WO2018187961A1

WO2018187961A1 - Security policy processing method and related device

Info

Publication number: WO2018187961A1
Application number: PCT/CN2017/080222
Authority: WO
Inventors: 衣强; 龙水平
Original assignee: 华为技术有限公司
Priority date: 2017-04-12
Filing date: 2017-04-12
Publication date: 2018-10-18
Also published as: CN109863772A; CN109863772B

Abstract

Disclosed is a security policy processing method, for satisfying different security requirements of different services or users between a UE and an RAN entity. The method in the embodiments of the present application comprises: a radio access network (RAN) entity acquiring a first message for a user equipment (UE), wherein the first message comprises a target security policy; the RAN entity determining an encryption and/or integrity protection policy of the UE according to the target security policy; and the RAN entity establishing a radio bearer according to the determined encryption and/or integrity protection policy of the UE. Further provided is a related device.

Description

Method for processing security policy and related equipment

Technical field

The present application relates to the field of communications technologies, and in particular, to a method and a related device for processing a security policy.

Background technique

With the rapid development of computer technology and Internet technology, users have higher and higher requirements for the experience of communication services. When obtaining information from the Internet, the server that is being accessed needs to provide the required content accurately and efficiently. In order to ensure that the user's access process is safe and efficient, a corresponding security policy needs to be adopted to meet the demand.

The next-generation wireless communication network provides services for various types of services. From the perspective of network security, different services or different tenants have different security requirements. For example, some services or users have high security requirements, and some services Or the user has low security requirements. In order to meet the different needs of the service or the user and utilize the resources reasonably, the next-generation network can provide a security policy with a granularity of services or users, that is, different services or different users use different security policies, thereby Meet the different security needs of different businesses or users. In the next-generation network, the user can also set the most basic or desired security requirements provided by the network through the user equipment (User Equipment, UE). After the UE requests the security requirements, the network should try to meet the security requirements of the UE. A UE supporting access to the next-generation core network can access the next-generation core network through the next-generation RAN entity, or can be accessed through an Evolved universal terrestrial radio access network (E-UTRAN). A generation of core networks.

At present, the user equipment can provide a security requirement, and the security policy control function entity in the network determines the security policy according to the security requirements of the UE and the security capability of the User Plane Gateway (UPGW), so that the security management (SM) is implemented. The entity generates a session key according to the determined security policy, and the SM sends the generated session key to the UPGW, and sends the determined security policy to the UE, and the UE generates the same session key, thereby implementing security between the UE and the UPGW. protection.

The above prior art only considers the determination and implementation of the security policy between the UE and the UPGW, but for some access technologies, such as an evolved universal land-based radio access network (evolved Evolved universal) that can access the next-generation core network. The terrestrial radio access network (evolved E-UTRAN) accesses the core network, and the security endpoints of the UE and the network are still on the radio access network (RAN) entity side, and the prior art does not consider the relationship between the UE and the RAN entity. How to implement different security requirements of different services or users, especially how to maintain different security requirements of different services or users during the handover process.

Summary of the invention

The embodiment of the present application provides a method for processing a security policy, which is used to meet different security requirements of different services or users between the UE and the RAN entity.

A first aspect of the present application provides a method for processing a security policy, including: a first entity acquiring a first message for establishing a session of the UE, the first entity acquiring a target security policy; Responding to the obtained first message and the target security policy, sending a context second message for creating the UE in the RAN entity to the radio access network RAN entity of the UE, and carrying in the second message A target security policy for the RAN entity to determine an encryption and/or integrity protection policy for the UE. In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the first entity sends the target security policy. Send to the wireless access network entity to meet the different security needs of different services or users.

In a possible implementation, in a first implementation manner of the first aspect of the embodiment, the first entity acquiring the first message and the target security policy for the user equipment UE include: receiving, by the first entity Receiving, by the UE, the first message, and simultaneously receiving the target security policy, where the target security policy may be sent to the first entity together with the first message, or may be separately sent to the first entity; or An entity receives the first message sent by the UE to establish a session; the first entity sends a security policy request message to a security policy management function entity; the first entity receives the security policy management function entity to send The security policy request response message includes a target security policy in the security policy request response message. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a second implementation manner of the first aspect of the embodiment, the first entity acquiring the first message and the target security policy for the user equipment UE, includes: receiving, by the first entity The first message sent by the UE, and receiving an access network type of the UE at the same time; the first entity sending an access network type security policy request message including the UE to the security policy management function entity The security policy management function entity determines the security endpoint information of the session to be established according to the access network type of the UE; the first entity receives the security policy response message sent by the security policy management function entity, The target security policy is included in the security policy response message, and the target security policy includes security endpoint information of the UE to be established. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a third implementation manner of the first aspect of the embodiment, the first entity acquiring the first message and the target security policy for the user equipment UE, includes: receiving, by the first entity The first message sent by the UE receives an access network type of the UE while receiving the first message; the first entity determines, according to an access network type of the UE, a desired Establish security endpoint information for the session. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a fourth implementation manner of the first aspect of the embodiment of the present application, after the first entity of the session management entity acquires the first message and the target security policy for the user equipment UE, the method further includes The first entity saves the acquired target security policy. The embodiment of the present application adds a step of saving the target security policy, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

A second aspect of the present application provides a method for processing a security policy, including: a radio access network RAN entity acquires a second message including a target security policy for a user equipment UE; and the RAN entity according to the target security policy Determining an encryption and/or integrity protection policy of the UE; the RAN entity establishing a radio bearer according to the determined encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the second aspect of the embodiment of the present application, when the radio access network RAN entity acquires a second message for the user equipment UE, the method further includes: The RAN entity obtains the first identifier, where the first identifier includes any one of a session identifier, a slice identifier, and a media stream identifier, where the target security policy is a security policy corresponding to the first identifier. The embodiment of the present application adds the step of obtaining the first identifier, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the second aspect of the embodiments of the present application, the radio access network RAN entity acquires a second message for the user equipment UE, where the second message includes target security. After the policy, the method further includes: the RAN entity saves the target security policy; or the RAN entity saves a correspondence between the first identifier and the target security policy. The embodiment of the present application adds a step of saving the target security policy, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a third implementation manner of the second aspect of the embodiment of the present application, the determining, by the RAN entity, the encryption and/or integrity protection policy of the UE according to the target security policy includes: the RAN Determining, by the entity, a target algorithm according to at least the target security policy and a security capability of the RAN entity, the target algorithm being an encryption and/or integrity protection algorithm for the UE; the RAN entity according to the determined UE Encryption and/or Integrity Protection Policy Establishing a radio bearer includes the RAN entity establishing/switching a radio bearer according to the target algorithm. The embodiment of the present application refines the process of determining the protection policy, and increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fourth implementation manner of the second aspect of the embodiments, the determining, by the RAN entity, the encryption and/or integrity protection policy of the UE according to the target security policy includes: the RAN Determining, by the entity, a target algorithm according to the target security policy and the security capability of the RAN entity, where the target algorithm is an encryption and/or integrity protection algorithm corresponding to the first identifier on the UE; The establishing, by the RAN entity, the radio bearer according to the determined encryption and/or integrity protection policy of the UE includes: the RAN entity establishing/switching a radio bearer according to the target algorithm. The embodiment of the present application refines the process of determining the protection policy, and increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fifth implementation manner of the second aspect of the embodiments of the present application, the determining, by the RAN entity, the target algorithm according to the target security policy and the security capability of the RAN entity includes: The RAN entity determines whether there is a candidate algorithm that satisfies the target security policy; if there is a candidate algorithm that satisfies the target security policy, the RAN entity determines, according to the security capability of the RAN entity, the highest priority among the candidate algorithms. The algorithm is the target algorithm. The embodiment of the present application refines the process of determining the target algorithm, and increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a sixth implementation manner of the second aspect of the embodiments of the present application, the establishing, by the RAN entity, the radio bearer according to the target algorithm includes: sending, by the RAN entity, a third message to the UE The third message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier, so that the UE storage station Corresponding relationship between the target algorithm and the second identifier; the RAN entity receiving a response message of the third message sent by the UE; the RAN entity sending an establishment/switching radio bearer request message to the UE, the establishing/switching The radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier, so that the UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier. The embodiment of the present application provides a specific implementation manner for establishing a radio bearer, which increases the operability of the embodiment of the present application.

In a possible implementation, in a seventh implementation manner of the second aspect of the embodiments of the present application, the establishing, by the RAN entity, the radio bearer according to the target algorithm includes: sending, by the RAN entity, a third message, where The third message includes a correspondence between the target algorithm and the second identifier, and a correspondence between the identifier of the RAN entity establishing/switching the radio bearer and the second identifier, so that the UE is configured according to the target algorithm and the second identifier. Corresponding relationship determines the built An algorithm used by the bearer/switched radio bearer, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. The embodiment of the present application provides a specific implementation manner for establishing a radio bearer, which increases the operability of the embodiment of the present application.

In a possible design, in an eighth implementation manner of the second aspect of the embodiment of the present application, the acquiring, by the radio access network RAN entity, the second message for the user equipment UE includes: the RAN entity receiving the first A second message sent by the entity, the second message being used to establish an initial context. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

In a possible design, in a ninth implementation manner of the second aspect of the embodiment of the present application, the acquiring, by the radio access network RAN entity, the second message for the user equipment UE includes: the RAN entity receiving the first The second message sent by the entity, where the second message is used to switch the session of the UE. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

In a possible design, in a tenth implementation manner of the second aspect of the embodiments of the present application, the RAN is a target RAN entity, and the second information that the radio access network RAN entity acquires for the user equipment UE includes: The RAN entity receives a second message sent by the source RAN entity, where the second message is used to switch the session of the UE. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

A third aspect of the embodiments of the present disclosure provides a method for processing a security policy, including: acquiring, by a second entity, a first message, where the first message is used to establish a session; and the second entity sending security to a security policy management function entity a policy request message; the second entity receives a security policy response message, where the security policy response message includes a target security policy; the second entity sends the first message, and simultaneously sends the target security policy. In the embodiment of the present application, in the process of establishing the initial context, when the security endpoint of the network is located on the radio access network side, the second entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the third aspect of the embodiment, the acquiring, by the second entity, the first message includes: receiving, by the second entity, the first message, the first message The second network entity sends the first message, and the second entity sends the first message, Sending the access network type of the UE. The embodiment of the present application adds a process of acquiring an access network type, and an implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the third aspect of the embodiments of the present application, the method further includes: the second entity receiving the first message and a security requirement of the UE; The second entity sends a security policy request message to the security policy management function entity, where the security policy request message includes a security requirement of the UE, and the second entity receives a security policy response message, where the security policy response message includes a target security policy, where the target security policy is determined by the policy control function entity according to the security requirement of the UE; the second entity sends the first message, and also sends the target security policy. The embodiment of the present application adds a process of acquiring a target security policy according to the security requirements of the UE, and the implementation manner of the embodiment of the present application is added.

A fourth aspect of the embodiments of the present application provides a method for processing a security policy, including: a source RAN entity decides to initiate a handover procedure for a user equipment UE; and the source RAN entity sends a first message to a target RAN entity, where the first The message is used to request a handover, where the first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target security policy, where the first identifier includes Session ID, Any of the slice ID or media stream identifier. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the source radio access network sends the received target security policy to the target radio access network, which satisfies different Different security needs of the business or user.

In a possible implementation, in a first implementation manner of the fourth aspect of the embodiments of the present application, after the source RAN entity decides to initiate a handover procedure for the user equipment, the source RAN entity sends the first RAN entity to the target RAN entity. Before the message, the method further includes: determining, by the source RAN entity, the target RAN entity according to the first security policy and the measurement report of the UE, where the first security policy is the target security of the UE saved by the source RAN entity The policy or the highest security policy in the target security policy of the UE saved by the source RAN entity, the measurement report including signal quality information of the candidate RAN entity. The embodiment of the present application adds a process of determining a target RAN entity according to the measurement report of the UE, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the fourth aspect of the embodiments of the present application, the determining, by the source RAN entity, the target RAN entity in the candidate RAN entity according to the first security policy and the measurement report of the UE includes: Determining, by the source RAN entity, a candidate RAN entity that meets a signal quality requirement according to the measurement report, the measurement report including signal quality information of the candidate RAN entity; the source RAN entity determining a compliance in the candidate RAN entity The RAN entity of the first security policy is the target RAN entity. The embodiment of the present application refines the process of determining the target RAN entity, which increases the achievability and operability of the embodiment of the present application.

A fifth aspect of the embodiments of the present application provides a method for processing a security policy, including: a target RAN entity acquiring a first message and a target security policy, where the first message is used to request a handover of a session of the UE; The target security policy determines an encryption and/or integrity protection policy of the UE; the target RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the target radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the fifth aspect of the embodiments, the method further includes: the target RAN entity further acquiring a first identifier, where the first identifier includes a session identifier, Any of the slice ID or media stream identifier. The embodiment of the present application adds the step of obtaining the first identifier, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the fifth aspect of the embodiments of the present application, the acquiring, by the target RAN entity, the first message and the target security policy includes: receiving, by the target RAN entity, the source RAN entity a first message, the first message is used to request to switch a session of the UE, and the first message includes a target security policy; or the target RAN entity receives a first message sent by the source RAN entity, where the first message is used by the first message. The first message includes a first identifier and a corresponding target security policy, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a third implementation manner of the fifth aspect of the embodiments of the present application, the acquiring, by the target RAN entity, the first message and the target security policy includes: sending, by the target RAN, the source RAN entity to a first message, the first message is used to request a handover of a session of the UE; the target RAN entity sends a security policy request message to the first core network entity; and the target RAN entity receives the security sent by the first core network entity Policy response message, The target security policy is included in the security policy response message, and the first core network entity is a first entity or a second entity. The process of obtaining the target security policy is refined in the embodiment of the present application, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fourth implementation manner of the fifth aspect of the embodiments of the present application, the acquiring, by the target RAN entity, the first message and the target security policy includes: receiving, by the target RAN entity, the source RAN entity The first message is used to request to switch the session of the UE; the target RAN entity sends a security policy request to the first core network entity, where the security policy request includes a first identifier, the first identifier The first core network entity is a first entity or a second entity, and the RAN entity receives a security policy response message sent by the first entity, where the RAN entity receives any one of a slice identifier, a session identifier, or a media stream identifier. The first policy and the corresponding target security policy are included in the security policy response message. The process of obtaining the target security policy is refined in the embodiment of the present application, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fifth implementation manner of the fifth aspect of the embodiments of the present application, after the target RAN entity obtains the first message and the target security policy, the method further includes: the target RAN entity Sending the received target security policy to the first core network entity, so that the first core network entity verifies whether the target security policy is correct according to the saved security policy of the UE, where the first core network entity is a first entity or a second entity; or, the target RAN entity sends the received first identifier and a corresponding target security policy to the first core network entity, so that the first core network entity according to the saved The relationship between the security policy and the identifier of the UE is verified whether the target security policy corresponding to the first identifier is correct, and the first core network entity is the first entity or the second entity. The embodiment of the present application adds a step of verifying whether the target security policy is correct, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

A sixth aspect of the embodiments of the present disclosure provides a method for processing a security policy, including: receiving, by a core network entity, a security policy request message sent by a radio access network RAN entity; and the core network entity to the RAN entity Sending a security policy response message, where the target security policy is included in the security policy response message. In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the core network entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the sixth aspect of the embodiments, the method further includes: receiving, by the core network entity, the security policy request message sent by the RAN entity, where The security policy request message further includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier; the core network entity sends a security policy response message to the RAN entity, where The target security policy is included in the security policy response message, where the target security policy is a target security policy corresponding to the first identifier. The embodiment of the present application adds a process for the core network entity to send the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the sixth aspect of the embodiments, the core network entity is a first entity or a second entity. The embodiment of the present application defines the core network entity, so that the embodiment of the present application is more logical.

A seventh aspect of the embodiments of the present application provides a method for processing a security policy, including: a core network entity receiving a target security policy for a user equipment UE sent by the target radio access network RAN entity, where the target security policy is Deriving the target RAN entity from the source RAN entity in a handover procedure; the core network entity according to the saved UE The security policy verifies that the target security policy is correct. In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the core network entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the seventh aspect of the embodiments, the method further includes: the core network entity receiving the first identifier sent by the target RAN entity, and the Identifying a target security policy, where the first identifier and the target security policy corresponding to the first identifier are obtained by the target RAN entity from a source RAN entity in a handover process; and the core network entity is in accordance with the saved security policy. The relationship with the identifier verifies whether the target security policy corresponding to the first identifier is correct. The embodiment of the present application adds a process for the core network entity to send the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the seventh aspect of the embodiment, the core network entity is a first entity or a second entity. The embodiment of the present application defines the core network entity, so that the embodiment of the present application is more logical.

An eighth aspect of the embodiments of the present application provides a method for processing a security policy, including: a source RAN entity decides to initiate a handover procedure for a user equipment UE; and the source RAN entity sends a first message to the first entity, where the first The message is used to request to switch the session of the UE, where the first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target security policy, where the An identifier includes any one of a session identifier, a slice identifier, a radio bearer identifier, or a media stream identifier. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the source radio access network sends the received target security policy to the target radio access network, which satisfies different Different security needs of the business or user.

In a possible implementation, in a first implementation manner of the eighth aspect of the embodiments of the present application, after the source RAN entity decides to initiate a handover process for the user equipment UE, the source RAN entity sends the information to the first entity. Before the first message, the method further includes: determining, by the source RAN entity, the target RAN entity according to the first security policy and the measurement report of the UE, where the first security policy is the target of the UE saved by the source RAN entity a security policy or a highest security policy in the target security policy of the UE saved by the source RAN entity, the measurement report including signal quality information of the candidate RAN entity. The embodiment of the present application adds a process of determining a target RAN entity according to the measurement report of the UE, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the eighth aspect of the embodiments, the source RAN entity determines, according to the first security policy and the measurement report of the UE, that the target RAN entity comprises: the source RAN entity Determining, according to the measurement report, a candidate RAN entity that meets a signal quality requirement, the measurement report including signal quality information of the candidate RAN entity; the source RAN entity determining, in the candidate RAN entity, that the first security policy is met The RAN entity is the target RAN entity. The embodiment of the present application refines the process of determining the target RAN entity, which increases the achievability and operability of the embodiment of the present application.

A ninth aspect of the present application provides a method for processing a security policy, including: a target RAN entity acquires a second message, the second message is used to request a handover of a session of the UE, and the second message includes a target security policy; Determining, by the target RAN entity, an encryption and/or integrity protection policy of the UE according to the target security policy; the target RAN entity establishing a radio bearer according to the determined encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the target radio access network The radio bearer is established according to the received target security policy, and meets different security requirements of different services or users.

In a possible design, in a first implementation manner of the ninth aspect of the embodiment, the acquiring, by the target RAN entity, the second message and the target security policy, a second message, the second message is used to request to switch a session of the UE, and the second message includes a target security policy; or the target RAN entity receives a second message sent by the first entity, where the second message is used by the second message. The second message includes a first identifier and a corresponding target security policy, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. The embodiment of the present application refines the obtained second message, which increases the achievability and operability of the embodiment of the present application.

A tenth aspect of the embodiments of the present application provides a method for processing a security policy, including: acquiring, by a first entity, a first message of a user equipment UE, where the first message is used to request to switch a session of the UE; The entity sends a second message to the target radio access network RAN entity of the UE, the second message is used to request to switch the session of the UE, and the second message includes a target security policy, where the target security policy is used The target RAN entity determines an encryption and/or integrity protection policy for the UE. In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the first entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the tenth aspect of the embodiments, the acquiring, by the first entity, the first message of the user equipment UE includes: receiving, by the first entity, the UE The first message sent by the source base station, the first entity receiving the first security message while receiving the first message; or the first entity receiving the first message sent by the source base station to which the UE is attached The first entity obtains a target security policy saved by itself. The process of obtaining the target security policy is refined in the embodiment of the present application, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a second implementation manner of the tenth aspect of the embodiments, the first entity acquires a first message of the user equipment UE, where the first message is used to request to switch the UE The first entity receives the first message sent by the source base station to which the UE is attached, and receives the target RAN entity type of the UE while receiving the first message; The security policy management function entity sends a security policy request message, where the security policy request message includes a target RAN entity type of the UE, so that the security policy management function entity determines, according to the target RAN entity type of the UE, that the target RAN entity is to be switched. a security endpoint information of the session; the first entity receives a security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, and the target security policy includes the The security endpoint information of the UE to establish a session. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a third implementation manner of the tenth aspect, the first entity acquires a first message of the user equipment UE, where the first message is used to request to switch the UE The first entity receives the first message sent by the source base station to which the UE is attached, and receives the target RAN entity type of the UE while receiving the first message; The target RAN entity type of the UE determines the security endpoint information of the UE to establish a session. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

An eleventh aspect of the present application provides a method for processing a security policy, including: receiving, by a user equipment UE, a correspondence between a second identifier sent by a first radio access network RAN entity and a target algorithm, and receiving Corresponding relationship between the radio bearer identifier that is established/switched by the first RAN entity and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier; Determining an algorithm used by the established/switched radio bearer according to the correspondence between the algorithm and the second identifier. In the embodiment of the present application, when the security endpoint of the network is located on the radio access network side, the user equipment establishes a radio bearer with the radio access network entity according to the obtained target security policy, and meets different security requirements of different services or users.

In a possible implementation, in a first implementation manner of the eleventh embodiment of the present application, the method further includes: receiving, by the UE, a third message sent by the first RAN entity, where The third message includes a correspondence between the second identifier and the target algorithm; the UE stores a correspondence between the target algorithm and the second identifier; and the UE receives the setup/switch radio bearer sent by the first RAN entity a request message, the establishing/switching radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier; and determining, by the UE, the established/switched wireless according to the correspondence between the target algorithm and the second identifier The algorithm used by the bearer. The embodiment of the present application adds the step of establishing/switching the radio bearer according to the relationship between the second identifier and the target algorithm, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the eleventh embodiment of the present application, the method further includes: receiving a third message sent by the first RAN entity, where the third message is Corresponding relationship between the second identifier and the target algorithm, and the correspondence between the radio bearer identifier and the second identifier of the first RAN entity establishment/switching; the UE determining the location according to the correspondence between the target algorithm and the second identifier The algorithm used to establish/switch the radio bearer. The embodiment of the present application adds the step of establishing/switching a radio bearer according to the relationship between the second identifier and the target algorithm, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a third implementation manner of the eleventh embodiment of the present application, the method further includes: when the user rejects the target algorithm, the UE sends the first RAN entity to the first RAN entity Sending a reject message of the third message, the UE enters an idle state; the UE selects a second RAN entity in the candidate RAN; the UE establishes a connection with the second RAN entity. The embodiment of the present application adds the steps when the user rejects the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a fourth implementation manner of the eleventh aspect of the embodiments of the present application, the method further includes: receiving, by the UE, security capability information broadcast by a RAN entity; The capability and the security requirements of the UE determine the first RAN entity or the second RAN entity. The embodiment of the present application adds a step of the UE determining the first RAN entity or the second RAN entity, and the implementation manner of the embodiment of the present application is added.

The twelfth aspect of the embodiment of the present application provides a functional entity, where the functional entity is a first entity, and includes: an acquiring unit, configured to acquire a first message and a target security policy for the user equipment UE, where the first message is a session for establishing the UE, a sending unit, configured to send a second message to the radio access network RAN entity of the UE, where the second message is used to create a context of the UE in the RAN entity, where The second message includes the target security policy, and the target security policy is used by the RAN entity to determine an encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the first entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs begging.

In a possible implementation, in a first implementation manner of the twelfth aspect, the acquiring unit includes: a first receiving subunit, configured to receive the first message sent by the UE The first entity receives the first security message while receiving the first message; or the second receiving subunit is configured to receive the first message sent by the UE, where the first message is used Establishing a session; a first sending subunit, configured to send a security policy request message to the security policy management function entity; and a third receiving subunit, configured to receive a security policy request response message sent by the security policy management function entity, where the security The target security policy is included in the policy request response message. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a second implementation manner of the twelfth aspect, the acquiring unit includes: a fourth receiving subunit, configured to receive the first message sent by the UE Receiving the access network type of the UE while receiving the first message; the second sending subunit is configured to send a security policy request message to the security policy management function entity, where the security policy request message includes The access network type of the UE, so that the security policy management function entity determines the security endpoint information of the session to be established according to the access network type of the UE; and the fifth receiving subunit is configured to receive the policy. And a security policy response message sent by the management entity, where the security policy response message includes the target security policy, where the target security policy includes security endpoint information of the UE to be established. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a second implementation manner of the twelfth aspect, the acquiring unit includes: a fifth receiving subunit, configured to receive the first message sent by the UE Receiving the access network type of the UE while receiving the first message, and determining a subunit, configured to determine, according to the access network type of the UE, security endpoint information of the UE to establish a session. The embodiment of the present application refines the acquisition process, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a third implementation manner of the twelfth aspect, the first entity further includes: a saving unit, configured to save the acquired target security policy. The embodiment of the present application adds a step of saving the target security policy, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

A thirteenth aspect of the embodiments of the present application provides a radio access network entity, including: a first acquiring unit, configured to acquire a second message for a user equipment UE, where the second message includes a target security policy; And an establishing unit, configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE, according to the target security policy. In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the thirteenth aspect of the embodiments, the radio access network entity further includes: a second acquiring unit, configured to acquire a first identifier, where the The identifier includes any one of a session identifier, a slice identifier, and a media stream identifier, where the target security policy is a security policy corresponding to the first identifier. The embodiment of the present application adds the step of obtaining the first identifier, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the thirteenth aspect of the embodiment of the present application, the wireless connection The inbound network entity further includes: a saving unit, configured to save the target security policy; or, configured to save a correspondence between the first identifier and the target security policy. The embodiment of the present application adds a step of saving the target security policy, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a third implementation manner of the thirteenth aspect of the embodiments of the present application, the determining unit includes: determining a subunit, configured to be used according to at least the target security policy and the RAN entity The security capability determines a target algorithm, the target algorithm is an encryption and/or integrity protection algorithm for the UE; the establishing unit includes: a setup subunit, configured to establish/switch a radio bearer according to the target algorithm. The embodiment of the present application refines the process of determining the protection policy, and increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a fourth implementation manner of the thirteenth aspect of the embodiments of the present application, the determining unit includes: the determining subunit, further configured to perform the at least the target security policy and the The security capability of the RAN entity determines a target algorithm, the target algorithm is an encryption and/or integrity protection algorithm corresponding to the first identifier on the UE; a subunit is established, and is further configured to be used according to the target algorithm Establish/switch wireless bearers. The embodiment of the present application refines the process of determining the protection policy, and increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fifth implementation manner of the thirteenth aspect, the determining subunit includes: a determining module, configured to determine whether there is a candidate algorithm that satisfies the target security policy; The determining module, if there is a candidate algorithm that satisfies the target security policy, is configured to determine, according to the security capability of the RAN entity, that the algorithm with the highest priority among the candidate algorithms is the target algorithm. The embodiment of the present application refines the process of determining the target algorithm, and increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a sixth implementation manner of the thirteenth aspect of the embodiments, the establishing subunit includes: a first sending module, configured to send a third message to the UE, where The third message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier, so that the UE stores the target algorithm. Corresponding relationship with the second identifier; a receiving module, configured to receive a response message of the third message sent by the UE; and a second sending module, configured to send a setup/switch radio bearer request message to the UE, where the wireless device is established The bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier, so that the UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier. The embodiment of the present application provides a specific implementation manner for establishing a radio bearer, which increases the operability of the embodiment of the present application.

In a possible design, in a seventh implementation manner of the thirteenth aspect, the establishing subunit includes: a third sending module, configured to send a third message, where the third message is Corresponding relationship between the target algorithm and the second identifier, and a correspondence between the identifier of the RAN entity establishing/switching the radio bearer and the second identifier, so that the UE is corresponding to the second identifier according to the target algorithm Determining an algorithm used by the established/switched radio bearer, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. The embodiment of the present application provides a specific implementation manner for establishing a radio bearer, which increases the operability of the embodiment of the present application.

In a possible design, in an eighth implementation manner of the thirteenth aspect, the first acquiring unit includes: a first receiving subunit, configured to receive a second message sent by the first entity. The second message is used to establish an initial context. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

In a possible design, in a ninth implementation manner of the thirteenth aspect, the first acquiring unit includes: a second receiving subunit, configured to receive a second message sent by the first entity The second message is for switching. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

In a possible design, in a tenth implementation manner of the thirteenth aspect, the RAN is a target RAN entity, and the first acquiring unit includes: a third receiving subunit, configured to receive A second message sent by the source RAN entity, the second message being used for handover. The embodiment of the present application defines the second message, so that the embodiment of the present application is more logical.

A fourteenth aspect of the embodiments of the present application provides a functional entity, where the functional entity is a second entity, including: an acquiring unit, configured to acquire a first message, where the first message is used to establish a session; And sending a security policy request message to the security policy management function entity, where the first receiving unit is configured to receive the security policy response message, where the security policy response message includes the target security policy, and the second sending unit is configured to send the The first message also sends the target security policy. In the embodiment of the present application, in the process of establishing the initial context, when the security endpoint of the network is located on the radio access network side, the second entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the fourteenth aspect of the embodiments of the present application, the acquiring unit includes: a receiving subunit, configured to receive the first message, where the first message includes An access network type of the UE; a determining subunit, configured to determine an access network type of the UE; the second sending unit includes: a first sending subunit, configured to send the first message, and further send the The access network type of the UE. The embodiment of the present application adds a process of acquiring an access network type, and an implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the fourteenth aspect of the embodiments, the second entity further includes: a second receiving unit, configured to receive the first message and the UE The third sending unit is configured to send a security policy request message to the security policy management function entity, where the security policy request message includes the security requirement of the UE, and the third receiving unit is configured to receive the security policy response message. The security policy response message includes a target security policy, where the target security policy is determined by the policy control function entity according to the security requirement of the UE, and the fourth sending unit is configured to send the first message, The target security policy is also sent. The embodiment of the present application adds a process of acquiring a target security policy according to the security requirements of the UE, and the implementation manner of the embodiment of the present application is added.

A fifteenth aspect of the present application provides a source radio access network entity, including: a decision unit, configured to initiate a handover procedure for a user equipment UE, and a sending unit, configured to send a first message to the target RAN entity, The first message is used to request a handover, and the first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target security policy, The first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the fifteenth aspect, the source radio access network entity further includes: a determining unit, configured to measure according to the first security policy and the UE The report determines a target RAN entity, the first security policy is the target security policy of the UE saved by the source RAN entity or the source RAN The highest security policy in the target security policy of the UE saved by the entity, the measurement report including signal quality information of the candidate RAN entity. The embodiment of the present application adds a process of determining a target RAN entity according to the measurement report of the UE, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the fifteenth aspect of the embodiments of the present application, the determining unit includes: a first determining subunit, configured to determine, according to the measurement report, a signal quality requirement a candidate RAN entity, the measurement report includes signal quality information of the candidate RAN entity, and a second determining subunit, configured to determine, in the candidate RAN entity, a RAN entity that meets the first security policy as a target RAN entity. The embodiment of the present application refines the process of determining the target RAN entity, which increases the achievability and operability of the embodiment of the present application.

A sixteenth aspect of the embodiments of the present application provides a target radio access network entity, including: a first acquiring unit, configured to acquire a first message and a target security policy, where the first message is used to request a handover; And determining, by the target security policy, an encryption and/or integrity protection policy of the UE; and establishing, by the establishing unit, the radio bearer according to the determined encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the sixteenth aspect of the embodiments of the present application, the target radio access network entity further includes: a second acquiring unit, configured to acquire the first identifier, The first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. The embodiment of the present application adds the step of obtaining the first identifier, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the sixteenth aspect, the first acquiring unit includes: a first receiving subunit, configured to receive the first message sent by the source RAN entity. The first message is used to request a handover, the first message includes a target security policy, or is configured to receive a first message sent by a source RAN entity, where the first message is used to request a handover, the first message The first identifier and the corresponding target security policy are included, and the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a third implementation manner of the sixteenth aspect of the embodiments of the present application, the first acquiring unit includes: a second receiving subunit, configured to receive, by the source RAN entity, the first a message, the first message is used to request a handover; the first sending subunit is configured to send a security policy request message to the first core network entity, and the third receiving subunit is configured to receive the first core network entity The security policy response message includes the target security policy in the security policy response message, where the first core network entity is a first entity or a second entity. The process of obtaining the target security policy is refined in the embodiment of the present application, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a fourth implementation manner of the sixteenth aspect, the first acquiring unit includes: a fourth receiving subunit, configured to receive, by the source RAN entity, the first a message, the first message is used to request a handover, and the second sending subunit is configured to send a security policy request to the first core network entity, where the security policy request includes a first identifier, where the first identifier includes a slice identifier Any one of the session identifier or the media stream identifier, where the first core network entity is the first entity or the second entity, and the fifth receiving subunit is configured to receive the security policy response message sent by the first entity, where The security policy response message includes the first identifier and a corresponding target security policy. The process of obtaining the target security policy is refined in the embodiment of the present application, and the implementation of the embodiment of the present application is increased. Sex and operability.

In a possible implementation, in a fifth implementation manner of the sixteenth aspect, the radio access network entity further includes: a sending unit, configured to send the receiving to the first core network entity a target security policy, such that the first core network entity verifies whether the target security policy is correct according to the saved security policy of the UE, where the first core network entity is a first entity or a second entity; or And sending, by the first core network entity, the received first identifier and the corresponding target security policy, so that the first core network entity verifies the first according to the saved relationship between the security policy of the UE and the identifier. And determining whether the corresponding target security policy is correct, and the first core network entity is the first entity or the second entity. The embodiment of the present application adds a step of verifying whether the target security policy is correct, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

A seventeenth aspect of the present application provides a core network entity, including: a first receiving unit, configured to receive a security policy request message sent by a radio access network RAN entity; and a first sending unit, configured to send to the RAN The entity sends a security policy response message, where the target security policy is included in the security policy response message. In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the core network entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the seventeenth aspect, the core network entity further includes: a second receiving unit, configured to receive the security sent by the RAN entity a policy request message, where the security policy request message further includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier, and the second sending unit is configured to send the identifier to the RAN entity. The security policy response message includes the target security policy, where the target security policy is a target security policy corresponding to the first identifier. The embodiment of the present application adds a process for the core network entity to send the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the seventeenth aspect of the embodiments, the core network entity is a first entity or a second entity. The embodiment of the present application defines the core network entity, so that the embodiment of the present application is more logical.

The eighteenth aspect of the present application provides a core network entity, including: a first receiving unit, configured to receive a target security policy for a user equipment UE, sent by the target radio access network RAN entity, where the target security is The policy is that the target RAN entity obtains from the source RAN entity in the handover process, and the first verification unit is configured to verify whether the target security policy is correct according to the saved security policy of the UE. In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the core network entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

In a possible implementation, in a first implementation manner of the eighteenth aspect, the core network entity further includes: a second receiving unit, configured to receive, by the target RAN entity, the first Identifying a target security policy corresponding to the first identifier, where the first identifier and the target security policy corresponding to the first identifier are obtained by the target RAN entity from a source RAN entity in a handover process; and a second verification unit, And determining, according to the relationship between the saved security policy and the identifier, whether the target security policy corresponding to the first identifier is correct. The embodiment of the present application adds a process for the core network entity to send the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the eighteenth aspect of the embodiment of the present application, the core network The entity is the first entity or the second entity. The embodiment of the present application defines the core network entity, so that the embodiment of the present application is more logical.

A nineteenth aspect of the present application provides a source radio access network entity, including: a decision unit, configured to initiate a handover process for a user equipment UE, and a sending unit, configured to send a first message to the first entity, The first message is used to request a handover, and the first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target security policy, The first identifier includes any one of a session identifier, a slice identifier, a radio bearer identifier, or a media stream identifier. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the nineteenth aspect, the radio access network entity further includes: a determining unit, configured to use the first security policy and the measurement report of the UE Determining a target RAN entity, the first security policy being the target security policy of the UE saved by the source RAN entity or the highest security policy in the target security policy of the UE saved by the source RAN entity, the measurement The report includes signal quality information for the candidate RAN entity. The embodiment of the present application adds a process of determining a target RAN entity according to the measurement report of the UE, and the implementation manner of the embodiment of the present application is added.

In a possible implementation, in a second implementation manner of the nineteenth aspect of the embodiments of the present application, the determining unit includes: a first determining subunit, configured to determine, according to the measurement report, a signal quality requirement a candidate RAN entity, the measurement report includes signal quality information of the candidate RAN entity, and a second determining subunit, configured to determine, in the candidate RAN entity, a RAN entity that meets the first security policy as a target RAN entity. The embodiment of the present application refines the process of determining the target RAN entity, which increases the achievability and operability of the embodiment of the present application.

A twentieth aspect of the embodiments of the present disclosure provides a target radio access network entity, including: an obtaining unit, configured to acquire a second message, where the second message is used to request handover, and the second message includes a target security policy. And a determining unit, configured to determine an encryption and/or integrity protection policy of the UE according to the target security policy; and an establishing unit, configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE. In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

In a possible design, in a first implementation manner of the twentieth aspect of the embodiment, the acquiring unit includes: a receiving subunit, configured to receive a second message sent by the first entity, where the The second message is used to request the handover, and the second message includes the target security policy; or, the second message is sent by the first entity, the second message is used to request the handover, and the second message includes the first message. And identifying a corresponding target security policy, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier. The embodiment of the present application refines the obtained second message, which increases the achievability and operability of the embodiment of the present application.

A twenty-first aspect of the present application provides a functional entity, where the functional entity is a first entity, and includes: an acquiring unit, configured to acquire a first message of the user equipment UE, where the first message is used to request a handover. a session of the UE; a sending unit, configured to send a second message to a target radio access network RAN entity of the UE, where the second message is used to request to switch a session of the UE, and the second message includes a target A security policy for the target RAN entity to determine an encryption and/or integrity protection policy for the UE. In the embodiment of the present application, the UE session is switched. In the process, when the security endpoint of the network is located on the radio access network side, the first entity sends the target security policy to the radio access network entity to meet different security requirements of different services or users.

In a possible implementation, in a first implementation manner of the twenty-first aspect of the embodiments of the present application, the acquiring unit includes: a first receiving subunit, configured to receive, sent by a source base station to which the UE is attached The first message, the first entity receives the first message while receiving the target security policy; or is configured to receive a first message sent by the source base station to which the UE is attached, where the first entity obtains The target security policy that is saved by itself. The process of obtaining the target security policy is refined in the embodiment of the present application, which increases the achievability and operability of the embodiment of the present application.

In a possible implementation, in a second implementation manner of the twenty-first aspect of the embodiments of the present application, the acquiring unit includes: a second receiving subunit, configured to receive, by the source base station to which the UE is attached, Receiving, by the first message, the target RAN entity type of the UE, while receiving the first message, and sending a sub-unit, configured to send a security policy request message to the security policy management function entity, where the security policy request message is sent Determining a target RAN entity type of the UE, so that the security policy management function entity determines security endpoint information of a session to be switched according to a target RAN entity type of the UE; and a third receiving subunit, configured to receive the The security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, where the target security policy includes security endpoint information of the UE to be established. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

In a possible design, in a third implementation manner of the twenty-first aspect of the embodiments of the present application, the acquiring unit includes: a fourth receiving subunit, configured to receive, by the source base station to which the UE is attached, a first message, receiving a target RAN entity type of the UE while receiving the first message, and determining a subunit, configured to determine, according to the target RAN entity type of the UE, a security endpoint of the UE to establish a session information. The embodiment of the present application refines the obtained first message, which increases the achievability and operability of the embodiment of the present application.

A second aspect of the present application provides a user equipment, including: a first receiving unit, configured to receive a correspondence between a second identifier sent by a first radio access network RAN entity and a target algorithm, and receive the Corresponding relationship between the radio bearer identifier that is established/switched by the first RAN entity and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier; And an algorithm used to determine the established/switched radio bearer according to the correspondence between the algorithm and the second identifier. In the embodiment of the present application, when the security endpoint of the network is located on the radio access network side, the user equipment establishes a radio bearer with the radio access network entity according to the obtained target security policy, and meets different security requirements of different services or users.

In a possible design, in a first implementation manner of the second aspect of the embodiment, the user equipment further includes: a second receiving unit, configured to receive, by the first RAN entity, a third message, the third message includes a correspondence between the second identifier and the target algorithm, a storage unit, configured to store a correspondence between the target algorithm and the second identifier, and a third receiving unit, configured to receive the The establishing/switching radio bearer request message sent by the first RAN entity, the establishing/switching radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier, and a second determining unit, configured to The correspondence between the target algorithm and the second identity determines an algorithm used by the established/switched radio bearer. The embodiment of the present application adds the step of establishing/switching the radio bearer according to the relationship between the second identifier and the target algorithm, and the implementation manner of the embodiment of the present application is added, so that the steps of the embodiment of the present application are more perfect.

In a possible implementation, in a second implementation manner of the twenty-second aspect of the embodiment of the present application, the user The device further includes: a third receiving unit, configured to receive a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm, and the first RAN entity is established/ Corresponding relationship between the switched radio bearer identifier and the second identifier; the third determining unit is configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier. The embodiment of the present application adds the step of establishing/switching a radio bearer according to the relationship between the second identifier and the target algorithm, and the implementation manner of the embodiment of the present application is added.

In a possible design, in a third implementation manner of the twenty-second aspect of the embodiment of the present application, the user equipment further includes: a sending unit, when the user rejects the target algorithm, used to The first RAN entity sends a reject message of the third message, the UE enters an idle state; the selecting unit is configured to select a second RAN entity in the candidate RAN; and the establishing unit is configured to establish a connection with the second RAN entity. The embodiment of the present application adds the steps when the user rejects the target security policy, and the implementation manner of the embodiment of the present application is added.

In a possible design, in a fourth implementation manner of the second aspect of the embodiment, the user equipment further includes: a fourth receiving unit, configured to receive security capability information broadcast by the RAN entity; And a determining unit, configured to determine the first RAN entity or the second RAN entity according to the capability of the RAN entity and the security requirement of the UE. The embodiment of the present application adds a step of the UE determining the first RAN entity or the second RAN entity, and the implementation manner of the embodiment of the present application is added.

A twenty-third aspect of the embodiments of the present application provides a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the methods described in the above aspects.

A twenty-fourth aspect of the embodiments of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the above aspects.

As can be seen from the above technical solutions, the embodiments of the present application have the following advantages:

In the technical solution provided by the embodiment of the present application, the radio access network RAN entity acquires a first message for the user equipment UE, where the first message includes a target security policy, and the RAN entity determines the encryption and/or integrity protection of the UE according to the target security policy. Policy; the RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE. The embodiments of the present application satisfy different security requirements of different services or users between the UE and the RAN entity.

DRAWINGS

FIG. 1 is a schematic diagram of an existing network architecture;

2 is a schematic diagram of an embodiment of a method for processing a security policy according to an embodiment of the present disclosure;

3 is a schematic flowchart of a specific process for establishing a radio bearer in an embodiment of the present application;

4 is a schematic diagram of another embodiment of a method for processing a security policy according to an embodiment of the present application;

FIG. 5 is a schematic diagram of another embodiment of a method for processing a security policy according to an embodiment of the present disclosure;

6 is a schematic diagram of an embodiment of a session management function entity in an embodiment of the present application;

FIG. 7 is a schematic diagram of an embodiment of a radio access network entity in an embodiment of the present application;

FIG. 8 is a schematic diagram of an embodiment of an access and mobility management function entity in an embodiment of the present application;

FIG. 9 is a schematic diagram of another embodiment of a radio access network entity according to an embodiment of the present application;

FIG. 10 is a schematic diagram of another embodiment of a radio access network entity according to an embodiment of the present application;

FIG. 11 is a schematic diagram of an embodiment of a core network entity in an embodiment of the present application;

FIG. 12 is a schematic diagram of another embodiment of a core network entity in an embodiment of the present application;

FIG. 13 is a schematic diagram of another embodiment of a radio access network entity in an embodiment of the present application;

14 is a schematic diagram of another embodiment of a radio access network entity in an embodiment of the present application;

15 is a schematic diagram of another embodiment of a session management function entity in an embodiment of the present application;

FIG. 16 is a schematic diagram of an embodiment of a user equipment according to an embodiment of the present application;

FIG. 17 is a schematic diagram of another embodiment of a user equipment according to an embodiment of the present application;

FIG. 17b is a schematic diagram of another embodiment of a user equipment according to an embodiment of the present application;

FIG. 18 is a schematic diagram of an embodiment of a functional entity device in an embodiment of the present application.

detailed description

The embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

The terms "first", "second", "third", "fourth", etc. (if present) in the specification and claims of the present application and the above figures are used to distinguish similar objects without having to use To describe a specific order or order. It is to be understood that the data so used may be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than what is illustrated or described herein. In addition, the term "comprises" or "comprises" or any variations thereof, is intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those that are clearly listed Steps or units, but may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

As shown in Figure 1, it is a schematic diagram of the architecture of the Next Generation (NG) mobile communication system, which is widely accepted and recognized in the progress of the 3rd Generation Partnership Project (3GPP) standard. The system architecture is an example. The user equipment (User Equipment, UE), the access network (AN), the core network (Core network, CN), and the data network (Data Network), wherein the user equipment, the access network, and the core network are configured. The main components of the architecture, logically they can be divided into two parts: user plane and control plane, the control plane is responsible for the management of the mobile network, and the user plane is responsible for the transmission of business data.

UE: It is the entrance of the mobile user to interact with the network. It can provide basic computing power, storage capability, display the business window to the user, and accept user input. Next Generation UE supports next-generation air interface technology, which establishes signal connection and data connection with the access network to transmit control signals and service data to the mobile network.

AN: Similar to the base station in the traditional network, it is deployed close to the UE, provides the network access function for authorized users in a specific area, and can transmit user data using different quality transmission tunnels according to the user level and service requirements. The AN can manage its own resources, make reasonable use, provide access services for the UE as needed, and forward control signals and user data between the UE and the CN.

CN: Responsible for maintaining the subscription data of the mobile network, managing the network elements of the mobile network, and providing functions such as session management, mobility management, policy management, and security authentication for the UE. When the UE is attached, the UE is provided with network access authentication; when the UE has a service request, the network resource is allocated to the UE; when the UE moves, the network resource is updated for the UE; when the UE is idle, the UE is provided with a fast recovery mechanism; When the UE is detached, the network resource is released for the UE; when the UE has the service data, the data routing function is provided for the UE, such as forwarding the uplink data to the data network; or connecting from the data network. The downlink data sent by the UE is received and forwarded to the AN for transmission to the UE.

Data Network: A data network that provides business services to users. The general client is located at the UE and the server is located at the data network. The data network can be a private network, such as a local area network, or an external network that is not controlled by the operator, such as the Internet Internet, or a proprietary network deployed by the operator, such as to configure the IP Multimedia Network subsystem (IP Multimedia Core). Network Subsystem, IMS) service.

In the existing Evolved Universal Terrestrial Radio Access Network (E-UTRAN), the UE can propose security requirements, and the security policy control function entity in the network according to the security requirements of the UE and the user plane gateway ( The security capability of the User Plane Gateway (UPGW) determines the security policy, so that the SM entity generates the session key according to the determined security policy, and the SM sends the generated session key to the UPGW, and sends the determined security policy to the UE, and the UE generates The same session key, in order to achieve security protection between the UE and the UPGW. The prior art only considers the determination and implementation of the security policy between the UE and the UPGW, but for some access technologies, such as by evolved E-UTRAN, the security endpoint of the UE and the network is still in the radio access network (Radio Access Network). , RAN) side, and the prior art does not consider how the entity between the UE and the RAN implements different security requirements of different services or users.

In this application, the radio access network RAN entity acquires a first message for the user equipment UE, where the first message includes a target security policy; the RAN entity determines an encryption and/or integrity protection policy of the UE according to the target security policy; The UE's encryption and/or integrity protection policy establishes a radio bearer. The embodiments of the present application satisfy different security requirements of different services or users between the UE and the RAN entity. In the embodiment of the present application, when the security endpoint of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and meets different security requirements of different services or users.

In the present application, the "first entity" is an entity that implements the session management function, and the "second entity" is an entity that implements the access and mobility management functions. For ease of description and understanding, in the embodiment of the present application, An entity is referred to as a "session management functional entity" and a "second entity" is referred to as an "access and mobility management functional entity." It can be understood that the “access and mobility management function entity” involved in the present application is the name of a core network entity that implements terminal device access and mobility management, and the “session management function entity” is a core network implementation terminal. Abbreviation for the core network entity of device session management. This application does not limit the name of the same functional entity.

For the sake of understanding, the specific process of the embodiment of the present application is described below. Referring to FIG. 2, an embodiment of the method for processing a security policy in the embodiment of the present application includes:

201. The user equipment UE configures a security capability requirement.

The user equipment UE receives the security capability requirements set by the user, and the user can set security requirements applied to all services or security requirements applied to a specific service.

202. The UE is attached to the network.

The UE attaches to the network and passes two-way authentication with the core network.

It should be noted that the UE is attached to the network through the RAN entity, and the broadcast information of the RAN entity includes the highest security capability supported by the RAN entity. The UE selects a cell that meets the UE security capability requirement according to the information broadcast by the RAN entity. The subsequent UE can enter the idle state. When the UE enters the connected state from the idle state, the UE can select the cell that meets the UE security capability requirement in the same manner.

203. The UE sends a session establishment request message, where the session establishment request message includes a security capability requirement of the UE.

The UE sends a session establishment request message to the core network, where the session establishment request message includes the security capability requirement of the UE.

It should be noted that the session establishment request message further includes a UE identifier, a network slice selection assistance information (NSSAI), and other information.

It can be understood that the NSSAI can include the service type and other information for selecting a slice, or it can be an identifier of a slice.

204. The access and mobility management function entity AMF receives the session establishment request message and sends it to the session management function entity SMF.

The Access and Mobility Management Function (AMF) receives the session establishment request message sent by the UE. The AMF sends the received session establishment request message to the session management function (SMF).

It should be noted that the AMF carries the UE access network type in the session establishment request message sent to the SMF. For example, the access network is an evolved E-UTRAN or a next generation radio access network (New Radio, NR), and the AMF can be based on The RAN entity identity of the UE accessing the network determines the access network type of the UE.

It can be understood that when the AMF selects the SMF, it is necessary to consider the security capability requirements of the UE, and try to select an SMF that satisfies the security requirements of the UE.

205. The SMF sends a session policy request message to the security policy management function entity.

The SMF sends a session policy request message to the security policy management function entity, and is configured to request the security policy management function entity to obtain the security policy, where the session policy request message includes the security requirement of the UE, and if the session establishment request message received by the SMF includes the NSSAI, The NSSAI is further included in the session policy request message, and is used to request to obtain a security policy for the slice corresponding to the NSSAI.

It should be noted that the session policy request message may further include a UE access network type, and the security policy management function entity determines the security endpoint according to the access network type of the UE. The security policy management function entity determines the security policy of the session according to the security requirements of the UE, the security requirements of the service, and the security policy of the operation.

The specific form of the security policy may be whether encryption or integrity protection policy information is required, and/or security requirement policy, and the security requirement policy may be security level information, minimum key length required to maintain data security, or security algorithm conforming to security requirements. In any form, the application does not limit the specific form; optionally, the security policy includes the security endpoint information of the session.

206. The security policy management function entity determines a security policy of the UE, where the policy is a target security policy.

The security policy management function entity determines the security policy of the UE, which is the target security policy.

207. The SMF receives a session policy response message sent by the security policy management function entity.

The SMF receives the session policy response message sent by the security policy management function entity, where the session policy response message includes the security policy of the UE that has been determined by the security policy management function entity, and the policy is the target security policy.

In an alternative embodiment, the SMF applies the security policy obtained from the security policy management function entity to different situations, or the SMF applies it to different situations according to the security policy content obtained from the security policy management function entity. For example, a security policy is applied to a slice, or a security policy is applied to a session, or a security policy is applied to a media stream.

It should be noted that the security policy management function entity can be integrated into one entity separately or separately The functional entities are integrated together. In this application, the security policy management function entity is a logical function entity that implements security policy management. The application does not limit the name of the same functional entity.

208. The SMF establishes a session with the core network.

The SMF initiates a session establishment process and establishes a session with the core network.

Optionally, in the process, the SMF determines a security endpoint of the session, and in this step, the SMF determines a security endpoint of the session according to the type of access network obtained from the AMF.

It should be noted that, in this embodiment of the present application, the SMF or the security policy management function entity determines that the security endpoint of the session is on the access network side.

209. The SMF sends an initial context setup request message to the AMF, where the initial context setup request message includes a target security policy.

The SMF sends an initial context setup request message to the RAN entity through the AMF, where the initial context setup request message includes a target security policy.

It should be noted that, if the target security policy is used for a certain slice, the initial context setup request message further includes the identifier of the slice, and the specific form may be the network slice selection auxiliary information NSSAI, or may be the identifier of the other identifier slice of the SMF. Used to indicate that the security policy corresponds to the slice.

It can be understood that the target security policy can also be applied to all radio bearers (RBs) of the UE, or applied to a certain session, or applied to a certain data flow, and the target security policy is configured according to the service requirements of the operator. For example, when the target security policy is applied to a session, the initial context setup request message includes a session identifier; when the security policy is applied to a certain data flow, the initial context setup request message includes a data flow identifier.

It can be understood that the initial context request message includes the session identifier to which the established radio bearer belongs; when the requested radio bearer belongs to one media stream, the media stream identifier is included in the initial context request message; if the initial context request is requested to be established When the radio bearer belongs to a slice, the slice identifier is included in the initial context request message. If the slice identifier, the session identifier, or the media stream identifier also corresponds to the target security policy, the initial context request message carries the target security policy and the identifier. For the corresponding relationship, the slice identifier, the session identifier, or the media stream identifier does not need to be repeatedly carried in the initial context request message.

210. The AMF sends the obtained initial context setup request message to the RAN entity, where the initial context setup request message includes a target security policy.

The AMF sends an initial context setup request message obtained from the SMF to the RAN entity, where the initial context setup request message includes a target security policy, or a target security policy and corresponding identifier information.

It should be noted that, when the AMF sends the initial context setup request message to the RAN entity, the AMF may add other information in the process of encapsulating the message. For example, the RAN entity side may also carry the signaling and the initial context setup request message. The key required for security protection (for example, Kenb), the RAN entity side generates a target key required for encryption and/or integrity protection based on the key. It can be understood that the key for generating the target key has multiple generation manners, one way is generated by the AMF, for example, the AMF obtains the root key from the Security Anchor Function (SEAF) to derive the corresponding RAN. The key required by the entity; or generated by the SEAF, the AMF is obtained from the SEAF; it can also be obtained by the SMF in step 209, and carried in the initial context setup request message of step 209, for example, the SMF needs to obtain the RAN entity side from the SEAF. Key, or SMF based on the obtained SEAF The key is derived to obtain the key required by the RAN entity side. The required key key can be applied to all radio bearers RBs of the UE, and can also be applied to specific slices or sessions.

211. The RAN entity saves the security policy.

The RAN entity receives an initial context setup request message, where the initial context setup request message includes a target security policy, and the RAN entity saves the target security policy after acquiring the target security policy.

It should be noted that when the target security policy is applied to different situations, the RAN entity also needs to save the correspondence between the security policy and the identifier. For example, if the target security policy corresponds to the slice, the RAN entity saves the correspondence between the security policy and the slice identifier; if the target security policy corresponds to the radio bearer RB, the RAN generates a radio bearer identifier, and saves the correspondence between the security policy and the radio bearer identifier. If the target security policy corresponds to the session, the RAN entity saves the correspondence between the security policy and the session identifier; if the target security policy corresponds to the media stream, the RAN entity saves the correspondence between the target security policy and the media stream identifier.

It can be understood that the target security policy is used to generate a corresponding security context, and the RAN entity establishes a radio bearer according to the security context.

212. The RAN entity determines a UE encryption and/or integrity protection policy according to the target security policy.

If the target security policy specifies a security requirement, the RAN entity determines whether there is a candidate algorithm that satisfies the security requirements of the target security policy, and the candidate algorithm is an algorithm in the preset algorithm list; and the RAN entity should also consider the security capability of the UE, in the candidate algorithm. The algorithm that meets the security capability of the UE is selected. If there is a candidate algorithm that meets the security requirements of the target security policy and is UE-compliant, the RAN entity determines, according to the security capability configuration of the RAN entity, the algorithm with the highest priority among the candidate algorithms that meet the requirements. The target encryption and/or integrity protection algorithm; if there is no candidate algorithm that satisfies the security requirements of the target security policy, the RAN entity determines, in the preset algorithm, the algorithm with the highest priority that meets the UE capability as the target algorithm.

It should be noted that, when the service needs to perform data or signaling processing, and the processing is encryption and/or integrity protection, the RAN entity firstly follows the target security policy determined by the core network, its own security capability configuration, and the UE capability. The above principles select an encryption and/or a guarantee algorithm; when the service does not require encryption or integrity protection, the target security policy specifies that the signaling or data does not require encryption or integrity protection, and the RAN entity does not implement the corresponding security policy according to the target security policy. Security protection, no longer determining encryption and/or integrity protection algorithms.

Determining the encryption and/or integrity protection policy based on the target security policy is not limited to determining encryption and/or integrity protection algorithms, but may also be used to determine the key length based on the security requirements of the target security policy.

When the target policy is applied to different situations, the determined encryption and/or integrity protection policy is an encryption and/or integrity protection policy corresponding to the identity in that case.

213. The RAN entity establishes a radio bearer with the UE.

The RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE, and the encryption and/or integrity protection policy of the UE may be an encryption and/or integrity protection algorithm. When the target security policy is applied to different situations, the RAN entity determines an algorithm used by the established radio bearer according to the correspondence between the identifier corresponding to the established radio bearer and the encryption and/or integrity protection policy.

It should be noted that the process of establishing a radio bearer with the UE by the RAN entity is as shown in FIG. 3 . The specific steps are as follows: the RAN entity sends a security mode instruction message to the UE, and the security mode instruction includes a target algorithm, where the target policy is applied. In a different case, the security mode command further carries a second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier, and the UE stores a correspondence between the target algorithm and the second identifier. The RAN entity receives the security mode command completion message sent by the UE; the RAN entity sends a setup radio bearer request message to the UE; the UE receives the setup radio bearer request message sent by the RAN entity, where the setup radio bearer request message includes the established radio bearer identifier and corresponding And determining, by the UE, the algorithm used by the established radio bearer according to the correspondence between the target algorithm and the second identifier, that is, determining, according to the second identifier corresponding to the established radio bearer, the corresponding target algorithm, that is, the established wireless The algorithm used by the bearer; in a specific implementation process, the UE receives the security mode command message, and may present the network-selected algorithm information corresponding to the second identifier to the user, and the user decides whether to accept the algorithm, and the form of the presentation is not limited. Presenting a specific algorithm, and also presenting security level information corresponding to the algorithm Another optional implementation presented to the user is to include security level information corresponding to the selected algorithm in the security mode command for presenting to the user. When the user accepts the selected algorithm, the UE returns a security mode instruction completion message. When the user rejects the target algorithm or the security level, the UE sends a security mode instruction failure message to the RAN entity, the rejected RAN entity is the first RAN entity, the UE enters an idle state, and reselects the second RAN entity, the UE and the second The RAN entity establishes a connection; the UE reselects the second RAN entity according to the manner of selecting the RAN entity in step 202.

It can be understood that, if the target algorithm corresponds to the radio bearer, the security mode command message includes the radio bearer identification information; if the target algorithm corresponds to the slice, the security mode command message includes the slice identifier information; if the target algorithm corresponds to the session, The security mode command message includes the session identifier information. If the target algorithm corresponds to the media stream, the security mode command message includes the media stream identifier information.

It should be noted that, the present application does not limit the names of the messages in FIG. 3, and the message names that perform the same function are all within the protection scope of the present application.

214. The RAN entity sends an initial context setup response message to the AMF.

The RAN entity sends an initial context setup response message to the AMF.

215. The AMF sends an initial context setup response message to the SMF.

After the AMF obtains the initial context response message from the RAN entity, the initial context response message is sent to the SMF.

It can be understood that the session policy request message can also be sent by the AMF to the security policy management function entity, and obtain the target security policy fed back by the security policy management function entity. Steps 205 to 207 of the SMF obtaining the target security policy may be replaced by the following steps:

Step 1: The AMF sends a session policy request message to the security policy management function entity.

The session policy request message includes the security requirement requested by the UE. If the AMF receives the NSSAI information while receiving the session establishment request message, the session policy request further includes an NSSAI.

Step 2: The security policy management function entity determines the security policy of the UE, and the policy is the target security policy.

The form of the security policy is similar to that described in step 205 and will not be described again.

Step 3: The AMF receives the session policy response message sent by the security policy management function entity.

The session policy response message contains the target security policy.

Step 4: The AMF sends the received session establishment request message to the SMF, and sends the acquired target security policy while sending the session establishment request message.

The SMF may apply the security policy obtained from the security policy management function entity to different situations, or the SMF may apply it to different situations according to the security policy content obtained from the security policy management function entity. For example, a security policy is applied to a slice, or a security policy is applied to a session, or a security policy is applied to a media stream.

It should be noted that there may be multiple security policy management function entities. For example, for different slices, there may be corresponding security policy management function entities, and the security policy management function entity outside the slice is called the first security. The policy management function entity, after the AMF receives the session establishment request message, the AMF sends a security policy request message to the first security policy management function entity, where the first security policy management function is provided because the session policy request message includes the slice-related information. The entity may request the second security policy management function entity responsible for the slice to obtain the target security policy corresponding to the slice. After the first security policy management function entity obtains the target security policy, the target security policy is sent to the AMF.

It can be understood that when the security policy request message is related to the slice, the security policy related to the slice may also be preset in the first security policy management function entity, without requesting the acquisition target from the security policy management function entity responsible for the slice. The security policy, the first security policy management function entity outside the slice determines the security policy of the session according to the security requirements of the UE, the security requirements of the service, the security policy of the operation, and the security requirements of the slice, and feeds back the determined target security policy to the AMF. .

In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, different security requirements of different services or users are met, and the embodiment is also applicable to the need to confirm the security termination. Point, the default is to include security protection on the RAN side.

For the sake of understanding, the specific process of the embodiment of the present application is described below. Referring to FIG. 4, when the wireless access side implements the handover, another embodiment of the method for processing the security policy in the embodiment of the present application includes:

401. The user equipment UE configures a security capability requirement.

402. The UE establishes a session.

The UE establishes a session with the core network, where the session has a corresponding executed security policy.

403. The source RAN entity determines to initiate a handover to the UE.

The source RAN entity decides to initiate a handover procedure for the UE.

404. The source RAN entity determines the target RAN entity.

The source RAN entity determines a candidate RAN entity that meets the signal quality requirement according to the measurement report of the UE, where the measurement report of the UE includes signal quality information of the candidate RAN entity, and the source RAN entity targets the RAN entity that meets the first security policy among the candidate RAN entities. The RAN entity, the first security policy is a security policy of the UE saved by the source RAN entity, or a security policy or a highest security policy in the UE security context saved by the source RAN entity.

It should be noted that, in an optional implementation manner, when the target RAN entity to be selected is the evolved E-UTRAN, the source RAN selects the target evolved E-based based on the security policy or the highest security policy in the saved UE security context. UTRAN, in which the evolved E-UTRAN that meets the highest security policy requirements in the UE and meets the signal quality requirements is selected as the target RAN entity.

405. The source RAN entity sends a handover request message to the target RAN entity.

The source RAN entity sends a handover request message to the target RAN entity. The handover request message carries a security policy, where the policy is a target security policy; when the target security policy is applied to different situations, the handover request message includes the security policy and its corresponding identifier, for example, if the target security policy corresponds to the slice And the switch request message includes a slice identifier and a corresponding security policy; if the target security policy corresponds to the radio bearer RB, the handover request message includes the radio bearer identifier and the corresponding security policy; if the target security policy corresponds to the session, The switch request message includes a session identifier and a corresponding security policy. If the target security policy corresponds to the media stream, the switch request message includes the media stream identifier and the corresponding security policy.

In addition, if the target security policy is associated with the slice, the handover request further includes a correspondence between the radio bearer identifier and the slice identifier. In this manner, when the target RAN establishes the radio bearer, first determine the slice identifier corresponding to the radio bearer identifier. And determining, according to the slice identifier, a security policy of the slice, that is, a security policy applied to the radio bearer; similarly, if the target security policy corresponds to the session, the handover request further includes a correspondence between the radio bearer identifier and the session identifier; If the target security policy corresponds to the media stream, the handover request further includes a correspondence between the radio bearer identifier and the media stream identifier.

In an optional implementation manner, the source RAN entity determines whether to carry the security policy or the security policy and the corresponding identifier according to the network type of the target RAN of the handover. When the target RAN entity is the evolved E-UTRAN, the source RAN may carry the security policy or the security policy and the corresponding identifier of each security context of the UE in the handover request message, and the source RAN entity determines that the target RAN entity is the next generation wireless access. In the case of the network (New Radio, NR), the NR is not a secure endpoint of the session, and the handover request message may not include the security policy information, and only needs to include information required for the target RAN to reconstruct the radio bearer.

The handover request message further includes a key used for radio bearer encryption and/or integrity protection, where the key may be used for all radio bearers or a set of different keys corresponding to each radio bearer. It can also be a collection of keys for each slice or each session, or for each media stream.

406. The target RAN entity determines whether the target security policy of the UE is obtained.

The target RAN entity determines whether the target security policy of the UE is obtained. If the target security policy of the UE is not obtained, steps 407-408 are performed; otherwise, step 409 is performed.

It should be noted that, in an optional implementation manner, when the target RAN entity is evolved E-UTRAN, and the handover request message does not include a security policy, steps 407-408 are performed; when the target RAN entity is evolved E- When the UTRAN is included, and the handover request message includes a security policy, step 409 is performed.

407. The target RAN entity sends a security policy request message to the core network entity.

The target RAN entity sends a security policy request message to the core network entity. The core network entity may be an access and mobility management function entity AMF or a session management function entity SMF. If the target RAN entity sends the security policy request message to the SMF, the security policy request message is sent to the SMF through the AMF.

It should be noted that, in an optional implementation manner, the security policy request message further includes a slice identifier or a session identifier or a media stream identifier according to an actual application situation of the target security policy.

408. The core network entity sends a security policy response message to the target RAN entity.

The core network entity sends a security policy response message to the target RAN entity, where the security policy response message carries the target security policy of the UE, and when the security policy request message does not contain any information, all security policies for the UE are Sending to the target RAN entity, when the security policy request message further includes a slice identifier, the security policy response message includes a target security policy corresponding to the slice identifier and the slice identifier; and when the security policy request message further includes the session identifier, the security policy The response message includes a target security policy corresponding to the session identifier and the session identifier. When the security policy request message further includes the media stream identifier, the security policy response message includes the media stream identifier and the target security policy corresponding to the media stream identifier.

It should be noted that if the target RAN entity requests the target security policy of the UE from the SMF, the security policy response message is sent to the target RAN entity through the AMF.

409. The target RAN entity determines an encryption and/or integrity protection policy of the UE according to the target security policy.

The target RAN entity saves the target security policy before the target RAN determines the encryption and/or integrity protection policy of the UE.

The target RAN entity determines that the encryption and/or integrity protection policy of the UE is similar to the step 212 according to the target security policy, and is not described in this step.

It can be understood that, in an optional implementation manner, when the target RAN entity is evolved E-UTRAN, security protection of the session needs to be performed, and the target RAN determines the encryption and/or integrity protection policy of the UE according to the target security policy, otherwise Do not perform this step.

410. The target RAN entity establishes a radio bearer that is handed over on the UE.

The target RAN entity establishes a radio bearer for handover on the UE, and according to the target security policy obtained by the target RAN entity, if the handover radio bearer needs to perform encryption and/or integrity protection, the target RAN entity determines the handover radio bearer according to the determined target algorithm. The algorithm used. When the target security policy is applied to different situations, the RAN entity determines an algorithm used by the switched radio bearer according to the correspondence between the identifier corresponding to the switched radio bearer and the encryption and/or integrity protection policy.

If the target radio security policy determines that the switched radio bearer does not need to be encrypted or integrity protected, the above steps are not performed, and the data or signaling corresponding to the radio bearer is not encrypted and/or integrity protected.

411. The target RAN entity sends a handover request response message to the source RAN entity.

The target RAN entity sends a handover request response message to the source RAN entity, where the handover request response message includes the determined target algorithm. When the target security policy is applied to different situations, the handover request response message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. The handover request response message further includes the radio bearer identifier of the target RAN entity handover and the second identifier corresponding to the radio bearer, where the second identifier is not the radio bearer identifier, and step 412 is similar.

In a specific implementation manner, in order to express the foregoing correspondence, the second identifier may be included in the handover request response message twice, or may be included once, and is not limited. The following steps are similar.

412. The source RAN entity sends a handover instruction message to the UE.

After the target RAN entity acquires the handover request response message from the source RAN entity, the source RAN entity sends a handover instruction message to the UE, where the handover instruction message includes the determined algorithm. When the target security policy is applied to different situations, the handover instruction message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. After the UE receives the handover instruction, saves the target algorithm, or saves the correspondence between the target algorithm and the second identifier, and the UE determines the target RAN entity according to the target algorithm. The algorithm used by the switched radio bearers.

The handover command message further includes a radio bearer identifier that is switched by the target RAN entity and a second identifier that is corresponding to the radio bearer, and the UE determines, according to the correspondence between the target algorithm and the second identifier, the radio bearer used by the target RAN entity. The algorithm determines the target algorithm corresponding to the second identifier according to the second identifier corresponding to the radio bearer identifier that is switched by the target RAN entity, and is an algorithm used by the switched radio bearer.

Similar to step 213, when the UE receives the correspondence between the target algorithm or the target algorithm and the second identifier, the UE may present the network-selected algorithm information corresponding to the second identifier to the user, and the user decides whether to accept the algorithm. The form of the presentation is not limited to the presentation of the specific algorithm, and the security level information corresponding to the algorithm may also be presented. Another optional implementation manner presented to the user is to include the security corresponding to the selected algorithm in the handover request response message and the handover command message. The level information is used to present to the user. When the user accepts the selected algorithm, the UE accesses the target RAN entity. When the user rejects the target algorithm or security level, the rejected RAN entity is the first RAN entity, and the UE enters the idle state. And reselecting the second RAN entity, and the UE establishes a connection with the second RAN entity.

413. The target RAN entity sends a path switch request message to the SMF.

The target RAN entity sends a path switch request message to the SMF, and notifies the SMF that the UE has switched the information of the RAN entity.

It should be noted that, if the target RAN entity receives the target security policy of the UE in step 405, the target handover policy is included in the path switch request message, and the SMF is used to verify whether the security policy used by the target RAN entity is correct. The path switch request message is sent to the SMF through the AMF.

In an optional implementation manner, the target security policy of the received UE is sent at the same time as the path switch request message is sent, so that the AMF verifies whether the security policy used by the target RAN is correct.

It can be understood that, in another optional implementation manner, when the target RAN entity is NR, the target RAN type is further included in the path switch request message, and the target RAN entity type is NR indication information, so that the SMF The endpoint of the session is determined according to the target RAN entity type in the User Plane Gateway (UPGW).

414. The SMF determines, according to the saved target security policy of the UE, whether the security policy used by the target RAN entity is correct.

When the judgment is correct, the subsequent process is performed. When the SMF determines that the security policy used by the target RAN entity is incorrect, corresponding measures may be taken, such as alerting the target RAN entity. Correspondingly, the situation verified by AMF is similar.

When the SMF determines that the endpoint of the session is the UPGW, the SMF creates a corresponding security context between the UE and the UPGW according to the saved target security policy of the UE.

415. The SMF sends a path switch response message to the target RAN entity.

The SMF sends a Path Switch Response message to the target RAN entity, and the Path Switch Response message is sent to the target RAN entity through the AMF.

In the embodiment of the present application, in the process of switching the radio bearer, when the security termination point of the network is located on the radio access network side, different security requirements of different services or users are met.

Referring to FIG. 5, when the wireless access side implements the handover, another embodiment of the method for processing the security policy in the embodiment of the present application includes:

501. The user equipment UE configures a security capability requirement.

502. The UE establishes a session.

503. The source RAN entity decides to initiate a handover to the UE.

The source RAN entity decides to initiate a handover procedure for the UE.

504. The source RAN entity determines a target RAN entity.

505. The source RAN entity sends a handover request message to the access and mobility management function entity AMF.

The source RAN entity sends a handover request message to the session management function entity SMF, whose handover request message is sent to the SMF through the access and mobility management function entity AMF.

In an optional implementation manner, the handover request message carries the security policy information of the UE, where the policy is a target security policy, and when the target security policy is applied to different situations, the security policy is included in the handover request message and Corresponding identifier, for example, if the target security policy corresponds to the slice, the switch request message includes the slice identifier and the corresponding security policy; if the target security policy corresponds to the radio bearer RB, the radio bearer identifier is included in the handover request message. Corresponding security policy; if the target security policy corresponds to the session, the session request identifier and the corresponding security policy are included in the handover request message; if the target security policy corresponds to the media flow, the mediation identifier and the corresponding media stream identifier are included in the handover request message. security strategy.

In addition, if the target security policy is associated with the slice, the handover request message further includes a correspondence between the radio bearer identifier and the slice identifier. In this manner, when the target RAN establishes the radio bearer, first determine the slice corresponding to the radio bearer identifier. Identifying, and determining a security policy of the slice according to the slice identifier, that is, a security policy applied to the radio bearer; similarly, if the target security policy corresponds to the session, the handover request message further includes a correspondence between the radio bearer identifier and the session identifier. If the target security policy corresponds to the media stream, the handover request message further includes a correspondence between the radio bearer identifier and the media stream identifier.

In another optional implementation manner, the source RAN entity determines, according to the network type of the target RAN of the handover, whether the security policy or the security policy and the corresponding identifier are carried in the handover request message. When the target RAN entity is the evolved E-UTRAN, the source RAN may carry the security policy or the security policy and the corresponding identifier of each security context of the UE in the handover request message, and the source RAN entity determines that the target RAN entity is the next generation wireless access. In the case of the network (New Radio, NR), the NR is not a secure endpoint of the session, and the handover request message may not include the security policy information, and only needs to include information required for the target RAN to reconstruct the radio bearer.

506. The AMF sends a handover request message to the source session management function entity SMF.

The AMF sends a handover request message to the source session management function entity SMF.

An optional implementation manner is that, in step 505, the security policy information of the UE is not included, but the AMF identifies that the request message is to be sent to the SMF, and the AMF uses the saved security policy information of the UE as the target security policy. The information is sent to the SMF together with the handover request message. In this case, the handover request message includes the correspondence between the radio bearer identifier and the slice identifier, or the correspondence between the radio bearer identifier and the session identifier, or the radio bearer identifier and the media stream identifier. Correspondence relationship.

507. The SMF sends a handover request message to the target RAN entity.

After receiving the handover request message sent by the source RAN entity, the SMF sends a handover request message to the target RAN entity, where the handover request message carries security policy information, which is the target security policy information received from the handover request message.

In another optional implementation manner, the target security policy information is not included in the steps 505, 506. The target security policy information is the security policy information saved by the SMF for the UE session.

The target security policy information is obtained by using any of the foregoing embodiments. When the target security policy is applied to different situations, the security policy and the corresponding identifier are included in the handover request. For example, if the target security policy corresponds to the slice, the handover request is performed. The slice identifier and the corresponding security policy are included; if the target security policy corresponds to the radio bearer RB, the radio bearer identifier and the corresponding security policy are included in the handover request; if the target security policy corresponds to the session, the session is included in the handover request The identifier and the corresponding security policy; if the target security policy corresponds to the media stream, the media stream identifier and the corresponding security policy are included in the handover request.

In addition, the handover request further includes a correspondence between the radio bearer identifier and the identifier obtained by the target RAN entity from the handover request message, such as a correspondence between the radio bearer identifier and the slice identifier, or a correspondence between the radio bearer identifier and the session identifier, or Correspondence between the radio bearer identifier and the media stream identifier.

In another optional implementation manner, the SMF determines the security endpoint of the session according to the type of the target RAN entity that is switched, and the SMF may determine the security endpoint of the session according to the target RAN entity type, or send the target RAN type. To the security policy management function entity, the security policy management function entity determines the security endpoint of the session and returns it to the SMF. When the target RAN is the evolved E-UTRAN, it is determined that the security endpoint of the session is in the target RAN entity, and the security request information is carried in the handover request message sent to the target RAN; when the source RAN entity determines that the target RAN entity is the next generation wireless connection When the NR is not a secure endpoint of the session, the handover request message does not contain security policy information, and only needs to include information needed to reconstruct the radio bearer in the target RAN.

It can be understood that, if the SMF changes, the source SMF that receives the handover request message sent by the AMF sends a redirect request message to the target SMF, where the redirect request message includes target security policy information, and the target SMF according to the redirect request The message sends a handover request message to the target RAN entity.

508. The target RAN entity determines an encryption and/or integrity protection policy of the UE according to the target security policy.

The target RAN entity determines that the encryption and/or integrity protection policy of the UE is the same as that of step 212 according to the target security policy, and is not described in this step.

509. The target RAN entity establishes a radio bearer that is handed over on the UE.

The target RAN entity establishes a radio bearer for handover on the UE, and according to the target policy obtained by the target RAN entity, if the handover radio bearer needs to perform encryption and/or integrity protection, the target RAN entity determines the handover radio bearer according to the determined target algorithm. The algorithm used. When the target security policy is applied to different situations, the RAN entity determines an algorithm used by the switched radio bearer according to the correspondence between the identifier corresponding to the switched radio bearer and the encryption and/or integrity protection policy.

If the radio bearer of the target security policy is not required to perform encryption or integrity protection, the above steps are not performed, and the data or signaling corresponding to the radio bearer is not encrypted or integrity protected.

510. The target RAN entity sends a handover request response message to the SMF.

The target RAN entity sends a handover request response message to the SMF, where the handover request response message includes the determined algorithm. When the target security policy is applied to different situations, the handover request response message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. . The handover request response message further includes a radio bearer identifier that is switched by the target RAN entity and a second identifier corresponding to the radio bearer, where the second identifier is not a radio bearer identifier, and steps 511 and 512 are similar.

The handover request response message is sent to the SMF through the AMF.

511. The SMF sends a handover instruction message to the source RAN.

After the SMF obtains the handover request response message from the target RAN entity, the SMF sends a handover instruction message to the source RAN, where the handover instruction message includes the determined algorithm. When the target security policy is applied to different situations, the handover instruction message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. The handover command message further includes a radio bearer identifier switched by the target RAN entity and a second identifier corresponding to the radio bearer.

512. The source RAN sends a handover instruction message to the UE.

After the source RAN acquires the handover instruction message from the SMF, the source RAN sends a handover instruction message to the UE.

After receiving the handover instruction message, the UE saves the target algorithm, or saves the correspondence between the target algorithm and the second identifier, and determines an algorithm used by the target RAN entity to switch the radio bearer according to the target algorithm, or according to the target algorithm and the second algorithm. Determining, by the identifier, the algorithm used by the radio bearer switched by the target RAN entity, that is, determining the target algorithm corresponding to the second identifier according to the second identifier corresponding to the radio bearer identifier that is switched by the target RAN entity, as the switched radio bearer The algorithm used.

Similar to step 213, when the UE receives the correspondence between the target algorithm or the target algorithm and the second identifier, the UE may present the network-selected algorithm information corresponding to the second identifier to the user, and the user decides whether to accept the algorithm. The form of the presentation is not limited to presenting a specific algorithm, and the security level information corresponding to the algorithm may also be presented to be presented to the user. Another optional implementation manner is that the switching instruction message includes security level information corresponding to the selected algorithm, and is used for presenting to the user. When the user accepts the selected algorithm, the UE accesses the target RAN entity, and when the user rejects When the target algorithm or security level is reached, the rejected RAN entity is the first RAN entity, the UE enters an idle state, and the second RAN entity is reselected, and the UE establishes a connection with the second RAN entity.

The method for processing the security policy in the embodiment of the present application is described above. The following describes the related device in the embodiment of the present application. Referring to FIG. 6, an embodiment of the session management function entity in the embodiment of the present application includes:

The obtaining unit 601 is configured to acquire a first message and a target security policy for the user equipment UE, where the first message is used to establish a session of the UE;

The sending unit 602 is configured to send, to the radio access network RAN entity of the UE, a second message, where the second message is used to create a context of the UE, the second message includes a target security policy, and the target security policy is used by the RAN entity to determine the UE. Encryption and/or integrity protection strategy.

Optionally, the obtaining unit 601 may further include:

The first receiving subunit 6011 is configured to receive a first message sent by the UE, and the SMF receives the first message while receiving the target security policy; or

a second receiving subunit 6012, configured to receive a first message sent by the UE, where the first message is used to establish a session;

The first sending subunit 6013 is configured to send a security policy request message to the security policy management function entity;

The third receiving sub-unit 6014 is configured to receive a security policy request response message sent by the security policy management function entity, where the security policy request response message includes a target security policy.

Optionally, the obtaining unit 601 may further include:

The fourth receiving subunit 6015 is configured to receive the first message sent by the UE, and receive the access network type of the UE while receiving the first message;

The second sending sub-unit 6016 is configured to send a security policy request message to the security policy management function entity, where the security policy request message includes the access network type of the UE, so that the policy management entity determines the to-be established according to the access network type of the UE. Security endpoint information for the session;

The fifth receiving sub-unit 6017 is configured to receive a security policy response message sent by the security policy management function entity, where the security policy response message includes a target security policy, where the target security policy includes the security endpoint information of the UE to establish a session.

Optionally, the obtaining unit 601 may further include:

The fifth receiving subunit 6018 is configured to receive the first message sent by the UE, and receive the access network type of the UE while receiving the first message;

The determining subunit 6019 is configured to determine, according to the access network type of the UE, the security endpoint information of the UE to establish a session.

Optionally, the session management function entity may further include:

The saving unit 603 is configured to save the acquired target security policy.

In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located in the radio access network On the network side, the session management function entity sends the target security policy to the radio access network entity to meet different security requirements of different services or users.

Referring to FIG. 7, an embodiment of a radio access network entity in this embodiment of the present application includes:

The first obtaining unit 701 is configured to acquire a second message for the user equipment UE, where the second message includes a target security policy;

a determining unit 702, configured to determine an encryption and/or integrity protection policy of the UE according to the target security policy;

The establishing unit 703 is configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.

Optionally, the radio access network entity may further include:

The second obtaining unit 704 is configured to obtain the first identifier, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier, and the target security policy is a security policy corresponding to the first identifier.

Optionally, the radio access network entity may further include:

The saving unit 705 is configured to save the target security policy; or, to save a correspondence between the first identifier and the target security policy.

Optionally, the determining unit 702 may further include:

Determining a sub-unit 7021, configured to determine a target algorithm according to at least a target security policy and a security capability of the RAN entity, where the target algorithm is an encryption and/or integrity protection algorithm for the UE;

The establishing unit 703 includes:

A subunit 7031 is created for establishing/switching a radio bearer according to a target algorithm.

Optionally, the determining unit 702 may further include:

The determining subunit 7021 is further configured to determine a target algorithm according to at least a target security policy and a security capability of the RAN entity, where the target algorithm is an encryption and/or integrity protection algorithm corresponding to the first identifier on the UE.

Optionally, the determining subunit 7021 may further include:

The determining module 70211 is configured to determine whether there is a candidate algorithm that satisfies the target security policy;

The determining module 70212 is configured to determine, according to the security capability of the RAN entity, an algorithm with the highest priority among the candidate algorithms as the target algorithm, if there is a candidate algorithm that satisfies the target security policy.

Optionally, the establishing subunit 7031 may further include:

The first sending module 70311 is configured to send a third message to the UE, where the third message includes a correspondence between the target algorithm and the second identifier, where the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. The identifier is such that the UE stores the correspondence between the target algorithm and the second identifier;

The receiving module 70312 is configured to receive a response message of the third message sent by the UE.

The second sending module 70313 is configured to send a setup/switch radio bearer request message to the UE, where the establishing/switching the radio bearer request message includes the correspondence between the established/switched radio bearer identifier and the second identifier, so that the UE is configured according to the target algorithm. The correspondence with the second identity determines the algorithm used by the established/switched radio bearer.

Optionally, the establishing subunit 7031 may further include:

The third sending module 70314 is configured to send a third message, where the third message includes a correspondence between the target algorithm and the second identifier, and a correspondence between the identifier of the RAN entity establishing/switching the radio bearer and the second identifier, So that the UE determines, according to the correspondence between the target algorithm and the second identifier, that the established/switched radio bearer is used. And the second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier.

Optionally, the first obtaining unit 701 may further include:

The first receiving subunit 7011 is configured to receive a second message sent by the session management function entity SMF, where the second message is used to establish an initial context.

Optionally, the first obtaining unit 701 may further include:

The second receiving subunit 7012 is configured to receive a second message sent by the session management function entity SMF, where the second message is used to switch the session of the UE.

Optionally, the first obtaining unit 701 may further include:

The third receiving subunit 7013 is configured to receive a second message sent by the source RAN entity, where the second message is used to switch the session of the UE.

In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

Referring to FIG. 8, an embodiment of an access and mobility management function entity in this embodiment of the present application includes:

The obtaining unit 801 is configured to acquire a first message, where the first message is used to establish a session;

The first sending unit 802 is configured to send a security policy request message to the security policy management function entity.

The first receiving unit 803 is configured to receive a security policy response message, where the security policy response message includes a target security policy;

The second sending unit 804 is configured to send the first message, and also send the target security policy.

Optionally, the obtaining unit 801 may further include:

The receiving subunit 8011 is configured to receive a first message, where the first message includes an access network type of the UE;

Determining a subunit 8012, configured to determine an access network type of the UE;

The second sending unit 804 includes:

The first sending subunit 8041 is configured to send the first message, and also send the access network type of the UE.

Optionally, the access and mobility management function entity may further include:

a second receiving unit 805, configured to receive a first message and a security requirement of the UE;

The third sending unit 806 is configured to send a security policy request message to the security policy management function entity, where the security policy request message includes the security requirement of the UE.

The third receiving unit 807 is configured to receive a security policy response message, where the security policy response message includes a target security policy, where the target security policy is determined by the policy control function entity according to the security requirement of the UE;

The fourth sending unit 808 is configured to send the first message, and also send the target security policy.

In the embodiment of the present application, in the process of establishing an initial context, when the security endpoint of the network is located on the radio access network side, the access and mobility management function entity sends the target security policy to the radio access network entity, which satisfies Different security needs of different businesses or users.

Referring to FIG. 9, another embodiment of a radio access network entity in this embodiment of the present application includes:

The determining unit 901 is configured to: initiate a handover process for the user equipment UE;

The sending unit 902 is configured to send, to the target RAN entity, a first message, where the first message is used to request a handover, where the first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target. The security policy, the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier.

Optionally, the radio access network entity may further include:

The determining unit 903 is configured to determine, according to the first security policy and the measurement report of the UE, the target RAN entity, where the first security policy is the highest of the target security policy of the UE saved by the source RAN entity or the target security policy of the UE saved by the source RAN entity. The security policy, the measurement report includes signal quality information of the candidate RAN entity.

Optionally, the determining unit 903 may further include:

a first determining subunit 9031, configured to determine, according to the measurement report, a candidate RAN entity that meets a signal quality requirement, where the measurement report includes signal quality information of the candidate RAN entity;

The second determining subunit 9032 is configured to determine, in the candidate RAN entity, that the RAN entity that conforms to the first security policy is the target RAN entity.

In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the source radio access network sends the received target security policy to the target radio access network, which satisfies different Different security needs of the business or user.

Referring to FIG. 10, another embodiment of a radio access network entity in this embodiment of the present application includes:

The first obtaining unit 1001 is configured to acquire a first message and a target security policy, where the first message is used to request to switch the session of the UE;

a determining unit 1002, configured to determine, by the target security policy, an encryption and/or integrity protection policy of the UE;

The establishing unit 1003 is configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.

Optionally, the radio access network entity may further include:

The second obtaining unit 1004 is configured to obtain a first identifier, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier.

Optionally, the first obtaining unit 1001 may further include:

The first receiving subunit 10011 is configured to receive a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE, where the first message includes a target security policy;

Or, for receiving the first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE, where the first message includes the first identifier and the corresponding target security policy, where the first identifier includes the session identifier, the slice identifier, or Any of the media stream identifiers.

Optionally, the first obtaining unit 1001 may further include:

The second receiving subunit 10012 is configured to receive a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

The first sending subunit 10013 is configured to send a security policy request message to the first core network entity.

The third receiving subunit 10014 is configured to receive a security policy response message sent by the first core network entity, where the security policy response message includes a target security policy, where the first core network entity is a session management function entity SMF or access and mobility management. Functional entity AMF.

Optionally, the first obtaining unit 1001 may further include:

The fourth receiving subunit 10015 is configured to receive a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

The second sending sub-unit 10016 is configured to send a security policy request to the first core network entity, where the security policy request includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier, and the first core The network entity is a session management function entity SMF or an access and mobility management function entity AMF;

The fifth receiving subunit 10017 is configured to receive a security policy response message sent by the SMF, where the security policy response message includes the first identifier and the corresponding target security policy.

Optionally, the radio access network entity may further include:

The sending unit 1005 is configured to send the received target security policy to the first core network entity, so that the first core network entity verifies whether the target security policy is correct according to the saved UE security policy, where the first core network entity is a session management function entity. SMF or access and mobility management function entity AMF;

or,

And the first core network entity is configured to send the received first identifier and the corresponding target security policy to the first core network entity, so that the first core network entity verifies whether the target security policy corresponding to the first identifier is correct according to the relationship between the saved security policy and the identifier of the UE. The first core network entity is a session management function entity SMF or an access and mobility management function entity AMF.

In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the target radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or users. Different security needs.

Referring to FIG. 11, an embodiment of a core network entity in this embodiment of the present application includes:

The first receiving unit 1101 is configured to receive a target security policy for the user equipment UE that is sent by the target radio access network RAN entity, where the target security policy is obtained by the target RAN entity from the source RAN entity in the handover process;

The first verification unit 1102 is configured to verify, according to the saved security policy of the UE, whether the target security policy is correct.

Optionally, the core network entity may further include:

The second receiving unit 1103 is configured to receive a first identifier sent by the target RAN entity and a target security policy corresponding to the first identifier, where the target identifier and the target security policy corresponding to the first identifier are the target RAN entity in the handover process from the source Obtained by the RAN entity;

The second verification unit 1104 is configured to verify, according to the saved relationship between the security policy and the identifier, whether the target security policy corresponding to the first identifier is correct.

In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the core network entity sends the target security policy to the radio access network entity, which satisfies different services or users. Different security needs.

Referring to FIG. 12, another embodiment of a core network entity in this embodiment of the present application includes:

The first receiving unit 1201 is configured to receive a target security policy for the user equipment UE that is sent by the target radio access network RAN entity, where the target security policy is obtained by the target RAN entity from the source RAN entity in the handover process;

The first verification unit 1202 is configured to verify, according to the saved security policy of the UE, whether the target security policy is correct.

Optionally, the core network entity may further include:

The second receiving unit 1203 is configured to receive the first identifier sent by the target RAN entity and the target corresponding to the first identifier. The security policy, the first identifier, and the target security policy corresponding to the first identifier are obtained by the target RAN entity from the source RAN entity in the handover process;

The second verification unit 1204 is configured to verify, according to the saved relationship between the security policy and the identifier, whether the target security policy corresponding to the first identifier is correct.

Referring to FIG. 13, another embodiment of a radio access network entity in this embodiment of the present application includes:

a decision unit 1301, configured to initiate a handover process for the user equipment UE;

The sending unit 1302 is configured to send a first message to the session management function entity SMF, where the first message is used to request to switch the session of the UE, where the first message includes a target security policy for the UE, or the handover request includes the first for the UE. And the corresponding target security policy, where the first identifier includes any one of a session identifier, a slice identifier, a radio bearer identifier, or a media stream identifier.

Optionally, the radio access network entity may further include:

The determining unit 1303 is configured to determine, according to the first security policy and the measurement report of the UE, the target RAN entity, where the first security policy is the highest of the target security policy of the UE saved by the source RAN entity or the target security policy of the UE saved by the source RAN entity. The security policy, the measurement report includes signal quality information of the candidate RAN entity.

Optionally, the determining unit 1303 may further include:

a first determining subunit 13031, configured to determine, according to the measurement report, a candidate RAN entity that meets a signal quality requirement, where the measurement report includes signal quality information of the candidate RAN entity;

The second determining subunit 13032 is configured to determine, in the candidate RAN entity, that the RAN entity that conforms to the first security policy is the target RAN entity.

Referring to FIG. 14, another embodiment of a radio access network entity in this embodiment of the present application includes:

The obtaining unit 1401 is configured to acquire a second message, where the second message is used to request to switch a session of the UE, and the second message includes a target security policy;

a determining unit 1402, configured to determine, according to the target security policy, an encryption and/or integrity protection policy of the UE;

The establishing unit 1403 is configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.

Optionally, the obtaining unit 1401 may further include:

The receiving subunit 14011 is configured to receive a second message sent by the session management function entity SMF, where the second message is used to request to switch the session of the UE, the second message includes a target security policy, or is used to receive the session management function entity SMF. The second message is used to request to switch the session of the UE. The second message includes the first identifier and the corresponding target security policy. The first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier.

In the embodiment of the present application, in the process of switching the UE session, when the security termination point of the network is located on the radio access network side, the target radio access network establishes a radio bearer according to the received target security policy, and satisfies different services or uses. Different security needs of the household.

Referring to FIG. 15, another embodiment of a session management function entity in this embodiment of the present application includes:

The acquiring unit 1501 is configured to acquire a first message of the user equipment UE, where the first message is used to request to switch the session of the UE;

The sending unit 1502 is configured to send a second message to the target radio access network RAN entity of the UE, where the second message is used to request to switch the session of the UE, the second message includes a target security policy, and the target security policy is used by the target RAN entity to determine the UE. Encryption and/or integrity protection strategy.

Optionally, the obtaining unit 1501 may further include:

The first receiving subunit 15011 is configured to receive a first message sent by the source base station to which the UE is attached, and the SMF receives the first message and receives the target security policy;

or,

The first message sent by the source base station to which the UE is attached is received, and the SMF obtains the target security policy saved by itself.

Optionally, the obtaining unit 1501 may further include:

The second receiving subunit 15012 is configured to receive the first message sent by the source base station to which the UE is attached, and receive the target RAN entity type of the UE while receiving the first message;

The sending sub-unit 15013 is configured to send a security policy request message to the security policy management function entity, where the security policy request message includes the target RAN entity type of the UE, so that the security policy management function entity determines the to-be-switched according to the target RAN entity type of the UE. Security endpoint information for the session;

The third receiving sub-unit 15014 is configured to receive a security policy response message sent by the security policy management function entity, where the security policy response message includes a target security policy, where the target security policy includes the security endpoint information of the UE to establish a session.

Optionally, the obtaining unit 1501 may further include:

The fourth receiving subunit 15015 is configured to receive a first message sent by the source base station to which the UE is attached, and receive a target RAN entity type of the UE while receiving the first message;

The determining subunit 15016 is configured to determine, according to the target RAN entity type of the UE, security endpoint information of the UE to establish a session.

In the embodiment of the present application, in the process of switching the UE session, when the security endpoint of the network is located on the radio access network side, the session management function entity sends the target security policy to the radio access network entity to satisfy different services or users. Different security needs.

Referring to FIG. 16, an embodiment of a user equipment in this embodiment of the present application includes:

The first receiving unit 1601 is configured to receive a correspondence between the second identifier sent by the first radio access network RAN entity and the target algorithm, and receive a correspondence between the radio bearer identifier that is established/switched by the first RAN entity and the second identifier, The second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier;

The first determining unit 1602 is configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the algorithm and the second identifier.

Optionally, the user equipment may further include:

The second receiving unit 1603 is configured to receive a third message sent by the first RAN entity, where the third message includes the second label Correspondence between the knowledge and the target algorithm;

The storage unit 1604 is configured to store a correspondence between the target algorithm and the second identifier.

The third receiving unit 1605 is configured to receive a setup/switch radio bearer request message sent by the first RAN entity, where the establishing/switching radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier;

The second determining unit 1606 is configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.

Optionally, the user equipment may further include:

The third receiving unit 1607 is configured to receive a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm, and a radio bearer identifier and a second identifier that are established/switched by the first RAN entity. Correspondence relationship;

The third determining unit 1608 is configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.

Optionally, the user equipment may further include:

The sending unit 1609, when the user rejects the target algorithm, sends a reject message of the third message to the first RAN entity, and the UE enters an idle state;

a selecting unit 1610, configured to select a second RAN entity in the candidate RAN;

The establishing unit 1611 is configured to establish a connection with the second RAN entity.

Optionally, the user equipment may further include:

The fourth receiving unit 1612 is configured to receive security capability information broadcast by the RAN entity.

The fourth determining unit 1613 is configured to determine the first RAN entity or the second RAN entity according to the capability of the RAN entity and the security requirement of the UE.

In the embodiment of the present application, when the security endpoint of the network is located on the radio access network side, the user equipment establishes a radio bearer with the radio access network entity according to the obtained target security policy, and meets different security requirements of different services or users.

The related devices in the embodiments of the present application are described in detail from the perspective of a modular functional entity. The related devices in the embodiments of the present application are described in detail below.

Figure 17a is a schematic structural diagram of a user equipment according to an embodiment of the present application, with reference to Figure 17a. In the case of an integrated unit, FIG. 17a shows a possible structural diagram of the user equipment involved in the above embodiment. The user equipment 1700 includes a processing unit 1702 and a communication unit 1703. The processing unit 1702 is configured to control and manage the actions of the user equipment. For example, the processing unit 1702 is configured to support the user equipment to perform steps 201 to 203 in FIG. 2, and/or other processes for the techniques described herein. The communication unit 1703 is configured to support communication of the user equipment with other network entities. The streaming user equipment may further include a storage unit 1701 for storing program codes and data of the user equipment.

The processing unit 1702 may be a processor or a controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit, ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component Or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 1703 can be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and can include one or more interfaces, such as a transceiver interface. The storage unit 1701 may be a memory.

When the processing unit 1702 is a processor, the communication unit 1703 is a communication interface, and the storage unit 1701 is a memory, the user equipment involved in the embodiment of the present application may be the user equipment shown in FIG. 17b.

Referring to FIG. 17b, the user equipment 1710 includes a processor 1712, a communication interface 1713, and a memory 1711. Optionally, the user equipment 1710 may further include a bus 1714. The communication interface 1713, the processor 1712, and the memory 1711 may be connected to each other through a bus 1714; the bus 1714 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA). Bus, etc. The bus 1714 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 17b, but it does not mean that there is only one bus or one type of bus.

The user equipment structure shown in FIG. 17a or FIG. 17b may also be a structure of a user equipment part module. Referring to FIG. 18, FIG. 18 is a schematic structural diagram of a functional entity apparatus according to an embodiment of the present application. Depending on configuration or performance, a large difference may be included, including one or more central processing units (CPU) 1801 (eg, one or more processors) and memory 1809, one or more storage applications 1807 or storage medium 1808 of data 1806 (eg, one or one storage device in Shanghai). Among them, the memory 1809 and the storage medium 1808 may be short-term storage or persistent storage. The program stored on the storage medium 1803 may include one or more modules (not shown), each of which may include a series of instruction operations in the server. Still further, the processor 1801 can be configured to communicate with the storage medium 1803 to perform a series of instruction operations in the storage medium 1803 on the functional entity device 1800.

Functional physical device 1800 may also include one or more power supplies 1804, one or more wired or wireless network interfaces 1805, one or more input and output interfaces 1806, and/or one or more operating systems 1805, such as Windows Server, Mac OS X, Unix, Linux, FreeBSDTM and more.

The steps performed by the functional entities such as the RAN entity, the access and mobility management function entity, the session management function entity, and the core network entity in the above embodiments may be based on the structure shown in FIG.

The steps of the method or algorithm described in connection with the disclosure of the embodiments of the present application may be implemented in a hardware manner, or may be implemented by a processor executing software instructions. The software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium may be located in an application specific integrated circuit.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server, or data center by wire (eg, coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a Solid State Disk (SSD)) or the like.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in the embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

The above embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents. The modifications and substitutions of the embodiments do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

The various embodiments in the specification are described in a progressive manner, and the same or similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

Claims

A method for processing a security policy, comprising:

The first entity acquires a first message and a target security policy for the user equipment UE, where the first message is used to establish a session of the UE;

Transmitting, by the first entity, a second message to a radio access network RAN entity of the UE, where the second message is used to create a context of the UE in the RAN entity, where the second message includes the target security A policy, the target security policy is used by the RAN entity to determine an encryption and/or integrity protection policy of the UE.
The processing method according to claim 1, wherein the acquiring, by the first entity, the first message and the target security policy for the user equipment UE comprises:

Receiving, by the first entity, the first message sent by the UE, the first entity receiving the first message while receiving the target security policy;

or,

Receiving, by the first entity, the first message sent by the UE, where the first message is used to establish a session;

Sending, by the first entity, a security policy request message to the security policy management function entity;

The first entity receives a security policy request response message sent by the security policy management function entity, where the security policy request response message includes a target security policy.
The processing method according to claim 1, wherein the acquiring, by the first entity, the first message and the target security policy for the user equipment UE comprises:

Receiving, by the first entity, the first message sent by the UE, and receiving an access network type of the UE while receiving the first message;

The first entity sends a security policy request message to the security policy management function entity, where the security policy request message includes an access network type of the UE, so that the security policy management function entity is configured according to the UE The access network type determines the security endpoint information of the session to be established;

The first entity receives the security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, where the target security policy includes the security of the UE to establish a session. Endpoint information.
The processing method according to claim 1 or 2, wherein the acquiring, by the first entity, the first message and the target security policy for the user equipment UE comprises:

Receiving, by the first entity, the first message sent by the UE, and receiving an access network type of the UE while receiving the first message;

The first entity determines, according to the access network type of the UE, security endpoint information of the UE to establish a session.
The processing method according to claim 1, wherein after the first entity acquires the first message and the target security policy for the user equipment UE, the method further includes:

The first entity saves the acquired target security policy.
A method for processing a security policy, comprising:

The radio access network RAN entity acquires a second message for the user equipment UE, the second message including the target security Full strategy

Determining, by the RAN entity, an encryption and/or integrity protection policy of the UE according to the target security policy;

The RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The processing method according to claim 6, wherein when the radio access network RAN entity acquires the second message for the user equipment UE, the method further includes:

And the RAN entity obtains the first identifier, where the first identifier includes any one of a session identifier, a slice identifier, and a media stream identifier, where the target security policy is a security policy corresponding to the first identifier.
The processing method according to claim 6 or 7, wherein the radio access network RAN entity acquires a second message for the user equipment UE, and after the second message includes the target security policy, the method further includes :

The RAN entity saves the target security policy;

or,

The RAN entity saves a correspondence between the first identifier and the target security policy.
The processing method according to claim 6, wherein the determining, by the RAN entity, the encryption and/or integrity protection policy of the UE according to the target security policy comprises:

Determining, by the RAN entity, a target algorithm according to at least the target security policy and a security capability of the RAN entity, where the target algorithm is an encryption and/or integrity protection algorithm for the UE;

The establishing, by the RAN entity, the radio bearer according to the determined encryption and/or integrity protection policy of the UE includes:

The RAN entity establishes/switches a radio bearer according to the target algorithm.
The processing method according to claim 7, wherein the determining, by the RAN entity, the encryption and/or integrity protection policy of the UE according to the target security policy comprises:

Determining, by the RAN entity, a target algorithm according to at least the target security policy and a security capability of the RAN entity, where the target algorithm is an encryption and/or integrity protection corresponding to the first identifier on the UE algorithm;

The establishing, by the RAN entity, the radio bearer according to the determined encryption and/or integrity protection policy of the UE includes:

The RAN entity establishes/switches a radio bearer according to the target algorithm.
The processing method according to claim 9 or 10, wherein the determining, by the RAN entity, the target algorithm according to at least the target security policy and the security capability of the RAN entity comprises:

Determining, by the RAN entity, whether there is a candidate algorithm that satisfies the target security policy;

If there is a candidate algorithm that satisfies the target security policy, the RAN entity determines, according to the security capability of the RAN entity, that the algorithm with the highest priority among the candidate algorithms is the target algorithm.
The processing method according to claim 10, wherein the establishing, by the RAN entity, the radio bearer according to the target algorithm comprises:

The RAN entity sends a third message to the UE, where the third message includes a correspondence between the target algorithm and the second identifier, where the second identifier is in the session identifier, the slice identifier, the media stream identifier, and the radio bearer identifier. Any one of the identifiers, so that the UE stores a correspondence between the target algorithm and the second identifier;

Receiving, by the RAN entity, a response message of the third message sent by the UE;

Sending, by the RAN entity, a setup/switch radio bearer request message to the UE, the establishing/switching radio bearer The request message includes a correspondence between the established/switched radio bearer identifier and the second identifier, so that the UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The processing method according to claim 10, wherein the establishing, by the RAN entity, the radio bearer according to the target algorithm comprises:

The RAN entity sends a third message, where the third message includes a correspondence between the target algorithm and the second identifier, and a correspondence between the identifier of the RAN entity establishing/switching the radio bearer and the second identifier, so that Determining, by the UE, an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier, where the second identifier is a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier. Any of the logos.
The processing method according to any one of claims 6-7, 9-10, wherein the acquiring, by the radio access network RAN entity, the second message for the user equipment UE comprises:

The RAN entity receives a second message sent by the first entity, the second message being used to establish an initial context.
The processing method according to any one of claims 6-7, 9-10, wherein the acquiring, by the radio access network RAN entity, the second message for the user equipment UE comprises:

The RAN entity receives a second message sent by the first entity, where the second message is used to switch the session of the UE.
The processing method according to any one of claims 6-7, 9-10, wherein the RAN is a target RAN entity, and the radio access network RAN entity acquires a second message for the user equipment UE, including :

The RAN entity receives a second message sent by the source RAN entity, where the second message is used to switch the session of the UE.
A method for processing a security policy, comprising:

The second entity acquires a first message, where the first message is used to establish a session;

Sending, by the second entity, a security policy request message to the security policy management function entity;

The second entity receives a security policy response message, where the security policy response message includes a target security policy;

The second entity sends the first message while also transmitting the target security policy.
The processing method according to claim 17, wherein the acquiring, by the second entity, the first message comprises:

Receiving, by the second entity, the first message, where the first message includes an access network type of the UE;

Determining, by the second entity, an access network type of the UE;

The sending, by the second entity, the first message includes:

The second entity sends the first message, and also sends an access network type of the UE.
The processing method according to claim 17, wherein the method further comprises:

Receiving, by the second entity, the first message and a security requirement of the UE;

The second entity sends a security policy request message to the security policy management function entity, where the security policy request message includes the security requirement of the UE;

The second entity receives a security policy response message, where the security policy response message includes a target security policy, where the target security policy is determined by the policy control function entity according to the security requirement of the UE;

The second entity sends the first message while also transmitting the target security policy.
A method for processing a security policy, comprising:

The source RAN entity decides to initiate a handover procedure for the user equipment UE;

The source RAN entity sends a first message to the target RAN entity, the first message being used to request a handover, The first message includes a target security policy for the UE, or the handover request includes a first identifier for the UE and a corresponding target security policy, where the first identifier includes a session identifier, a slice identifier, or a media stream. Any of the logos.
The processing method according to claim 20, wherein, after the source RAN entity decides to initiate a handover procedure for the user equipment, before the source RAN entity sends the first message to the target RAN entity, the method further includes:

Determining, by the source RAN entity, the target RAN entity according to the first security policy and the measurement report of the UE, where the first security policy is the target security policy of the UE saved by the source RAN entity or the UE saved by the source RAN entity The highest security policy in the target security policy, the measurement report including signal quality information of the candidate RAN entity.
The processing method according to claim 21, wherein the determining, by the source RAN entity, the target RAN entity in the candidate RAN entity according to the first security policy and the measurement report of the UE comprises:

Determining, by the source RAN entity, a candidate RAN entity that meets a signal quality requirement according to the measurement report, where the measurement report includes signal quality information of the candidate RAN entity;

The source RAN entity determines, in the candidate RAN entity, a RAN entity that conforms to the first security policy as a target RAN entity.
A method for processing a security policy, comprising:

The target RAN entity acquires a first message and a target security policy, where the first message is used to request to switch the session of the UE;

Determining, by the target RAN entity, an encryption and/or integrity protection policy of the UE according to the target security policy;

The target RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The processing method according to claim 23, wherein the method further comprises:

The target RAN entity further acquires a first identifier, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier.
The processing method according to claim 23, wherein the acquiring, by the target RAN entity, the first message and the target security policy comprises:

Receiving, by the target RAN entity, a first message sent by a source RAN entity, where the first message is used to request a handover of a session of the UE, where the first message includes a target security policy;

or,

Receiving, by the target RAN entity, a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE, where the first message includes the first identifier and the corresponding target security policy, the first identifier Includes any of the session ID, slice ID, or media stream ID.
The processing method according to claim 23, wherein the acquiring, by the target RAN entity, the first message and the target security policy comprises:

The target RAN receives a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

Sending, by the target RAN entity, a security policy request message to the first core network entity;

Receiving, by the target RAN entity, a security policy response message sent by the first core network entity, where the security policy is The target security policy is included in the response message, and the first core network entity is a first entity or a second entity.
The processing method according to claim 23, wherein the acquiring, by the target RAN entity, the first message and the target security policy comprises:

Receiving, by the target RAN entity, a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

The target RAN entity sends a security policy request to the first core network entity, where the security policy request includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier, where the A core network entity is a first entity or a second entity;

The RAN entity receives the security policy response message sent by the first entity, where the security policy response message includes the first identifier and a corresponding target security policy.
The processing method according to claim 23, wherein after the target RAN entity obtains the first message and the target security policy, the method further includes:

Sending, by the target RAN entity, the received target security policy to the first core network entity, so that the first core network entity verifies whether the target security policy is correct according to the saved security policy of the UE, where A core network entity is a first entity or a second entity;

or,

The target RAN entity sends the received first identifier and the corresponding target security policy to the first core network entity, so that the first core network entity verifies the relationship according to the saved relationship between the security policy and the identifier of the UE. Whether the target security policy corresponding to the first identifier is correct, and the first core network entity is the first entity or the second entity.
A method for processing a security policy, comprising:

Receiving, by the core network entity, a security policy request message sent by the radio access network RAN entity;

The core network entity sends a security policy response message to the RAN entity, where the security policy response message includes the target security policy.
The processing method according to claim 29, wherein the method further comprises:

The core network entity receives the security policy request message sent by the RAN entity, where the security policy request message further includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier. Species

The core network entity sends a security policy response message to the RAN entity, where the security policy response message includes the target security policy, where the target security policy is a target security policy corresponding to the first identifier.
The processing method according to claim 29, wherein the core network entity is a first entity or a second entity.
A method for processing a security policy, comprising:

Receiving, by the core network entity, a target security policy for the user equipment UE sent by the target radio access network RAN entity, where the target security policy is obtained by the target RAN entity from the source RAN entity during the handover process;

The core network entity verifies whether the target security policy is correct according to the saved security policy of the UE.
The processing method according to claim 32, wherein the method further comprises:

The core network entity receives the first identifier sent by the target RAN entity and the target security policy corresponding to the first identifier, where the target security policy corresponding to the first identifier and the first identifier is the target RAN entity Switching The process is obtained from the source RAN entity;

The core network entity verifies whether the target security policy corresponding to the first identifier is correct according to the relationship between the saved security policy and the identifier.
The processing method according to claim 32, wherein the core network entity is a first entity or a second entity.
A method for processing a security policy, comprising:

The source RAN entity decides to initiate a handover procedure for the user equipment UE;

The source RAN entity sends a first message to the first entity, where the first message is used to request a handover of the UE, the first message includes a target security policy for the UE, or the handover request includes For the first identifier of the UE and the corresponding target security policy, the first identifier includes any one of a session identifier, a slice identifier, a radio bearer identifier, or a media stream identifier.
The processing method according to claim 35, wherein after the source RAN entity decides to initiate a handover procedure for the user equipment UE, before the source RAN entity sends the first message to the first entity, the method further includes :

Determining, by the source RAN entity, the target RAN entity according to the first security policy and the measurement report of the UE, where the first security policy is the target security policy of the UE saved by the source RAN entity or the UE saved by the source RAN entity The highest security policy in the target security policy, the measurement report including signal quality information of the candidate RAN entity.
The processing method according to claim 36, wherein the determining, by the source RAN entity, the target RAN entity according to the first security policy and the measurement report of the UE comprises:

Determining, by the source RAN entity, a candidate RAN entity that meets a signal quality requirement according to the measurement report, where the measurement report includes signal quality information of the candidate RAN entity;

The source RAN entity determines, in the candidate RAN entity, a RAN entity that conforms to the first security policy as a target RAN entity.
A method for processing a security policy, comprising:

The target RAN entity acquires a second message, where the second message is used to request to switch the session of the UE, and the second message includes a target security policy;

Determining, by the target RAN entity, an encryption and/or integrity protection policy of the UE according to the target security policy;

The target RAN entity establishes a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The processing method according to claim 38, wherein the acquiring, by the target RAN entity, the second message and the target security policy comprises:

Receiving, by the target RAN entity, a second message sent by the first entity, where the second message is used to request to switch the session of the UE, and the second message includes a target security policy;

or,

The target RAN entity receives a second message sent by the first entity, where the second message is used to request to switch the session of the UE, and the second message includes the first identifier and the corresponding target security policy, where the first identifier Includes any of the session ID, slice ID, or media stream ID.
A method for processing a security policy, comprising:

Obtaining, by the first entity, a first message of the user equipment UE, where the first message is used to request to switch the session of the UE;

Transmitting, by the first entity, a second message to a target radio access network RAN entity of the UE, where the second message is used to request to switch a session of the UE, and the second message includes a target security policy, the target A security policy is used by the target RAN entity to determine an encryption and/or integrity protection policy for the UE.
The processing method according to claim 40, wherein the acquiring, by the first entity, the first message of the user equipment UE comprises:

Receiving, by the first entity, the first message sent by the source base station to which the UE is attached, the first entity receiving the first message while receiving the target security policy;

or,

The first entity receives a first message sent by the source base station to which the UE is attached, and the first entity acquires a target security policy saved by itself.
The processing method according to claim 40, wherein the first entity acquires a first message of the user equipment UE, and the first message is used to request to switch the session of the UE, including:

Receiving, by the first entity, the first message sent by the source base station to which the UE is attached, and receiving the target RAN entity type of the UE while receiving the first message;

The first entity sends a security policy request message to the security policy management function entity, where the security policy request message includes the target RAN entity type of the UE, so that the security policy management function entity is based on the target RAN of the UE. The entity type determines the security endpoint information of the session to be switched;

The first entity receives the security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, where the target security policy includes the security of the UE to establish a session. Endpoint information.
The processing method according to claim 40 or 41, wherein the first entity acquires a first message of the user equipment UE, and the first message is used to request to switch the session of the UE, including:

Receiving, by the first entity, the first message sent by the source base station to which the UE is attached, and receiving the target RAN entity type of the UE while receiving the first message;

The first entity determines, according to the target RAN entity type of the UE, security endpoint information of the UE to establish a session.
A method for processing a security policy, comprising:

Receiving, by the user equipment UE, a correspondence between the second identifier sent by the first radio access network RAN entity and the target algorithm, and receiving a correspondence between the radio bearer identifier established and switched by the first RAN entity and the second identifier, where The second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier.

The UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the algorithm and the second identifier.
The processing method according to claim 44, wherein the method further comprises:

Receiving, by the UE, a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm;

The UE stores a correspondence between the target algorithm and the second identifier;

The UE receives the setup/switch radio bearer request message sent by the first RAN entity, where the setup/switch radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier;

The UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The processing method according to claim 44, wherein the method further comprises:

Receiving a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm, and a correspondence between the radio bearer identifier established and switched by the first RAN entity and the second identifier relationship;

The UE determines an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The processing method according to claim 44, wherein the method further comprises:

When the user rejects the target algorithm, the UE sends a reject message of the third message to the first RAN entity, and the UE enters an idle state;

The UE selects a second RAN entity among candidate RANs;

The UE establishes a connection with a second RAN entity.
The method of any of claims 44-47, wherein the method further comprises:

Receiving, by the UE, security capability information broadcast by the RAN entity;

The UE determines the first RAN entity or the second RAN entity according to the capability of the RAN entity and the security requirement of the UE.
A functional entity, wherein the functional entity is a first entity, including:

An acquiring unit, configured to acquire a first message and a target security policy for the user equipment UE, where the first message is used to establish a session of the UE;

a sending unit, configured to send, to the radio access network RAN entity of the UE, a second message, where the second message is used to create a context of the UE in the RAN entity, where the second message includes the target security A policy, the target security policy is used by the RAN entity to determine an encryption and/or integrity protection policy of the UE.
The first entity according to claim 49, wherein the obtaining unit comprises:

a first receiving subunit, configured to receive the first message sent by the UE, where the first entity receives the first message while receiving the target security policy;

or,

a second receiving subunit, configured to receive the first message sent by the UE, where the first message is used to establish a session;

a first sending subunit, configured to send a security policy request message to the security policy management function entity;

And a third receiving subunit, configured to receive a security policy request response message sent by the security policy management function entity, where the security policy request response message includes a target security policy.
The first entity according to claim 49, wherein the obtaining unit comprises:

a fourth receiving subunit, configured to receive the first message sent by the UE, and receive an access network type of the UE while receiving the first message;

a second sending subunit, configured to send a security policy request message to the security policy management function entity, where the security policy request message includes an access network type of the UE, so that the policy management entity is configured according to the UE The access network type determines the security endpoint information of the session to be established;

a fifth receiving subunit, configured to receive a security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, where the target security policy includes the required establishment of the UE Security endpoint information for the session.
The first entity according to claim 49 or 50, wherein the obtaining unit comprises:

a fifth receiving subunit, configured to receive the first message sent by the UE, and receive an access network type of the UE while receiving the first message;

And determining a subunit, configured to determine, according to the access network type of the UE, security endpoint information of the UE to establish a session.
The first entity according to claim 49, wherein the first entity further comprises:

a saving unit, configured to save the obtained target security policy.
A radio access network entity, comprising:

a first acquiring unit, configured to acquire a second message for the user equipment UE, where the second message includes a target security policy;

a determining unit, configured to determine an encryption and/or integrity protection policy of the UE according to the target security policy;

And an establishing unit, configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The radio access network entity according to claim 54, wherein the radio access network entity further comprises:

The second obtaining unit is configured to obtain the first identifier, where the first identifier includes any one of a session identifier, a slice identifier, and a media stream identifier, where the target security policy is a security policy corresponding to the first identifier.
The radio access network entity according to claim 54 or 55, wherein the radio access network entity further comprises:

a saving unit, configured to save the target security policy;

or,

And a correspondence between the first identifier and the target security policy.
The radio access network entity according to claim 54, wherein the determining unit comprises:

Determining a subunit, configured to determine a target algorithm based on at least the target security policy and a security capability of the RAN entity, the target algorithm being an encryption and/or integrity protection algorithm for the UE;

The establishing unit includes:

Establishing a subunit for establishing/switching a radio bearer according to the target algorithm.
The radio access network entity according to claim 55, wherein the determining unit comprises:

The determining subunit is further configured to determine a target algorithm according to at least the target security policy and a security capability of the RAN entity, where the target algorithm is used for encryption and corresponding to the first identifier on the UE / or integrity protection algorithm;

The subunit is further configured to establish/switch a radio bearer according to the target algorithm.
The radio access network entity according to claim 57 or 58, wherein the determining subunit comprises:

a determining module, configured to determine whether there is a candidate algorithm that satisfies the target security policy;

The determining module, if there is a candidate algorithm that satisfies the target security policy, is configured to determine, according to the security capability of the RAN entity, that the algorithm with the highest priority among the candidate algorithms is the target algorithm.
The radio access network entity according to claim 58, wherein the establishing subunit comprises:

a first sending module, configured to send a third message to the UE, where the third message includes a correspondence between a target algorithm and a second identifier, where the second identifier is a session identifier, a slice identifier, a media stream identifier, and a radio bearer. Identifying, in the identifier, any one of the identifiers, so that the UE stores a correspondence between the target algorithm and the second identifier;

a receiving module, configured to receive a response message of the third message sent by the UE;

a second sending module, configured to send a setup/switch radio bearer request message to the UE, where the establishing/switching radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier, so that the UE is Determining an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The radio access network entity according to claim 58, wherein the establishing subunit comprises:

a third sending module, configured to send a third message, where the third message includes a correspondence between the target algorithm and the second identifier, and a correspondence between the identifier of the RAN entity establishing/switching the radio bearer and the second identifier And determining, by the UE, an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier, where the second identifier is a session identifier, a slice identifier, a media stream identifier, and a wireless identifier. Any one of the bearer identifiers.
The radio access network entity according to any one of claims 54-55, 57-58, wherein the first obtaining unit comprises:

And a first receiving subunit, configured to receive a second message sent by the first entity, where the second message is used to establish an initial context.
The radio access network entity according to any one of claims 54-55, 57-58, wherein the first obtaining unit comprises:

And a second receiving subunit, configured to receive a second message sent by the first entity, where the second message is used to switch the session of the UE.
The radio access network entity according to any one of claims 54-55, 57-58, wherein the RAN is a target RAN entity, and the first obtaining unit comprises:

And a third receiving subunit, configured to receive a second message sent by the source RAN entity, where the second message is used to switch the session of the UE.
A functional entity, wherein the functional entity is a second entity, including:

An obtaining unit, configured to acquire a first message, where the first message is used to establish a session;

a first sending unit, configured to send a security policy request message to the security policy management function entity;

a first receiving unit, configured to receive a security policy response message, where the security policy response message includes a target security policy;

And a second sending unit, configured to send the first message, and simultaneously send the target security policy.
The second entity according to claim 65, wherein the obtaining unit comprises:

a receiving subunit, configured to receive the first message, where the first message includes an access network type of the UE;

Determining a subunit, configured to determine an access network type of the UE;

The second sending unit includes:

And a first sending subunit, configured to send the first message, and simultaneously send an access network type of the UE.
The second entity according to claim 65, wherein the second entity further comprises:

a second receiving unit, configured to receive the first message and a security requirement of the UE;

a third sending unit, configured to send a security policy request message to the security policy management function entity, where the security policy request message includes a security requirement of the UE;

a third receiving unit, configured to receive a security policy response message, where the security policy response message includes a target security policy, where the target security policy is determined by the policy control function entity according to the security requirement of the UE;

And a fourth sending unit, configured to send the first message, and simultaneously send the target security policy.
A source radio access network entity, comprising:

a decision unit, configured to initiate a handover process for the user equipment UE;

a sending unit, configured to send a first message to the target RAN entity, where the first message is used to request a handover, where the first message includes a target security policy for the UE, or the handover request includes the The first identifier of the UE and the corresponding target security policy, where the first identifier includes any one of a session identifier, a slice identifier, or a media stream identifier.
The source radio access network entity according to claim 68, wherein the source radio access network entity further comprises:

a determining unit, configured to determine, according to the first security policy and the measurement report of the UE, the target RAN entity, where the first security policy is the target security policy of the UE saved by the source RAN entity or the UE saved by the source RAN entity The highest security policy in the target security policy, the measurement report including signal quality information of the candidate RAN entity.
The source radio access network entity according to claim 69, wherein the determining unit comprises:

a first determining subunit, configured to determine, according to the measurement report, a candidate RAN entity that meets a signal quality requirement, where the measurement report includes signal quality information of the candidate RAN entity;

And a second determining subunit, configured to determine, in the candidate RAN entity, that the RAN entity that meets the first security policy is a target RAN entity.
A target radio access network entity, comprising:

a first acquiring unit, configured to acquire a first message and a target security policy, where the first message is used to request to switch a session of the UE;

a determining unit, configured to determine, by the target security policy, an encryption and/or integrity protection policy of the UE;

And an establishing unit, configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The target radio access network entity according to claim 71, wherein the target radio access network entity further comprises:

a second acquiring unit, configured to acquire a first identifier, where the first identifier includes a session identifier, a slice identifier, or a media stream Any of the logos.
The target radio access network entity according to claim 71, wherein the first obtaining unit comprises:

a first receiving subunit, configured to receive a first message sent by a source RAN entity, where the first message is used to request to switch a session of the UE, where the first message includes a target security policy;

or,

And a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE, where the first message includes a first identifier and a corresponding target security policy, where the first identifier includes a session identifier. Any of the slice identifiers or media stream identifiers.
The target radio access network entity according to claim 71, wherein the first obtaining unit comprises:

a second receiving subunit, configured to receive a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

a first sending subunit, configured to send a security policy request message to the first core network entity;

a third receiving subunit, configured to receive a security policy response message sent by the first core network entity, where the security policy response message includes the target security policy, where the first core network entity is a first entity or a Two entities.
The target radio access network entity according to claim 71, wherein the first obtaining unit comprises:

a fourth receiving subunit, configured to receive a first message sent by the source RAN entity, where the first message is used to request to switch the session of the UE;

a second sending subunit, configured to send a security policy request to the first core network entity, where the security policy request includes a first identifier, where the first identifier includes any one of a slice identifier, a session identifier, or a media stream identifier. The first core network entity is a first entity or a second entity;

And a fifth receiving subunit, configured to receive a security policy response message sent by the first entity, where the security policy response message includes the first identifier and a corresponding target security policy.
The target radio access network entity according to claim 71, wherein the radio access network entity further comprises:

a sending unit, configured to send the received target security policy to the first core network entity, so that the first core network entity verifies whether the target security policy is correct according to the saved security policy of the UE, where A core network entity is a first entity or a second entity;

or,

And sending, by the first core network entity, the received first identifier and the corresponding target security policy, so that the first core network entity verifies the first according to the saved relationship between the security policy of the UE and the identifier. And determining whether the corresponding target security policy is correct, and the first core network entity is the first entity or the second entity.
A core network entity, characterized by comprising:

a first receiving unit, configured to receive a security policy request message sent by a radio access network RAN entity;

a first sending unit, configured to send a security policy response message to the RAN entity, where the security policy response message is sent The target security policy is included.
The core network entity according to claim 77, wherein the core network entity further comprises:

a second receiving unit, configured to receive the security policy request message sent by the RAN entity, where the security policy request message further includes a first identifier, where the first identifier includes a slice identifier, a session identifier, or a media stream identifier Any one;

And a second sending unit, configured to send a security policy response message to the RAN entity, where the security policy response message includes the target security policy, where the target security policy is a target security policy corresponding to the first identifier.
The core network entity according to claim 77, wherein the core network entity is a first entity or a second entity.
A core network entity, characterized by comprising:

a first receiving unit, configured to receive a target security policy for the user equipment UE sent by the target radio access network RAN entity, where the target security policy is obtained by the target RAN entity from a source RAN entity in a handover process;

And a first verification unit, configured to verify, according to the saved security policy of the UE, whether the target security policy is correct.
The core network entity according to claim 80, wherein the core network entity further comprises:

a second receiving unit, configured to receive a first identifier sent by the target RAN entity and a target security policy corresponding to the first identifier, where the first identifier and the target security policy corresponding to the first identifier are the target The RAN entity is obtained from the source RAN entity during the handover procedure;

And a second verification unit, configured to verify, according to the relationship between the saved security policy and the identifier, whether the target security policy corresponding to the first identifier is correct.
The core network entity according to claim 80, wherein the core network entity is a first entity or a second entity.
A source radio access network entity, comprising:

a decision unit, configured to initiate a handover process for the user equipment UE;

a sending unit, configured to send a first message to the first entity, where the first message is used to request to switch a session of the UE, where the first message includes a target security policy for the UE, or the handover request includes For the first identifier of the UE and the corresponding target security policy, the first identifier includes any one of a session identifier, a slice identifier, a radio bearer identifier, or a media stream identifier.
The radio access network entity according to claim 83, wherein the source radio access network entity further comprises:

a determining unit, configured to determine, according to the first security policy and the measurement report of the UE, the target RAN entity, where the first security policy is the target security policy of the UE saved by the source RAN entity or the UE saved by the source RAN entity The highest security policy in the target security policy, the measurement report including signal quality information of the candidate RAN entity.
The radio access network entity according to claim 84, wherein the determining unit comprises:

a first determining subunit, configured to determine, according to the measurement report, a candidate RAN entity that meets a signal quality requirement, where the measurement report includes signal quality information of the candidate RAN entity;

a second determining subunit, configured to determine, in the candidate RAN entity, a RAN that conforms to the first security policy The body is the target RAN entity.
A target radio access network entity, comprising:

An acquiring unit, configured to acquire a second message, where the second message is used to request to switch a session of the UE, where the second message includes a target security policy;

a determining unit, configured to determine an encryption and/or integrity protection policy of the UE according to the target security policy;

And an establishing unit, configured to establish a radio bearer according to the determined encryption and/or integrity protection policy of the UE.
The processing method according to claim 86, wherein the obtaining unit comprises:

a receiving subunit, configured to receive a second message sent by the first entity, where the second message is used to request to switch a session of the UE, where the second message includes a target security policy;

or,

And the second message is used to receive the second message sent by the first entity, where the second message is used to request to switch the session of the UE, where the second message includes the first identifier and the corresponding target security policy, where the first identifier includes the session identifier. Any of the slice identifiers or media stream identifiers.
A functional entity, wherein the functional entity is a first entity, including:

An acquiring unit, configured to acquire a first message of the user equipment UE, where the first message is used to request to switch a session of the UE;

a sending unit, configured to send a second message to the target radio access network RAN entity of the UE, where the second message is used to request to switch a session of the UE, and the second message includes a target security policy, the target A security policy is used by the target RAN entity to determine an encryption and/or integrity protection policy for the UE.
The first entity according to claim 88, wherein the obtaining unit comprises:

a first receiving subunit, configured to receive the first message sent by a source base station to which the UE is attached, where the first entity receives the first message while receiving the target security policy;

or,

And receiving, by the source base station, the first message sent by the source base station, where the first entity acquires a target security policy saved by itself.
The first entity according to claim 88, wherein the obtaining unit comprises:

a second receiving subunit, configured to receive the first message sent by the source base station to which the UE is attached, and receive the target RAN entity type of the UE while receiving the first message;

a sending subunit, configured to send a security policy request message to the security policy management function entity, where the security policy request message includes a target RAN entity type of the UE, so that the security policy management function entity is configured according to the target of the UE The RAN entity type determines the security endpoint information of the session to be switched;

a third receiving subunit, configured to receive a security policy response message sent by the security policy management function entity, where the security policy response message includes the target security policy, where the target security policy includes the required establishment of the UE Security endpoint information for the session.
The first entity according to claim 88 or claim 89, wherein the obtaining unit comprises:

a fourth receiving subunit, configured to receive a first message sent by the source base station to which the UE is attached, and receive a target RAN entity type of the UE while receiving the first message;

Determining a subunit, configured to determine, according to the target RAN entity type of the UE, security endpoint information of the UE to establish a session.
A user equipment, comprising:

a first receiving unit, configured to receive a correspondence between the second identifier sent by the first radio access network RAN entity and the target algorithm, and receive a correspondence between the radio bearer identifier established and switched by the first RAN entity and the second identifier The second identifier is any one of a session identifier, a slice identifier, a media stream identifier, and a radio bearer identifier.

The first determining unit is configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the algorithm and the second identifier.
The user equipment according to claim 92, wherein the user equipment further comprises:

a second receiving unit, configured to receive a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm;

a storage unit, configured to store a correspondence between the target algorithm and the second identifier;

a third receiving unit, configured to receive a setup/switch radio bearer request message sent by the first RAN entity, where the setup/switch radio bearer request message includes a correspondence between the established/switched radio bearer identifier and the second identifier;

And a second determining unit, configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The user equipment according to claim 92, wherein the user equipment further comprises:

a third receiving unit, configured to receive a third message sent by the first RAN entity, where the third message includes a correspondence between the second identifier and the target algorithm, and a radio bearer established/switched by the first RAN entity Corresponding relationship between the identifier and the second identifier;

And a third determining unit, configured to determine an algorithm used by the established/switched radio bearer according to the correspondence between the target algorithm and the second identifier.
The user equipment according to claim 92, wherein the user equipment further comprises:

a sending unit, when the user rejects the target algorithm, sending a reject message of the third message to the first RAN entity, where the UE enters an idle state;

a selecting unit, configured to select a second RAN entity in the candidate RAN;

Establishing a unit for establishing a connection with the second RAN entity.
The user equipment according to any one of claims 92-95, wherein the user equipment further comprises:

a fourth receiving unit, configured to receive security capability information broadcast by the RAN entity;

And a fourth determining unit, configured to determine the first RAN entity or the second RAN entity according to the capability of the RAN entity and the security requirement of the UE.
A computer readable storage medium comprising instructions which, when executed on a computer, cause the computer to perform the method of any of claims 1-48.
A computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of any of claims 1-48.