WO2018176187A1 - 数据传输方法、用户设备和控制面节点 - Google Patents

数据传输方法、用户设备和控制面节点 Download PDF

Info

Publication number
WO2018176187A1
WO2018176187A1 PCT/CN2017/078261 CN2017078261W WO2018176187A1 WO 2018176187 A1 WO2018176187 A1 WO 2018176187A1 CN 2017078261 W CN2017078261 W CN 2017078261W WO 2018176187 A1 WO2018176187 A1 WO 2018176187A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
session
application
attribute
control plane
Prior art date
Application number
PCT/CN2017/078261
Other languages
English (en)
French (fr)
Inventor
倪慧
李永翠
应江威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202110112087.1A priority Critical patent/CN112887975A/zh
Priority to EP21153369.0A priority patent/EP3873121A1/en
Priority to PCT/CN2017/078261 priority patent/WO2018176187A1/zh
Priority to BR112019019671A priority patent/BR112019019671A2/pt
Priority to CN201780076347.6A priority patent/CN110050436B/zh
Priority to EP17904234.6A priority patent/EP3588840B1/en
Publication of WO2018176187A1 publication Critical patent/WO2018176187A1/zh
Priority to US16/586,373 priority patent/US11523274B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the embodiments of the present invention relate to the field of communications, and in particular, to a data transmission method, a user equipment, and a control plane node.
  • End to end (E2E) security protection can be implemented during user data transmission.
  • the E2E protection link is deployed at the gateway of the terminal device and the base station. Improve the security of user data.
  • the security protection of E2E can meet the security requirements of different applications and achieve security isolation between different slices or services.
  • E2E security protection may have the following phenomena, and different services may correspond to different security requirements.
  • the terminal device has multiple sessions. When the UE initiates a new service, the UE cannot determine whether to reuse the existing session of the UE or initiate a new session establishment process.
  • different security requirements may correspond to different user plane protocol stacks, and the prior art does not solve how the UE selects a suitable user plane protocol stack for data transmission.
  • the embodiments of the present invention provide a data transmission method, a user equipment, and a control plane node, which can reduce unnecessary signaling interaction caused by a new session during data transmission to meet the requirements of different services.
  • a data transmission method comprising: the user equipment UE determining a security attribute of a session of the UE.
  • the UE sends a session establishment request message to the control plane node, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application.
  • the UE determines, according to the security requirements of the application, whether the session of the UE corresponds to the security requirement of the application.
  • the session establishment process is triggered to establish a session corresponding to the security requirement for the application to meet the requirements of different services.
  • security attributes may include security algorithms (such as encryption algorithms for data encryption standards, encryption algorithms for advanced encryption standards, etc.), key lengths (such as 256 bits, 128 bits, etc.) and encrypted locations (such as the Internet). At least one of the security parameters of the protocol field, the transmission control protocol field, and the like.
  • the security requirements of the application may also include at least one of security algorithms, key lengths, and encrypted locations.
  • the method further includes: the UE receiving a session establishment response message from the control plane node, where the session establishment response message may include a security requirement corresponding to the application.
  • the security attributes of the session The UE transmits the data of the application according to the security attribute of the session corresponding to the security requirement of the application.
  • the security attribute of the session corresponding to the security requirement of the application includes an encrypted location
  • the UE sends the data of the application according to the security attribute of the session corresponding to the security requirement of the application, including: determining, by the UE, the encrypted location.
  • the encapsulation format of the applied data The UE generates a data packet according to the encapsulation format of the application data and the data of the application. And send the packet.
  • the security attribute of the session corresponding to the security requirements of the application may be a security attribute of the slice corresponding to the session corresponding to the security requirements of the application.
  • the session establishment response message may further include user plane protocol stack indication information, where the user plane protocol stack indication information is used to indicate an encapsulation format of the data of the application.
  • the security attribute of the session may be the security attribute of the slice corresponding to the session.
  • the method may further include: the UE sending a registration request message to the control plane node.
  • the UE receives the registration response message from the control plane node, and the registration response message may include the security attribute of the slice that the UE can access, and the security attribute of the slice that the UE can access may include the security attribute of the slice corresponding to the session.
  • the method may further include: when the security attribute of the at least one session in the session corresponds to the security requirement of the application, the UE may send the data of the application through one session in the at least one session.
  • the method may include: the control plane node receives a session establishment request message sent by the user equipment UE, and the session establishment request message is used to request to establish a session corresponding to the security requirement of the application of the UE. .
  • the control plane node sends a session establishment response message to the UE according to the session establishment request message, and the session establishment response message may include a security attribute of the session corresponding to the security requirement of the application.
  • the method can enable the UE to determine whether the session of the UE corresponds to the security requirement of the application according to the security requirement of the application. When the security attribute of the UE does not meet the security requirements of the application, the session establishment process is triggered to establish a session corresponding to the security requirement for the application to meet the requirements of different services.
  • the security attribute can include at least one of a security algorithm, a key length, and an encrypted location.
  • the security requirements of the application may also include at least one of security algorithms, key lengths, and encrypted locations.
  • the security attribute of the session corresponding to the security requirements of the application may be a security attribute of the slice corresponding to the session corresponding to the security requirements of the application.
  • the session establishment request message can include session management slice selection assistance information.
  • the method may further include: the control plane node may select the auxiliary information according to the session management slice to determine a security attribute of the session corresponding to the security requirement of the application.
  • the session establishment request message may include the security requirements of the application.
  • the method may further include: the control plane node may determine a security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application.
  • the session establishment request message may also include the security capabilities of the UE.
  • the control plane node may determine the security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application, including: the control plane node may determine the session corresponding to the security requirement of the application according to the security requirement of the application and the security capability of the UE. Security attribute.
  • the method may further include: the control plane node may determine a security attribute of the session corresponding to the security requirement of the application according to the local configuration policy.
  • the control plane node may receive security attributes of the session corresponding to the security requirements of the application from the subscription server.
  • the control plane node may receive an index from the policy decision node and determine a security attribute of the session corresponding to the security requirement of the application based on the index.
  • the session establishment response message may further include user plane protocol stack indication information, and the user plane The protocol stack indication information can be used to indicate a user plane protocol stack employed by the session corresponding to the security requirements of the application.
  • the user plane protocol stack can determine the encapsulation format of the application data.
  • the method may further include: the control plane node may receive the registration request message from the UE, where the registration request message may include the configured slice selection assistance information. .
  • the control plane node may select the auxiliary information according to the configured slice to determine the security attribute of the slice that the UE can access.
  • the control plane node sends a registration response message to the UE, and the registration response message may include a security attribute of the slice accessible by the UE.
  • a user equipment having a function of implementing the behavior of the user equipment in the actual method.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • a control plane node having a function of implementing the behavior of the control plane node in the actual method.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the user equipment can include a processor and a transmitter.
  • the processor is configured to determine a security attribute of a session of the user equipment UE.
  • the processor is further configured to: when the security attribute of the session of the UE does not meet the security requirement of the application, send a session establishment request message to the control plane node by using the sender, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application.
  • the user equipment can also include a memory for coupling to the processor to store program instructions and data necessary for the user equipment.
  • the processor is operative to execute a program in the memory to perform the actions involved by the UE in the above aspects.
  • a computer storage medium for storing computer software instructions for use by the user equipment, including a program for performing the actions involved by the UE in the above aspects.
  • a control plane node in a seventh aspect, can include: a receiver, a transmitter, and a receiver.
  • the processor is configured to receive, by using a receiver, a session establishment request message sent by the UE, where the session establishment request message is used to request to establish a session corresponding to a security requirement of the application of the UE.
  • the processor is further configured to send, by the sender, a session establishment response message according to the session establishment request message, where the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • the control plane node can also include a storage for coupling to the processor to store program instructions and data necessary for the control plane node.
  • the processor is operative to execute a program in the memory to perform the actions involved in controlling the surface node in the above aspects.
  • a computer storage medium for storing computer software instructions for use by the control plane node, including a program for performing the actions involved by the control plane nodes of the above aspects.
  • FIG. 1 is a schematic structural diagram of a protection link provided
  • FIG. 2 is a signaling interaction diagram of a data transmission method according to an embodiment of the present invention.
  • 3A is a schematic structural diagram of a data encapsulation format according to an embodiment of the present invention.
  • FIG. 3B is a schematic structural diagram of another data encapsulation format according to an embodiment of the present invention.
  • FIG. 3C is a schematic structural diagram of another data encapsulation format according to an embodiment of the present invention.
  • FIG. 4 is a signaling interaction diagram of another data transmission method according to an embodiment of the present disclosure.
  • FIG. 5 is a signaling interaction diagram of still another data transmission method according to an embodiment of the present disclosure.
  • FIG. 6 is a signaling interaction diagram of still another data transmission method according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a user equipment according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a control plane node according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another control plane node according to an embodiment of the present invention.
  • the protection link structure may include a user plane node and a control plane node.
  • the user plane node may include a terminal device, an access network (AN), a user plane (UP), and a data network (DN).
  • the control plane node may include an access and mobility management function (AMF) entity and a session management function (SMF) entity.
  • AMF access and mobility management function
  • SMF session management function
  • the terminal device involved in the present application may include various handheld devices, in-vehicle devices, wearable devices, computing devices, and various forms of user equipment (UE equipment) having wireless communication functions. )Wait.
  • the access network devices involved in the present application include, but are not limited to, an evolved Node B (eNB or eNodeB), a wireless fidelity access point (WiFi AP), and global microwave interoperability access. (worldwide interoperability for microwave access, WiMAX) and base station (BS).
  • eNB or eNodeB evolved Node B
  • WiFi AP wireless fidelity access point
  • BS base station
  • the foregoing terminal devices in this application may be collectively referred to as UEs.
  • the UP entity is used for packet processing and forwarding.
  • the UP entity may be a forwarding plane function with a packet data network gateway (PDN GW), a forwarding plane function of a serving gateway (S-GW), or a physical or virtual forwarding device such as a router or a switch.
  • PDN GW packet data network gateway
  • S-GW serving gateway
  • a physical or virtual forwarding device such as a router or a switch.
  • the DN node is used for packet processing and forwarding to provide data transmission services for users.
  • the DN may be a packet data network (PDN) such as the Internet, an IP multi-media service (IMS), or the like.
  • PDN packet data network
  • IMS IP multi-media service
  • the AMF entity is used for mobility management and forwarding path management in the mobile network.
  • the packet forwarding policy is sent to the UP, and the UP is instructed to process and forward the packet according to the packet forwarding policy.
  • SMF entities are used for session management in mobile networks, such as session establishment, modification, and release.
  • the entities involved in the present invention may exist in the form of a virtual machine in the form of a physical machine, which is not limited herein.
  • FIG. 2 is a signaling interaction diagram of a data transmission method according to an embodiment of the present invention. As shown in Figure 2, the method can To include:
  • Step 210 The UE determines a security attribute of an established session of the UE.
  • the session can be in an idle state or in an active state.
  • the security attribute may include at least one of a security algorithm, a key length, and an encrypted location.
  • the security algorithm may include a data encryption standard (DES) encryption algorithm, an Advanced Encryption Standard (AES) encryption algorithm, and a ZUC encryption algorithm (Ron Rivest, Adi Shamir and Leonard Adleman). , RSA) encryption algorithm or no encryption algorithm.
  • the key length can be 256 bits, 128 bits, 64 bits, or 0 bits (ie, no key field).
  • the encrypted location may be an internet protocol (IP) field or a Transmission Control Protocol (TCP) field (or User Datagram Protocol (UDP)).
  • IP internet protocol
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the security parameters of the encrypted location may be embodied as IP field encryption or IP field not encryption, TCP field encryption or TCP field field is not encrypted, and a combination of the encryption of the corresponding IP field and the encryption of the TCP field.
  • the key length security algorithm may include an AES encryption algorithm combined with a 128-bit key length, an AES encryption algorithm combined with a 256-bit key length or an RSA encryption algorithm combined with a 512-bit key length.
  • the UE determines that the security attribute of the session of the UE may be obtained by the UE acquiring the security attribute of the session of the UE.
  • the security attribute of the session of the UE may be obtained by the UE through a session establishment process or a registration process.
  • the security attribute of the session of the UE may be obtained from the memory of the UE, and is not limited. .
  • the security attribute of the session may also be a security attribute of the slice corresponding to the session. That is to say, the security attribute of the session may be the security attribute of the slice corresponding to the session, in other words, the security attribute of the session may be the security attribute of the slice serving the session.
  • the security attribute of the slice corresponding to the session may be obtained through a registration process.
  • the registration process refers to the process in which the UE registers with the carrier network to obtain the operator service.
  • the UE sends a registration request message to the control plane node, the registration request message including Configured Slack Selection Assistance Information (Configured NSSAI), so that the control plane node selects the auxiliary information according to the slice.
  • the registration response message may include a security attribute of a slice accessible by the UE.
  • the security attribute of the slice accessible by the UE corresponds to the security attribute of the at least one session.
  • the UE starts an application (application, APP).
  • application application, APP
  • the UE sends the data of the application through one session in at least one session.
  • Step 220 When the security attribute of the session of the UE does not meet the security requirement of the application, the UE sends a session establishment request message to the control plane node.
  • the session establishment request message may be used to request to establish a session corresponding to the security requirement of the application.
  • control plane node receives the session establishment request message sent by the UE.
  • the application may be an application opened by the user through the UE, such as a Baidu webpage, a Sina microblog, and the like.
  • the security requirements of the application may be configured by the operator on the UE or configured by the UE's manufacturer on the UE.
  • the security requirements of the application may include at least one of a security algorithm, a key length, and an encrypted location.
  • the security requirements of the application include the same security parameters as the security attributes of the session. It can also be different.
  • the UE determines that the security attribute of the session corresponds to the security requirement of the application of the UE.
  • the data of the application can be transmitted through the session, that is, the UE reuses the session.
  • the UE determines that the security attribute of the session does not meet the security requirement of the application of the UE. That is to say, the data of the above application cannot be transmitted on the session, and step 220 is performed.
  • the security algorithm in the security attribute of the session is the DES encryption algorithm
  • the security algorithm in the security requirement of the application is the AES encryption algorithm. Because the two encryption algorithms are different, the application that the UE just initiated cannot run on the session.
  • the key length in the security attribute of the session is 64 bits
  • the key length in the security requirement of the application is 256 bits. Since 64 bits is much smaller than 256 bits, the application that the UE just initiated cannot run on the session.
  • the key length in the security attribute of the session is 256 bits
  • the key length in the security requirement of the application is 64 bits. Since 64bit is much smaller than 256bit, the application just launched by the UE can run on the session.
  • the key length and security algorithm in the security attribute of the session are AES encryption algorithm and 128-bit key length respectively
  • the key length and security algorithm in the security requirements of the application are AES encryption algorithm and 512-bit key length. It can be seen that the encryption algorithm of the two is the same, but the key length in the security attribute of the session is smaller than the key length in the security requirement of the application, so that the application just initiated by the UE cannot run on the session.
  • the security attribute of the session may be a security attribute of a slice corresponding to the session.
  • the security attribute of the session corresponding to the security requirements of the application may be the security attribute of the slice corresponding to the session corresponding to the security requirements of the application.
  • the control plane node may be an AMF entity, or an SMF entity, or an AMF entity and an SMF entity.
  • the session establishment request message is used to request to establish a session corresponding to the security requirement of the application for data transmission.
  • Step 230 The control plane node sends a session establishment response message to the UE according to the session establishment request message.
  • the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • the session establishment response message includes indication information, and does not include a security attribute of the session corresponding to the security requirement of the application.
  • the indication information is used to instruct the UE to send data of the application according to the security requirement of the application. For example, when the security attribute corresponding to the session is the same as the security requirement of the application, the session establishment response message may only include the indication information.
  • the session establishment request message includes security requirements of the above application.
  • step 230 includes: the control plane node determines a security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application.
  • the control plane node can determine the security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application, and the following manner can be adopted:
  • the control plane node determines a security attribute of the session corresponding to the security requirement of the application according to the local configuration policy.
  • the operator initializes the control plane node and configures a correspondence table between the application security requirements and the session security attributes, as shown in Table 1.
  • the control plane node when the control plane node receives the security requirement of the application as A, the control plane node queries the local configuration policy table to find out that the security attribute of the session corresponding to the application security requirement A is X, and the control plane node determines the session.
  • the security attribute X is a security attribute of the session corresponding to the security requirement A of the application.
  • the control plane node queries the local configuration policy table to query that the security attribute of the session corresponding to the application security requirement B is Y, and the control plane node determines that the security attribute Y of the session is The security attribute of the session corresponding to the security requirement B of the application.
  • the control plane node receives the security attribute of the session corresponding to the security requirement of the application from the subscription server.
  • the operator initializes the subscription server and configures the correspondence table between the security requirements of the application and the security attributes of the session, as shown in Table 1.
  • the control plane node sends a security attribute acquisition request message to the subscription server, and the acquisition request message may include the security requirement of the application, and the subscription server will query the security requirement of the received application in the corresponding table to obtain the security requirement corresponding to the application.
  • the security attribute of the corresponding session is not limited to the following security attribute acquisition request message.
  • the subscription server sends an acquisition request response message to the control plane node, the response message may include a security attribute of the session, such that the control plane node receives the security attribute of the session corresponding to the security requirement of the application.
  • the control plane node receives the index from the policy decision node, and determines the security attribute of the session corresponding to the security requirement of the application according to the index.
  • the control plane node stores a correspondence table of indexes and security attributes of the session, as shown in Table 2.
  • the operator initializes the policy decision node and configures the security requirements of the application and the corresponding table 3 of the index in the control plane node.
  • the control plane node sends a security attribute acquisition request message to the policy decision node, and the acquisition request message may include the security requirement A of the application.
  • the policy decision node determines, according to the security requirement A of the application, the lookup table 3 determines that the index value of the security requirement A corresponding to the application is 1, and the policy decision node sends a get request response message to the control plane node, and the get response message may include the index value. 1.
  • the control plane node queries Table 2 according to the index value 1 to determine the security attribute X of the session corresponding to the security requirement A of the application.
  • the session establishment request message further includes a security capability of the UE.
  • the security capability of the UE may be a configuration policy of the UE itself.
  • the configuration policy may include that the UE only supports IP layer encryption and does not support transport layer encryption; in terms of key length, the configuration policy may only support 256 bits, or 128 bits, or 64 bits; in terms of security algorithms, The configuration policy may only support one or more of the DES encryption algorithm, or the DES encryption algorithm, the AES encryption algorithm, the ZUC encryption algorithm, and the RSA encryption algorithm.
  • control plane node determines the security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application and the security capability of the UE.
  • the control plane node identifies, according to the security capability of the UE, whether the UE can support the security requirement of the application. If the control plane node recognizes that the UE can support the security requirements of the application, for example, the security capability of the UE is to support IP layer encryption, and the key length is 256 bits, and the security parameter included in the security requirement of the application is IP layer encryption, and the key length is 64bit. At this time, the control plane node can determine the security attribute of the session corresponding to the security requirement of the application by using the above three methods.
  • the session establishment request message may include session management-network slice selection assistance information (SM-NSSAI).
  • SM-NSSAI session management-network slice selection assistance information
  • step 230 includes: the control plane node determines the security attribute of the session corresponding to the security requirement of the application according to the session management slice selection assistance information.
  • control plane node can determine the security attribute of the slice corresponding to the security requirement of the application by determining the security attribute corresponding to the security requirement of the application by means of the local configuration policy, the manner of obtaining from the subscription server, and the manner of obtaining the index from the policy decision node.
  • the security attributes of the session can be determined.
  • control plane node may also determine the security attribute of the session corresponding to the security requirement of the application by other means, which is not limited herein.
  • the session establishment response message may further include user plane protocol stack indication information, where the user plane protocol stack indication information is used to indicate a user plane protocol stack adopted by the session corresponding to the security requirement of the application, where the user plane protocol stack determines the application.
  • the encapsulation format of the data is used to indicate a user plane protocol stack adopted by the session corresponding to the security requirement of the application, where the user plane protocol stack determines the application.
  • the above method further includes step 240.
  • Step 240 The UE sends data of the application according to a security attribute of the session corresponding to the security requirement of the application.
  • the UE may determine the encapsulation format of the data of the application based on the encrypted location in the security attributes of the session.
  • An example is as follows:
  • the UE encrypts the IP layer when encapsulating the application data, and the encapsulation mode thereof may be as shown in FIG. 3A, and the application data is applied from the application.
  • the layer is transmitted to the physical layer through the IP layer, the encryption security layer, the transport layer, and the data link layer.
  • the UE needs to encrypt the transport layer when encapsulating the application data, and the encapsulation method thereof As shown in FIG. 3B, the applied data is transmitted from the application layer to the physical layer via the IP layer, the transport layer, the encryption security layer, and the data link layer.
  • the UE does not encrypt any layer when encapsulating the data of the application, and the encapsulation manner thereof may be as shown in FIG. 3C, and the application data is applied from the application layer to the IP layer and the transport layer.
  • the data link layer is transmitted to the physical layer.
  • the UE can encapsulate the application data according to the encapsulation format of the application data, generate a corresponding data packet, and send the data packet.
  • the session establishment request message may include the security requirements of the SM-NSSAI and the application.
  • step 230 includes: the control plane node determines a security attribute of the session corresponding to the security requirement of the application according to the security requirements of the SM-NSSAI and the application.
  • the control plane node sends a session establishment response message to the UE.
  • the session establishment response message includes a security attribute of the session corresponding to the security requirements of the application.
  • the session establishment response message includes indication information, and does not include a security attribute of the session corresponding to the security requirement of the application.
  • the indication information is used to instruct the UE to send data of the application according to the security requirement of the application. For example, when the security attribute corresponding to the session is the same as the security requirement of the application, the session establishment response message may only include the indication information, and does not include the security attribute of the session corresponding to the security requirement of the application.
  • the UE determines whether the session of the UE corresponds to the security requirement of the application according to the security requirement of the application.
  • the session is used to perform service data transmission of the application, that is, the session is reused, and the utilization of the established session is improved.
  • the session establishment process is triggered to establish a session corresponding to the security requirement for the application to meet the requirements of different services.
  • the following method for transmitting the service data of the UE to the application When the security attribute of the session does not meet the security requirements of the application, the following method for transmitting the service data of the UE to the application.
  • FIG. 4 is a signaling interaction diagram of a data transmission method according to an embodiment of the present invention.
  • the control plane node is an SMF entity as an example, and is specifically as follows.
  • Step 410 The UE sends a session establishment request message to the SMF entity.
  • the UE may send a session establishment request to the SMF entity by using the AN node and the AMF entity, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application for data transmission.
  • Step 420 The SMF entity determines a security attribute of the session corresponding to the security requirement of the application according to the session establishment request message.
  • the session establishment request message may include an application security requirement.
  • control plane node may determine the security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application, for example, the manner in which the control plane node can locally configure the policy, the manner acquired from the subscription server, or the policy decision node.
  • the way the index is obtained determines the security attributes of the session that correspond to the security requirements of the application.
  • the session establishment request message may further include session management-network slice selection assistance information (SM-NSSAI) for indicating one slice, so that the selection corresponds to application security.
  • SM-NSSAI session management-network slice selection assistance information
  • Step 430 The SMF entity selects a user plane protocol stack and a UP entity used by the session according to a security attribute of the session corresponding to the security requirement of the application.
  • Step 440 The SMF entity sends a user plane path establishment request message to the UP entity.
  • the user plane path setup request message may be used to trigger user plane path establishment between the AN node and the UP entity.
  • the user plane path setup request message may include a security attribute of the session corresponding to the security requirement of the application, for indicating that the UP entity adopts a suitable user plane protocol stack.
  • the user plane path setup request message may further include user plane protocol stack indication information, where the user plane protocol stack indication information may be used to indicate that the UP entity adopts a suitable user plane protocol stack.
  • Step 450 The UP entity sends a user plane path setup response message to the SMF entity.
  • the user plane path setup response message may include identifier information of the UP entity, such as an IP of the UP entity.
  • Step 460 The SMF entity sends a session establishment response message to the UE.
  • the session establishment response message may include a security attribute of the session corresponding to the security requirement of the application.
  • the session establishment response message may further include user plane protocol stack indication information, where the user plane protocol stack indication information is used to indicate a user plane protocol stack adopted by the session corresponding to the security requirement of the application, where the user plane protocol stack determines the application.
  • the encapsulation format of the data is as shown in FIGS. 3A, 3B, and 3C.
  • the UE may encapsulate the data of the application according to the encapsulation format of the application data, generate a corresponding data packet, and perform transmission of the service data of the application.
  • the UE may acquire the security attribute of the slice corresponding to the session in the registration process.
  • FIG. 5 is a signaling interaction diagram of still another data transmission method according to an embodiment of the present invention.
  • the control plane node is taken as an AMF entity as an example, and is specifically as follows.
  • Step 510 The UE sends a registration request message to the AMF entity.
  • the UE may send a registration request message to the AMF entity through the AN node, and the registration request message may include configured network slice selection assistance information (Configured NSSAI).
  • Configured NSSAI configured network slice selection assistance information
  • Step 520 The AMF entity selects the auxiliary information according to the configured slice, and determines a security attribute of the slice that the UE can access.
  • the AMF entity Before performing step 520, the AMF entity initiates an authentication and authorization process for the UE to complete the corresponding authentication and authorization process.
  • the AMF entity may select auxiliary information based on the configured slice to obtain accessible slice selection assistance information (accepted NSSAI) and security attributes of the accessible slice.
  • the accessible slice selection assistance information may include at least one session management slice selection assistance information.
  • the AMF entity may also obtain the accessible slice selection assistance information and the security attributes of the accessible slice by using the following acquisition method.
  • the security attributes of the accessible slice may include security attributes of at least one slice.
  • the AMF entity sends the security attribute acquisition request message to the SMF entity, and the security attribute acquisition request message may include the accessible slice selection assistance information, after determining the accessible slice selection auxiliary information according to the configured slice selection auxiliary information.
  • the SMF entity selects the auxiliary information according to the accessible slice, and obtains the accessible slice corresponding to the accessible slice selection auxiliary information and the security attribute of the corresponding slice.
  • the SMF entity sends a security attribute acquisition response message to the AMF entity, and the response message may include the accessible slice selection assistance information and the security attributes of the accessible slice to enable the AMF entity to acquire the security attribute of the accessible slice.
  • the AMF entity after the AMF entity selects the auxiliary information according to the configured slice and determines the accessible slice selection auxiliary information, the AMF entity sends a security attribute acquisition request message to the policy decision node, and the security attribute acquisition request message includes the accessible slice selection assistant. information.
  • the policy decision node may select the auxiliary information corresponding to the accessible slice selection assistance information according to the accessible slice selection and the security attributes of the corresponding slice.
  • the policy decision node sends a security attribute acquisition response message to the AMF entity, and the response message may include accessible slice selection assistance information and security attributes of the accessible slice to enable the AMF entity to acquire the security attributes of the accessible slice.
  • Method 3 Based on the implementation process of the method 1, the AMF entity may also send a security attribute acquisition request message to the policy node by using the SMF entity, so as to obtain the accessible slice selection auxiliary information and the accessable slice security from the policy node by using the SMF entity. Attributes.
  • the registration request message further includes a security capability of the UE.
  • the AMF entity determines the security attributes of the session corresponding to the security requirements of the application according to the configured slice selection assistance information and the security capabilities of the UE.
  • the step 230 For a description of the specific method, reference may be made to the step 230, which is not described herein again.
  • Step 530 The AMF entity sends a registration response message to the UE.
  • the registration response message may include a security attribute of the accessible slice.
  • the UE completes the registration process, that is, the UE acquires the accessible slice selection assistance information and the security attributes of the accessible slice, and the UE manages the slice selection auxiliary information SM according to at least one session in the accessible slice selection auxiliary information.
  • - NSSAI and at least one session management slice select the relationship between the auxiliary information and the service, and configure a correspondence table between the application service and the security attribute of the slice. As shown in Table 4,
  • the UE obtains the security attribute 1 of the slice corresponding to the APP1 according to the SM-NSSAI1 corresponding to the APP1; the UE acquires the security attribute 1 of the slice corresponding to the APP2 according to the SM-NSSAI1 corresponding to the APP2, that is, the APP1 and the APP2
  • the security requirements are the same; the UE obtains the security attribute 2 of the slice corresponding to APP3 according to the SM-NSSAI2 corresponding to APP3.
  • the UE may obtain the security attribute of the slice corresponding to the session by using a preset policy configured by the operator. As shown in Table 5,
  • Policy 1, Policy 2, and Policy 3 are respectively three policies configured by the UE stored by the UE.
  • the UE determines that the security attribute of the slice corresponding to APP1 is security attribute 1 according to the correspondence between APP1 and SM-NSSAI1 and the correspondence between the security attributes of the SM-NSSAI1 and the slice.
  • the UE when the UE starts APP2, the UE according to the correspondence between APP2 and SM-NSSAI1, and The correspondence between the SM-NSSAI1 and the security attributes of the slice determines that the security attribute of the slice corresponding to APP2 is the security attribute 1. It can be understood that the security attribute of the slice corresponding to APP1 is the security attribute 1, and the security attribute of the slice corresponding to APP2. Also for security attribute 1, the security requirements of APP1 and APP2 are the same.
  • the UE determines the security attribute of the slice corresponding to the APP3 as the security attribute 2 according to the correspondence between the APP3 and the SM-NSSAI2 and the correspondence between the security attributes of the SM-NSSAI2 and the slice.
  • the UE determines the security requirement of the application according to the correspondence between the application and the SM-NSSAI and the security relationship between the SM-NSSAI and the security attributes of the slice, that is, the security attribute of the corresponding slice is applied. Then, the UE determines whether there is a session in the slice corresponding to the application, and if yes, indicating that the security attribute corresponding to the session corresponds to the security requirement of the application, the session data of the session is transmitted by the UE; otherwise, the UE rejects the application.
  • the UE starts the application, and when the security attribute of the at least one session in the session corresponds to the security requirement of the application, the UE sends the data of the application through one of the at least one session.
  • the security attribute of the session here refers to the security attribute of the slice corresponding to the session.
  • the security attributes of the slice may be part of the SM-NSSAI, such as in the form of a field in the SM-NSSAI, that is, some fields of the SM-NSSAI are used to identify the slice.
  • Security attribute may be part of the SM-NSSAI, such as in the form of a field in the SM-NSSAI, that is, some fields of the SM-NSSAI are used to identify the slice.
  • FIG. 6 is a signaling interaction diagram of still another data transmission method according to an embodiment of the present invention. As shown in FIG. 6, the method may include:
  • Step 610 The UE sends a session establishment request message to the SMF entity.
  • the session establishment request message may be used to request to establish a session corresponding to the security requirement of the application.
  • the UE may send a session establishment request to the SMF entity through the AN node and the AMF entity.
  • Step 620 The SMF entity determines, according to the session establishment request message, a security attribute of a slice corresponding to the session corresponding to the security requirement of the application.
  • the session establishment request message may include an SM-NSSAI. Furthermore, the SMF entity can determine the security attributes of the slice corresponding to the SM-NSSAI according to the SM-NSSAI.
  • the session establishment request message further includes a security capability of the UE.
  • the SMF entity can determine the security attributes of the slice corresponding to the SM-NSSAI according to the SM-NSSAI and the security capabilities of the UE.
  • the method for determining, by the SMF entity, the security attribute of the session-corresponding slice corresponding to the security requirement of the application according to the SM-NSSAI may be implemented by referring to the obtaining method in step 520, which is not described herein.
  • Step 630 The SMF entity selects a user plane protocol stack and a UP entity according to a security attribute of a slice corresponding to the session corresponding to the security requirement of the application.
  • step 430 The implementation process of this step is similar to the implementation process of step 430, and details are not described herein again.
  • Step 640 The SMF entity sends a user plane path establishment request message to the UP entity.
  • the user plane path setup request message is used to trigger user plane path establishment between the AN node and the UP entity.
  • the user plane path setup request message may include a security attribute of the slice to indicate a security attribute of the current session of the UP entity, and instruct the UP entity to use a suitable user plane protocol stack according to the security attribute of the session.
  • the user plane path setup request may further include user plane protocol stack indication information for indicating that the target UP adopts a suitable user plane protocol stack.
  • Step 650 The UP entity sends a user plane path setup response message to the SMF entity.
  • the user plane path setup response message is used to establish a user plane path between the AN node and the UP entity.
  • the user plane path setup response message may include identifier information of the UP entity, such as an IP of the UP entity.
  • Step 660 The SMF entity sends a session establishment response message to the UE.
  • the session establishment response message may include a security attribute of a slice corresponding to the SM-NSSAI.
  • the session establishment response message includes indication information, and does not include a security attribute of a slice corresponding to the SM-NSSAI.
  • the indication information may be used to instruct the UE to send data of the application according to the security requirement of the application. For example, when the security requirement of the SM-NSSAI corresponding slice determined by the SMF entity is the same as the security requirement of the application, the session establishment response message may only include the indication information.
  • the session establishment response message may further include user plane protocol stack indication information, where the user plane protocol stack indication information is used to indicate a user plane protocol stack used by the session corresponding to the security requirement of the application, and the user plane protocol stack may be used.
  • the UE may encapsulate the data of the application according to the encapsulation format of the application data, generate a corresponding data packet, and perform transmission of the service data of the application.
  • the UE After the UE starts the application, the UE selects the SM-NSSAI according to the security requirements of the application, and then determines the security attribute of the slice corresponding to the security requirement of the application according to the correspondence between the SM-NSSAI and the security attribute of the slice, thereby establishing a new session and performing a new session. Data transmission to reduce unnecessary signaling interactions caused by new sessions.
  • the user equipment may include:
  • the processing unit 710 is configured to determine a security attribute of the session of the UE.
  • the sending unit 720 is configured to send a session establishment request message to the control plane node when the security attribute of the session of the UE does not meet the security requirement of the application, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application.
  • control plane node may be an AMF entity or an SMF entity, or the control plane node includes: an AMF entity and an SMF entity.
  • the security attribute includes at least one of a security algorithm, a key length, and an encrypted location.
  • the security requirements of the application include at least one of security algorithms, key lengths, and encrypted locations.
  • the device further includes a receiving unit 730, configured to receive a session establishment response message from the control plane node, where the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • a receiving unit 730 configured to receive a session establishment response message from the control plane node, where the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • the sending unit 720 is further configured to send data of the application according to a security attribute of the session corresponding to the security requirement of the application.
  • the processing unit 710 is further configured to determine, according to the encrypted location, an encapsulation format of the data of the application, and generate a data packet according to the encapsulation format of the application data and the data of the application.
  • the sending unit 720 is further configured to send a data packet.
  • the security attribute of the session corresponding to the security requirement of the application is a security attribute of the slice corresponding to the session corresponding to the security requirement of the application.
  • the session establishment response message further includes user plane protocol stack indication information, and the user plane protocol stack indication information is used.
  • the security attribute of the session is a security attribute of the slice corresponding to the session.
  • the sending unit 720 is further configured to send a registration request message to the control plane node.
  • the receiving unit 730 is further configured to receive a registration response message from the control plane node, where the registration response message includes a security attribute of a slice that the UE can access, and the security attribute of the slice that the UE can access includes a security attribute of the slice corresponding to the session.
  • the sending unit 720 is further configured to: when the security attribute of the at least one session in the session corresponds to the security requirement of the application, send the data of the application through one session in the at least one session.
  • each functional unit of the user equipment can be implemented by using the steps of the UE in the foregoing method. Therefore, the specific working process of the user equipment provided by the foregoing embodiment of the present invention is not described herein.
  • a control plane node provided by an embodiment of the present invention may be an AMF entity or an SMF entity, or the control plane node includes an AMF entity and an SMF entity.
  • the control plane node may include: a receiving unit 810 and a transmitting unit 820.
  • the receiving unit 810 is configured to receive a session establishment request message sent by the UE, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application of the UE.
  • the sending unit 820 is configured to send a session establishment response message to the UE according to the session establishment request message, where the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • the security attribute includes at least one of a security algorithm, a key length, and an encrypted location.
  • the security requirements of the application include at least one of security algorithms, key lengths, and encrypted locations.
  • the security attribute of the session corresponding to the security requirement of the application is a security attribute of the slice corresponding to the session corresponding to the security requirement of the application.
  • control plane node further includes a processing unit 830, and the session establishment request message includes session management slice selection assistance information.
  • the processing unit 830 is configured to determine, according to the session management slice selection assistance information, a security attribute of the session corresponding to the security requirement of the application.
  • the session establishment request message includes a security requirement of the application
  • the processing unit 830 is further configured to determine a security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application.
  • the session establishment request message further includes the security capability of the UE
  • the processing unit 830 is further configured to determine a security attribute of the session corresponding to the security requirement of the application according to the security requirement of the application and the security capability of the UE.
  • processing unit 830 is further configured to determine, according to the local configuration policy, a security attribute of the session corresponding to the security requirement of the application; or
  • the receiving unit 810 is further configured to receive, from the subscription service unit, a security attribute of the session corresponding to the security requirement of the application; or
  • the receiving unit 810 is further configured to receive an index from the policy decision node, and determine, according to the index, a security attribute of the session corresponding to the security requirement of the application.
  • the session establishment response message further includes user plane protocol stack indication information, where the user plane protocol stack indication information is used to indicate a user plane protocol stack adopted by the session corresponding to the security requirement of the application.
  • the receiving unit 810 is further configured to receive a registration request message from the UE, where the registration request message includes the configuration Slice selection auxiliary information.
  • the processing unit 830 is further configured to determine, according to the slice selection assistance information, a security attribute of a slice that the UE can access.
  • the sending unit 820 is further configured to send a registration response message to the UE, where the registration response message includes a security attribute of a slice that the UE can access.
  • each functional unit of the control plane node can be implemented by the steps of the control plane node in the above method. Therefore, the specific working process of the control plane node provided by the foregoing embodiment of the present invention is not described herein.
  • FIG. 9 is a schematic structural diagram of another user equipment according to an embodiment of the present invention.
  • the user equipment includes at least a processor 910, a transmitter 920, and a receiver 930.
  • the user equipment may further include a storage 930.
  • the transmitter 920 and the receiver 930 may be antennas.
  • the processor 910 can be a central processing unit (CPU), or a combination of a CPU and a hardware chip.
  • the hardware chip may be a pplication-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the processor 910 is used to control the entire network device as well as signal processing.
  • the memory 930 may include volatile memory such as random access memory (RAM); the memory 930 may also include non-volatile memory such as read only memory (ROM), flash memory, hard disk or solid state hard disk. The memory 930 may also include a combination of the above types of memories. Memory 930 is used to store various applications, operating systems and data. The memory 930 can transfer the stored data to the processor 910.
  • RAM random access memory
  • ROM read only memory
  • flash memory flash memory
  • hard disk or solid state hard disk solid state hard disk.
  • the memory 930 may also include a combination of the above types of memories.
  • Memory 930 is used to store various applications, operating systems and data. The memory 930 can transfer the stored data to the processor 910.
  • the memory 930 can be integrated in the processor 910 or can exist independently.
  • a memory 930 configured to store a program
  • the processor 910 is configured to execute a program in the memory 930 to perform the steps of the UE in each of the foregoing method embodiments.
  • the processor 910 is configured to determine a security attribute of a session of the UE.
  • the processor 910 is further configured to: when the security attribute of the session of the UE does not meet the security requirement of the application, send a session establishment request message to the control plane node by using the transmitter 920, where the session establishment request message is used to request to establish a security requirement corresponding to the application. Conversation.
  • FIG. 10 is a schematic structural diagram of another control plane node according to an embodiment of the present invention.
  • the control plane node may be an AMF entity or an SMF entity, or the control plane node includes an AMF entity and an SMF entity.
  • the control plane node includes at least a processor 1010, a transmitter 1020, and a receiver 1030.
  • control plane node may further include a storage 1030.
  • the transmitter 1020 and the receiver 1030 may be an antenna, that is, a wireless communication interface, or may be a wired communication interface, which is not limited. When the transmitter 1020 and the receiver 1030 are wired communication interfaces, the two may be the same communication interface or different communication interfaces.
  • the processor 1010 may be a CPU, or a combination of a CPU and a hardware chip.
  • the above hardware chip may be an ASIC, a PLD, or a combination thereof.
  • the above PLD may be a CPLD, an FPGA, a GAL, or any combination thereof.
  • the processor 1010 is for controlling the entire network device and signal processing.
  • the memory 1030 may include volatile memory, such as random access memory (RAM); the memory 1030 may also include non-volatile memory such as read only memory (ROM), flash memory, hard disk or solid state hard disk.
  • RAM random access memory
  • ROM read only memory
  • flash memory flash memory
  • hard disk hard disk
  • solid state hard disk solid state hard disk
  • the memory 1030 may also include a combination of the above types of memories.
  • the memory 1030 is used to store various applications, operating systems and data.
  • the memory 1030 can transfer the stored data to the processor 1010.
  • the memory 1030 can be integrated in the processor 1010 or can exist independently.
  • a memory 1030 configured to store a program
  • the processor 1010 is configured to execute a program in the memory 1030 to perform the steps of the control plane node in each of the foregoing method embodiments.
  • the processor 1010 is configured to receive, by the receiver 1030, a session establishment request message sent by the UE, where the session establishment request message is used to request to establish a session corresponding to the security requirement of the application of the UE.
  • the processor 1010 is further configured to send, by the sender 1020, a session establishment response message according to the session establishment request message, where the session establishment response message includes a security attribute of the session corresponding to the security requirement of the application.
  • Non-transitory medium such as random access memory, read only memory, flash memory, hard disk, solid state disk, magnetic tape, floppy disk, optical disc, and any combination thereof.

Abstract

本发明实施例涉及一种数据传输方法、用户设备和控制面节点。通过用户设备UE确定UE的会话的安全属性。当UE的会话的安全属性不满足应用的安全需求时，UE向控制面节点发送会话建立请求消息，该会话建立请求消息用于请求建立对应于该应用的安全需求的会话。也就是说，UE根据应用的安全需求，确定UE的会话是否对应于应用的安全需求。当UE的安全属性不满足应用的安全需求时，触发会话建立流程，为该应用建立对应于安全需求的会话，以减少数据传输过程中新建会话引起的不必要的信令交互，满足不同业务的需求。

Description

数据传输方法、用户设备和控制面节点 技术领域
本申请实施例涉及通信领域，尤其涉及一种数据传输方法、用户设备和控制面节点。
背景技术
端到端(end to end，E2E)安全保护可以在用户数据传输过程中实现安全保护。在终端设备(如用户设备)与网络设备(如基站)之间，由于基站处于低安全区域，容易被攻击，导致用户隐私泄露，将E2E保护链路部署在终端设备与基站的网关处，可以提高用户数据的安全性。并且，E2E的安全保护能够满足不同应用差异化的安全需求，实现不同切片或业务之间的安全隔离。
然而，E2E安全保护会出现如下现象，不同的业务可能对应不同的安全需求。例如，终端设备具有多个会话，当UE发起新的业务时，UE无法确定是重用UE的现有会话，还是发起新的会话建立流程。另外，不同的安全需求可能对应不同的用户面协议栈，而现有技术没有解决UE如何选择合适的用户面协议栈来进行数据传输。
发明内容
本发明实施例提供了一种数据传输方法、用户设备和控制面节点，可以减少数据传输过程中新建会话引起的不必要的信令交互，以满足不同业务的需求。
第一方面，提供了一种数据传输方法，该方法可以包括：用户设备UE确定UE的会话的安全属性。当UE的会话的安全属性不满足应用的安全需求时，UE向控制面节点发送会话建立请求消息，会话建立请求消息用于请求建立对应于应用的安全需求的会话。UE根据应用的安全需求，确定UE的会话是否对应于应用的安全需求。当UE的安全属性不满足应用的安全需求时，触发会话建立流程，为该应用建立对应于安全需求的会话，以满足不同业务的需求。
在一个可选的实现中，安全属性可以包括安全算法(如数据加密标准的加密算法、高级加密标准的加密算法等)、密钥长度(如256比特、128比特等)和加密位置(如因特网协议字段、传输控制协议字段等)中的至少一种安全参数。应用的安全需求也可以包括安全算法、密钥长度和加密位置中的至少一种安全参数。
在一个可选的实现中，在UE向控制面节点发送会话建立请求消息之后，该方法还包括：UE从控制面节点接收会话建立响应消息，会话建立响应消息可以包括对应于应用的安全需求的会话的安全属性。UE根据对应于应用的安全需求的会话的安全属性，发送应用的数据。
在一个可选的实现中，对应于应用的安全需求的会话的安全属性包括加密位置，UE根据对应于应用的安全需求的会话的安全属性，发送应用的数据，包括：UE根据加密位置，确定应用的数据的封装格式。UE根据应用数据的封装格式以及应用的数据，生成数据包， 并发送数据包。
在一个可选的实现中，对应于应用的安全需求的会话的安全属性可以为对应于应用的安全需求的会话对应的切片的安全属性。
在一个可选的实现中，会话建立响应消息还可以包括用户面协议栈指示信息，用户面协议栈指示信息用于指示应用的数据的封装格式。
在一个可选的实现中，会话的安全属性可以为会话对应的切片的安全属性。
在一个可选的实现中，在UE确定UE的会话的安全属性之前，该方法还可以包括：UE向控制面节点发送注册请求消息。UE从控制面节点接收注册响应消息，注册响应消息可以包括UE可接入的切片的安全属性，UE可接入的切片的安全属性可以包含会话对应的切片的安全属性。
在一个可选的实现中，该方法还可以包括：当会话中存在至少一个会话的安全属性对应于应用的安全需求时，UE可以通过至少一个会话中一个会话发送应用的数据。
第二方面，提供了另一种数据传输方法，该方法可以包括：控制面节点接收用户设备UE发送的会话建立请求消息，会话建立请求消息用于请求建立对应于UE的应用的安全需求的会话。控制面节点根据会话建立请求消息，向UE发送会话建立响应消息，会话建立响应消息可以包括对应于应用的安全需求的会话的安全属性。该方法可以使UE根据应用的安全需求，确定UE的会话是否对应于应用的安全需求。当UE的安全属性不满足应用的安全需求时，触发会话建立流程，为该应用建立对应于安全需求的会话，以满足不同业务的需求。
在一个可选的实现中，安全属性可以包括安全算法、密钥长度和加密位置中的至少一种安全参数。应用的安全需求也可以包括安全算法、密钥长度和加密位置中的至少一种安全参数。
在一个可选的实现中，对应于应用的安全需求的会话的安全属性可以为对应于应用的安全需求的会话对应的切片的安全属性。
在一个可选的实现中，会话建立请求消息可以包括会话管理切片选择辅助信息。该方法还可以包括：控制面节点可以根据会话管理切片选择辅助信息，确定对应于应用的安全需求的会话的安全属性。
在一个可选的实现中，会话建立请求消息可以包括应用的安全需求。该方法还可以包括：控制面节点可以根据应用的安全需求，确定对应于应用的安全需求的会话的安全属性。
在一个可选的实现中，会话建立请求消息还可以包括UE的安全能力。控制面节点可以根据应用的安全需求，确定对应于应用的安全需求的会话的安全属性，包括：控制面节点可以根据应用的安全需求和UE的安全能力，确定对应于应用的安全需求的会话的安全属性。
在一个可选的实现中，该方法还可以包括：控制面节点可以根据本地配置策略，确定对应于应用的安全需求的会话的安全属性。或，控制面节点可以从签约服务器接收对应于应用的安全需求的会话的安全属性。或，控制面节点可以从策略决策节点接收索引，并根据索引，确定对应于应用的安全需求的会话的安全属性。
在一个可选的实现中，会话建立响应消息还可以包括用户面协议栈指示信息，用户面 协议栈指示信息可以用于指示对应于应用的安全需求的会话采用的用户面协议栈。该用户面协议栈可以决定应用的数据的封装格式。
在一个可选的实现中，在控制面节点接收UE发送的会话建立请求消息之前，该方法还可以包括：控制面节点可以从UE接收注册请求消息，注册请求消息可以包括配置的切片选择辅助信息。控制面节点可以根据配置的切片选择辅助信息，确定UE可接入的切片的安全属性。控制面节点向UE发送注册响应消息，注册响应消息可以包括UE可接入的切片的安全属性。
第三方面，提供了一种用户设备，该用户设备具有实现上述方法实际中用户设备行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第四方面，提供了一种控制面节点，该控制面节点具有实现上述方法实际中控制面节点行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第五方面，提供了另一种用户设备。该用户设备可以包括：处理器和发送器。其中，处理器用于确定用户设备UE的会话的安全属性。处理器还用于当UE的会话的安全属性不满足应用的安全需求时，通过发送器向控制面节点发送会话建立请求消息，会话建立请求消息用于请求建立对应于应用的安全需求的会话。
该用户设备还可以包括储存器，该存储器用于与处理器耦合连接，保存该用户设备必要的程序指令和数据。处理器用于执行存储器中的程序，以执行上述方面UE所涉及的动作。
第六方面，提供了一种计算机存储介质，用于储存为上述用户设备所用的计算机软件指令，其包含用于执行上述方面UE所涉及的动作的程序。
第七方面，提供了一种控制面节点。该控制面节点可以包括：接收器、发送器和接收器。其中，处理器，用于通过接收器接收UE发送的会话建立请求消息，会话建立请求消息用于请求建立对应于UE的应用的安全需求的会话。处理器还用于根据会话建立请求消息，通过发送器向UE发送会话建立响应消息，会话建立响应消息包括对应于应用的安全需求的会话的安全属性。该控制面节点还可以包括储存器，该存储器用于与处理器耦合连接，保存该控制面节点必要的程序指令和数据。处理器用于执行存储器中的程序，以执行上述方面控制面节点所涉及的动作。
再一方面，提供了一种计算机存储介质，用于储存为上述控制面节点所用的计算机软件指令，其包含用于执行上述方面控制面节点所涉及的动作的程序。
附图说明
图1为提供的保护链路的结构示意图；
图2为本发明实施例提供的一种数据传输方法的信令交互图；
图3A为本发明实施例提供的一种数据的封装格式的结构示意图；
图3B为本发明实施例提供的另一种数据的封装格式的结构示意图
图3C为本发明实施例提供的再一种数据的封装格式的结构示意图
图4为本发明实施例提供的另一种数据传输方法的信令交互图；
图5为本发明实施例提供的再一种数据传输方法的信令交互图；
图6为本发明实施例提供的再一种数据传输方法的信令交互图；
图7为本发明实施例提供的一种用户设备的结构示意图；
图8为本发明实施例提供的一种控制面节点的结构示意图；
图9为本发明实施例提供的另一种用户设备的结构示意图
图10为本发明实施例提供的另一种控制面节点的结构示意图。
具体实施方式
下面通过附图和实施例，对本申请的技术方案做进一步的详细描述。
本申请提供的数据传输方法应用于无线通信场景的端到端安全保护链路中。如图1所示，该保护链路结构可以包括用户面节点和控制面节点。用户面节点可以包括终端设备、接入网设备(access network，AN)、转发面节点(user plane，UP)和数据网络(data network，DN)。控制面节点可以包括接入和移动性管理节点(access and mobility management function，AMF)实体和会话管理节点(session management function，SMF)实体。
其中，本申请所涉及到的终端设备可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备(英文：wearable device)、计算设备,以及各种形式的用户设备(user equipment,UE)等。本申请所涉及到的接入网设备包括但不限于演进的节点B(evolved NodeB,eNB或者eNodeB)、无线保真接入点(wireless fidelity access point，WiFi AP)、全球微波互操作性接入(worldwide interoperability for microwave access，WiMAX)和基站(base station，BS)等。为方便描述，本申请中上述的终端设备可以统称为UE。
UP实体用于报文处理与转发。UP实体可以是具有分组数据网络网关(packet data network gateway，PDN GW)的转发面功能、服务网关(serving gateway,S-GW)的转发面功能、路由器或交换机等物理或虚拟的转发设备。
DN节点用于报文处理与转发，为用户提供数据传输服务。DN可以是分组数据网络(packet data network，PDN)，如Internet、IP多媒体业务(IP multi-media service，IMS)等。
AMF实体用于移动网络中的移动性管理、转发路径管理，如向UP下发报文转发策略，指示UP根据报文转发策略进行报文处理和转发。
SMF实体用于移动网络中的会话管理，如会话建立、修改和释放。如UE IP地址分配，用户面节点的选择或重选等。
需要说明的是，本发明中涉及的各个实体，如UP实体、AMF实体、SMF实体等，除了以物理机的形式存在，还可以以虚拟机的形式存在，本申请在此不做限定。
图2为本发明实施例提供的一种数据传输方法的信令交互图。如图2所示，该方法可 以包括：
步骤210、UE确定该UE的会话(established session)的安全属性。
其中，该会话可以处于空闲态，也可以处于激活态。
可选地，安全属性可以包括安全算法、密钥长度和加密位置中的至少一种安全参数。其中，安全算法可以包括数据加密标准(data encryption standard，DES)的加密算法、高级加密标准(Advanced Encryption Standard，AES)的加密算法、祖冲之(ZUC)加密算法，(Ron Rivest,Adi Shamir and Leonard Adleman，RSA)加密算法或无加密算法。
密钥长度可以是256比特(bit)、128bit、64bit或0bit(即无密钥字段)。
加密位置(或称加密字段)可以是因特网协议(internet protocol，IP)字段或传输控制协议(Transmission Control Protocol，TCP)字段(或用户数据包协议(User Datagram Protocol，UDP))。例如，加密位置的安全参数可以体现为IP字段加密或IP字段不加密，TCP字段加密或TCP字段字段不加密，以及相应IP字段的加密情况和TCP字段的加密情况的组合。
密钥长度的安全算法可以包括AES加密算法结合128bit的密钥长度、AES加密算法结合256bit的密钥长度或RSA加密算法结合512bit的密钥长度。
可选地，UE确定该UE的会话的安全属性可以通过该UE获取该UE的会话的安全属性来实现，例如，可以是UE通过会话建立流程或注册流程获取该UE的会话的安全属性，也可以是从UE的存储器中获取UE的会话的安全属性，不予限制。。
可选地，会话的安全属性也可以是会话对应的切片的安全属性。也就是说，会话的安全属性可以为会话对应的切片的安全属性，换言之，会话的安全属性可以是为会话提供服务的切片的安全属性。
可选地，在UE确定该UE的会话的安全属性之前，会话对应的切片的安全属性可以通过注册过程获取。注册过程指的是UE注册到运营商网络以获取运营商服务的过程。
在一个示例中，UE向控制面节点发送注册请求消息，该注册请求消息包括配置的切片选择辅助信息(Configured Network sl ice selection assistance information，Configured NSSAI)，以使控制面节点根据切片选择辅助信息，确定UE可接入的切片的安全属性，从而向UE发送注册响应消息，该注册响应消息可以包括UE可接入的切片的安全属性。其中，UE可接入的切片的安全属性对应至少一个会话的安全属性。
UE启动一个应用(application，APP)，当会话中存在至少一个会话的安全属性对应于该应用的安全需求时，UE通过至少一个会话中一个会话发送应用的数据。
步骤220、当该UE的会话的安全属性不满足应用的安全需求时，该UE向控制面节点发送会话建立请求消息。
其中，该会话建立请求消息可以用于请求建立对应于应用的安全需求的会话。
相应地，控制面节点接收UE发送的会话建立请求消息。
其中，该应用可以为用户通过UE开启的应用，如百度网页、新浪微博等。该应用的安全需求可以由运营商配置在UE上或由UE的生产商配置在UE上。
可选地，应用的安全需求可以包括安全算法、密钥长度和加密位置中的至少一种安全参数。
其中，应用的安全需求包含的安全参数与会话的安全属性包含的安全参数可以相同 也可以不同。
在一个示例中，当上述应用的安全需求包括的安全参数与会话的安全属性包含的安全参数相同或低于会话的安全属性时，UE确定会话的安全属性对应于UE的应用的安全需求，此时该应用的数据可以通过会话进行传输，即UE对该会话进行重用。
在另一个示例中，当上述应用的安全需求包含的安全参数与会话的安全属性包含的安全参数不相同时，UE确定会话的安全属性不满足UE的应用的安全需求。也就是说，上述应用的数据不能在该会话上传输，执行步骤220。
例如，若会话的安全属性中的安全算法为DES加密算法，应用的安全需求中的安全算法为AES加密算法。由于两种加密算法不同，导致UE刚发起的应用不能在该会话上运行。
若会话的安全属性中的密钥长度为64bit，应用的安全需求中的密钥长度为256bit。由于64bit远小于256bit，导致UE刚发起的应用不能在该会话上运行。
若会话的安全属性中的密钥长度为256bit，应用的安全需求中的密钥长度为64bit。由于64bit远小于256bit，因此UE刚发起的应用可以在该会话上运行。
若会话的安全属性中密钥长度和安全算法分别为AES加密算法和128bit的密钥长度，应用的安全需求中密钥长度和安全算法分别为AES加密算法和512bit的密钥长度。可见二者的加密算法相同，但该会话的安全属性中密钥长度小于应用的安全需求中密钥长度，导致UE刚发起的应用不能在该会话上运行。
可选地，会话的安全属性可以为会话对应的切片的安全属性。对应于应用的安全需求的会话的安全属性可以为对应于应用的安全需求的会话对应的切片的安全属性。
其中，控制面节点可以是AMF实体，或SMF实体，或AMF实体和SMF实体。该会话建立请求消息用于请求建立对应于应用的安全需求的会话，以进行数据传输。
步骤230、控制面节点根据会话建立请求消息，向UE发送会话建立响应消息。
其中，该会话建立响应消息包括对应于应用的安全需求的会话的安全属性。
可选地，该会话建立响应消息包括指示信息，而不包括对应于应用的安全需求的会话的安全属性。该指示信息用于指示UE根据应用的安全需求，发送该应用的数据。比如，当会话对应的安全属性与应用的安全需求相同时，该会话建立响应消息可以只包含指示信息。
在一种实施场景下，会话建立请求消息包括上述应用的安全需求。
可选地，步骤230包括：控制面节点根据应用的安全需求，确定对应于应用的安全需求的会话的安全属性。
其中，控制面节点根据应用的安全需求可以通过以下方式确定对应于应用的安全需求的会话的安全属性，具体可以采用以下方式：
方式(1)、控制面节点根据本地配置策略，确定对应于应用的安全需求的会话的安全属性。
运营商对控制面节点进行初始化配置，配置出应用的安全需求与会话的安全属性的对应表，如表1。
表1
应用的安全需求 会话的安全属性
A X
B Y
表1中，当控制面节点接收到应用的安全需求为A时，控制面节点在本地配置策略表中查询出应用的安全需求A对应的会话的安全属性为X，则控制面节点确定会话的安全属性X为对应于应用的安全需求A的会话的安全属性。当控制面节点接收到应用的安全需求为B时，控制面节点在本地配置策略表中查询出应用的安全需求B对应的会话的安全属性为Y，则控制面节点确定会话的安全属性Y为对应于应用的安全需求B的会话的安全属性。
方式(2)、控制面节点从签约服务器接收对应于应用的安全需求的会话的安全属性。
运营商对签约服务器进行初始化配置，配置出应用的安全需求与会话的安全属性的对应表，如表1。
控制面节点向签约服务器发送安全属性获取请求消息，该获取请求消息可以包括应用的安全需求，签约服务器将接收到的应用的安全需求，在对应表中进行查询，获取对应于该应用的安全需求对应的会话的安全属性。
签约服务器向控制面节点发送获取请求响应消息，该响应消息可以包括会话的安全属性，从而使控制面节点接收对应于应用的安全需求的会话的安全属性。
方式(3)、控制面节点从策略决策节点接收索引，并根据索引确定对应于应用的安全需求的会话的安全属性。
控制面节点存储索引与会话的安全属性的对应表，如表2。
表2
索引 会话的安全属性
1 X
2 Y
运营商对策略决策节点进行初始化配置，配置出应用的安全需求与控制面节点中索引的对应表3。
表3
应用的安全需求 索引
A 1
B 2
控制面节点向策略决策节点发送安全属性获取请求消息，该获取请求消息可以包括应用的安全需求A。策略决策节点根据应用的安全需求A，查找表3确定对应于该应用的安全需求A的索引值为1，策略决策节点向控制面节点发送获取请求响应消息，该获取响应消息可以包括该索引值1，控制面节点根据该索引值1查询表2，确定对应于应用的安全需求A的会话的安全属性X。
可选地，会话建立请求消息还包括UE的安全能力。
其中，UE的安全能力可以是UE自身的配置策略。例如，在加密位置方面，该配置策略可以包括UE只支持IP层加密，不支持传输层加密；在密钥长度方面，该配置策略可以只支持256bit，或128bit，或64bit；在安全算法方面，该配置策略可以只支持DES加密算法，或者DES加密算法、AES加密算法、ZUC加密算法和RSA加密算法中的一种或多种。
结合上述三种方式，控制面节点根据应用的安全需求和UE的安全能力，确定对应于应用的安全需求的会话的安全属性。
示例性的，控制面节点根据UE的安全能力，识别该UE是否能够支持该应用的安全需求。若控制面节点识别出该UE能够支持该应用的安全需求，如UE的安全能力为支持IP层加密，密钥长度为256bit，应用的安全需求包含的安全参数为IP层加密，密钥长度为64bit。此时控制面节点可以通过上述三种方式，确定对应于应用的安全需求的会话的安全属性。
在另一种实施场景下，当会话的安全属性为会话对应的切片的安全属性时，会话建立请求消息可以包括会话管理切片选择辅助信息(session management-network slice selection assistance information，SM-NSSAI)。
可选地，步骤230包括：控制面节点根据会话管理切片选择辅助信息，确定对应于应用的安全需求的会话的安全属性。
例如，控制面节点可以通过本地配置策略的方式、从签约服务器获取的方式和从策略决策节点获取索引的方式，确定对应于应用的安全需求的切片的安全属性，从而确定对应于应用的安全需求的会话的安全属性。
需要说明的是，控制面节点还可以通过其他方式确定对应于应用的安全需求的会话的安全属性，本发明实施例在此不作限定。
可选地，会话建立响应消息还可以包括用户面协议栈指示信息，用户面协议栈指示信息用于指示对应于应用的安全需求的会话采用的用户面协议栈，该用户面协议栈决定应用的数据的封装格式。
可选地，上述方法还包括步骤240。
步骤240、UE根据对应于应用的安全需求的会话的安全属性，发送该应用的数据。
在一个示例中，UE可以根据会话的安全属性中的加密位置，确定应用的数据的封装格式。举例说明如下：
若会话的安全属性中的加密位置为IP字段，即IP字段需要加密，则UE在对应用的数据进行封装时，对IP层加密，其封装方式可以如图3A所示，应用的数据从应用层经IP层、加密安全层、传输层、数据链路层向物理层传输。
若会话的安全属性中的加密位置为TCP字段，即TCP字段需要加密(其中，传输层可以采用TCP协议等)，则UE在对应用的数据进行封装时，需要对传输层加密，其封装方式可以如图3B所示，应用的数据从应用层经IP层、传输层、加密安全层、数据链路层向物理层传输。
若会话的安全属性中不含加密位置，则UE在对应用的数据进行封装时，不对任何层加密，其封装方式可以如图3C所示，应用的数据从应用层经IP层、传输层、数据链路层向物理层传输。
可见，UE可以按照应用数据的封装格式对应用的数据进行封装，生成相应数据包，并发送数据包。
再一种实施场景下，当会话的安全属性为会话对应的切片的安全属性时，会话建立请求消息可以包括SM-NSSAI和应用的安全需求。可选地，步骤230包括：控制面节点根据SM-NSSAI和应用的安全需求，确定对应于应用的安全需求的会话的安全属性。
控制面节点向UE发送会话建立响应消息。该会话建立响应消息包括对应于应用的安全需求的会话的安全属性。可选地，该会话建立响应消息包括指示信息，而不包括对应于应用的安全需求的会话的安全属性。其中，该指示信息用于指示UE根据应用的安全需求，发送该应用的数据。比如，当会话对应的安全属性与应用的安全需求相同时，该会话建立响应消息可以只包含指示信息，而不包括对应于应用的安全需求的会话的安全属性。
由此可知，UE根据应用的安全需求，确定UE的会话是否对应于应用的安全需求。当会话的安全属性对应于应用的安全需求时，使用该会话进行该应用的业务数据传输，即实现会话的重新使用，提高已建会话的利用率。当UE的会话的安全属性不满足应用的安全需求时，触发会话建立流程，为该应用建立对应于安全需求的会话，以满足不同业务的需求。
在会话的安全属性不满足应用的安全需求时，下面对UE对应用的业务数据的传输方法。
图4为本发明实施例提供的一种数据传输方法的信令交互图。该实施例中以控制面节点为SMF实体为例进行说明，具体如下。
步骤410、UE向SMF实体发送会话建立请求消息。
可选地，UE可以通过AN节点、AMF实体向SMF实体发送会话建立请求，该会话建立请求消息用于请求建立对应于应用的安全需求的会话，以进行数据传输。
步骤420、SMF实体根据会话建立请求消息，确定对应于应用的安全需求的会话的安全属性。
其中，会话建立请求消息可以包括应用的安全需求。
此时，控制面节点可以根据应用的安全需求，确定对应于应用的安全需求的会话的安全属性，例如，控制面节点可以通过本地配置策略的方式、从签约服务器获取的方式或从策略决策节点获取索引的方式，确定对应于应用的安全需求的会话的安全属性。
可选地，在切片场景中，会话建立请求消息还可以包括会话管理切片选择辅助信息(session management-network slice selection assistance information，SM-NSSAI)，以用于指示一个切片，从而选择对应于应用安全需求的切片。
步骤430、SMF实体根据对应于应用的安全需求的会话的安全属性，选择该会话采用的用户面协议栈和UP实体。
步骤440、SMF实体向UP实体发送用户面路径建立请求消息。
其中，用户面路径建立请求消息可以用于触发AN节点与UP实体之间的用户面路径建立。
其中，用户面路径建立请求消息可以包括对应于应用的安全需求的会话的安全属性，以用于指示UP实体采用合适的用户面协议栈。
可选地，用户面路径建立请求消息还可以包括用户面协议栈指示信息，该用户面协议栈指示信息可以用于指示UP实体采用合适的用户面协议栈。
步骤450、UP实体向SMF实体发送用户面路径建立应答消息。
可选地，用户面路径建立应答消息可以包括UP实体的标识信息，如UP实体的IP。
步骤460、SMF实体向UE发送会话建立响应消息。
其中，该会话建立响应消息可以包括对应于应用的安全需求的会话的安全属性。
可选地，会话建立响应消息还可以包括用户面协议栈指示信息，用户面协议栈指示信息用于指示对应于应用的安全需求的会话采用的用户面协议栈，该用户面协议栈决定应用的数据的封装格式，如图3A、图3B和图3C所示。
例如，UE可以按照应用数据的封装格式对应用的数据进行封装，生成相应数据包，并进行该应用的业务数据的传输。
可选地，当对应于应用的安全需求的会话的安全属性为对应于应用的安全需求的会话对应的切片的安全属性时，UE可以在注册过程中获取会话对应的切片的安全属性。
图5为本发明实施例提供的再一种数据传输方法的信令交互图。该实施例中以控制面节点为AMF实体为例进行说明，具体如下。
步骤510、UE向AMF实体发送注册请求消息。
UE可以通过AN节点向AMF实体发送注册请求消息，该注册请求消息可以包括配置的切片选择辅助信息(configured network slice selection assistance information，Configured NSSAI)。
步骤520、AMF实体根据配置的切片选择辅助信息，确定UE可接入的切片的安全属性。
在执行步骤520之前，AMF实体发起对UE的鉴权、授权过程，以完成相应的鉴权、授权过程。
在一个示例中，AMF实体可以根据配置的切片选择辅助信息，获取可接入的切片选择辅助信息(accepted NSSAI)以及可接入的切片的安全属性。可接入的切片选择辅助信息可以包括至少一个会话管理切片选择辅助信息。
可选地，AMF实体还可以通过以下获取方法，获取可接入的切片选择辅助信息以及可接入的切片的安全属性。可接入的切片的安全属性可以包括至少一个切片的安全属性。
方法一，AMF实体根据配置的切片选择辅助信息，确定可接入的切片选择辅助信息后，向SMF实体发送安全属性获取请求消息，安全属性获取请求消息可以包括可接入的切片选择辅助信息。
例如，SMF实体根据可接入的切片选择辅助信息，获取可接入的切片选择辅助信息对应的可接入的切片以及相应切片的安全属性。SMF实体向AMF实体发送安全属性获取响应消息，该响应消息可以包括可接入的切片选择辅助信息和可接入切片的安全属性，以使AMF实体获取可接入切片的安全属性。
方法二，AMF实体根据配置的切片选择辅助信息，确定可接入的切片选择辅助信息后，AMF实体向策略决策节点发送安全属性获取请求消息，安全属性获取请求消息包括可接入的切片选择辅助信息。
例如，策略决策节点可以根据可接入的切片选择辅助信息，获取可接入的切片选择辅助信息对应的可接入的切片以及相应切片的安全属性。
策略决策节点向AMF实体发送安全属性获取响应消息，该响应消息可以包括可接入的切片选择辅助信息和可接入切片的安全属性，以使AMF实体获取可接入切片的安全属性。
方法三，基于方法一的实施过程，AMF实体还可以通过SMF实体向策略节点发送安全属性获取请求消息，以通过SMF实体从策略节点获取可接入的切片选择辅助信息和可接入切片的安全属性。
可选地，注册请求消息还包括UE的安全能力。
结合上述三种方式，AMF实体根据配置的切片选择辅助信息和UE的安全能力，确定对应于应用的安全需求的会话的安全属性。具体方法描述可以参考步骤230，本发明实施例此处不再赘述。
步骤530、AMF实体向UE发送注册响应消息。
其中，该注册响应消息可以包括可接入切片的安全属性。
可选地，UE完成注册过程，即UE获取可接入的切片选择辅助信息和可接入切片的安全属性，UE根据可接入的切片选择辅助信息中的至少一个会话管理切片选择辅助信息SM-NSSAI和至少一个会话管理切片选择辅助信息与业务的关系，配置应用业务与切片的安全属性的对应表。如表4所示，
表4
业务 SM-NSSAI 切片的安全属性
APP1 SM-NSSAI1 安全属性1
APP2 SM-NSSAI1 安全属性1
APP3 SM-NSSAI2 安全属性2
表4中，UE根据APP1对应的SM-NSSAI1，获取APP1对应的切片的安全属性1；UE根据APP2对应的SM-NSSAI1，获取APP2对应的切片的安全属性1，也就是说，APP1与APP2的安全需求相同；UE根据APP3对应的SM-NSSAI2，获取APP3对应的切片的安全属性2。
可选地，UE还可以通过运营商配置的预置策略，获取会话对应的切片的安全属性。如表5所示，
表5
默认策略 业务 SM-NSSAI 切片的安全属性
策略1 APP1 SM-NSSAI1 安全属性1
策略2 APP2 SM-NSSAI1 安全属性1
策略3 APP3 SM-NSSAI2 安全属性2
表5中，默认策略中策略1、策略2和策略3分别为UE存储的运营商配置的三种策略。
在第一示例中，当UE开启APP1时，UE根据APP1与SM-NSSAI1的对应关系，以及SM-NSSAI1与切片的安全属性的对应关系，确定APP1对应的切片的安全属性为安全属性1。
在第二个示例中，当UE开启APP2时，UE根据APP2与SM-NSSAI1的对应关系，以及 SM-NSSAI1与切片的安全属性的对应关系，确定APP2对应的切片的安全属性为安全属性1，可以理解的是，由于APP1对应的切片的安全属性为安全属性1，APP2对应的切片的安全属性也为安全属性1，故APP1与APP2的安全需求相同。
在第三个示例中，当UE开启APP3时，UE根据APP3与SM-NSSAI2的对应关系，以及SM-NSSAI2与切片的安全属性的对应关系，确定APP3对应的切片的安全属性为安全属性2。
可见，当UE启动应用，UE根据应用与SM-NSSAI的对应关系，以及SM-NSSAI与切片的安全属性的对应关系，确定应用的安全需求，即应用对应的切片的安全属性。然后UE判断该应用对应的切片中是否存在会话，如果存在，表明该会话对应的安全属性对应于应用的安全需求，则UE通过的会话中的一个会话来传输应用的数据；否则，UE拒绝该应用。也就是说，UE启动应用，当会话中存在至少一个会话的安全属性对应于该应用的安全需求时，UE通过至少一个会话中的一个会话发送应用的数据。此处会话的安全属性指的是会话对应的切片的安全属性。
需要说明的是，表4和表5的示例中，切片的安全属性可以作为SM-NSSAI的一部分，如以字段形式体现在SM-NSSAI中，即SM-NSSAI的某一些字段用于标识切片的安全属性。
图6为本发明实施例提供的再一种数据传输方法的信令交互图。如图6所示，该方法可以包括：
步骤610、UE向SMF实体发送会话建立请求消息。
其中，该会话建立请求消息可以用于请求建立对应于应用的安全需求的会话。
可选地，UE可以通过AN节点、AMF实体向SMF实体发送会话建立请求。
步骤620、SMF实体根据会话建立请求消息，确定对应于应用的安全需求的会话对应的切片的安全属性。
其中，该会话建立请求消息可以包括SM-NSSAI。进而，SMF实体可以根据SM-NSSAI，确定与SM-NSSAI对应切片的安全属性。
可选地，该会话建立请求消息还包括UE的安全能力。进而，SMF实体可以根据SM-NSSAI以及UE的安全能力，确定与SM-NSSAI对应切片的安全属性。具体实现方法可以参照步骤230的描述，本发明实施例在此不做赘述。
可选地，SMF实体根据SM-NSSAI，确定对应于应用的安全需求的会话对应切片的安全属性的方法可以参照步骤520中的获取方法来实现，本发明实施例在此不做赘述。
步骤630、SMF实体根据对应于应用的安全需求的会话对应的切片的安全属性，选择用户面协议栈和UP实体。
该步骤的实施过程与步骤430的实施过程相似，在此不再赘述。
步骤640、SMF实体向UP实体发送用户面路径建立请求消息。
其中，该用户面路径建立请求消息用于触发AN节点与UP实体之间的用户面路径建立。
可选地，用户面路径建立请求消息可以包括切片的安全属性，以指示UP实体当前会话的安全属性，以及指示UP实体根据会话的安全属性，使用合适的用户面协议栈。
可选地，用户面路径建立请求还可以包括用户面协议栈指示信息，以用于指示目标UP采用合适的用户面协议栈。
步骤650、UP实体向SMF实体发送用户面路径建立应答消息。
其中，该用户面路径建立应答消息用于建立AN节点与UP实体之间的用户面路径。
可选地，用户面路径建立应答消息可以包括UP实体的标识信息，如UP实体的IP。
步骤660、SMF实体向UE发送会话建立响应消息。
其中，该会话建立响应消息可以包括SM-NSSAI对应的切片的安全属性。
可选地，该会话建立响应消息包括指示信息，而不包括SM-NSSAI对应的切片的安全属性。该指示信息可以用于指示UE根据应用的安全需求，发送该应用的数据。比如，当SMF实体确定的SM-NSSAI对应切片的安全属与应用的安全需求相同时，该会话建立响应消息可以只包含指示信息。
可选地，该会话建立响应消息还可以包括用户面协议栈指示信息，用户面协议栈指示信息用于指示对应于应用的安全需求的会话采用的用户面协议栈，该用户面协议栈可以用于决定应用的数据的封装格式。
例如，UE可以按照应用数据的封装格式对应用的数据进行封装，生成相应数据包，并进行该应用的业务数据的传输。
UE启动应用后，UE根据应用的安全需求，选择SM-NSSAI，再根据SM-NSSAI与切片的安全属性的对应关系，确定对应于应用的安全需求的切片的安全属性，从而建立新会话，进行数据传输，以减少新会话引起的不必要的信令交互。
与上述方法对应的，本发明实施例提供的一种UE，如图7所示，该用户设备可以包括：
处理单元710，用于确定UE的会话的安全属性。
发送单元720，用于当UE的会话的安全属性不满足应用的安全需求时，向控制面节点发送会话建立请求消息，会话建立请求消息用于请求建立对应于应用的安全需求的会话。
其中，确定用户设备UE的会话的安全属性的实现方式可以参见步骤210的相关描述，不再赘述。此外，控制面节点可以是AMF实体或SMF实体，或该控制面节点包括：AMF实体和SMF实体。
可选地，安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数。应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
可选地，该设备还包括接收单元730，接收单元730，用于从控制面节点接收会话建立响应消息，会话建立响应消息包括对应于应用的安全需求的会话的安全属性。
发送单元720，还用于根据对应于应用的安全需求的会话的安全属性，发送应用的数据。
可选地，处理单元710，还用于根据加密位置，确定应用的数据的封装格式，并根据应用数据的封装格式以及应用的数据，生成数据包。
发送单元720，还用于发送数据包。
可选地，对应于应用的安全需求的会话的安全属性为对应于应用的安全需求的会话对应的切片的安全属性。
可选地，会话建立响应消息还包括用户面协议栈指示信息，用户面协议栈指示信息用 于指示应用的数据的封装格式。
可选地，会话的安全属性为会话对应的切片的安全属性。
可选地，发送单元720，还用于向控制面节点发送注册请求消息。
接收单元730，还用于从控制面节点接收注册响应消息，注册响应消息包括UE可接入的切片的安全属性，UE可接入的切片的安全属性包含所述会话对应的切片的安全属性。
可选地，发送单元720，还用于当会话中存在至少一个会话的安全属性对应于应用的安全需求时，通过至少一个会话中一个会话发送应用的数据。
该用户设备的各功能单元的功能，可以通过上述方法中UE的各步骤来实现，因此，本发明上述实施例提供的用户设备的具体工作过程，在此不复赘述。
与上述方法对应的，本发明实施例提供的一种控制面节点，该控制面节点可以是AMF实体或SMF实体，或该控制面节点包括AMF实体和SMF实体。如图8所示，该控制面节点可以包括：接收单元810和发送单元820。
接收单元810，用于接收UE发送的会话建立请求消息，会话建立请求消息用于请求建立对应于UE的应用的安全需求的会话。
发送单元820，用于根据会话建立请求消息，向UE发送会话建立响应消息，会话建立响应消息包括对应于应用的安全需求的会话的安全属性。
可选地，安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数。应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
可选地，对应于应用的安全需求的会话的安全属性为对应于所述应用的安全需求的会话对应的切片的安全属性。
可选地，控制面节点还包括处理单元830，会话建立请求消息包括会话管理切片选择辅助信息。
处理单元830，用于根据会话管理切片选择辅助信息，确定对应于应用的安全需求的会话的安全属性。
可选地，会话建立请求消息包括所述应用的安全需求；
处理单元830，还用于根据应用的安全需求，确定对应于应用的安全需求的会话的安全属性。
可选地，会话建立请求消息还包括所述UE的安全能力；处理单元830，还用于根据应用的安全需求和UE的安全能力，确定对应于应用的安全需求的会话的安全属性。
可选地，处理单元830，还用于根据本地配置策略，确定对应于应用的安全需求的会话的安全属性；或，
接收单元810，还用于从签约服务单元接收对应于应用的安全需求的会话的安全属性；或，
接收单元810，还用于从策略决策节点接收索引，并根据索引，确定对应于应用的安全需求的会话的安全属性。
可选地，会话建立响应消息还包括用户面协议栈指示信息，用户面协议栈指示信息用于指示对应于应用的安全需求的会话采用的用户面协议栈。
可选地，接收单元810，还用于从UE接收注册请求消息，注册请求消息包括配置的 切片选择辅助信息。
处理单元830，还用于根据切片选择辅助信息，确定UE可接入的切片的安全属性。
发送单元820，还用于向UE发送注册响应消息，注册响应消息包括UE可接入的切片的安全属性。
该控制面节点的各功能单元的功能，可以通过上述方法中控制面节点的各步骤来实现，因此，本发明上述实施例提供的控制面节点的具体工作过程，在此不复赘述。
图9为本发明实施例提供的另一种用户设备的结构示意图。
该用户设备至少包括处理器910、发送器920和接收器930。
可选地，用户设备还可以包括储存器930。其中，发送器920和接收器930可以是天线。
处理器910可以是中央处理器(central processing unit，CPU)，或者CPU和硬件芯片的组合。上述硬件芯片可以是专用集成电路(pplication-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。处理器910用于控制整个网络设备以及信号处理。
存储器930可以包括易失性存储器，例如随机存取存储器(RAM)；存储器930也可以包括非易失性存储器，例如只读存储器(ROM)，快闪存储器(flash memory)，硬盘或固态硬盘。存储器930还可以包括上述种类的存储器的组合。存储器930用于存储各种应用，操作系统和数据。存储器930可以将存储的数据传输给处理器910。
可以理解的是，存储器930可以集成在处理器910中，也可以独立存在。
存储器930，用于存储程序；
处理器910，用于执行存储器930中的程序，以执行上述各方法实施例中UE的步骤。
在一个示例中，处理器910，用于确定UE的会话的安全属性。处理器910，还用于当UE的会话的安全属性不满足应用的安全需求时，通过发送器920向控制面节点发送会话建立请求消息，会话建立请求消息用于请求建立对应于应用的安全需求的会话。
由于上述实施例中用户设备的各器件解决问题的实施方式以及有益效果可以参见上述方法实施方式以及有益效果，故在此不复赘述。
图10为本发明实施例提供的另一种控制面节点的结构示意图。该控制面节点可以是AMF实体或SMF实体，或该控制面节点包括AMF实体和SMF实体。
该控制面节点至少包括处理器1010、发送器1020和接收器1030。
可选地，该控制面节点还可以包括储存器1030。其中，发送器1020和接收器1030可以是天线，即无线通信接口，也可以是有线通信接口，不予限制。当发送器1020和接收器1030为有线通信接口时，两者可以为同一个通信接口，也可以为不同的通信接口。
处理器1010可以是CPU，或者CPU和硬件芯片的组合。上述硬件芯片可以是ASIC，PLD或其组合。上述PLD可以是CPLD，FPGA，GAL或其任意组合。处理器1010用于控制整个网络设备以及信号处理。
存储器1030可以包括易失性存储器，例如随机存取存储器(RAM)；存储器1030也可以包括非易失性存储器，例如只读存储器(ROM)，快闪存储器(flash memory)，硬盘或固态硬盘。存储器1030还可以包括上述种类的存储器的组合。存储器1030用于存储各种应用，操作系统和数据。存储器1030可以将存储的数据传输给处理器1010。
可以理解的是，存储器1030可以集成在处理器1010中，也可以独立存在。
存储器1030，用于存储程序；
处理器1010，用于执行存储器1030中的程序，以执行上述各方法实施例中控制面节点的步骤。
在一个示例中，处理器1010用于通过接收器1030接收UE发送的会话建立请求消息，会话建立请求消息用于请求建立对应于所述UE的应用的安全需求的会话。处理器1010，还用于根据会话建立请求消息，通过发送器1020向UE发送会话建立响应消息，会话建立响应消息包括对应于应用的安全需求的会话的安全属性。
由于上述实施例中控制面节点的各器件解决问题的实施方式以及有益效果可以参见上述方法实施方式以及有益效果，故在此不复赘述。
专业人员应该还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分步骤是可以通过程序来指令处理器完成，所述的程序可以存储于计算机可读存储介质中，所述存储介质是非短暂性(non-transitory)介质，例如随机存取存储器，只读存储器，快闪存储器，硬盘，固态硬盘，磁带(magnetic tape)，软盘(floppy disk)，光盘(optical disc)及其任意组合。
以上所述，仅为本申请较佳的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应该以权利要求的保护范围为准。

Claims (36)

  1. 一种数据传输方法，其特征在于，所述方法包括：
    用户设备UE确定所述UE的会话的安全属性；
    当所述UE的会话的安全属性不满足应用的安全需求时，所述UE向控制面节点发送会话建立请求消息，所述会话建立请求消息用于请求建立对应于所述应用的安全需求的会话。
  2. 根据权利要求1所述的方法，其特征在于，所述安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数；所述应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
  3. 根据权利要求1或2所述的方法，其特征在于，在所述UE向控制面节点发送会话建立请求消息之后，所述方法还包括：
    所述UE从所述控制面节点接收会话建立响应消息，所述会话建立响应消息包括所述对应于所述应用的安全需求的会话的安全属性；
    所述UE根据所述对应于所述应用的安全需求的会话的安全属性，发送所述应用的数据。
  4. 根据权利要求3所述的方法，其特征在于，所述对应于所述应用的安全需求的会话的安全属性包括加密位置，所述UE根据所述对应于所述应用的安全需求的会话的安全属性，发送所述应用的数据，包括：
    所述UE根据所述加密位置，确定所述应用的数据的封装格式；
    所述UE根据所述应用数据的封装格式以及所述应用的数据，生成数据包，并发送所述数据包。
  5. 根据权利要求3或4所述的方法，其特征在于，所述对应于所述应用的安全需求的会话的安全属性为所述对应于所述应用的安全需求的会话对应的切片的安全属性。
  6. 根据权利要求3-5任一项所述的方法，其特征在于，所述会话建立响应消息还包括用户面协议栈指示信息，所述用户面协议栈指示信息用于指示所述应用的数据的封装格式。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述会话的安全属性为所述会话对应的切片的安全属性。
  8. 根据权利要求7所述的方法，其特征在于，在所述UE确定所述UE的会话的安全属性之前，所述方法还包括：
    所述UE向所述控制面节点发送注册请求消息；
    所述UE从所述控制面节点接收注册响应消息，所述注册响应消息包括所述UE可接入的切片的安全属性，所述UE可接入的切片的安全属性包含所述会话对应的切片的安全属性。
  9. 根据权利要求1-8任一项所述的方法，其特征在于，所述方法还包括：
    当所述会话中存在至少一个会话的安全属性对应于所述应用的安全需求时，所述UE通过所述至少一个会话中一个会话发送所述应用的数据。
  10. 一种数据传输方法，其特征在于，所述方法包括：
    控制面节点接收用户设备UE发送的会话建立请求消息，所述会话建立请求消息用于请求建立对应于所述UE的应用的安全需求的会话；
    所述控制面节点根据所述会话建立请求消息，向所述UE发送会话建立响应消息，所述会话建立响应消息包括对应于所述应用的安全需求的会话的安全属性。
  11. 根据权利要求10所述的方法，其特征在于，所述安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数；所述应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
  12. 根据权利要求10或11所述的方法，其特征在于，所述对应于所述应用的安全需求的会话的安全属性为所述对应于所述应用的安全需求的会话对应的切片的安全属性。
  13. 根据权利要求10-12任一项所述的方法，其特征在于，所述会话建立请求消息包括会话管理切片选择辅助信息；所述方法还包括：
    所述控制面节点根据所述会话管理切片选择辅助信息，确定对应于所述应用的安全需求的会话的安全属性。
  14. 根据权利要求10-12任一项所述的方法，其特征在于，所述会话建立请求消息包括所述应用的安全需求；所述方法还包括：
    所述控制面节点根据所述应用的安全需求，确定对应于所述应用的安全需求的会话的安全属性。
  15. 根据权利要求14所述的方法，其特征在于，所述会话建立请求消息还包括所述UE的安全能力；
    所述控制面节点根据所述应用的安全需求，确定对应于所述应用的安全需求的会话的安全属性，包括：
    所述控制面节点根据所述应用的安全需求和所述UE的安全能力，确定对应于所述应用的安全需求的会话的安全属性。
  16. 根据权利要求10-12任一项所述的方法，其特征在于，所述方法还包括：
    所述控制面节点根据本地配置策略，确定对应于所述应用的安全需求的会话的安全属性；或，
    所述控制面节点从签约服务器接收对应于所述应用的安全需求的会话的安全属性；或，
    所述控制面节点从策略决策节点接收索引；
    所述控制面节点根据所述索引，确定对应于所述应用的安全需求的会话的安全属性。
  17. 根据权利要求10-15任一项所述的方法，其特征在于，所述会话建立响应消息还包括用户面协议栈指示信息，所述用户面协议栈指示信息用于指示所述对应于所述应用的安全需求的会话采用的用户面协议栈。
  18. 根据权利要求10-16任一项所述的方法，其特征在于，在所述控制面节点接收UE发送的会话建立请求消息之前，所述方法还包括：
    所述控制面节点从所述UE接收注册请求消息，所述注册请求消息包括配置的切片选择辅助信息；
    所述控制面节点根据所述配置的切片选择辅助信息，确定所述UE可接入的切片的安 全属性；
    所述控制面节点向所述UE发送注册响应消息，所述注册响应消息包括所述UE可接入的切片的安全属性。
  19. 一种用户设备，其特征在于，所述设备包括：处理器和接收器；
    所述处理器，用于确定用户设备UE的会话的安全属性；
    所述处理器，还用于当所述UE的会话的安全属性不满足应用的安全需求时，通过所述发送器向控制面节点发送会话建立请求消息，所述会话建立请求消息用于请求建立对应于所述应用的安全需求的会话。
  20. 根据权利要求19所述的设备，其特征在于，所述安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数；所述应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
  21. 根据权利要求19或20所述的设备，其特征在于，所述设备还包括接收器，
    接收器，用于从所述控制面节点接收会话建立响应消息，所述会话建立响应消息包括所述对应于所述应用的安全需求的会话的安全属性；
    所述处理器，还用于根据所述对应于所述应用的安全需求的会话的安全属性，通过所述发送器发送所述应用的数据。
  22. 根据权利要求21所述的设备，其特征在于，所述对应于所述应用的安全需求的会话的安全属性包括加密位置，
    所述处理器，还用于根据所述加密位置，确定所述应用的数据的封装格式，并根据所述应用数据的封装格式以及所述应用的数据，生成数据包；
    所述发送器，还用于并发送所述数据包。
  23. 根据权利要求21或22所述的设备，其特征在于，所述对应于所述应用的安全需求的会话的安全属性为所述对应于所述应用的安全需求的会话对应的切片的安全属性。
  24. 根据权利要求21-23任一项所述的设备，其特征在于，所述会话建立响应消息还包括用户面协议栈指示信息，所述用户面协议栈指示信息用于指示所述应用的数据的封装格式。
  25. 根据权利要求19-24任一项所述的设备，其特征在于，所述会话的安全属性为所述会话对应的切片的安全属性。
  26. 根据权利要求25所述的设备，其特征在于，
    所述发送器，还用于向所述控制面节点发送注册请求消息；
    所述接收器，还用于从所述控制面节点接收注册响应消息，所述注册响应消息包括所述UE可接入的切片的安全属性，所述UE可接入的切片的安全属性包含所述会话对应的切片的安全属性。
  27. 根据权利要求19-26任一项所述的设备，其特征在于，所述发送器，还用于当所述会话中存在至少一个会话的安全属性对应于所述应用的安全需求时，通过所述至少一个会话中一个会话发送所述应用的数据。
  28. 一种控制面节点，其特征在于，所述控制面节点包括：处理器，接收器和发送器；
    所述处理器，用于通过所述接收器接收用户设备UE发送的会话建立请求消息，所述会话建立请求消息用于请求建立对应于所述UE的应用的安全需求的会话；
    所述处理器，还用于根据所述会话建立请求消息，通过所述发送器向所述UE发送会话建立响应消息，所述会话建立响应消息包括对应于所述应用的安全需求的会话的安全属性。
  29. 根据权利要求28所述的控制面节点，其特征在于，所述安全属性包括安全算法、密钥长度和加密位置中的至少一种安全参数；所述应用的安全需求包括安全算法、密钥长度和加密位置中的至少一种安全参数。
  30. 根据权利要求28或29所述的控制面节点，其特征在于，所述对应于所述应用的安全需求的会话的安全属性为所述对应于所述应用的安全需求的会话对应的切片的安全属性。
  31. 根据权利要求28-30任一项所述的控制面节点，其特征在于，所述会话建立请求消息包括会话管理切片选择辅助信息；
    所述处理器，还用于根据所述会话管理切片选择辅助信息，确定对应于所述应用的安全需求的会话的安全属性。
  32. 根据权利要求28-30任一项所述的控制面节点，其特征在于，所述会话建立请求消息包括所述应用的安全需求；
    所述处理器，还用于根据所述应用的安全需求，确定对应于所述应用的安全需求的会话的安全属性。
  33. 根据权利要求32所述的控制面节点，其特征在于，所述会话建立请求消息还包括所述UE的安全能力；
    所述处理器，还用于根据所述应用的安全需求和所述UE的安全能力，确定对应于所述应用的安全需求的会话的安全属性。
  34. 根据权利要求28-30任一项所述的控制面节点，其特征在于，
    所述处理器，还用于根据本地配置策略，确定对应于所述应用的安全需求的会话的安全属性；或，
    所述接收器，还用于从签约服务器接收对应于所述应用的安全需求的会话的安全属性；或，
    所述处理器，还用于从策略决策节点接收索引，并根据所述索引，确定对应于所述应用的安全需求的会话的安全属性。
  35. 根据权利要求28-32任一项所述的控制面节点，其特征在于，所述会话建立响应消息还包括用户面协议栈指示信息，所述用户面协议栈指示信息用于指示所述对应于所述应用的安全需求的会话采用的用户面协议栈。
  36. 根据权利要求28-34任一项所述的控制面节点，其特征在于，
    所述接收器，还用于从所述UE接收注册请求消息，所述注册请求消息包括配置的切片选择辅助信息；
    所述处理器，还用于根据所述配置的切片选择辅助信息，确定所述UE可接入的切片的安全属性；
    所述发送器，还用于向所述UE发送注册响应消息，所述注册响应消息包括所述UE 可接入的切片的安全属性。
PCT/CN2017/078261 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点 WO2018176187A1 (zh)

Priority Applications (7)

Application Number Priority Date Filing Date Title
CN202110112087.1A CN112887975A (zh) 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点
EP21153369.0A EP3873121A1 (en) 2017-03-27 2017-03-27 Data transmission method, user equipment, and control plane node
PCT/CN2017/078261 WO2018176187A1 (zh) 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点
BR112019019671A BR112019019671A2 (pt) 2017-03-27 2017-03-27 método de transmissão de dados, equipamento de usuário, e nodo de plano de controle
CN201780076347.6A CN110050436B (zh) 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点
EP17904234.6A EP3588840B1 (en) 2017-03-27 2017-03-27 Data transmission method, user equipment, and control plane node
US16/586,373 US11523274B2 (en) 2017-03-27 2019-09-27 Data transmission method, user equipment, and control plane node

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/078261 WO2018176187A1 (zh) 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/586,373 Continuation US11523274B2 (en) 2017-03-27 2019-09-27 Data transmission method, user equipment, and control plane node

Publications (1)

Publication Number Publication Date
WO2018176187A1 true WO2018176187A1 (zh) 2018-10-04

Family

ID=63673874

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/078261 WO2018176187A1 (zh) 2017-03-27 2017-03-27 数据传输方法、用户设备和控制面节点

Country Status (5)

Country Link
US (1) US11523274B2 (zh)
EP (2) EP3873121A1 (zh)
CN (2) CN110050436B (zh)
BR (1) BR112019019671A2 (zh)
WO (1) WO2018176187A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220141255A1 (en) * 2019-02-18 2022-05-05 Nokia Technologies Oy Security status of security slices

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10986506B2 (en) * 2018-02-16 2021-04-20 Lenovo (Singapore) Pte. Ltd. Network slice selection assistance information configuration

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895882A (zh) * 2009-05-21 2010-11-24 中兴通讯股份有限公司 一种WiMAX系统中的数据传输方法、系统及装置
WO2014169451A1 (zh) * 2013-04-17 2014-10-23 华为技术有限公司 数据传输方法和装置
CN105701407A (zh) * 2016-01-08 2016-06-22 腾讯科技（深圳）有限公司 安全级别确定方法及装置
US20170013459A1 (en) * 2008-10-13 2017-01-12 Microsoft Technology Licensing, Llc Simple protocol for tangible security

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6094485A (en) * 1997-09-18 2000-07-25 Netscape Communications Corporation SSL step-up
AU2001293269A1 (en) * 2000-09-11 2002-03-26 David Edgar System, method, and computer program product for optimization and acceleration of data transport and processing
US8020201B2 (en) * 2001-10-23 2011-09-13 Intel Corporation Selecting a security format conversion for wired and wireless devices
CN101052037B (zh) * 2006-05-10 2010-08-18 华为技术有限公司 一种ip承载网的会话管理控制方法
CN101087248B (zh) * 2006-06-23 2010-08-18 中兴通讯股份有限公司 基于会话业务的网络侧发起承载建立的方法
CN101242629B (zh) * 2007-02-05 2012-02-15 华为技术有限公司 选择用户面算法的方法、系统和设备
CN101572951B (zh) * 2008-04-30 2011-09-14 华为技术有限公司 建立承载的方法、mme、pcrf和用户终端
CN101355811B (zh) * 2008-09-08 2012-04-25 华为终端有限公司 承载信道重建的方法、系统及设备
US9654505B2 (en) * 2009-06-22 2017-05-16 Citrix Systems, Inc. Systems and methods for encoding the core identifier in the session identifier
US9996548B2 (en) * 2009-11-25 2018-06-12 International Business Machines Corporation Dispersed storage using localized peer-to-peer capable wireless devices in a peer-to-peer or femto cell supported carrier served fashion
KR101706383B1 (ko) * 2010-05-03 2017-02-14 삼성전자주식회사 이동 통신 시스템에서 단문 메시지 서비스 메시지 전달 방법 및 시스템
US9027076B2 (en) * 2012-03-23 2015-05-05 Lockheed Martin Corporation Method and apparatus for context aware mobile security
CN103404102B (zh) * 2012-12-31 2016-09-28 华为技术有限公司 一种承载创建方法、装置和系统
US9137216B2 (en) * 2013-08-13 2015-09-15 Verizon Patent And Licensing Inc. Session layer data security
US9973534B2 (en) * 2013-11-04 2018-05-15 Lookout, Inc. Methods and systems for secure network connections
CN104378374B (zh) * 2014-11-14 2017-11-07 国家超级计算深圳中心(深圳云计算中心) 一种基于安全套接层建立通信的方法及系统
US9935769B1 (en) * 2014-12-12 2018-04-03 Amazon Technologies, Inc. Resource-based cipher suite selection
CN106341832B (zh) * 2015-07-07 2020-11-06 中国移动通信集团公司 网络切片的管理及选择方法、系统、基站、路由交换设备
WO2017075410A1 (en) * 2015-10-30 2017-05-04 Convida Wireless, Llc System and methods for achieving end-to-end security for hop-by-hop services
CN110691429B (zh) * 2016-05-13 2021-02-12 华为技术有限公司 Rrc状态的控制方法和装置
KR102358918B1 (ko) * 2016-07-04 2022-02-07 삼성전자 주식회사 무선 통신 시스템에서 서비스에 따른 보안 관리 방법 및 장치
CN105959317A (zh) * 2016-07-11 2016-09-21 深圳市金立通信设备有限公司 一种安全认证方法及终端
CN108306831B (zh) 2017-01-13 2021-12-03 华为技术有限公司 选路方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170013459A1 (en) * 2008-10-13 2017-01-12 Microsoft Technology Licensing, Llc Simple protocol for tangible security
CN101895882A (zh) * 2009-05-21 2010-11-24 中兴通讯股份有限公司 一种WiMAX系统中的数据传输方法、系统及装置
WO2014169451A1 (zh) * 2013-04-17 2014-10-23 华为技术有限公司 数据传输方法和装置
CN105701407A (zh) * 2016-01-08 2016-06-22 腾讯科技（深圳）有限公司 安全级别确定方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3588840A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220141255A1 (en) * 2019-02-18 2022-05-05 Nokia Technologies Oy Security status of security slices

Also Published As

Publication number Publication date
EP3588840A1 (en) 2020-01-01
CN112887975A (zh) 2021-06-01
EP3588840B1 (en) 2021-03-03
CN110050436B (zh) 2021-03-02
CN110050436A (zh) 2019-07-23
EP3873121A1 (en) 2021-09-01
US20200029207A1 (en) 2020-01-23
US11523274B2 (en) 2022-12-06
EP3588840A4 (en) 2020-03-25
BR112019019671A2 (pt) 2020-04-22

Similar Documents

Publication Publication Date Title
JP6928143B2 (ja) 暗号化されたクライアントデバイスコンテキストを用いたネットワークアーキテクチャおよびセキュリティ
KR102263336B1 (ko) 보안 구현 방법, 기기 및 시스템
US11778459B2 (en) Secure session method and apparatus
TWI708513B (zh) 網路安全架構
EP4221439A2 (en) Session management method, apparatus, and system
US11722888B2 (en) Security context obtaining method and apparatus
US9706396B2 (en) System and method of counter management and security key update for device-to-device group communication
CN108366369B (zh) 一种数据安全传输的方法及接入网、终端、核心网设备
US20200228977A1 (en) Parameter Protection Method And Device, And System
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
WO2019004929A2 (zh) 网络切片分配方法、设备及系统
KR101936662B1 (ko) 데이터 패킷을 포워딩하는 액세스 노드 장치
TW201705780A (zh) 具有加密的網路可達性上下文的網路架構和安全
US11523274B2 (en) Data transmission method, user equipment, and control plane node
US20210168614A1 (en) Data Transmission Method and Device
US9572158B2 (en) Residential local break out in a communication system
WO2023160390A1 (zh) 通信方法与装置
US11032856B2 (en) Data transmission method and apparatus

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17904234

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112019019671

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2017904234

Country of ref document: EP

Effective date: 20190926

ENP Entry into the national phase

Ref document number: 112019019671

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20190920