端设备从所述第一接入网设备切换到所述第二接入网设备；控制所述发送器向所述第二接入网设备发送SN状态传输消息，用于指示RLC模式下一个或多个上下行SN状态；
控制所述发送器向所述第二接入网设备发送所述缓存的加密后的数据。
结合第五方面或第五方面的第一种可能的实现方式，在第五方面的第二种可能的实现方式中，所述第二接入网设备与第二核心网设备通信；所述处理器具体用于：控制所述发送器向所述第一核心网设备发送所述缓存的加密后的数据。
结合第五方面或第五方面的第二种可能的实现方式，在第五方面的第三种可能的实现方式中，所述处理器还用于：在控制所述发送器向所述第一核心网设备发送所述缓存的加密后的数据之前，控制所述发送器向所述第一核心网设备发送所述SN状态传输消息。
结合第五方面或第五方面的第一种可能的实现方式至第三种可能的实现方式中任一可能的实现方式，在第五方面的第四种可能的实现方式中，所述缓存的加密后的数据包括所述接入网设备缓存的待发送给所述终端设备的数据以及已发送给所述终端设备还未接收到所述终端设备反馈的数据。
结合第五方面或第五方面的第一种可能的实现方式至第四种可能的实现方式中任一可能的实现方式，在第五方面的第五种可能的实现方式中，所述用户面安全信息还包括头压缩功能位置指示信息、完整性保护功能位置指示信息。
结合第五方面或第五方面的第一种可能的实现方式至第五种可能的实现方式中任一可能的实现方式，在第五方面的第六种可能的实现方式中，所述处理器还用于：在控制所述接收器接收所述终端设备传输的加密后的数据之前，控制所述接收器接收操作与管理设备发送的网络切片管理消息，所述网络切片管理消息中包括基础的网络切片的用户面安全信息；控制所述存储器存储所述基础的网络切片的用户面安全信息。
第六方面，提供一种终端设备。
所述终端设备包括：接收器、处理器和发送器，以及所述发送器，用于向第一接入网设备发送请求消息，所述请求消息中包括一个或多个网络切片选择信息；所述接收器，用于接收所述第一接入网设备发送的第一核心网设备为所述终端设备配置的用户面安全信息，所述用户面安全信息包括用户面加/解密位置指示信息；所述处理器，用于根据所述用户面安全信息处理待传输的数据，生成加密后的数据，并控制所述发送器向所述第一接入网设备传输所述加密后的数据。
结合第六方面，在第六方面的第一种可能的实现方式中，所述处理器还用于：在控制所述发送器向所述第一接入网设备传输所述加密后的数据之后，控制所述接收器接收所述第一接入网设备发送的切换指令；与所述第二接入网设备建立RRC连接，并控制所述发 送器向所述第二接入网设备发送切换完成消息。
结合第六方面或第六方面的第一种可能的实现方式，在第六方面的第二种可能的实现方式中，所述处理器还用于：在控制所述发送器向所述第二接入网设备发送切换完成消息之后，控制所述接收器接收所述第二接入网设备发送的序列号SN指示消息，用于指示所述终端设备接收或发送的数据的SN边界值。
第七方面，提供一种核心网设备。
所述核心网设备包括：接收器、处理器和发送器，以及所述接收器，用于接收第一接入网设备发送的一个或多个网络切片选择信息；所述处理器，用于根据所述一个或多个网络切片选择信息，配置终端设备的用户面安全信息；所述发送器，用于向所述第一接入网设备发送所述用户面安全信息。
结合第七方面，在第七方面的第一种可能的实现方式中，所述处理器还用于：在控制所述发送器向所述第一接入网设备发送所述用户面安全信息之后，控制所述接收器接收所述第一接入网设备发送的SN状态传输消息以及缓存的待传输至第二接入网设备的加密后的数据。
第八方面，提供一种接入网设备。
所述接入网设备包括：接收器、处理器和发送器，以及所述处理器，用于控制所述接收器接收第一接入网设备发送的切换请求消息；所述处理器，还用于控制所述发送器向所述第一接入网设备发送切换请求确认消息，并接收所述第一接入网设备发送的SN状态传输消息；以及控制所述接收器接收第一接入网设备发送的加密后的数据。
结合第八方面，在第八方面的第一种可能的实现方式中，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；所述处理器具体用于：控制所述接收器接收第二核心网设备发送的数据。
结合第八方面或第八方面的第一种可能的实现方式，在第八方面的第二种可能的实现方式中，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；所述处理器还用于：在控制所述接收器接收所述第一接入网设备发送的加密后的数据之后，与所述终端设备建立RRC连接；控制所述发送器向所述终端设备发送SN指示信息，用于指示所述终端设备接收或发送的数据的SN边界值。
第九方面，提供一种接入网设备。该接入网设备包括接收单元、处理单元和发送单元，所述接收单元执行上述第五方面或其任意实现方式中的接收器所执行的步骤，所述处理单元执行上述第五方面或其任意实现方式中的处理器所执行的步骤，所述发送单元执行上述第五方面或其任意实现方式中的发送器所执行的步骤。
第十方面，提供一种终端设备。该终端设备包括接收单元、处理单元和发送单元，所述接收单元执行上述第六方面或其任意实现方式中的接收器所执行的步骤，所述处理单元执行上述第六方面或其任意实现方式中的处理器所执行的步骤，所述发送单元执行上述第六方面或其任意实现方式中的发送器所执行的步骤。
第十一方面，提供一种核心网设备。该核心网设备包括接收单元、处理单元和发送单元，所述接收单元执行上述第七方面或其任意实现方式中的接收器所执行的步骤，所述处理单元执行上述第七方面或其任意实现方式中的处理器所执行的步骤，所述发送单元执行上述第七方面或其任意实现方式中的发送器所执行的步骤。
第十二方面，提供一种接入网设备。该接入网设备接收单元、处理单元和发送单元， 所述接收单元执行上述第八方面或其任意实现方式中的接收器所执行的步骤，所述处理单元执行上述第八方面或其任意实现方式中的处理器所执行的步骤，所述发送单元执行上述第八方面或其任意实现方式中的发送器所执行的步骤。
第十三方面，本申请实施例提供一种接入网设备，该接入网设备包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，接入网设备用于执行上述第一方面或第一方面中任一种可能的实现方式的方法。
第十四方面，本申请实施例提供一种终端设备，该终端设备包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，终端设备用于执行上述第二方面或第二方面中任一种可能的实现方式的方法。
第十五方面，本申请实施例提供一种核心网设备，该核心网设备包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，核心网设备用于执行上述第三方面或第三方面中任一种可能的实现方式的方法。
第十六方面，本申请实施例提供一种接入网设备，该接入网设备包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，接入网设备用于执行上述第四方面或第四方面中任一种可能的实现方式的方法。
第十七方面，提供一种计算机存储介质，所述计算机存储介质上存储有程序代码，所述程序代码包括用于实现所述第一方面、第二方面、第三方面或第四方面的方法的任意可能的实现方式的指令。
附图说明
图1为一种网络切片分类的示意图；
图2为本发明实施例提供的一种系统架构的示意图；
图3为本发明实施例提供的一种数据安全传输的方法的流程示意图；
图4为本发明实施例提供的一种终端设备切换的流程示意图；
图5为本发明实施例提供的一种数据传输的方法的流程示意图；
图6为本发明实施例提供的一种数据传输的方法的流程示意图；
图7为本发明实施例提供的一种用户面安全信息传输的流程示意图；
图8为本发明实施例提供的一种数据安全传输装置的结构示意图。
具体实施方式
图2示例性的示出了本发明实施例所适用的一种系统架构，基于该系统架构可实现数据安全传输的流程，本发明实施例提供的数据安全传输的系统架构可以包括网络设备110和终端设备120。
其中，网络设备110可以包括与终端设备120通信的接入网(Radio Access Network，RAN))设备以及核心网(Core Network，CN)设备，RAN设备可以是WLAN中的接入点(ACCESS POINT，AP)，GSM或CDMA中的基站(Base Transceiver Station，BTS)，也可 以是WCDMA中的基站(NodeB，NB)，还可以是LTE中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备，例如可以连接5G核心网设备的基站，传输与接收点(Transmission and Reception Point，TRP)，集中式处理单元(Centralized Unit，CU)，分布式处理单元(Distributed Unit，DU)等。CN设备可以是LTE中的移动管理实体(Mobile Management Entity,MME)，网关(Gateway)，还可以是5G网络中的控制面(Control Plan，CP)网络功能(Network Function，NF)以及用户面(User Plan，UP)网络功能，例如公共控制面网络功能(Common CP NF，CCNF)，会话管理网络功能(Session Management NF，SMF)等。每个网络切片包含RAN设备以及CN设备，其中，多个网络切片可以共享一个RAN设备的网络功能；CN设备中可以包含网络切片间共享的网络功能以及网络切片独有的网络功能两部分，部分网络切片可以共享CN设备中的共享的网络功能，部分网络切片也可以单独使用CN设备中该网络切片独有的网络功能，如Slice A、Slice B，这两个切片共享了CN设备中的网络功能；网络切片还可以不与其他网络切片共享网络功能，如Slice C，独自拥有CN设备的网络功能。
在本发明实施例中，终端设备120可以为具有无线高保真(英文：wireless fidelity，WiFi)模块的设备，例如，手机、手环、平板电脑、笔记本电脑、超级移动个人计算机(英文：Ultra-Mobile Personal Computer，UMPC)、个人数字助理(英文：Personal Digital Assistant，PDA)设备、车载设备、可穿戴设备、具有网络接入功能的传感器等，而不仅限于通信终端。
在5G系统中，由于网络切片需求的安全等级不同，安全等级高的网络切片的加/解密功能将从RAN设备侧上移到CN设备侧，CN设备发送给终端设备120的数据，需要在CN设备上加密，加密后再通过RAN设备发送给终端设备120，此时，终端设备120在接收或发送数据时，需要知道加解密的秘钥，以及加解密功能的位置信息。
因此，在终端设备120在向CN设备发起业务传输的用户面数据包之前，需要确定出接收或发送的数据的加解密的秘钥，以实现数据的安全传输。
基于上述描述，图3示例性的示出了本发明实施例提供的一种数据安全传输的方法的流程，该流程可以实现5G系统中数据的安全传输，下面将结合图2和图3来描述数据安全传输的方法。
如图3所示，该流程的具体步骤包括：
步骤301，终端设备向第一RAN设备发送请求消息。
该向第一RAN设备发送的请求消息中包含有一个或多个网络切片选择信息，用于指示终端设备要发起连接的网络切片。该请求消息可以携带非接入层(Non-access stratum，NAS)消息，该NAS消息中包含有上述一个或多个网络切片选择信息，以使第一RAN设备在接收到该请求消息之后，将该请求消息中的一个或多个网络切片选择信息转发给第一CN设备，用于发起网络切片选择或协议数据单元(Protocol Data Unit，PDU)会话建立。进一步地，该请求消息可以是RRC消息，MAC消息或物理层消息。
上述网络切片选择信息包含但不限于以下相关信息：网络切片类型，例如增强的移动宽带业务(enhanced Mobile Broadband，eMBB)，超可靠低时延通信(Ultra-Reliable Low lactecncy Communications，URLLC)，海量机器类通信(Massive Machine Type Communication，mMTC)等指示网络切片类型的信息，进一步地，该网络切片类型可以指 端到端网络切片类型，包含RAN侧以及CN侧，也可以指RAN侧网络切片类型，或者CN侧网络切片类型。业务类型，与具体的业务相关，例如视频业务，车联网业务，语音业务等指示业务特征或者具体业务的信息。租户(Tenant)信息，用于指示创建或者租用该网络切片的客户信息，如腾讯，国家电网等。用户组信息，用于指示按照某种特征，如用户的级别等将用户进行分组的分组信息。切片组信息，用于指示按照某种特征，如用户接入的网络切片进行分组的分组信息。网络切片实例信息，用于指示为该网络切片创建的实例标识以及特征信息，例如，为网络切片实例分配一个标识，用于指示该网络切片实例，也可以在网络切片实例标识的基础上映射一个新的标识，关联该网络切片实例，接收方可以根据该标识识别出代表的具体网络切片实例。专有核心网(Dedicated Core Network，DCN)标识，该标识用于唯一指示专有核心网，例如物联网专有的核心网，可选的，该DCN标识可以与网络切片标识做映射，由DCN标识可以映射出网络切片标识，通过网络切片标识也可以映射出DCN标识。
步骤302，第一RAN设备接收终端设备发送的请求消息，并向第一CN设备发送一个或多个网络切片选择信息。
第一RAN设备在接收到终端设备发送的请求消息之后，可以通过第一RAN设备与第一CN设备的接口消息将接收的请求消息中携带的NAS消息发送给第一CN设备，以使第一CN设备根据给请求消息中的一个或多个网络切片选择信息为终端设备配置用户面安全信息。
步骤303，第一CN设备接收第一RAN设备发送的一个或多个网络切片选择信息，并根据一个或多个网络切片选择信息，配置终端设备的用户面安全信息。
第一CN设备在接收到第一RAN设备发送的一个或多个网络切片选择信息之后，可选的，第一CN设备可以将所述网络切片选择信息发送给网络切片安全相关的CN设备，所述网络切片相关的CN设备可以根据该一个或多个网络切片选择信息，比如不同安全等级的网络切片可以配置不同的用户面安全信息，或者还可以根据网络切片可以关联的不同的业务配置不同的用户面安全信息。该为终端设备配置的用户面安全信息至少可以包括用户面加/解密位置指示信息，用于终端设备对接收的数据解密或对发送的数据加密，提高了数据传输的安全性。
具体的，该用户面安全信息还可以包含但不限于以下相关信息：加/解密功能位置信息，即加/解密功能位置锚点，例如位于RAN侧，位于CN侧，位于RAN以及CN侧等，进一步地，若加/解密功能位于RAN侧，需要RAN侧对用户面数据包进行加/解密，若加/解密功能位于CN侧，RAN侧可以不对用户面数据包进行加/解密，若加/解密功能位于RAN侧以及CN侧，RAN侧还需要对用户面数据包进行加/解密；进一步地，位于RAN侧可以位于分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层，或者位于无线资源控制协议(Radio Resource Control，RRC)层；位于CN侧可以位于用于负责安全功能的控制面或者用户面网络功能，例如会话管理网络功能，或者网管网络功能。加/解密功能使能开关信息，例如开启或者关闭RAN侧，CN侧，或者RAN以及CN侧的加/解密功能。加/解密秘钥，例如需要在RAN侧以及UE侧使用的加/解密秘钥，或者需要在UE侧以及CN侧使用的加/解密秘钥等。加/解密功能算法，例如RAN侧，CN侧，或者RAN以及CN侧的加/解密功能所使用的算法。头压缩(Robust Header Compression,ROHC)功能位置信息，例如位于RAN侧，位于CN侧，位于RAN以及CN侧等，进一步地，若头压缩功能位于RAN侧，需要RAN侧对用户面数据包进行头压缩，若加/解密功能位于CN侧，RAN侧可以不对用户面数据包进行头压缩，若 加/解密功能位于RAN侧以及CN侧，RAN侧还需要对用户面数据包进行头压缩功能；进一步地，位于RAN侧可以位于PDCP层，或者位于RRC层；位于CN侧可以位于用于负责安全功能的控制面或者用户面网络功能，例如会话管理网络功能，或者网管。头压缩功能使能开关信息，例如开启或者关闭RAN侧，CN侧，或者RAN以及CN侧的头压缩功能。头压缩功能算法，例如RAN侧，CN侧，或者RAN以及CN侧的头压缩功能所使用的算法。头压缩类型，例如压缩实时传输协议(Real-time Transport Protocol,RTP)数据包头，用户数据报协议(User Datagram Protocol,UDP)数据包以及互联网协议(Internet Protocol,IP)数据包头，或者压缩UDP/IP数据包头，或者只压缩IP数据包头等。
进一步地，该用户面安全信息还可以包含但不限于以下相关信息：完整性保护功能位置信息，例如位于RAN侧，位于CN侧，位于RAN以及CN侧等，进一步地，若完整性保护功能位于RAN侧，需要RAN侧对用户面数据包进行完整性保护功能，若完整性保护功能位于CN侧，RAN侧可以不对用户面数据包进行完整性保护功能，若加/解密功能位于RAN侧以及CN侧，RAN侧还需要对用户面数据包进行完整性保护功能；进一步地，位于RAN侧可以位于PDCP层，或者位于RRC层；位于CN侧可以位于用于负责安全功能的控制面或者用户面网络功能，例如会话管理网络功能，或者网管。完整性保护功能使能开关信息，例如开启或者关闭RAN侧，CN侧，或者RAN以及CN侧的完整性功能。完整性保护功能算法信息，例如RAN侧，CN侧，或者RAN以及CN侧的完整性保护功能使用的算法。秘钥更新功能信息，例如终端设备在切换或者RRC连接重建立(RRC Connection Re-establishment)过程中秘钥更新所使用的算法，进一步地，该算法可以指示UE在切换或者RRC连接重建立过程是否使用或者衍生出新的秘钥，也可以指示UE在切换或者RRC连接重建立过程不需要是否或者衍生出新的秘钥。
步骤304，第一CN设备向第一RAN设备发送用户面安全信息。
第一CN设备通过接口消息通知第一RAN设备该第一CN设备为终端设备配置的用户面安全信息，该用户面安全信息可以使得第一RAN设备获取用户面安全信息，该用户面安全信息可以是在接口消息中显式或隐式的携带的，具体可以适用于下述业务相关配置信息中：
CN侧为UE选择的至少一个网络切片对应的用户面安全信息，用于该网络切片传输的用户面数据；RAN侧需要为UE建立的至少一个无线承载(radio bearer)对应的用户面安全信息，用于该无线承载传输的用户面数据，；CN侧为UE建立的至少一个PDU会话对应的用户面安全信息，用于该PDU会话传输的用户面数据；CN侧为UE建立的PDU会话中包含的至少一个流(flow)对应的用户面安全信息，用于该流传输的用户面数据。
第一RAN设备通过该消息可以获知网络切片，无线承载，PDU会话，或者该PDU会话包含的流的用户面安全信息，例如是否需要第一RAN设备进行加密和/或头压缩的功能等。
可选地，该接口消息中还可以携带第一CN设备为该终端设备选择的网络切片的标识，也可以携带该第一CN设备为该终端设备建立的PDU会话信息。
步骤305，第一RAN设备接收第一CN设备发送的响应消息，并向终端设备发送用户面信息。
该响应消息中包括第一CN设备为终端设备配置的用户面安全信息，该用户面安全信息至少包括用户面加/解密位置指示信息，之后第一RAN设备向终端设备发送该用户面安全信息，以使终端设备根据该用户面安全信息处理待传输的数据，生成加密后的数据，比如对 接收的数据解密或对发送的数据加密，提高了数据传输的安全性。
第一CN设备向终端设备发送用户面安全信息可以通过空口配置消息发送，该空口配置消息可以是RRC消息、MAC消息或者物理层消息，该配置消息中可以显式或隐式的携带该用户面安全秘钥，该用户面安全秘钥可以适用于一个或者多个无线承载，一个或者多个PDU会话，或者该PDU会话包含的一个或者多个flow，或者该PDU会话对应的网络切片，终端设备通过该消息获知该无线承载，PDU会话，或者该PDU会话包含的流，或者该PDU会话对应的网络切片的安全信息，例如是否需要UE侧在PDCP层进行加/解密和/或头压缩的功能。
步骤306，终端设备接收第一RAN设备发送的第一CN设备为终端设备配置的用户面安全信息，终端设备可以根据接受到的用户面安全信息，根据用户面安全信息处理待传输的数据，生成加密后的数据，并向第一RAN设备传输加密后的数据，同时可以使用用户面安全信息对接收第一RAN设备发送的数据进行解密。
终端设备接收到第一RAN设备发送的第一CN设备为终端设备配置的用户面安全信息之后，将该用户面安全信息进行保存。终端设备在发起业务传输的用户面数据包时，使用存储的用户面安全信息加密该业务传输的用户面数据包，并向第一RAN设备传输该加密后的数据。
步骤307，第一RAN设备接收终端设备传输的加密后的数据，并向第一CN设备传输加密后的数据。
第一RAN设备接收终端设备传输的加密后的数据，然后转发至第一CN设备。该加密后的数据是终端设备使用第一CN设备为终端设备配置的。通过使用第一CN设备配置的用户面安全信息对数据进行加密，可以进一步提高数据传输过程中的安全性，避免出现因第一RAN设备被攻击后造成主秘钥失效，威胁其它网络切片安全的情况。
在用户面的加/解密功能由RAN设备侧上移到CN设备侧时，若终端设备需要从第一RAN设备切换到第二RAN设备，或者添加第二RAN设备进行多连接操作共同为终端设备提供网络连接服务，此时第一RAN设备和第二RAN设备都连接同一CN设备，若终端设备需要从第一RAN设备切换到第二RAN设备，则第一RAN设备需要向第二RAN设备传输加密后的数据。第一RAN设备为源RAN节点，第二RAN设备为目标RAN节点。
如图4所示的切换/多连接流程，该流程的具体步骤包括：
步骤401，第一RAN设备向第二RAN设备发送切换请求消息。
该切换请求消息用于指示第二RAN设备发起切换准备。进一步地，该切换请求消息包含但不限于以下信息：切换原因，用于指示此次切换的原因，例如无线网络层原因(由于信号原因触发的切换，基于资源的优化等)。目标小区标识，用于唯一指示目标小区的标识。切换限制列表，包含服务PLMN，等效PLMN，禁止的服务区等。终端设备对应的临时标识，用于CN设备查找保存的终端设备的上下文。终端设备关联的核心网控制功能实体标识。终端设备选择的一个或者多个或者全部网络切片分别对应的网络切片标识。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择 的一个或者多个或者全部网络切片分别对应的需要建立的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。该终端设备的上下文信息，例如终端设备签约的一个或者多个或者全部网络切片对应的网络切片标识等。
可选的，第一RAN设备可以向第二RAN设备发送RAN设备添加请求，用于请求第二RAN设备建立多连接操作，从而分配无线资源给终端设备。进一步地，该RAN设备添加请求包含但不限于以下信息：终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。
可选的，第一RAN设备可以向第二RAN设备发送RAN设备修改请求，用于请求修改第二RAN设备当前终端设备的上下文信息以及第二RAN设备为终端设备准备的无线资源分配，从而分配无线资源给终端设备。进一步地，该RAN设备修改请求包含但不限于以下信息：终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立，修改以及释放的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立，修改以及释放的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要建立，修改以及释放的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立，修改以及释放的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立，修改以及释放的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要建立，修改以及释放的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面 安全信息，具体消息内容可以参照步骤304的接口消息。
可选的，第一RAN设备可以向第二RAN设备发送RAN设备修改需求，用于触发无线资源的释放，主服务小区的修改，PDCP SN号即将翻转等。进一步地，该RAN设备修改需求包含但不限于以下信息：终端设备选择的一个或者多个或者全部网络切片分别对应的需要释放的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要释放的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的需要释放的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要释放的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要释放的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他需要释放的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。
步骤402，第二RAN设备接收第一RAN设备发送的切换请求消息，并向第一RAN设备发送切换请求确认消息。
第二RAN设备向第一RAN设备发送切换请求确认消息表明该第二RAN设备已经准备好了资源，做好切换准备。该切换请求确认消息包含但不限于以下信息：第一RAN设备的标识。第二RAN设备的标识。第二RAN设备到第一RAN设备的透明容器(container)，包含RRC的切换命令。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。
可选的，第二RAN设备可以向第一RAN设备发送RAN设备添加请求确认，用于指示第二RAN设备已经准备好了资源，从而分配无线资源给终端设备。进一步地，该RAN设备添加请求确认包含但不限于以下信息：终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及被接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及被接纳 的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及被接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及被接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及被接纳的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及被接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。
可选的，第二RAN设备可以向第一RAN设备发送RAN设备修改请求确认，用于响应第一RAN设备的修改请求。进一步地，该RAN设备修改请求确认包含但不限于以下信息：终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及接纳的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。终端设备选择的一个或者多个或者全部网络切片分别对应的未被接纳以及接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及接纳的无线承载信息，例如无线承载标识，无线承载级别的QoS参数，隧道终结点，无线承载对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及接纳的会话信息，例如会话标识，会话级别的QoS参数，隧道终结点，会话对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。其他未被接纳以及接纳的流信息，例如流标识，流级别的QoS参数，隧道终结点，流对应的用户面安全信息，具体消息内容可以参照步骤304的接口消息。
步骤403，第一RAN设备接收所述第二RAN设备发送的切换请求确认消息，向终端设备发送切换指令并缓存待传输至第二RAN设备的加密后的数据。
第一RAN设备在接收到切换请求确认消息之后，向终端设备发送切换指令，用于指示终端设备切换，该切换指令可以是在RRC消息中携带的。该RRC消息中还可以包含但不限于以下信息：目标小区标识，终端设备新的临时标识。承载配置，例如PDCP，无线链路层控制协议(Radio Link Control，RLC)，介质访问控制(Media Access Control，MAC)以及物理层的配置。
第一RAN设备还需要缓存待传输到第二RAN设备的加密后的数据，该待传输至第二RAN设备的加密后的数据可以为第一RAN设备缓存的待发送给终端设备的数据以及已发送给终端设备还未接收到终端设备反馈的数据。
步骤404，第一RAN设备向第二RAN设备发送序列号(Sequence Number，SN)状态传输消息，并向第二RAN设备发送缓存的加密后的数据。
该SN状态传输消息用于指示适用于RLC确认模式下的一个或多个承载、会话、流对应的上行PDCP SN接收状态，和/或下行PDCP SN发送状态。比如，上行PDCP SN接收状态至 少包含第一个丢失的上行服务数据单元(Service Data Unit,SDU)的SN号，并且里面可能包含乱序的上行SDU的接收状态比特地图，用于指示哪些上行SDU需要UE在RAN节点2进行重新传输。下行PDCP SN发送状态用于指示RAN节点2需要分配的下一个新的PDCP SN号。
第一RAN设备向第二RAN设备发送上述缓存的加密后的数据，可以解决切换过程中的数据包丢失，同时由于第一RAN设备前传的是加密后的数据，使得第二RAN设备发送给UE的该缓存数据可以在UE侧继续解密，保证了数据传输的安全性。
步骤405，终端设备接收第一RAN设备发送的切换指令，与第二RAN设备建立RRC连接，并向第二RAN设备发送切换完成消息。
终端设备在接收到切换指令之后，与第二RAN设备建立RRC连接，然后向第二RAN设备发送切换完成消息，例如RRC连接重配置完成消息，指示已经完成切换。
可选地，在用户面的加/解密功能由RAN设备侧上移到CN设备侧时，若终端设备需要从第一RAN设备切换到第二RAN设备，此时第一RAN设备和第二RAN设备都连接不同的CN设备，则第一RAN设备需要向第二RAN设备传输加密后的数据。第一RAN设备为源RAN节点，第二RAN设备为目标RAN节点。
可选地，若需要触发RAN设备以及CN设备间接口的切换过程时，例如上述第一RAN设备和第二RAN设备之间没有直接的陆地侧接口或者无线回传链路时，在上述步骤401中的切换请求消息可以由通过第一核心网设备转发，比如，第一RAN设备将该切换请求消息发送给第一核心网设备，具体切换请求消息内容可以参考步骤401的切换请求消息，之后该第一核心网设备再将该切换请求消息发送给第二RAN设备，从而实现了第一RAN设备向第二RAN设备发送切换请求消息。第二RAN设备向第一核心网设备发送切换请求确认消息，具体切换请求确认消息可以参考步骤402的切换请求确认消息，之后该第一核心网设备再将该切换请求确认消息发送给第二RAN设备，从而实现了第二RAN设备向第一RAN设备发送切换请求确认消息。第一RAN设备接收所述第二RAN设备发送的切换请求确认消息，向终端设备发送切换指令并缓存待传输至第二RAN设备的加密后的数据。第一RAN设备向第二RAN设备发送序列号SN)状态传输消息，并向第一核心网发送缓存的加密后的数据，之后该第一核心网设备再将接收到的数据发送给第二RAN设备，从而实现了第一RAN设备向第二RAN设备发送缓存的加密后的数据。
如图5所示的数据传输的流程，该流程的具体步骤包括：
步骤501，第一RAN设备向所述第二RAN设备发送SN状态传输消息。
该SN状态传输消息用于指示适用于RLC确认模式下的一个或多个承载、会话、流对应的上行PDCP SN接收状态，和/或下行PDCP SN发送状态。比如，上行PDCP SN接收状态至少包含第一个丢失的上行SDU的SN号，并且里面可能包含乱序的上行SDU的接收状态比特地图，用于指示哪些上行SDU需要UE在RAN节点2进行重新传输。下行PDCP SN发送状态用于指示RAN节点2需要分配的下一个新的PDCP SN号。
步骤502，第一RAN设备向第一CN设备发送缓存的加密后的数据。
可选地，第一RAN设备向第二CN设备发送SN状态传输消息。
步骤503，第一CN设备接收第一RAN设备发送的加密后的数据，并对该加密后的数据解密，向第二CN设备发送未加密的数据。
该数据为可以为第一RAN设备缓存的待发送给终端设备的数据以及已发送给终端设 备还未接收到终端设备反馈的数据。
步骤504，第二CN设备接收第一CN设备发送的未加密的数据，向第二RAN设备发送未加密的数据。
通过使用第一CN设备和第二CN设备将第一RAN设备缓存的加密后的数据传输给第二RAN设备，可以解决切换过程中的数据丢失，并且通过第一CN设备可以传输未加密的数据给第二CN设备，使得第二CN设备可以使用该设备适用的新的安全机制进行数据加密，使得第二RAN设备传输给UE的数据包可以使用第二CN设备适用的安全机制，保证了数据传输的安全性以及切换后安全机制的顺利更换。
可选地，在用户面的加/解密功能由RAN设备侧上移到CN设备侧时，若终端设备需要从第一RAN设备切换到第二RAN设备，此时第一RAN设备和第二RAN设备都连接不同的CN设备，则第一RAN设备需要向第二RAN设备传输加密后的数据。第一RAN设备为源RAN节点，第二RAN设备为目标RAN节点。
如图6所示的数据传输的流程，该流程的具体步骤包括：
步骤601，第一RAN设备向所述第二RAN设备发送SN状态传输消息。
该SN状态传输消息用于指示适用于RLC确认模式下的一个或多个承载、会话、流对应的上行PDCP SN接收状态，和/或下行PDCP SN发送状态。比如，上行PDCP SN接收状态至少包含第一个丢失的上行SDU的SN号，并且里面可能包含乱序的上行SDU的接收状态比特地图，用于指示哪些上行SDU需要UE在RAN节点2进行重新传输。下行PDCP SN发送状态用于指示RAN节点2需要分配的下一个新的PDCP SN号。
步骤602，第一RAN设备向第一CN设备发送SN状态传输消息。
可选地，第一RAN设备向第一CN设备发送缓存的加密后的数据。该数据为可以为第一RAN设备缓存的待发送给终端设备的数据以及已发送给终端设备还未接收到终端设备反馈的数据。
步骤603，第一CN设备接收第一RAN设备发送的加密后的数据，并对该加密后的数据解密，向第二CN设备发送未加密的数据。
步骤604，第二CN设备接收第一CN设备发送的未加密的数据，向第二RAN设备发送未加密的数据。
通过使用第一CN设备和第二CN设备将第一RAN设备缓存的加密后的数据传输给第二RAN设备，可以解决切换过程中的数据丢失，并且通过第一CN设备可以传输未加密的数据给第二CN设备，使得第二CN设备可以使用该设备适用的新的安全机制进行数据加密，使得第二RAN设备传输给UE的数据包可以使用第二CN设备适用的安全机制，保证了数据传输的安全性以及切换后安全机制的顺利更换。
进一步地，终端设备在从第一RAN设备向第二RAN设备切换时，若第一RAN设备与第二RAN设备都连接不同的CN设备，在上述如图4所示的流程中，第二RAN设备在接收到终端设备发送的切换完成消息之后，向终端设备发送SN指示消息，该SN指示消息可以是RRC消息，MAC消息或者物理层消息，包含但不限于以下相关信息：SN边界值，用于指示UE哪些接收以及发送的数据包需要使用原先的加解密秘钥，哪些需要使用新的加解密秘钥，例如若这些数据包对应的PDCP SDU的SN号在SN边界值之前的数据包需要使用原先的加解密秘钥，之后的数据包则需要使用新的加解密秘钥。
可选地，该SN指示消息还可以通过在数据包中添加秘钥指示，用于通知终端设备该数 据包加解密使用的秘钥已经发生变化，需要使用信道秘钥。
可选地，该SN指示消息还可以通过发生end-marker的数据包的形式，通过发送一个end-marker数据包用于指示UE侧之前保存的加解密秘钥失效，开始使用新的秘钥。
为了能够使得第一RAN设备确定出网络切片的用户面安全信息是在第一RAN设备侧还第一CN设备侧，第一RAN设备还可以接收操作与管理面设备(Operation and Management，OAM)发送的网络切片管理消息。
具体的，如图7所示的流程，包括流程步骤具体包括：
步骤701，OAM设备向第一RAN设备发送网络切片管理消息。
该网络切片管理消息中包括基础的网络切片的用户面安全信息。该OAM可以是切片管理(Slice manager)设备，和/或RAN领域的切片管理设备，和/或RAN侧的设备管理系统(Network Element Management System,EMS)等。该消息中还包括的内容可以如上述实施例中用户面安全信息的描述，在此不再赘述。
该消息的具体表现形式不限，可以依据具体信息内容编码，可以以不同字段代表不同用户面安全信息，也可以通过索引的方式编码。
步骤702，第一RAN设备接收OAM设备发送的网络切片管理消息，并向OAM设备发送确认消息。
第一RAN设备在接收到网络切片管理消息之后，可以向OAM设备发送确认消息，也可以不发送。该确认消息可以包含以下一种或几种信息组合：确认成功消息，用于指示RAN设备同意OAM设备通过消息1发送的网络切片实例生成和/或修改配置。确认失败消息，用于指示RAN设备拒绝OAM设备通过网络切片管理消息发送的网络切片实例生成和/或修改配置，进一步地，该消息还可以指示失败的原因，例如无法完成网络切片管理消息的某一条或者多条配置要求，比如无法完成加/解密功能算法配置。
步骤703，第一RAN设备存储基础的网络切片的用户面安全信息，可选的，第一RAN设备可以将网络切片的用户面安全信息通过空口消息发送给UE。
该空口消息可以是RRC消息，例如RRC连接建立消息，RRC连接重配置消息等
上述实施例表明，第一接入网设备接收终端设备发送的请求消息，第一接入网设备向第一核心网设备所述一个或多个网络切片选择信息，第一接入网设备接收第一核心网设备发送的响应消息，用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包，第一接入网设备向终端设备发送用户面安全信息，第一接入网设备接收终端设备传输的加密后的数据，并向第一核心网设备传输所述加密后的数据，加密后的数据为终端设备根据所述用户面安全信息处理后的数据。通过第一接入网设备接收第一核心网设备发送的用户面安全信息，使得第一接入网设备可以获知网络切片关联的业务的相关用户面安全信息，例如是否需要第一接入网对业务传输的用户面数据包进行加/解密，第一接入网设备将第一核心网设备为终端设备配置的用户面安全信息发送给终端设备，使得终端设备依据该用户面安全信息在数据传输时加/解密，从而可以实现网络切片的网络架构下的数据传输过程的安全性、可靠性，由于第一核心网设备是依据一个或多网络切片选择信息配置的用户面安全信息，可以满足不同网络切片对用户面安全的不同需求，提高了数据加/解密的灵活性和差异性。
本发明实施例中提到的终端设备，可以是无线终端设备也可以是有线终端设备，无线终端设备可以是指向用户提供语音和/或其他业务数据连通性的设备，具有无线连接功能的 手持式设备、或连接到无线调制解调器的其他处理设备。无线终端设备可以经无线接入网(英文：Radio Access Network；简称：RAN)与一个或多个核心网进行通信，无线终端设备可以是移动终端，如移动电话(或称为“蜂窝”电话)和具有移动终端的计算机，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(英文：Personal Communication Service；简称：PCS)电话、无绳电话、会话发起协议(英文：Session Initiation Protocol；简称：SIP)话机、无线本地环路(英文：Wireless Local Loop；简称：WLL)站、个人数字助理(英文：Personal Digital Assistant；简称：PDA)等设备。无线终端设备也可以称为系统、订户单元(Subscriber Unit)、订户站(Subscriber Station)，移动站(Mobile Station)、移动台(Mobile)、远程站(Remote Station)、远程终端(Remote Terminal)、接入终端(Access Terminal)、用户终端(User Terminal)、用户代理(User Agent)、用户设备(User Device or User Equipment)。
另外，本发明实施例中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本发明实施例中字符“/”，一般表示前后关联对象是一种“或”的关系。
本发明实施例中的一些英文简称为以LTE系统为例对本发明实施例进行的描述，其可能随着网络的演进发生变化，具体演进可以参考相应标准中的描述。
接下来请参考图8，图8为本发明实施例提供的一种数据安全传输装置的可能的结构图。该装置例如为上述第一接入网设备、第二接入网设备、第一核心网设备、第二核心网设备、终端设备的一种可能的结构图。如图8所示，该装置包括：处理器10、发送器20、接收器30、存储器40和天线50。存储器40、发送器20和接收器30和处理器10可以通过总线进行连接。当然，在实际运用中，存储器40、发送器20和接收器30和处理器10之间可以不是总线结构，而可以是其它结构，例如星型结构，本申请不作具体限定。
可选的，处理器10具体可以是通用的中央处理器或特定应用集成电路(英文：Application Specific Integrated Circuit，简称：ASIC)，可以是一个或多个用于控制程序执行的集成电路，可以是使用现场可编程门阵列(英文：Field Programmable Gate Array，简称：FPGA)开发的硬件电路，可以是基带处理器。
可选的，处理器10可以包括至少一个处理核心。
可选的，存储器40可以包括只读存储器(英文：Read Only Memory，简称：ROM)、随机存取存储器(英文：Random Access Memory，简称：RAM)和磁盘存储器中的一种或多种。存储器40用于存储处理器10运行时所需的数据和/或指令。存储器40的数量可以为一个或多个。存储器40中的部分可以与处理器集成设置，也可以独立于处理器设置。
可选的，发送器20和接收器30在物理上可以相互独立也可以集成在一起。发送器20可以通过天线50进行数据发送。接收器30可以通过天线50进行数据接收。
基于同一发明构思，本发明实施例还提供一种数据安全传输装置(如图8所示)，该装置用于实现前述方法中的任意一种方法。
当该装置为接入网设备时，例如前述第一接入网设备时，所述处理器10，用于控制所述接收器30接收终端设备发送的请求消息；所述请求消息中包括一个或多网络切片选择信息；以及控制所述发送器20向第一核心网设备发送所述一个或多个网络切片选择信息；
所述处理器10，还用于控制所述接收器30接收所述第一核心网设备发送的响应消息； 所述响应消息中包括所述第一核心网设备为所述终端设备配置的用户面安全信息；所述用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包；
所述处理器10，还用于控制所述发送器20向所述终端设备发送所述用户面安全信息；以及控制所述接收器30接收所述终端设备传输的加密后的数据，并控制所述发送器20向所述第一核心网设备传输所述加密后的数据，所述加密后的数据为所述终端设备根据所述用户面安全信息处理后的数据。
可选的，所述接入网设备还包括存储器40；
所述处理器10还用于：
在将所述加密后的数据传输至所述第一核心网设备之后，控制所述发送器20向第二接入网设备发送切换请求消息，所述第二接入网设备为所述终端设备待切换到的设备；
控制所述接收器30接收所述第二接入网设备发送的切换请求确认消息；
控制所述发送器20向所述终端发送切换指令并控制所述存储器40缓存待传输至所述第二接入网设备的加密后的数据，所述待传输至所述第二接入网设备的加密后的数据为第一核心网设备加密并传输至所述终端设备的数据，所述切换指令用于指示所述终端设备从所述第一接入网设备切换到所述第二接入网设备；
控制所述发送器20向所述第二接入网设备发送SN状态传输消息，用于指示RLC模式下一个或多个上下行SN状态；
控制所述发送器20向所述第二接入网设备发送所述缓存的加密后的数据。
可选的，所述第二接入网设备与第二核心网设备通信；
所述处理器10具体用于：
控制所述发送器20向所述第一核心网设备发送所述缓存的加密后的数据。
可选的，所述处理器10还用于：
在控制所述发送器20向所述第一核心网设备发送所述缓存的加密后的数据之前，控制所述发送器20向所述第一核心网设备发送所述SN状态传输消息。
可选的，所述缓存的加密后的数据包括所述接入网设备缓存的待发送给所述终端设备的数据以及已发送给所述终端设备还未接收到所述终端设备反馈的数据。
可选的，所述用户面安全信息还包括头压缩功能位置指示信息、完整性保护功能位置指示信息。
可选的，所述处理器10还用于：
在控制所述接收器30接收所述终端设备传输的加密后的数据之前，控制所述接收器30接收操作与管理设备发送的网络切片管理消息，所述网络切片管理消息中包括基础的网络切片的用户面安全信息；
控制所述存储器40存储所述基础的网络切片的用户面安全信息。
当该装置为终端设备时，所述发送器20，用于向第一接入网设备发送请求消息，所述请求消息中包括一个或多个网络切片选择信息；
所述接收器30，用于接收所述第一接入网设备发送的第一核心网设备为所述终端设备配置的用户面安全信息，所述用户面安全信息包括用户面加/解密位置指示信息；
所述处理器10，用于根据所述用户面安全信息处理待传输的数据，生成加密后的数据，并控制所述发送器20向所述第一接入网设备传输所述加密后的数据。
可选的，所述处理器10还用于：
在控制所述发送器20向所述第一接入网设备传输所述加密后的数据之后，控制所述接收器30接收所述第一接入网设备发送的切换指令；
与所述第二接入网设备建立RRC连接，并控制所述发送器20向所述第二接入网设备发送切换完成消息。
可选的，所述处理器10还用于：
在控制所述发送器20向所述第二接入网设备发送切换完成消息之后，控制所述接收器30接收所述第二接入网设备发送的SN指示消息，用于指示所述终端设备接收或发送的数据的SN边界值。
当该设备为核心网设备时，所述接收器30，用于接收第一接入网设备发送的一个或多个网络切片选择信息；
所述处理器10，用于根据所述一个或多个网络切片选择信息，配置终端设备的用户面安全信息；
所述发送器20，用于向所述第一接入网设备发送所述用户面安全信息。
可选的，所述处理器10还用于：
在控制所述发送器20向所述第一接入网设备发送所述用户面安全信息之后，控制所述接收器30接收所述第一接入网设备发送的SN状态传输消息以及缓存的待传输至第二接入网设备的加密后的数据。
当该装置为第二接入网设备时，所述处理器10，用于控制所述接收器30接收第一接入网设备发送的切换请求消息；
所述处理器10，还用于控制所述发送器20向所述第一接入网设备发送切换请求确认消息，并接收所述第一接入网设备发送的SN状态传输消息；以及控制所述接收器30接收第一接入网设备发送的加密后的数据。
可选的，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；
所述处理器10具体用于：
控制所述接收器30接收第二核心网设备发送的数据。
可选的，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；
所述处理器10还用于：
在控制所述接收器30接收所述第一接入网设备发送的加密后的数据之后，与所述终端设备建立RRC连接；控制所述发送器20向所述终端设备发送SN指示信息，用于指示所述终端设备接收或发送的数据的SN边界值。
基于同一发明构思，本发明实施例还提供一种数据安全传输装置，该数据传输装置包括用于执行前述方法步骤的功能模块。
前述实施例中的数据传输方法中的各种变化方式和具体实例同样适用于本实施例的数据传输装置以及图8中的装置，通过前述对数据传输方法的详细描述，本领域技术人员可以清楚的知道本实施例中数据传输装置以及图8中的装置的实施方法，所以为了说明书的简洁，在此不再详述。
本领域内的技术人员应明白，本申请的实施例可提供为方法、或计算机程序产品。因 此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请各种改动和变型而不脱离本申请的范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种数据安全传输的方法，其特征在于，该方法包括：
    第一接入网设备接收终端设备发送的请求消息；所述请求消息中包括一个或多网络切片选择信息；
    所述第一接入网设备向第一核心网设备发送所述一个或多个网络切片选择信息；
    所述第一接入网设备接收所述第一核心网设备发送的响应消息；所述响应消息中包括所述第一核心网设备为所述终端设备配置的用户面安全信息；所述用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包；
    所述第一接入网设备向所述终端设备发送所述用户面安全信息；
    所述第一接入网设备接收所述终端设备传输的加密后的数据，并向所述第一核心网设备传输所述加密后的数据，所述加密后的数据为所述终端设备根据所述用户面安全信息处理后的数据。
  2. 如权利要求1所述的方法，其特征在于，在所述第一接入网设备将所述加密后的数据传输至所述第一核心网设备之后，还包括：
    所述第一接入网设备向第二接入网设备发送切换请求消息，所述第二接入网设备为所述终端设备待切换到的设备；
    所述第一接入网设备接收所述第二接入网设备发送的切换请求确认消息；
    所述第一接入网设备向所述终端设备发送切换指令并缓存待传输至所述第二接入网设备的加密后的数据，所述待传输至所述第二接入网设备的加密后的数据为第一核心网设备加密并传输至所述终端设备的数据，所述切换指令用于指示所述终端设备从所述第一接入网设备切换到所述第二接入网设备；
    所述第一接入网设备向所述第二接入网设备发送序列号SN状态传输消息，用于指示无线链路层控制协议RLC模式下一个或多个上下行SN状态；
    所述第一接入网设备向所述第二接入网设备发送所述缓存的加密后的数据。
  3. 如权利要求2所述的方法，其特征在于，所述第二接入网设备与第二核心网设备通信；
    所述第一接入网设备向所述第二接入网设备发送所述缓存的加密后的数据，包括：
    所述第一接入网设备向所述第一核心网设备发送所述缓存的加密后的数据。
  4. 如权利要求3所述的方法，其特征在于，在所述第一接入网设备向所述第一核心网设备发送所述缓存的加密后的数据之前，还包括：
    所述第一接入网设备向所述第一核心网设备发送所述SN状态传输消息。
  5. 如权利要求2至4任一项所述的方法，其特征在于，所述缓存的加密后的数据包括所述第一接入网设备缓存的待发送给所述终端设备的数据以及已发送给所述终端设备还未接收到所述终端设备反馈的数据。
  6. 如权利要求1至5任一项所述的方法，其特征在于，所述用户面安全信息还包括头压缩功能位置指示信息、完整性保护功能位置指示信息。
  7. 如权利要求1至6任一项所述的方法，其特征在于，在所述第一接入网设备接收所述终端设备传输的加密后的数据之前，还包括：
    所述第一接入网设备接收操作与管理设备发送的网络切片管理消息，所述网络切片管理消息中包括基础的网络切片的用户面安全信息；
    所述第一接入网设备存储所述基础的网络切片的用户面安全信息。
  8. 一种数据安全传输的方法，其特征在于，该方法包括：
    终端设备向第一接入网设备发送请求消息，所述请求消息中包括一个或多个网络切片选择信息；
    所述终端设备接收所述第一接入网设备发送的第一核心网设备为所述终端设备配置的用户面安全信息，所述用户面安全信息包括用户面加/解密位置指示信息；
    所述终端设备根据所述用户面安全信息处理待传输数据，生成加密后的数据，并向所述第一接入网设备传输所述加密后的数据。
  9. 如权利要求8所述的方法，其特征在于，在所述终端设备向所述第一接入网设备传输所述加密后的数据之后，还包括：
    所述终端设备接收所述第一接入网设备发送的切换指令；
    所述终端设备与所述第二接入网设备建立无线资源控制协议RRC连接，并向所述第二接入网设备发送切换完成消息。
  10. 如权利要求9所述的方法，其特征在于，在所述终端设备向所述第二接入网设备发送切换完成消息之后，还包括：
    所述终端设备接收所述第二接入网设备发送的序列号SN指示消息，用于指示所述终端设备接收或发送的数据的SN边界值。
  11. 一种数据安全传输的方法，其特征在于，该方法包括：
    第一核心网设备接收第一接入网设备发送的一个或多个网络切片选择信息；
    所述第一核心网设备根据所述一个或多个网络切片选择信息，配置终端设备的用户面安全信息；
    所述第一核心网设备向所述第一接入网设备发送所述用户面安全信息。
  12. 如权利要求11所述的方法，其特征在于，在所述第一核心网设备向所述第一接入网设备发送所述用户面安全信息之后，还包括：
    所述第一核心网设备接收所述第一接入网设备发送的序列号SN状态传输消息以及缓存的待传输至第二接入网设备的加密后的数据。
  13. 一种数据安全传输的方法，其特征在于，该方法包括：
    第二接入网设备接收第一接入网设备发送的切换请求消息；
    所述第二接入网设备向所述第一接入网设备发送切换请求确认消息，并接收所述第一接入网设备发送的序列号SN状态传输消息；
    所述第二接入网设备接收第一接入网设备发送的加密后的数据。
  14. 如权利要求13所述的方法，其特征在于，所述第一接入网设备与第一核心网设备通信，所述第二接入网设备与第二核心网设备通信；
    所述第二接入网设备接收第一接入网设备发送的加密后的数据，包括：
    所述第二接入网设备接收第二核心网设备发送的数据。
  15. 如权利要求13或14所述的方法，其特征在于，所述第一接入网设备与第一核心网设备通信，所述第二接入网设备与第二核心网设备通信；
    在所述第二接入网设备接收所述第一接入网设备发送的加密后的数据之后，还包括：
    所述第二接入网设备与所述终端设备建立无线资源控制协议RRC连接；
    所述第二接入网设备向所述终端设备发送序列号SN指示信息，用于指示所述终端设备接收或发送的数据的SN边界值。
  16. 一种接入网设备，其特征在于，所述接入网设备包括：接收器、处理器和发送器，以及
    所述处理器，用于控制所述接收器接收终端设备发送的请求消息；所述请求消息中包括一个或多网络切片选择信息；以及控制所述发送器向第一核心网设备发送所述一个或多个网络切片选择信息；
    所述处理器，还用于控制所述接收器接收所述第一核心网设备发送的响应消息；所述响应消息中包括所述第一核心网设备为所述终端设备配置的用户面安全信息；所述用户面安全信息包括用户面加/解密位置指示信息，用于加/解密所述终端设备选择的网络切片关联的业务传输的用户面数据包；
    所述处理器，还用于控制所述发送器向所述终端设备发送所述用户面安全信息；以及控制所述接收器接收所述终端设备传输的加密后的数据，并控制所述发送器向所述第一核心网设备传输所述加密后的数据，所述加密后的数据为所述终端设备根据所述用户面安全信息处理后的数据。
  17. 如权利要求16所述的接入网设备，其特征在于，所述接入网设备还包括存储器；
    所述处理器还用于：
    在将所述加密后的数据传输至所述第一核心网设备之后，控制所述发送器向第二接入网设备发送切换请求消息，所述第二接入网设备为所述终端设备待切换到的设备；
    控制所述接收器接收所述第二接入网设备发送的切换请求确认消息；
    控制所述发送器向所述终端发送切换指令并控制所述存储器缓存待传输至所述第二接入网设备的加密后的数据，所述待传输至所述第二接入网设备的加密后的数据为第一核心网设备加密并传输至所述终端设备的数据，所述切换指令用于指示所述终端设备从所述第一接入网设备切换到所述第二接入网设备；
    控制所述发送器向所述第二接入网设备发送序列号SN状态传输消息，用于指示无线链路层控制RLC模式下一个或多个上下行SN状态；
    控制所述发送器向所述第二接入网设备发送所述缓存的加密后的数据。
  18. 如权利要求17所述的接入网设备，其特征在于，所述第二接入网设备与第二核心网设备通信；
    所述处理器具体用于：
    控制所述发送器向所述第一核心网设备发送所述缓存的加密后的数据。
  19. 如权利要求18所述的接入网设备，其特征在于，所述处理器还用于：
    在控制所述发送器向所述第一核心网设备发送所述缓存的加密后的数据之前，控制所述发送器向所述第一核心网设备发送所述SN状态传输消息。
  20. 如权利要求17至19任一项所述的接入网设备，其特征在于，所述缓存的加密后的数据包括所述接入网设备缓存的待发送给所述终端设备的数据以及已发送给所述终端设备还未接收到所述终端设备反馈的数据。
  21. 如权利要求16至20任一项所述的接入网设备，其特征在于，所述用户面安全信息还包括头压缩功能位置指示信息、完整性保护功能位置指示信息。
  22. 如权利要求16至21任一项所述的接入网设备，其特征在于，所述处理器还用于：
    在控制所述接收器接收所述终端设备传输的加密后的数据之前，控制所述接收器接收操作与管理设备发送的网络切片管理消息，所述网络切片管理消息中包括基础的网络切片的用户面安全信息；
    控制所述存储器存储所述基础的网络切片的用户面安全信息。
  23. 一种终端设备，其特征在于，所述终端设备包括：接收器、处理器和发送器，以及
    所述发送器，用于向第一接入网设备发送请求消息，所述请求消息中包括一个或多个网络切片选择信息；
    所述接收器，用于接收所述第一接入网设备发送的第一核心网设备为所述终端设备配置的用户面安全信息，所述用户面安全信息包括用户面加/解密位置指示信息；
    所述处理器，用于根据所述用户面安全信息处理待传输的数据，生成加密后的数据，并控制所述发送器向所述第一接入网设备传输所述加密后的数据。
  24. 如权利要求23所述的终端设备，其特征在于，所述处理器还用于：
    在控制所述发送器向所述第一接入网设备传输所述加密后的数据之后，控制所述接收器接收所述第一接入网设备发送的切换指令；
    与所述第二接入网设备建立无线资源控制RRC连接，并控制所述发送器向所述第二接入网设备发送切换完成消息。
  25. 如权利要求24所述的终端设备，其特征在于，所述处理器还用于：
    在控制所述发送器向所述第二接入网设备发送切换完成消息之后，控制所述接收器接收所述第二接入网设备发送的序列号SN指示消息，用于指示所述终端设备接收或发送的数据的SN边界值。
  26. 一种核心网设备，其特征在于，所述核心网设备包括：接收器、处理器和发送器，以及
    所述接收器，用于接收第一接入网设备发送的一个或多个网络切片选择信息；
    所述处理器，用于根据所述一个或多个网络切片选择信息，配置终端设备的用户面安全信息；
    所述发送器，用于向所述第一接入网设备发送所述用户面安全信息。
  27. 如权利要求26所述的核心网设备，其特征在于，所述处理器还用于：
    在控制所述发送器向所述第一接入网设备发送所述用户面安全信息之后，控制所述接收器接收所述第一接入网设备发送的序列号SN状态传输消息以及缓存的待传输至第二接入网设备的加密后的数据。
  28. 一种接入网设备，其特征在于，所述接入网设备包括：接收器、处理器和发送器，以及
    所述处理器，用于控制所述接收器接收第一接入网设备发送的切换请求消息；
    所述处理器，还用于控制所述发送器向所述第一接入网设备发送切换请求确认消息，并接收所述第一接入网设备发送的序列号SN状态传输消息；以及控制所述接收器接收第一接入网设备发送的加密后的数据。
  29. 如权利要求28所述的接入网设备，其特征在于，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；
    所述处理器具体用于：
    控制所述接收器接收第二核心网设备发送的数据。
  30. 如权利要求28或29所述的接入网设备，其特征在于，所述第一接入网设备与第一核心网设备通信，所述接入网设备与第二核心网设备通信；
    所述处理器还用于：
    在控制所述接收器接收所述第一接入网设备发送的加密后的数据之后，与所述终端设备建立无线资源控制协议RRC连接；控制所述发送器向所述终端设备发送序列号SN指示信息，用于指示所述终端设备接收或发送的数据的SN边界值。
PCT/CN2018/074201 2017-01-26 2018-01-25 一种数据安全传输的方法及接入网、终端、核心网设备 WO2018137689A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710064248.8 2017-01-26
CN201710064248.8A CN108366369B (zh) 2017-01-26 2017-01-26 一种数据安全传输的方法及接入网、终端、核心网设备

Publications (1)

Publication Number Publication Date
WO2018137689A1 true WO2018137689A1 (zh) 2018-08-02

Family

ID=62977804

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/074201 WO2018137689A1 (zh) 2017-01-26 2018-01-25 一种数据安全传输的方法及接入网、终端、核心网设备

Country Status (2)

Country Link
CN (1) CN108366369B (zh)
WO (1) WO2018137689A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110582109A (zh) * 2019-08-31 2019-12-17 华为技术有限公司 一种无线局域网wlan网络接入方法及装置
CN112913268A (zh) * 2018-11-01 2021-06-04 高通股份有限公司 对网络切片选择辅助信息进行加密
CN117221894A (zh) * 2023-11-09 2023-12-12 湖南雷诺科技发展有限公司 一种基于大数据的5g通信传输方法

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108966217B (zh) * 2018-08-29 2022-05-17 焦作市数据安全工程研究中心 一种保密通信方法、移动终端及保密网关
CN111479335A (zh) * 2019-01-24 2020-07-31 华为技术有限公司 一种数据传输的方法和通信装置
CN111585721B (zh) * 2019-02-15 2022-08-19 华为技术有限公司 一种实体建立的处理方法及装置
CN109981771A (zh) * 2019-03-22 2019-07-05 长安大学 一种基于5g技术的车路通信测试系统及测试方法
CN111770498B (zh) * 2019-04-01 2022-01-14 华为技术有限公司 一种确定安全保护方式的方法、接入网设备及终端
CN113348682B (zh) * 2019-06-28 2023-01-10 Oppo广东移动通信有限公司 无线通信的方法、终端设备、接入网设备和核心网设备
CN113766607B (zh) * 2020-06-03 2023-03-31 华为技术有限公司 接入控制方法及相关设备
US11622282B2 (en) 2020-10-23 2023-04-04 Dish Wireless L.L.C. Secondary operator integration with a cellular network
WO2022125200A2 (en) * 2020-10-23 2022-06-16 Dish Wireless L.L.C. Secondary operator integration with a cellular network

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056226A (zh) * 2009-11-10 2011-05-11 中兴通讯股份有限公司 Pdcp状态报告的获取方法和pdcp实体
WO2016162502A1 (en) * 2015-04-08 2016-10-13 Telefonaktiebolaget Lm Ericsson (Publ) Method, apparatus, and system for providing encryption or integrity protection in a wireless network
CN106060900A (zh) * 2016-05-13 2016-10-26 宇龙计算机通信科技(深圳)有限公司 网络切片的接入控制方法及装置、终端化小区和sdn控制器
US20160352604A1 (en) * 2015-06-01 2016-12-01 Telefonaktiebolaget L M Ericsson (Publ) Real time caching effficient check in ccn
US20160352578A1 (en) * 2015-05-26 2016-12-01 Dell Products L.P. System and method for adaptive paths locator for virtual network function links

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101047500A (zh) * 2006-03-28 2007-10-03 华为技术有限公司 一种在演进网络中进行加密数据包传输的方法
CN101047998B (zh) * 2006-06-27 2010-05-12 华为技术有限公司 一种基站间切换过程中的数据传输方法
US7995994B2 (en) * 2006-09-22 2011-08-09 Kineto Wireless, Inc. Method and apparatus for preventing theft of service in a communication system
CN106210042B (zh) * 2016-07-11 2019-06-18 清华大学 一种基于端到端网络切片的用户服务请求选择方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102056226A (zh) * 2009-11-10 2011-05-11 中兴通讯股份有限公司 Pdcp状态报告的获取方法和pdcp实体
WO2016162502A1 (en) * 2015-04-08 2016-10-13 Telefonaktiebolaget Lm Ericsson (Publ) Method, apparatus, and system for providing encryption or integrity protection in a wireless network
US20160352578A1 (en) * 2015-05-26 2016-12-01 Dell Products L.P. System and method for adaptive paths locator for virtual network function links
US20160352604A1 (en) * 2015-06-01 2016-12-01 Telefonaktiebolaget L M Ericsson (Publ) Real time caching effficient check in ccn
CN106060900A (zh) * 2016-05-13 2016-10-26 宇龙计算机通信科技(深圳)有限公司 网络切片的接入控制方法及装置、终端化小区和sdn控制器

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112913268A (zh) * 2018-11-01 2021-06-04 高通股份有限公司 对网络切片选择辅助信息进行加密
CN112913268B (zh) * 2018-11-01 2024-04-12 高通股份有限公司 对网络切片选择辅助信息进行加密
CN110582109A (zh) * 2019-08-31 2019-12-17 华为技术有限公司 一种无线局域网wlan网络接入方法及装置
CN117221894A (zh) * 2023-11-09 2023-12-12 湖南雷诺科技发展有限公司 一种基于大数据的5g通信传输方法
CN117221894B (zh) * 2023-11-09 2024-01-12 湖南雷诺科技发展有限公司 一种基于大数据的5g通信传输方法

Also Published As

Publication number Publication date
CN108366369B (zh) 2021-02-12
CN108366369A (zh) 2018-08-03

Similar Documents

Publication Publication Date Title
WO2018137689A1 (zh) 一种数据安全传输的方法及接入网、终端、核心网设备
US11950314B2 (en) Configuration method and apparatus, and system
CN111052781B (zh) 用于协商安全性算法和完整性算法的方法和设备
WO2020029938A1 (zh) 安全会话方法和装置
US9999028B2 (en) Data transmission method, base station, and user equipment
US10660008B2 (en) Data transmission system, method, and apparatus
JP6329277B2 (ja) データ伝送方法およびデバイス
US11483705B2 (en) Method and device for generating access stratum key in communications system
TWI762684B (zh) 切換方法、存取網設備和終端設備
WO2020052531A1 (zh) 获取安全上下文的方法和装置
WO2011032497A1 (zh) 一种聚合小区的重配置方法、设备和系统
CN109315008B (zh) 多连接通信方法和设备
WO2019157985A1 (zh) 一种无线回传通信处理方法和相关设备
WO2014175091A1 (ja) 通信制御方法、ユーザ端末、セルラ基地局、及びアクセスポイント
WO2018127018A1 (zh) 多链接通信方法、设备和终端
WO2018127219A1 (zh) 一种减少中断时延的方法、装置及用户设备
US20190230621A1 (en) Message identification method and apparatus
JP2017147746A (ja) データ分流のための方法およびデバイス
WO2014110908A1 (zh) 数据安全传输方法及lte接入网系统
WO2018023544A1 (zh) 通信方法、用户设备、基站、控制面网元和通信系统
EP3046362B1 (en) Distribution method, base station and user equipment
US20220377541A1 (en) Key Management Method and Communication Apparatus
WO2018176187A1 (zh) 数据传输方法、用户设备和控制面节点
CN115336382A (zh) 方法、基础设施设备和无线通信网络
WO2023213191A1 (zh) 安全保护方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18745434

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18745434

Country of ref document: EP

Kind code of ref document: A1