WO2018201630A1 - 一种通信方法及相关装置 - Google Patents

一种通信方法及相关装置 Download PDF

Info

Publication number
WO2018201630A1
WO2018201630A1 PCT/CN2017/095348 CN2017095348W WO2018201630A1 WO 2018201630 A1 WO2018201630 A1 WO 2018201630A1 CN 2017095348 W CN2017095348 W CN 2017095348W WO 2018201630 A1 WO2018201630 A1 WO 2018201630A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
terminal device
base station
integrity protection
security policy
Prior art date
Application number
PCT/CN2017/095348
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
胡力
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to EP23209521.6A priority Critical patent/EP4340537A3/en
Priority to EP17908356.3A priority patent/EP3541105B1/en
Priority to AU2017413023A priority patent/AU2017413023B2/en
Priority to ES17908356T priority patent/ES2830778T3/es
Priority to CN201780031003.3A priority patent/CN109219965B/zh
Priority to BR122020023465-2A priority patent/BR122020023465B1/pt
Priority to EP20175304.3A priority patent/EP3796694A1/en
Priority to KR1020197035424A priority patent/KR102162678B1/ko
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to BR112019023041-6A priority patent/BR112019023041B1/pt
Priority to JP2019560709A priority patent/JP6943978B2/ja
Publication of WO2018201630A1 publication Critical patent/WO2018201630A1/zh
Priority to US16/386,462 priority patent/US10798578B2/en
Priority to US16/728,764 priority patent/US10798579B2/en
Priority to US16/993,729 priority patent/US11272360B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/08—Upper layer protocols
    • H04W80/10—Upper layer protocols adapted for application session management, e.g. SIP [Session Initiation Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/04—Interfaces between hierarchically different network devices
    • H04W92/10—Interfaces between hierarchically different network devices between terminal device and access point, i.e. wireless air interface
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/04—Registration at HLR or HSS [Home Subscriber Server]

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a communication method and related apparatus.
  • LTE Long Term Evolution
  • AS Access Stratum
  • the terminal device sends an attach request to the Mobility Management Entity (MME) through the base station; wherein the attach request carries an algorithm supported by the terminal device.
  • MME Mobility Management Entity
  • the base station selects a security algorithm supported by the service network according to an algorithm that is allowed to be used by the pre-configured service network, and an algorithm supported by the terminal device forwarded by the MME.
  • the security algorithm includes an encryption algorithm and an integrity protection algorithm.
  • the base station generates an encryption key of the AS according to the selected encryption algorithm, and generates an integrity protection key according to the integrity protection algorithm.
  • the security algorithm supported by the service network selected by the base station is not only a security algorithm of the user plane but also a security algorithm applied to the signaling plane.
  • the base station and the terminal device use the security mode command (SMC) process to enable the terminal device to apply the security algorithm selected by the base station to the user plane and the signaling plane.
  • SMC security mode command
  • the encryption algorithm and the integrity protection algorithm selected by the base station are carried in the AS SMC and sent to the terminal device.
  • a security algorithm that is applied to both the user plane and the signaling plane is determined by the AS SMC process, and the security algorithm includes an encryption algorithm and an integrity protection algorithm.
  • the negotiation scheme of the security algorithm is relatively fixed, such as a user plane.
  • the same set of security algorithms is applied to the signaling plane and cannot be split.
  • the encryption algorithm and the integrity protection algorithm must be determined at the same time, and cannot be split. It can be seen that this security negotiation algorithm is relatively fixed and cannot adapt to the current flexible and changeable. Application scenario.
  • the embodiment of the present application provides a communication method, a related device, and a storage medium, which are used for flexiblely negotiating a user plane integrity protection algorithm.
  • the embodiment of the present application provides a communication method, including: acquiring, by a base station, a security policy, where the security policy includes integrity protection indication information, where the integrity protection indication information is used to indicate whether the base station performs integrity protection on the terminal device; When the sexual protection indication information indicates that the base station turns on the integrity protection for the terminal device, the base station sends the target user plane integrity protection algorithm to the terminal device.
  • the security policy can flexibly select whether to enable the integrity protection for the terminal device, and only when the integrity protection is enabled for the terminal device, the base station sends the target user plane integrity protection algorithm to the terminal device.
  • the security algorithm improves the flexibility of the user plane security algorithm and the signaling plane security algorithm separately.
  • the integrity protection indication information is increased, and the terminal device is improved. The flexibility determined by the target user plane integrity protection algorithm.
  • the integrity protection indication information is an identifier of a user plane integrity protection algorithm. That is to say, if it is determined that the security policy carries the identifier of the user plane integrity protection algorithm, it may be determined that the base station turns on the integrity protection of the terminal device.
  • the identifier of the user plane integrity protection algorithm carried in the security policy in this embodiment may be one or more (may be referred to as an algorithm list).
  • the user plane integrity protection algorithm carried in the security policy may be based on the service.
  • the user plane integrity protection algorithm allowed by the network, the user plane integrity protection algorithm supported by the terminal device, and the user plane integrity protection algorithm allowed by the base station are determined; it can also be said that the user plane carried in the security policy is complete.
  • the sexual protection algorithm is a user plane integrity protection algorithm allowed by the service network.
  • the acquiring the security policy by the base station may be that the base station receives the security policy from the other network element, or the base station determines the security policy from the at least one security policy pre-stored in the base station.
  • the security policy stored in advance on the base station side may also be a security policy pre-configured on the base station side.
  • the method for obtaining the security policy by the base station from the at least one security policy stored in the base station is different.
  • the identifier of the terminal device is determined according to the correspondence between the terminal identifier and the security policy pre-stored in the base station, and is stored in the base station.
  • the security policy corresponding to the session identifier and stored in the base station may be determined according to the correspondence between the session identifier and the security policy pre-stored in the base station; the solution may be similar to the scheme in which the SMF entity obtains the security policy, This will not be repeated here.
  • the base station sends the target user plane integrity protection algorithm to the terminal device, where the base station sends the target user plane integrity protection algorithm to the terminal device by using RRC signaling.
  • the solution provided by the embodiment of the present application is implemented by multiplexing the RRC signaling in the prior art, so that the existing technology is better compatible, and the prior art is less modified.
  • the base station sends a target signaling plane integrity protection algorithm to the terminal device, and the terminal device receives the target signaling plane integrity protection algorithm. It is also determined as the target user plane integrity protection algorithm, that is, the base station sends an integrity protection algorithm to the terminal device, and the integrity protection algorithm is both a signaling plane integrity protection algorithm and a user plane integrity protection algorithm.
  • the method further includes: determining, by the base station, the target user plane according to the user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm allowed by the base station. Integrity protection algorithm. In this way, both the security capability of the terminal device and the security capability of the base station can be considered, so that the determined target user plane integrity protection algorithm simultaneously matches the security capability of the terminal device and the security capability of the base station.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm sorted according to priority, so that a better target user plane integrity protection algorithm at the base station side can be selected.
  • the user plane integrity protection algorithm supported by the terminal device is a user plane integrity protection algorithm sorted according to priority, so that a better target user plane integrity protection algorithm on the terminal device side can be selected.
  • the security policy further includes a user plane integrity protection algorithm allowed by the service network; the base station determines the target user plane integrity protection algorithm according to the user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm allowed by the base station.
  • the method includes: determining, by the base station, a user plane integrity protection algorithm allowed by the base station, a user plane integrity protection algorithm supported by the terminal device, and a user plane integrity protection algorithm allowed by the service network, and determining a target user plane integrity protection algorithm, so that Considering the security capability of the terminal device, the security capability of the base station is also considered, and the actual state of the service network is also considered, so that the determined target user plane integrity protection algorithm can be matched with the security capability of the terminal device and the security capability of the base station. On the other hand, it matches the actual state of the service network more closely.
  • the base station may also determine an algorithm other than the user plane integrity protection algorithm allowed by the service network included in the security policy.
  • Standard user plane integrity protection algorithm For example, an algorithm can be determined from the user plane integrity protection algorithm allowed by the base station as the target user plane integrity protection algorithm.
  • the user plane integrity protection algorithm allowed by the service network is a prioritized user plane integrity protection algorithm, so that a better target user plane integrity protection algorithm based on the service network can be selected.
  • the method further includes: when the security policy further includes the encryption indication information, and the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device, the base station sends the target user plane encryption algorithm to the terminal device; or, when the security policy is further When the key length is included, the base station sends the key length to the terminal device; or when the security policy further includes the DH indication information, and the DH indication information is used to indicate that the base station turns on the DH to the terminal device, the base station sends the DH related key to the terminal device. .
  • any information in the security policy can be more flexibly indicated, so that the final determined security policy is more suitable for complex application scenarios.
  • the method further includes: the base station receiving, from the SMF entity, the quality of service of the current session of the terminal device; the base station according to at least one of the security policy and the service quality, The terminal device allocates a target wireless data bearer.
  • the base station allocates the target radio data bearer to the terminal device according to at least one of the security policy and the QoS, including: when the at least one historical radio data bearer on the base station satisfies the first condition, the base station Determining one of the at least one historical wireless data bearers satisfying the first condition as a target wireless data bearer; wherein each of the at least one historical wireless data bearers satisfying the first condition is supported by the wireless data bearer
  • the quality of service is the same as the quality of service of the current session
  • the security policy is the same as the security policy supported by each of the wireless data bearers.
  • the first condition includes: the quality of service of the two wireless data bearers is the same, and the security policies of the two wireless data bearers are the same.
  • the base station allocates the target wireless data bearer to the terminal device according to at least one of the security policy and the quality of service, including: when the wireless data bearer having no history on the base station satisfies the first a condition, but when the at least one historical wireless data bearer satisfies the second condition, the base station determines, by updating, one of the at least one historical wireless data bearers that meet the second condition, and determines the target wireless data bearer; Each of the at least one historical wireless data bearer of the second condition supports the same quality of service as the current session, and the security policy and the security policy supported by each of the wireless data bearers Matching; or, each of the at least one historical wireless data bearers satisfying the second condition, the quality of service supported by the current session is matched, and the security policy is associated with the The security policies supported by the wireless data bearers are the same; or the at least the said second condition is met Each wireless historical data wireless data bearers supported by the current session of the quality of service matching, and the security policy and the security policy of
  • the second condition includes: the quality of service of the two wireless data bearers is matched, and the security policies of the two wireless data bearers are the same.
  • the second condition includes: the quality of service of the two wireless data bearers is the same, and the security policies of the two wireless data bearers are matched.
  • the second condition includes: the quality of service of the two wireless data bearers is matched, and the security policies of the two wireless data bearers are matched.
  • the base station allocates a target wireless data bearer to the terminal device according to at least one of a security policy and a quality of service, including: when there is no history on the base station When the wireless data bearer satisfies the first condition, and the at least one historical wireless data bearer does not satisfy the second condition, the base station creates a target wireless data bearer for the terminal device according to at least one of the security policy and the quality of service.
  • the base station allocates a target wireless data bearer to the terminal device according to at least one of a security policy and a quality of service, including: when there is no history on the base station When the wireless data bearer satisfies the first condition, the base station creates a target wireless data bearer for the terminal device according to at least one of the security policy and the quality of service.
  • the base station allocates a target wireless data bearer to the terminal device according to at least one of a security policy and a quality of service, including: the base station according to the security policy and the quality of service. At least one of the creation of a target wireless data bearer for the terminal device.
  • the base station acquires the security policy, where the base station receives the security policy from the SMF entity, or the base station receives the identifier of the security policy from the SMF entity, and obtains the security policy according to the identifier of the security policy.
  • the embodiment of the present application further includes: the base station acquiring the signaling plane security algorithm supported by the terminal device; the base station determining the target signaling according to the signaling plane security algorithm supported by the terminal device and the signaling plane security algorithm allowed by the base station.
  • the security algorithm is implemented by the base station to carry the target signaling plane security algorithm in the access layer AS security mode command SMC to the terminal device, so that the decoupling between the signaling plane algorithm and the user plane security algorithm can be implemented, thereby making the user plane secure.
  • the algorithm and the signaling plane security algorithm negotiate separately, which provides a basis for more flexible determination of the user plane security algorithm.
  • the base station turns on user plane integrity protection when it is determined that the user plane integrity protection is enabled.
  • the base station turns on user plane encryption protection when it is determined that the user plane encryption protection is enabled.
  • the base station does not enable the user plane integrity protection in the case that it is determined that the user plane integrity protection is not enabled temporarily or whether the user plane integrity protection is currently not determined.
  • the base station does not enable the user plane encryption protection if it is determined that the user plane encryption protection is not enabled temporarily or whether it is currently impossible to determine whether the user plane encryption protection needs to be enabled.
  • the temporary meaning means that there is a time period, and the user plane integrity protection is not turned on temporarily, that is, the user plane integrity protection is not turned on within one time period, and the user plane integrity protection is turned on in another time period.
  • Temporarily not turning on user plane encryption protection means that user plane encryption protection is not enabled for one time period, and user plane encryption protection is enabled for another time period.
  • the network specifies that the user plane encryption protection may be enabled after receiving the AS security mode command, and whether the user plane integrity protection is enabled by the RRC reconfiguration message to notify the terminal device, in this case, the terminal The device cannot determine if user plane integrity protection is turned on.
  • the network after receiving the AS security mode command, the network only enables signaling plane security (open signaling plane integrity protection and/or signaling plane encryption protection), and the user plane is complete. Whether the sexual protection is enabled and whether the user plane encryption protection is enabled is notified by the RRC reconfiguration message to the terminal device. In this case, it is impossible to determine whether the user plane integrity protection is enabled, and whether the user plane encryption protection is enabled.
  • signaling plane security open signaling plane integrity protection and/or signaling plane encryption protection
  • not opening the user plane integrity protection includes: generating a user plane integrity protection key if the user plane integrity protection cannot be determined or determining that the user plane integrity protection is temporarily disabled, but not using the user
  • the face integrity protection key performs user plane integrity protection, and uses the user plane integrity protection key to perform user plane integrity protection when it is determined that user plane integrity protection is enabled.
  • the user plane integrity protection algorithm is obtained before the user plane integrity protection key is generated.
  • the signaling plane integrity protection algorithm may also be used as the user plane integrity protection algorithm.
  • not opening the user plane integrity protection includes: generating a user plane integrity protection key when determining to enable user plane integrity protection, and performing user plane integrity protection by using a user plane integrity protection key; That is to say, if it is not possible to determine whether to open the user plane integrity protection or to determine that the user plane integrity protection is not turned on temporarily,
  • the user plane integrity protection key may not be generated in the case of user plane integrity protection.
  • the terminal device and the base station if it is determined that the terminal device and the base station do not permanently open the user plane integrity protection (for example, may be a preset condition, etc.), the user plane integrity protection key may not be generated.
  • the user plane encryption protection is not enabled, and the user plane encryption key is generated when the user plane encryption protection cannot be determined or the user plane encryption protection is temporarily disabled, but the user plane encryption key is not used.
  • the user plane encryption protection uses the user plane encryption key to perform user plane encryption protection when it is determined that the user plane encryption protection is enabled.
  • the user plane encryption algorithm is acquired before the user plane encryption key is generated.
  • the signaling plane encryption algorithm can also be used as the user plane encryption algorithm.
  • the user plane encryption protection is not enabled: the user plane encryption key is generated when the user plane encryption protection is determined to be enabled, and the user plane encryption key is used for user plane encryption protection; that is, it is impossible to determine whether If the user plane encryption protection is enabled or the user plane encryption protection is not enabled temporarily, the user plane encryption key may not be generated.
  • the terminal device and the base station if it is determined that the terminal device and the base station do not permanently enable user plane encryption protection (for example, may be a preset condition, etc.), the user plane encryption key may not be generated.
  • the base station obtains the integrity protection indication information and/or the encryption indication information, determines whether to enable the integrity protection according to the obtained integrity protection indication information, or determines whether to enable the user plane encryption protection according to the encryption indication information.
  • the integrity protection indication information is used to indicate whether the user plane integrity protection is enabled
  • the encryption indication information is used to indicate whether the user plane encryption protection is enabled.
  • the method for obtaining the integrity protection indication information and/or the encryption indication information by the base station is different, for example, the base station determines to generate or receive at least the integrity protection indication information and the encryption indication information sent by other network elements.
  • the base station determines to generate or receive at least the integrity protection indication information and the encryption indication information sent by other network elements.
  • Other network elements may be SMF entities.
  • the base station may send at least one of the integrity protection indication information and the encryption indication information to the terminal device, so that the terminal device determines whether the user plane integrity protection is enabled and/or whether the user plane encryption protection is enabled. Or the terminal device determines and determines whether to open the user plane integrity protection and/or whether to enable the user plane encryption protection.
  • the integrity protection indication information and/or the encryption indication information may be an identifier of the bit information or algorithm.
  • the integrity protection indication information is an identifier of the target user plane integrity protection algorithm;
  • the encryption indication information is an identifier of the target user plane encryption protection algorithm, and, for example, the integrity protection indication information or the encryption indication information is indicated by using 1-bit information.
  • the integrity protection indication information and the encryption indication information are indicated by 2-bit information.
  • the embodiment of the present application provides a communication method, including: an SMF entity receiving a request message, where the request message includes a related parameter of the security policy; and the SMF entity obtains the identifier of the security policy or the security policy according to the relevant parameter of the security policy; The entity sends an identifier of the security policy or the security policy to the base station, where the security policy includes the integrity protection indication information, and the integrity protection indication information is used to indicate whether the base station turns on the integrity protection for the terminal device.
  • the security algorithm of the user plane is separately negotiated, the flexibility of separately determining the user plane security algorithm and the signaling plane security algorithm is improved, and on the other hand, the target user of the terminal device is improved by adding the integrity protection indication information.
  • the flexibility of the face integrity protection algorithm since the security algorithm of the user plane is separately negotiated, the flexibility of separately determining the user plane security algorithm and the signaling plane security algorithm is improved, and on the other hand, the target user of the terminal device is improved by adding the integrity protection indication information. The flexibility of the face integrity
  • the integrity protection indication information is an identifier of a user plane integrity protection algorithm. That is to say, if it is determined that the security policy carries the identifier of the user plane integrity protection algorithm, it may be determined that the base station turns on the integrity protection of the terminal device.
  • the identifier of the user plane integrity protection algorithm carried in the security policy in this embodiment may be one or more (may be referred to as an algorithm list).
  • the user plane integrity protection algorithm carried in the security policy may be based on the service.
  • the user plane integrity protection algorithm allowed by the network, the user plane integrity protection algorithm supported by the terminal device, and the user plane integrity protection algorithm allowed by the base station are determined; it can also be said that the user plane carried in the security policy is complete.
  • Sexual protection The method is the user plane integrity protection algorithm allowed by the service network.
  • the related parameters of the security policy include at least one of an identifier of the terminal device, a data service network name DNN of the terminal device, an identifier of the slice of the terminal device, a quality of service of the terminal device, and a session identifier of the terminal device.
  • the security policy can be formulated from different angles or granularities according to different identifiers, and is more flexible.
  • the SMF entity obtains the identifier of the security policy or the security policy according to the relevant parameters of the security policy, including: the relevant parameters of the security policy include the identifier of the terminal device, and the association between the identifier of the terminal device and the security policy by the SMF entity, and the terminal
  • the identification of the device obtains the security policy, so that the security policy at the granularity of the terminal device can be determined, and the different terminal devices can be corresponding to different security policies.
  • the SMF entity obtains the identifier of the security policy or the security policy according to the relevant parameters of the security policy, including: the relevant parameters of the security policy include the identifier of the slice of the terminal device, and the identifier of the SMF entity according to the slice and The association of the security policy and the identifier of the slice of the terminal device obtains a security policy, so that the security policy at the granularity of the slice can be determined, and the terminal device that accesses different slices can correspond to different security policies.
  • the SMF entity obtains the identifier of the security policy or the security policy according to the relevant parameters of the security policy, including: the related parameters of the security policy include the session identifier of the terminal device, and the SMF entity according to the session identifier and the security policy.
  • the association relationship and the session identifier of the terminal device obtain the security policy, so that the security policy at the granularity of the session can be determined, and the terminal device that initiates different sessions can be configured to correspond to different security policies.
  • the SMF entity obtains the identifier of the security policy or the security policy according to the relevant parameters of the security policy, including: the relevant parameters of the security policy include the quality of service of the terminal device; and the quality of service of the terminal device according to the SMF entity Obtaining a security policy, so that the security policy at the granularity of the quality of service can be determined, and the terminal device that initiates different quality of service can be configured to correspond to different security policies.
  • the security policy further includes: at least one of the following: the encryption indication information, where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device; the key length; the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH; and, the user plane integrity protection algorithm allowed by the service network.
  • the encryption indication information where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device
  • the key length the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH
  • the user plane integrity protection algorithm allowed by the service network the security policy can be more flexibly indicated, so that the final determined security policy is more suitable for complex application scenarios.
  • the SMF entity sends integrity protection indication information and/or encryption indication information to the base station.
  • the integrity protection indication information is used to indicate whether the user plane integrity protection is enabled
  • the encryption indication information is used to indicate whether the encryption protection is enabled.
  • the SMF entity determines whether to enable the user plane integrity protection and/or whether to enable the user plane encryption protection. For the following embodiments, refer to the base station to determine whether the user plane integrity protection is enabled and/or Whether the implementation of user plane encryption protection is enabled is not described here.
  • an embodiment of the present application provides a base station, where the base station includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to control the transceiver to perform signal reception and signal according to an instruction to perform memory storage.
  • the base station is configured to perform the method of any of the above first aspect or the first aspect when the processor executes the instruction stored in the memory.
  • an embodiment of the present application provides an SMF entity, where the SMF entity includes a memory, a transceiver, and a processor, where: the memory is used to store an instruction; the processor is configured to control the transceiver to perform signal reception according to an instruction to execute the memory storage. And signaling, when the processor executes the instruction stored in the memory, the SMF entity is configured to perform the method of any of the above second aspect or the second aspect.
  • the embodiment of the present application provides a base station, configured to implement any of the foregoing first aspect or the first aspect.
  • a method comprising corresponding functional modules for respectively implementing the steps in the above method.
  • the embodiment of the present application provides an SMF entity, which is used to implement the method of any one of the foregoing second aspect or the second aspect, and includes a corresponding functional module, which is used to implement the steps in the foregoing method.
  • the embodiment of the present application provides a computer storage medium, where the computer storage medium stores instructions, when the computer is running on the computer, causing the computer to perform the first aspect or the method in any possible implementation manner of the first aspect. .
  • an embodiment of the present application provides a computer storage medium, where the computer storage medium stores an instruction, when the computer is running on the computer, causing the computer to perform the method in any possible implementation manner of the second aspect or the second aspect. .
  • an embodiment of the present application provides a computer program product comprising instructions, which when executed on a computer, cause the computer to perform the method of the first aspect or any possible implementation of the first aspect.
  • the embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to perform the method in any of the possible implementations of the second aspect or the second aspect.
  • the security policy includes integrity protection indication information, where the integrity protection indication information is used to indicate whether the base station performs integrity protection on the terminal device, and the base station obtains the security policy, and the integrity protection indication information indicates that the base station turns on the terminal device.
  • the base station sends a target user plane integrity protection algorithm to the terminal device.
  • the security policy can flexibly select whether to enable the integrity protection for the terminal device, and only when the integrity protection is enabled for the terminal device, the base station sends the target user plane integrity protection algorithm to the terminal device.
  • the security algorithm improves the flexibility of the user plane security algorithm and the signaling plane security algorithm.
  • the integrity protection indication information is added, the target user plane integrity protection algorithm of the terminal device is improved. flexibility.
  • FIG. 1 is a schematic structural diagram of a system applicable to an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a communication method according to an embodiment of the present application.
  • FIG. 2a is a schematic flowchart of another communication method according to an embodiment of the present application.
  • 2b is a schematic flowchart of another communication method according to an embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a base station according to an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a terminal device according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of another base station according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of another terminal device according to an embodiment of the present application.
  • FIG. 1 exemplarily shows a system architecture diagram applicable to the embodiment of the present application.
  • the terminal device 101 in the 5G system architecture, the terminal device 101 is included.
  • the terminal device 101 can communicate with one or more core networks via a Radio Access Network (RAN), and the terminal device can be referred to as a user equipment (User Equipment, terminal equipment), an access terminal device, a subscriber unit, User station, mobile station, mobile station, remote station, remote terminal device, mobile device, user terminal device, terminal device, wireless communication device, user agent or user device.
  • the access terminal device may be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a Wireless Local Loop (WLL) station, and a personal digital processing (Personal).
  • Digital Assistant (PDA) a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal device in a future 5G network, and the
  • the base station 102 may be a 5G base station (gB), which may be an evolved eNB, or may be a new base station such as an LTE base station eNB, a 3G base station NB, or an evolved 5G base station.
  • gB 5G base station
  • LTE base station eNB Long Term Evolution base station
  • 3G base station NB Long Term Evolution base station
  • R AN
  • the base station 102 may be a device for communicating with the terminal device, for example, may be a base station (Base Transceiver Station, BTS) in the GSM system or CDMA, or a base station (NodeB, NB) in the WCDMA system, or may be An evolved base station (Evolutional Node B, eNB or eNodeB) in an LTE system may also be a 5G base station or the network device may be a relay station, an access point, an in-vehicle device, a wearable device, and a network side device in a future 5G network or Network devices and the like in a future evolved PLMN network.
  • BTS Base Transceiver Station
  • NodeB NodeB
  • NB base station
  • An evolved base station (Evolutional Node B, eNB or eNodeB) in an LTE system may also be a 5G base station or the network device may be a relay station, an access point, an in-vehicle device, a wear
  • the session management function (SMF) entity 103 may be a function split of the Mobility Management Entity (MME) in the LTE, and may be mainly responsible for session establishment of the user, and the data may be sent and received after the session of the user is established.
  • MME Mobility Management Entity
  • the MME in the LTE system is a network element responsible for security, mobility management, and session management at the core network side.
  • Security that is, when the terminal device 101 initially enters the network, it needs to perform mutual authentication with the network. After mutual authentication, the terminal device 101 and the core network generate a key. After the key is generated, the terminal device 101 and the MME perform algorithm negotiation, that is, security capability negotiation.
  • the mobility management is to record the location information of the terminal device 101, and select a suitable user plane network element device for the terminal device 101 according to the location information of the terminal device 101.
  • the session management is responsible for establishing the user plane link of the terminal device 101. After establishing the data plane contact of the user, the terminal device 101 can access the Internet.
  • the User Plane Function (UPF) entity 104 may be a combination of a Serving GateWay (S-GW) and a Public Data Network GateWay (P-GW) in the LTE system, and is a terminal device 101.
  • S-GW Serving GateWay
  • P-GW Public Data Network GateWay
  • the function network element of the user plane is mainly responsible for connecting to the external network.
  • a Dedicated Network (DN) 105 can provide a service for the terminal device 101.
  • some DNs can provide the Internet access function for the terminal device 101, and some DNs can provide the short message function for the terminal device 101.
  • PCF Policy Control Fun
  • PCF Policy Control Fun
  • the Authentication Server Function (AUSF) entity 107 interacts with the Authentication Credential Repository and Processing Function (ARPF) and terminates the authentication request from the SEAF. It is also a function that is split from the Home Subscriber Server (HSS) of the LTE system. AUSF 107 can be an independent network element. The HSS in the LTE system can store the subscription information of the user and the long-term key of the user.
  • ARPF Authentication Credential Repository and Processing Function
  • the ARPF can be incorporated into the User Data Management (UDM) entity 108 as part of the UDM.
  • UDM User Data Management
  • ARPF is split from the HSS of LTE. Mainly used to store long-term keys. The processing associated with the long-term key is also done here.
  • the function of the Access and Mobility Management Function (AMF) entity 109 is to manage the access problem of the terminal device 101 and also manage the mobility of the terminal device 101. It may be a Mobility Management (MM) function in the MME in LTE, and joins the function of access management. A Slice Select Function (SSF) 110 may also be included.
  • AMF Access and Mobility Management Function
  • MM Mobility Management
  • SSF Slice Select Function
  • the security anchor function (SEAF) entity 111 is responsible for the authentication function of the terminal device 101 and the network side, and stores an anchor key after the authentication succeeds.
  • a Security Context Management Function (SCMF) entity 112 obtains a key from the SEAF 111 and further derives other keys. It is a function that is split from the MME. In the actual situation, SEAF 111 and SCMF 112 may further become independent as a separate Authentication Function (AUF) entity. As shown in FIG. 1, SEAF 111 and SCMF 112 are combined into AMF 109 to form a network element.
  • SCMF Security Context Management Function
  • FIG. 1 Also shown in FIG. 1 is a possible implementation of an interface in each network element, such as an NG2 interface between the base station 102 and the AMF entity 109, an NG9 interface between the base station 102 and the UPF entity 104, etc., no longer one here.
  • an interface in each network element such as an NG2 interface between the base station 102 and the AMF entity 109, an NG9 interface between the base station 102 and the UPF entity 104, etc., no longer one here.
  • FIG. 2 is a schematic flow chart showing a communication method provided by an embodiment of the present application.
  • FIG. 2 a communication method provided by an embodiment of the present application is as shown in FIG. 2, and the method includes:
  • Step 201 The base station acquires a signaling plane security algorithm supported by the terminal device.
  • the signaling plane security algorithm supported by the terminal device is obtained in multiple manners, and the signaling plane security algorithm supported by the terminal device includes at least one signaling.
  • the face encryption algorithm and the at least one signaling plane integrity protection algorithm, such as receiving from the AMF, are obtained directly from the terminal device, such as by a signaling message, or are pre-configured on the base station.
  • a solution is provided to implement the foregoing step 201.
  • the terminal device sends a Non-Access Stratum (NAS) message to the base station.
  • the NAS message is a signaling plane message that the terminal device interacts with the core network, such as an attach request of LTE or a registration request of 5G.
  • NAS Non-Access Stratum
  • a 5G registration request message is taken as an example for description, and other NAS messages encounter similar steps to perform the same processing.
  • the terminal device sends a registration request (Registration Request) to the base station, where the registration request carries a signaling plane security algorithm supported by the terminal device.
  • the registration request may also carry a user plane security algorithm supported by the terminal device.
  • the user plane security algorithm supported by the terminal device may include a user plane integrity protection algorithm supported by the terminal device and a user plane encryption algorithm supported by the terminal device.
  • the signaling plane encryption algorithm supported by the terminal device, the signaling plane integrity protection algorithm supported by the terminal device, the user plane integrity protection algorithm supported by the terminal device, and the user plane encryption algorithm supported by the terminal device may be the same or different.
  • the terminal device may use a signaling plane integrity protection algorithm supported by the terminal device, a signaling plane encryption algorithm supported by the terminal device, a user plane integrity protection algorithm supported by the terminal device, and a user supported by the terminal device.
  • the face encryption algorithm can be reported separately, or if at least two algorithms are the same in the four algorithms, an algorithm can be reported for the same two algorithms, for example, if the terminal device supports the signaling plane integrity.
  • the protection algorithm is the same as the user plane integrity protection algorithm supported by the terminal device, and the terminal device only reports the same algorithm corresponding to the signaling plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm supported by the terminal device;
  • the signaling plane encryption algorithm supported by the terminal device is the same as the user plane encryption algorithm supported by the terminal device.
  • the terminal device only reports the same algorithm corresponding to the signaling plane encryption algorithm supported by the terminal device and the user plane encryption algorithm supported by the terminal device.
  • the signaling plane encryption algorithm supported by the terminal device the signaling plane integrity protection algorithm supported by the terminal device, the signaling plane integrity protection algorithm supported by the terminal device, the user plane integrity protection algorithm supported by the terminal device, and the user plane encryption supported by the terminal device
  • the algorithms are all the same, and the terminal device can report only one algorithm for indicating the four algorithms.
  • the algorithms reported by the terminal device are EEA1, EEA2, EIA1, and EIA2; then EEA1 and EEA2 can be used for both the signaling plane encryption algorithm selection and the user plane encryption algorithm selection.
  • EIA1 and EIA2 can be used for both.
  • the selection of the signaling plane integrity protection algorithm can also be used for the selection of the user plane integrity protection algorithm.
  • the algorithms reported by the terminal device are EEA11, EEA12, EIA11, EIA12, EEA21, EEA23, EIA21, EIA22, then EEA11 and EEA12 can be used for signaling plane encryption algorithm selection, and EEA21 and EEA23 are used for user plane encryption algorithm selection.
  • EIA11 and EIA12 are used for signal plane integrity protection algorithm selection, and EIA21 and EIA22 are used for user plane integrity protection algorithm selection.
  • the algorithms reported by the terminal device are EEA11, EEA12, EIA1, EIA2, EEA21, EEA23, EIA21, EIA22, then EEA11 and EEA12 can be used.
  • EEA21 and EEA23 are used for user plane encryption algorithm selection.
  • EIA1 and EIA2 can be used for both signaling plane integrity protection algorithm selection and user plane integrity protection algorithm selection.
  • the algorithms reported by the terminal device are EEA1, EEA1, EIA11, EIA12, EIA21, EIA22, then EEA1 and EEA2 can be used for both signaling plane encryption algorithm selection and user plane encryption algorithm selection, EIA11 and EIA12.
  • EIA21 and EIA22 are used for user plane integrity protection algorithm selection.
  • the terminal device can report the signaling plane security algorithm supported by the terminal device, the user plane integrity protection algorithm supported by the terminal device, and the user plane supported by the terminal device through multiple signaling.
  • An encryption algorithm in which an algorithm is included in one signaling.
  • the signaling plane security algorithm supported by the terminal device, the user plane integrity protection algorithm supported by the terminal device, and the user plane encryption algorithm supported by the terminal device are reported by one or more signalings, one of which is The signaling includes one or more algorithms.
  • some fields may be predefined in the signaling, and the fields are used to carry corresponding algorithms, such as setting the first field in sequence, a second field and a third field, where the first field is predefined for placing a signaling plane security algorithm supported by the terminal device, and the second field is predefined for placing a user plane integrity protection algorithm supported by the terminal device, and the third field is predefined
  • the user plane encryption algorithm supported by the terminal device is placed. Or, when all three algorithms are the same, only one algorithm is reported in one signaling, and the other network element defaults to the signaling plane security algorithm supported by the terminal device and the user plane integrity protection algorithm supported by the terminal device.
  • User plane encryption algorithm supported by the terminal device when all three algorithms are the same, only one algorithm is reported in one signaling, and the other network element defaults to the signaling plane security algorithm supported by the terminal device and the user plane integrity protection algorithm supported by the terminal device.
  • the security capabilities reported by the terminal device are EEA1, EEA2, EIA1, EIA2, then EEA1 and EEA2 can be used for both the signaling plane encryption algorithm selection and the user plane encryption algorithm selection. Similarly, EIA1 and EIA2 can be used for both.
  • the selection of the signaling plane integrity protection algorithm can also be used for the selection of the user plane integrity protection algorithm.
  • the security capabilities reported by the UE are EEA11, EEA12, EIA11, EIA12, EEA21, EEA23, EIA21, EIA22, then EEA11 and EEA12 can be used for signaling plane encryption algorithm selection, EEA21 and EEA23 are used for user plane encryption algorithm selection, EIA11 And EIA12 is used for signal plane integrity protection algorithm selection, and EIA21 and EIA22 are used for user plane integrity protection algorithm selection.
  • the security capabilities reported by the UE are EEA11, EEA12, EIA1, EIA2, EEA21, EEA23, EIA21, EIA22, then EEA11 and EEA12 can be used for signaling plane encryption algorithm selection, EEA21 and EEA23 are used for user plane encryption algorithm selection, EIA1 And EIA2 can be used for both signaling plane integrity protection algorithm selection and user plane integrity protection algorithm selection.
  • the base station forwards the registration request to the AMF, optionally after performing two-way authentication between the AMF and the base station and performing other registration processes with other core network elements, such as SEAF, AUSF, SMF, PCF, or UDM.
  • the AMF sends a first registration accept message to the base station, and the base station forwards the received first registration acceptance information to the terminal device, and the forwarding means not changing the message itself, but because the interface function of the bearer message is different, Additional parameters are added to the message to implement the message transmission function.
  • the first registration accept message is sent to the base station through the N2 interface, and the N2 interface has information that the base station needs to know in addition to the first registration accept message.
  • the base station forwards the first registration message to the UE by using an RRC message.
  • the RRC message may have at least information that other UEs need to know, or can find information of the UE; or the first registration accept message is performed.
  • the conversion for example, format conversion according to different interfaces, forwards the converted first registration accept message to the terminal device.
  • the first registration accept message is carried by the NG2 message.
  • the first registration accept message also carries a basic key (Kan) generated by the AMF or the SEAF for the base station and a signaling plane security algorithm supported by the terminal device reported by the terminal device.
  • the registration request message can be placed in the NAS container, and the security key of the base key (Kan) and the terminal device may be placed in the NAS container or may be placed outside the NAS container.
  • Step 202 The base station performs security calculation according to a signaling plane security algorithm supported by the terminal device and a signaling plane allowed by the base station. Method to determine the target signaling plane security algorithm.
  • the base station may pre-configure the signaling plane security algorithm allowed by the base station.
  • the algorithm included in the signaling plane security algorithm allowed by the base station is prioritized, for example, according to the operator. The preferences are prioritized and prioritized according to the local real-world configuration.
  • the signaling plane security algorithm allowed by the base station may be configured to the base station by using the network management device, or may be configured in the process of installing the software environment at the beginning of the establishment of the base station, or may be configured in other manners.
  • a possible implementation manner is that the base station selects the device with the highest priority and the terminal device according to the signaling plane security algorithm supported by the terminal device and the signaling plane security algorithm allowed by the base station with priority ordering.
  • the supported signaling plane security algorithm is used as the target signaling plane security algorithm, and the target signaling plane security algorithm may include an encryption algorithm and/or an integrity protection algorithm.
  • the base station selects a set of all algorithms that exist in the signaling plane security algorithm supported by the terminal device and exists in the signaling plane security algorithm allowed by the base station, and selects from the set of the algorithm.
  • the higher priority algorithm in the signaling plane security algorithm allowed by the base station is used as the target signaling plane security algorithm.
  • the base station is configured or pre-configured according to the operator's preference with the signaling plane security algorithm allowed by the base station and the user plane security algorithm allowed by the base station.
  • the signaling plane security algorithm allowed by the base station includes at least one signaling plane encryption algorithm allowed by the base station and/or at least one signaling plane integrity protection algorithm allowed by the base station.
  • the user plane security algorithm allowed by the base station includes at least one user plane encryption algorithm allowed by the base station and/or at least one user plane integrity protection algorithm allowed by the base station.
  • the signaling plane encryption algorithm allowed by the at least one base station of the signaling plane security algorithm allowed by the base station and/or the signaling plane integrity protection algorithm allowed by the at least one base station are prioritized, and the priority ordering may be determined by the operator. .
  • the user plane security algorithms allowed by the base station may be prioritized or not prioritized.
  • the base station may Only one set of prioritized algorithms is stored, that is, the user plane security algorithm allowed by the base station and prioritized, or the signaling plane security algorithm allowed by the storage base station and prioritized.
  • the base station generates only the relevant keys of the signaling plane based on the target signaling plane security algorithm, such as a signaling plane integrity protection key and a signaling plane encryption key.
  • the related key of the signaling plane is, for example, a Radio Resource Control (RRC) related key, specifically, a RRC integrity protection key (Krrc-int) and an RRC encryption key (Krrc-enc).
  • RRC Radio Resource Control
  • Krrc-int RRC integrity protection key
  • Krrc-enc an RRC encryption key
  • the base station can generate the key based on the base key (Kan). Kan is obtained by the base station from the core network element, such as Access and mobility management function (AMF), AUSF.
  • AMF Access and mobility management function
  • Step 203 The base station sends the target signaling plane security algorithm to the terminal device in an Access Stratum (AS) security mode command (SMC).
  • AS Access Stratum
  • SMC security mode command
  • the base station may send an AS SMC to the terminal device, where the AS SMC includes indication information of the target signaling plane security algorithm, such as an identifier of the target signaling plane security algorithm.
  • the base station may further carry a signaling plane security algorithm supported by the terminal device in the AS SMC.
  • the AS SMC can perform integrity protection by using a signaling plane integrity protection key generated by the base station.
  • the terminal device determines the target signaling plane security algorithm based on the indication information of the target signaling plane security algorithm, and generates a related key of the signaling plane (the terminal device generates a related key of the signaling plane)
  • the method is the same as the method for generating the relevant key of the signaling plane of the base station), and checks the integrity protection of the AS SMC according to the signaling plane integrity encryption key. If it is determined that the AS SMC integrity protection is acceptable, the signaling plane of the terminal device side is determined.
  • the integrity protection key is the same as the signaling plane integrity protection key used by the base station for the AS SMC.
  • the method further includes the step 204, the terminal device sends an AS security mode command complete (SMP) to the base station.
  • SMP AS security mode command complete
  • the terminal device may encrypt and/or integrity protect the AS SMP with the associated key of the generated signaling plane.
  • the base station checks whether the encryption protection and/or integrity protection of the AS SMP message is correct.
  • the base station forwards the received first registration acceptance information to the terminal device, or performs a certain conversion on the first registration accept message, for example, according to the interface. The difference is format conversion, etc., to obtain a second registration accept message (Registration Accept) message, and the second registration accept message is sent to the terminal device. Then, optionally, the terminal device replies to Registration Complete to AMF.
  • the AS SMC process is only used to implement the purpose of negotiating the target signaling plane security algorithm between the base station and the terminal device, and the decoupling between the signaling plane security algorithm and the user plane security algorithm is implemented.
  • the signaling plane security algorithm and the user plane security algorithm increase the flexibility of communication.
  • an optional solution is that the terminal device reports the signaling plane security algorithm supported by the terminal device by sending a registration request, and optionally, the terminal device can also support the user plane integrity protection algorithm supported by the terminal device.
  • the user plane encryption algorithm supported by the terminal device is carried in the registration request.
  • the signaling plane security algorithm supported by the terminal device may also be classified into a signaling plane security algorithm supported by the terminal device of the NAS layer and a signaling plane security algorithm supported by the terminal device of the AS layer, where the terminal device of the AS layer
  • the supported signaling plane security algorithm may also be referred to as a signaling plane security algorithm supported by the terminal equipment of the RRC layer.
  • the terminal device may add indication information to each security algorithm, or may Define some fields and place the corresponding algorithm in the corresponding field to identify whether each security algorithm belongs to the signaling plane or the user plane, or the NAS layer or the AS layer.
  • the signaling plane security algorithm pre-defines another field for placing the user plane security algorithm. For example, a predefined field is used to place the NAS layer security algorithm, and another field is predefined for the AS layer security algorithm.
  • the terminal device reports all the security algorithms supported by the terminal device to the AMF, and the terminal device does not distinguish whether the security algorithm is a signaling plane or a user plane, and is distinguished by the AMF. Or after being forwarded to the base station by the AMF, the base station makes a distinction.
  • the UE may send all the security algorithms reported by the terminal device to the base station, such as a signaling plane security algorithm, a user plane integrity protection algorithm supported by the terminal device, and User plane encryption algorithm supported by the terminal device.
  • the signaling plane security algorithm supported by the terminal device required by the base station to negotiate the target signaling plane security algorithm is sent to the base station.
  • only the signaling plane security algorithm supported by the terminal device of the RRC layer is transmitted.
  • the base station may add an indication information of the target signaling plane security algorithm only in the AS SMC message.
  • the terminal device parses the AS SMC information, it finds that only the target signaling plane security algorithm is negotiated.
  • the indication information is only generated according to the determined target signaling plane security algorithm. In this way, only one set of target signaling plane security algorithms is negotiated between the terminal device and the base station.
  • the target signaling plane security algorithm becomes a target security algorithm, and is used to generate a signaling plane related key and
  • the relevant key of the user plane the relevant key of the user plane includes the user plane encryption key and the user plane integrity protection key.
  • the signaling plane related key includes a signaling plane encryption key and a signaling plane integrity protection key. In this way, a set of target signaling plane security algorithms is negotiated between the terminal device and the base station. A set of target user plane security algorithms.
  • the base station may add, in the AS SMC information, information indicating indication information of the negotiation target signaling plane security algorithm and/or negotiation information of the relevant key of the user plane, for example, Add a bit, which can be new or multiplexed with the current bit. For example, if the bit is 0, it means that only the target signaling plane security algorithm is negotiated. If the bit is 1, it means that at the same time Negotiate the target signaling plane security algorithm and the relevant key of the user plane.
  • the target signaling plane security algorithm in the embodiment of the present application includes a target signaling surface integrity protection algorithm and a target signaling plane encryption algorithm.
  • a target signaling surface integrity protection algorithm and a target signaling plane encryption algorithm may be negotiated through the AS SMC process, or a target signaling plane security algorithm may be negotiated, which is used as the target signaling surface integrity.
  • the protection algorithm is also used as the target signaling plane encryption algorithm.
  • At least one of the target signaling surface integrity protection algorithm and the target signaling plane encryption algorithm may be negotiated through the AS SMC process, and another target signaling plane security algorithm may be used. Negotiate through other processes.
  • the target signaling plane security algorithm negotiated by the base station and the terminal device may be represented by an identifier of the algorithm, where an optional implementation scheme, regardless of the target signaling surface integrity protection algorithm and the target signaling plane encryption algorithm If they are the same or different, they are respectively represented by the identifiers of the two algorithms.
  • the identifier of one algorithm may be used.
  • the target signaling surface integrity protection algorithm and the target signaling plane encryption algorithm if the target signaling surface integrity protection algorithm and the target signaling plane encryption algorithm are different, the identifiers of the two algorithms are used to represent the target signaling surface integrity Protection algorithm and target signaling plane encryption algorithm.
  • the embodiment of the present application includes a target signaling plane security algorithm and a target user plane security algorithm, and an optional implementation scheme, regardless of a target signaling plane security algorithm and a target user plane security algorithm The same or different, respectively, are represented by the identifiers of the two sets of algorithms.
  • the identifier of the set of algorithms may be used to represent the target.
  • the signaling plane security algorithm and the target user plane security algorithm if the target signaling plane security algorithm and the target user plane security algorithm are different, the target signaling plane security algorithm and the target user plane security algorithm are represented by the identifiers of the two sets of algorithms.
  • the identifier of a set of algorithms corresponding to the target signaling plane security algorithm includes an identifier of at least one target signaling surface integrity protection algorithm and an identifier of at least one target signaling plane encryption algorithm, and a set corresponding to the target signaling plane security algorithm.
  • the identifier of the algorithm may be used to represent the target signaling surface integrity protection algorithm and the target signaling plane encryption algorithm by using the identifiers of the two algorithms.
  • the identifier of a set of algorithms corresponding to the target user plane security algorithm includes an identifier of at least one target signaling surface integrity protection algorithm and an identifier of at least one target user plane encryption algorithm, and a set corresponding to the target user plane security algorithm
  • the identifier of the algorithm may be used to represent the target signaling surface integrity protection algorithm and the target user plane encryption algorithm by using the identifiers of the two algorithms.
  • FIG. 2 is a schematic diagram showing another flow of a communication method provided by an embodiment of the present application.
  • the embodiment of the present application provides another communication method, as shown in FIG. 2a, the method includes:
  • the SMF entity receives the request message, where the request message may include an identifier of the terminal device.
  • the SMF entity receiving the request message may include multiple types, such as a registration request, a service request, or a session establishment request, where the session establishment request may also be referred to as a PDU session establishment. request.
  • the service request may be first sent by the terminal device to the base station, and then forwarded by the base station to the AMF, and then the AMF directly forwards, and the forwarding does not change the content of the original message to send the message to the AMF.
  • other parameters may be added according to factors such as the interface, or converted according to the interface information, and then sent to the SMF. If the interface between the base station and the AMF is an N2 interface, and the interface between the AMF and the SMF is N11, the service request forwarded by the base station to the AMF is a request matching the N2 interface, and the service request forwarded by the AMF to the SMF is The N11 interface matches the request.
  • the service request is a request from the NAS layer.
  • the request message may also be a registration request.
  • the session establishment request may be first sent by the terminal device to the AMF, and then the AMF directly forwards, and the forwarding does not change the content of the original message, and the message is sent to the AMF, and is sent to the AMF.
  • Other parameters may be added according to factors such as the interface, or converted according to the interface information and then sent to the SMF.
  • the terminal device may be in a state in which the session connection is disconnected.
  • the registration process of the foregoing step may be performed again between the terminal device and the base station, that is, the terminal device may send the connection to the base station.
  • the registration request is implemented to implement registration of the terminal device, and the target signaling plane security algorithm between the terminal device and the base station is renegotiated in the AS SMC and the AS SMP in the registration process.
  • the identifier of the terminal device may include any one or more of the IMSI, the IMEI, and the temporary identity.
  • Step 212 The SMF entity obtains an identifier of the security policy or the security policy according to the relevant parameters of the security policy.
  • Step 213 The SMF entity sends an identifier of the security policy or the security policy to the base station.
  • the security policy includes the integrity protection indication information, where the integrity protection indication information is used to indicate whether the base station turns on the integrity protection for the terminal device.
  • the SMF or other network element connected to the SMF stores the correspondence between the security policy and the security policy identifier.
  • the security policy is fully pre-configured on the SMF, base station, UE, or other network element connected to the SMF.
  • specific service configurations such as a security policy for VoIP voice services.
  • vendor configuration of the service such as the water meter factory.
  • the security policy identifier corresponding to the security policy may be obtained.
  • the SMF transmits the security policy identifier to the base station, and the base station can perform the user plane security protection according to the security policy to identify the corresponding security policy.
  • the SMF is pre-configured with the correspondence between the security policy and the security policy identifier, and the SMF determines the security policy identifier according to the content in the service request message, such as the identifier of the terminal device. For example, if the PCF has a relationship between the pre-configured security policy and the security policy identifier, the SMF needs to obtain the security policy identifier from the PDC.
  • both the SMF and the PCF are associated with the pre-configured security policy identifier, and the pre-configured security policy identifier at the PCF can cover the security policy identifier configured at the SMF, that is, the SMF transmits the security policy identifier obtained from the PCF to the base station.
  • the SMF entity directly sends an identifier of the security policy or the security policy to the base station, for example, according to the identifier of the terminal device and the preset relationship between the preset terminal device and the identifier of the security policy, and corresponding to the terminal device identifier.
  • the security policy is sent to the base station.
  • the default security policy can be preset on the SMF, or on the PCF or other network elements.
  • the default security policy and the identification of the security policy can be preset on the SMF or on the PCF or other network elements.
  • the method further includes: the SMF entity obtaining the security policy according to the request message.
  • the method further includes: obtaining, by the SMF, the security policy identifier according to the security policy.
  • the security policy identified by the identifier of the security policy or the security policy sent by the SMF entity to the base station may be a previously generated security policy, or may be the newly generated security policy.
  • the SMF entity sends the identifier of the security policy or the security policy to the base station in multiple forms.
  • the SMF entity may generate the security policy according to the relevant parameters of the security policy.
  • the security policy is generated according to the terminal device identifier or the session identifier. Some generation rules can also be preset, and all security policies can be pre-configured.
  • the base station may send the identifier of the security policy or the security policy applied by the terminal device or the request message of the terminal device to the past according to some information carried in the request message.
  • the related parameters of the security policy include: an identifier of the terminal device, a data network name (DNN) of the terminal device, an identifier of the slice of the terminal device, a quality of service of the terminal device, and at least a session identifier of the terminal device.
  • DNN data network name
  • the related parameters of the security policy include at least one of an identifier of the terminal device, a DNN of the terminal device, an identifier of the slice of the terminal device, a quality of service of the terminal device, a session identifier of the terminal device, and a flow identifier.
  • the association relationship in the embodiment of the present application may include a corresponding relationship, may also include some rules, or may also include some related relationships.
  • the correspondence between the relevant parameters and the security policy may be preset, and then the security policy corresponding to the relevant parameter may be found.
  • the security policy corresponding to the slice identifier is determined according to the identifier of the slice, and the session identifier is determined according to the session identifier.
  • the security policy determines the security policy corresponding to the session identifier and the slice identifier according to the association relationship between the session identifier, the slice identifier, and the security policy.
  • the related parameters of the security policy include the identifier of the terminal device, and the SMF entity obtains the security policy according to the association between the identifier of the terminal device and the security policy and the identifier of the terminal device.
  • the mapping between the terminal device and the security policy may be stored on the SMF or other network element connected to the SMF, for example, the terminal device has a corresponding relationship with the security policy.
  • the user subscription data has the corresponding relationship between the IMSI and the security policy. In this way, different security policies can be set for different service requirements of different terminal devices, such as terminal devices.
  • the association between the identifier of the terminal device and the security policy may be preset.
  • the identifier of the terminal device is associated with multiple security policies, and then one security policy may be selected from multiple security policies associated with the identifier of the terminal device.
  • the security policy may be further determined according to parameters other than the identifier of the terminal device in the related parameter, for example, the security policy associated with the session identifier is selected from the plurality of security policies associated with the identifier of the terminal device in combination with the session identifier.
  • the service quality flow identifier is determined according to the service quality, and the corresponding service quality security policy is determined according to the service quality flow identifier.
  • an Internet of Things terminal device is only responsible for copying water meters, that is, sending water meter data to water plants on a monthly basis. Then, the security policy of the terminal device is fixed, and the identifier of the terminal device may be set to correspond to a security policy, and optionally, the subscription data of the user saved in the UDM may be obtained.
  • the identifier of the slice of the terminal device is the information of the slice accessed by the terminal device in the 5G application scenario, and is used to indicate which slice the terminal device accesses.
  • the relevant parameters of the security policy include the identifier of the slice of the terminal device, and the SMF entity obtains the security policy according to the association between the identifier of the slice and the security policy and the identifier of the slice of the terminal device.
  • a terminal device may correspond to an identifier of at least one slice, for example, the terminal device may access different slices, and the terminal device user plane data may correspond to different security policies under different slices.
  • the terminal device carries the network slice selection assistance information (NSSAI) in the SR message or the PDU session establishment request.
  • SMF will get The security policy corresponding to the NSSAI is unique. If the security policy of the slice corresponding to the NSSAI is unique, the security policy obtained when the terminal device accesses the slice is unique. If the NSSAI information includes at least one slice, it needs to be selected according to the security policy of the slice currently accessed by the terminal device (the security policies of different slices may be different). If the security policy of the current slice is unique after the slice of the access is determined, the security policy obtained when the terminal device accesses the slice is unique.
  • NSSAI network slice selection assistance information
  • the terminal device needs to further determine the security policy according to other information, and the terminal device needs to further determine the security policy according to other information, such as according to other parameters except the slice identifier.
  • the at least one identifier is selected, such as by a terminal device identifier or a session identifier, and the like.
  • the session identifier of the terminal device is the session identifier corresponding to the session corresponding to the request message of the terminal device.
  • Conversation English can be called a session, such as a terminal device for Internet (such as browsing the web, watching video, WeChat chat), is a session.
  • the terminal device accesses the intranet of the company where the terminal device is located, and uses company-specific services (eg, company meetings), which is another session.
  • the terminal device accesses the network that makes the VoIP call, which is another session.
  • the session ID of the Internet service to 1; the session ID of the company intranet is 2; the session ID of the VoIP phone is 3.
  • the relevant parameters of the security policy include the session identifier of the terminal device, and the SMF entity obtains the security policy according to the association relationship between the session identifier and the security policy and the session identifier of the terminal device.
  • the SMF entity obtains the security policy according to the association relationship between the session identifier and the security policy and the session identifier of the terminal device.
  • a normal terminal device which only has the service of making calls and texting. These two business segments belong to two sessions. Then the quality of service and security policy are different depending on the session.
  • the user plane integrity protection is not required, and key mixing is not required.
  • the user plane encryption algorithm can be 128 bits, and the user plane encryption key length is 128 bits.
  • key mixing is required, user plane encryption algorithm uses 128 bits, user plane encryption key uses 128 bits (bits), user plane integrity protection algorithm uses 256 bits, user plane integrity.
  • the protection key is 256 bits.
  • the user plane integrity protection algorithm and user plane encryption algorithm with lower security level should be used in the security policy to ensure low latency.
  • 128-bit user plane integrity protection algorithm and user plane encryption algorithm, and 128-bit user plane integrity protection key and user plane encryption key; or user plane integrity protection algorithm and user plane encryption algorithm are not enabled.
  • the service corresponding to the session identifier is a service with high reliability requirements, not only the user plane encryption key is required for encryption protection, but also the user plane integrity protection key is required for integrity protection, and a higher security level is selected.
  • User plane integrity protection algorithm and user plane encryption algorithm such as 256-bit user plane integrity protection algorithm and user plane encryption algorithm, and 256-bit user plane encryption key and user plane encryption key.
  • the service corresponding to the session identifier is a general service, such as voice service, and may only require user plane encryption key protection, without user plane integrity protection, and may require a 256-bit user plane encryption algorithm, but the key Encryption key with 128bit user plane is enough. It can be seen that, in the embodiment of the present application, different security policies can be selected based on different services to meet the dynamic requirements of user plane security.
  • one slice identifier may correspond to multiple session identifiers.
  • the corresponding relationship is a logical correspondence. In actual applications, the session identifier is not necessarily specified. Correspondence with the slice identifier.
  • the SMF entity associates with the identifier of the terminal device, the identifier of the slice, the session identifier, and the security policy.
  • the system obtains the identifier of the slice and the security policy corresponding to the session identifier. In this way, a finer-grained partitioning can be obtained, and the security policy is selected for the same terminal device and accessing different sessions initiated in the same slice.
  • the SMF entity obtains the security policy of the terminal device according to the association relationship between the flow identifier and the security policy.
  • a finer-grained partition can be obtained, and the same terminal device accesses the same network to initiate the same session, but selects a security policy according to the specific content of the session.
  • the data stream on the Internet may be a webpage, or a video.
  • the Internet service belongs to session 1, then the browsing page is stream 1, and the video is stream 2.
  • the SMF will create a quality of service for Stream 1 when it finds that it does not support the quality of service for Stream 1. The same is true for stream 2. If the SMF finds that the quality of service of both stream 1 and stream 2 is available, then these qualities are directly sent to the base station.
  • the relevant parameters of the security policy include the quality of service of the terminal device; the SMF entity obtains the security policy according to the quality of service of the terminal device.
  • the service quality corresponding to the terminal device identifier is obtained according to the terminal device identifier included in the request message, where the service quality is, for example, the terminal device requires low delay, good security, etc., and then according to the quality of service.
  • the terminal device sets a set of security policies.
  • the security policy may be pre-configured on the SMF or the PCF, or the quality of service corresponding to the DNN may be obtained from the UPF and/or the UDM, and then a security policy is obtained according to the quality of service.
  • the default quality of service UDM is entered at the time of signing up.
  • the UPF can learn about the dynamic quality of service from an external network that handles calls or text messages. It can also be learned from the PCF or pre-configured.
  • the relevant parameters of the security policy include the DNN of the terminal device, and a set of security policies are set according to the DNN. For example, if the DNN is for Youku and the video service is more for the Youku network, the delay of the security policy set for the terminal device may be low. Some, for example, DNN is a financial-related website, and the security policy set for the terminal device is more secure.
  • the service quality corresponding to the DNN may be obtained from the core network element, such as the PCF/UPF or the UDM, and the service quality carries the security policy, or the security policy is set according to the service quality.
  • the dynamic service quality information obtained from the PCF is obtained from the UDM as the default service quality information when the user signs the contract.
  • the SMF obtaining information from the UDM may be obtained by sending a Subscription Data Request to the UDM and receiving a Subscription Data Response from the UDM.
  • SMF and PCF can be obtained through PDU-CAN session modification information.
  • the SMF and the UPF can be obtained by sending a Session Establishment/Modification Request to the UPF and receiving a Session Establishment/Modification Response from the UDM.
  • the quality of service may be identified by a quality of service flow (QoS flow), identified by an identification (ID), and may be referred to as a QoS Flow ID, or QFI for short.
  • QoS flow quality of service flow
  • ID identification
  • QoS Flow ID QoS Flow ID
  • QFI QoS Flow ID
  • the quality of service may include multiple parameters, such as a 5G QoS Indicator (5QI).
  • the 5QI is used to identify performance characteristics, and may include any one or more of a resource type (Guaranteed flow bit rate (GBR) or Non-GBR), a packet delay degree, and a bit error rate. Other parameters may be included.
  • 5QI is the basic parameter for the network element to allocate resources for service quality.
  • the quality of service may also include allocation and retention priority (ARP).
  • ARP allocation and retention priority
  • Priority can be identified from 1 to 15. Indicates the priority of the resource requested for the quality of service, whether it can be refused due to resource constraints Establish wireless data bearers.
  • the QoS may also include two parameters, which are used to define whether resources corresponding to other quality of service (such as wireless data bearers) can be preempted or whether the wireless data bearers established by the quality of service can be preempted by other quality of service.
  • resources corresponding to other quality of service such as wireless data bearers
  • the quality of service may also include: a GBR guaranteed data bit rate, which may be used for uplink and downlink.
  • the GBR data content GBR can be a session or a flow.
  • the GBR data has a corresponding service level, and different service levels also correspond to different service qualities.
  • Non-GBR data corresponds to the default service level. For example, for operators, calls must be guaranteed, so there is a GBR guarantee for making calls. For ordinary short message service, it is non-GBR, and there will be no problem if it is delayed for a while. There is another situation. For example, if Tencent Games buys the service of the operator, then the traffic flow of the original Tencent game non-GBR will become GBR.
  • the QoS includes a Maximum Flow Bit Rate (MFBR), and all flows of a session cannot add up to this rate. Once it is over, you may need to refer to the ARP to refuse to establish or preempt other resources.
  • MFBR Maximum Flow Bit Rate
  • the quality of service also includes a notification control.
  • This setting is on or off. If there is a situation where a wireless data bearer cannot be established for the quality of service, it is determined according to this switch whether or not the terminal device is to be notified.
  • the security policy further includes: at least one of the following: the encryption indication information, where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device; the key length; the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH; the user plane integrity protection algorithm allowed by the service network. That is to say, the security policy may also include whether user plane encryption is enabled, whether user plane integrity protection is enabled, whether the encryption/decryption algorithm is 128-bit or 256-bit, the key length is 128-bit or 256-bit, and whether one or more of key mixing is enabled. Any one or more of these contents.
  • bit sequence 0000000 means that the user plane encryption protection is not enabled and the user plane integrity protection is not turned on, since none of them are turned on, so all are 0.
  • bit sequence 1010100 indicates that the user plane encryption protection is turned on but the user plane integrity protection is not turned on, and the 128-bit encryption algorithm is used, and the key mixing is not turned on.
  • key mixing refers to D-H
  • D-H is a key mixing algorithm.
  • the security policy may further include a user plane encryption algorithm allowed by the service network. Or, if the allowed user plane encryption algorithm appears in the security policy, it means that the user plane encryption needs to be enabled.
  • the service network is a network that provides services to the terminal devices.
  • the security policy may include a key length of the user plane integrity protection algorithm, and may also include a key length of the user plane encryption algorithm.
  • the allowed user plane encryption algorithm appears in the security policy.
  • the algorithm is 256bite, which means that the key length of 256bite is used.
  • the method before the acquiring the security policy by the base station, the method further includes: the base station sending the first priority indication information to the access and mobility management AMF entity, where the first priority indication information is used to indicate the user plane integrity protection allowed by the base station
  • the algorithms are not sorted by priority.
  • the AMF forwards the first priority indication information to the SMF.
  • the SMF knows that the user plane integrity protection algorithm allowed by the base station is not prioritized, so the SMF will The user plane integrity protection algorithm allowed by the service network performs priority ordering or prioritization of the user plane integrity protection algorithm supported by the terminal device, and the user plane integrity protection algorithm supported by the terminal device is from the AMF. obtain.
  • the SMF may select an incorrect service network.
  • the allowed user plane integrity protection algorithm prioritizes.
  • prioritizing the user plane integrity protection algorithms allowed by the service network may be based on many factors, such as factors such as current carrier preferences, local service network environments, and the like.
  • the method further includes: the base station sending the second priority indication information to the access and mobility management AMF entity, where the second priority indication information is used to indicate whether the user plane encryption allowed by the base station is not Sort by priority.
  • the AMF forwards the second priority indication information to the SMF.
  • the SMF knows that the user plane encryption algorithm allowed by the base station is not prioritized, so the SMF will serve the service network.
  • the user plane encryption algorithm is allowed to prioritize or prioritize the user plane encryption algorithms supported by the terminal device, and the user plane encryption algorithm supported by the terminal device is obtained from the AMF.
  • the SMF does not obtain the second priority indication information, or the SMF knows that the user plane encryption algorithm allowed by the base station is prioritized according to other manners, the SMF is optional and is not allowed to the service network.
  • the user plane encryption algorithm prioritizes.
  • prioritizing the user plane encryption algorithms allowed by the service network may be based on many elements, such as factors such as current carrier preferences, local service network environments, and the like.
  • the priorities of the user plane encryption algorithm and the user plane integrity protection algorithm are respectively introduced.
  • the user indicates an information about the user plane encryption algorithm and the user plane integrity protection. The priority of the algorithm.
  • the method further includes: the base station sending the third priority indication information to the access and mobility management AMF entity, where the third priority indication information is used to indicate the user plane encryption algorithm allowed by the base station and User plane integrity protection algorithms are not prioritized.
  • the user plane encryption algorithm and the user plane integrity protection algorithm may be the same or different.
  • the AMF forwards the third priority indication information to the SMF.
  • the SMF knows that the user plane encryption algorithm and the user plane integrity protection algorithm allowed by the base station are not prioritized. Sorting, so the SMF prioritizes the user plane encryption algorithm and the user plane integrity protection algorithm allowed by the service network or prioritizes the user plane encryption algorithm and the user plane integrity protection algorithm supported by the terminal device.
  • the user plane encryption algorithm and the user plane integrity protection algorithm supported by the terminal device are obtained from the AMF.
  • the SMF does not obtain the third priority indication information, or the SMF knows according to other manners that the user plane encryption algorithm allowed by the base station and the integrity protection algorithm of the user plane are prioritized, the SMF
  • the user plane encryption algorithm allowed by the service network is not prioritized.
  • prioritizing the user plane encryption algorithm and the user plane integrity protection algorithm allowed by the service network may be based on many elements, such as factors such as current carrier preferences, local network environments, and the like.
  • FIG. 2b is a schematic flowchart showing another communication method provided by an embodiment of the present application.
  • a communication method provided by the embodiment of the present application is as shown in FIG. 2b, and the method includes:
  • Step 221 The base station acquires a security policy, where the security policy includes integrity protection indication information, and the integrity protection indication information is used to indicate whether the base station turns on the integrity protection for the terminal device.
  • the security policy may further include an allowed user plane encryption algorithm and a service network. Allowed user plane integrity protection algorithm and indication of whether to enable key mixing.
  • the user plane encryption algorithm allowed by the service network may include enabling user plane encryption protection and key length information. For example, if the user plane encryption algorithm is 256 bits, a 256-bit key is used.
  • the base station is allowed to not enable user plane encryption protection.
  • the base station turns on user plane integrity protection.
  • the key length is determined according to the bit information of the integrity algorithm, ie the 256-bit integrity algorithm uses a 256-bit key.
  • the allowed user plane integrity protection algorithm does not have an empty algorithm. If the integrity protection algorithm is not present in the security policy, the integrity protection is not turned on.
  • other information may also be used to inform the base station of the key length information, such as by bit information.
  • Step 222 When the integrity protection indication information indicates that the base station turns on the integrity protection for the terminal device, the base station determines a target user plane integrity protection algorithm.
  • Step 223 The base station sends a target user plane integrity protection algorithm to the terminal device.
  • the method for the base station to send the target user plane integrity protection algorithm to the terminal device refers to the foregoing content, and details are not described herein again.
  • the foregoing AS SMC and AS SMP processes may be further included between the foregoing step 221 and step 223, for re-negotiating a target signaling plane security algorithm between the base station and the terminal device.
  • the above steps 201 to 204 can be added between the above steps 221 and 223.
  • the acquiring, by the base station, the security policy includes: the base station receiving the security policy from the SMF entity.
  • the base station pre-stores the security policy, and then the base station receives the identifier of the security policy from the SMF entity, and obtains the security policy according to the identifier of the security policy.
  • a Base Station System (SDAP) layer is configured to map the quality of service to a Packet Data Convergence Protocol (PDCP) layer.
  • PDCP Packet Data Convergence Protocol
  • Each PDCP layer corresponds to one DRB. Therefore, the security level we defined earlier needs to be further subdivided on the RAN side. If security is still done at the PDCP layer, the user interface encryption and decryption and integrity protection are still done at the PDCP layer. Because one PDCP layer corresponds to one DRB, only the DRB level security processing can be performed on the RAN side. If security or partial security processing can be moved up to the SDAP layer, security processing at the QoS flow level can be achieved.
  • SDAP Base Station System
  • Partial security means that if only user plane integrity protection is based on flow granularity, then only the integrity protection related security processing needs to be placed at the SDAP layer. If user face encryption and decryption and integrity protection processing are based on flow granularity, they need to be done at the SDAP layer. Therefore, the premise of security processing based on the level of flow granularity is that security or partial security is put into the SDAP layer.
  • IP-flow there are 4 service flows (IP-flow) and 3 QoS flows in a session.
  • NAS-level mapping indicates the first QoS processing.
  • the IP flow is mapped to a QoS flow.
  • QFI QoS flow ID
  • the SDAP layer maps different given QFIs to different PDCP layers. It can be seen that QFI1 and QFI2 are placed in a PDCP Entity (PDCP entity), indicating that QFI1 and QFI2 are transmitted through one DRB. (One PDCP entity corresponds to one DRB bearer) QFI-3 is placed in another PDCP Entity-2, which is another DRB bearer.
  • PDCP entity PDCP Entity
  • QFI-3 is placed in another PDCP Entity-2, which is another DRB bearer.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm sorted according to priority.
  • the user plane integrity protection algorithm supported by the terminal device is a user plane integrity protection algorithm sorted according to priority.
  • the user plane integrity protection algorithm allowed by the base station can be prioritized according to the preferences of the local operator or the local environment, and can be pre-configured on the base station.
  • the user plane integrity protection algorithm supported by the terminal device may be prioritized according to the subscription content of the terminal device, or/and the preference of the terminal device, and may be sorted by the terminal device when signing up or when purchasing more services.
  • the user plane supported by the terminal device may be included in the security policy. Integrity protection algorithm.
  • the security policy includes at least one user plane integrity protection algorithm, where the base station directly includes at least one user plane integrity protection algorithm included in the security policy.
  • a user plane integrity protection algorithm is determined as the target user plane integrity protection algorithm.
  • the base station determines the target user plane integrity protection algorithm, including: determining, by the base station, a user plane integrity protection algorithm supported by the terminal device and a user plane integrity protection algorithm allowed by the base station, User plane integrity protection algorithm.
  • the base station determines that the target user plane integrity protection algorithm may have several optional implementation manners, for example, the base station determines at least one algorithm that belongs to the user plane integrity protection algorithm supported by the terminal device, and belongs to the user plane integrity protection algorithm allowed by the base station. Determining a target user plane integrity protection algorithm from the at least one algorithm.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm according to priority order, determining, from the at least one algorithm, that the priority ordering is higher in the user plane integrity protection algorithm allowed by the base station. Or the highest algorithm as the target user plane integrity protection algorithm.
  • the base station determines, from the at least one algorithm, a priority in the user plane integrity protection algorithm supported by the terminal device. The higher or highest ranked algorithm is used as the target user plane integrity protection algorithm.
  • the security policy further includes a user plane integrity protection algorithm allowed by the service network.
  • the user plane integrity protection algorithm allowed by the service network is a priority-ordered user plane integrity protection algorithm.
  • the user plane integrity protection algorithm allowed by the service network may be pre-configured on the SMF. The priority of the user plane integrity protection algorithm allowed by the service network can be sorted according to factors such as operator preference and/or local environment.
  • the base station determines the target user plane integrity protection algorithm according to the user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm allowed by the base station, including: the base station according to the user plane integrity protection algorithm allowed by the base station, The user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm allowed by the service network determine the target user plane integrity protection algorithm.
  • the priority order allowed by the service network is used as a primary condition or the priority order allowed by the base station is selected as a primary condition, and according to which priority
  • the ordering is determined by the strategy of the local operator, and may also be determined according to other information.
  • the priority order of the user plane integrity protection algorithm allowed by the base station is the primary condition; for example, the default is to prioritize the priority of the user plane integrity protection algorithm allowed by the base station; if the user plane allowed by the service network When the integrity protection algorithm is not prioritized, the priority order of the user plane integrity protection algorithm allowed by the base station is the primary condition.
  • the base station determines that the target user plane integrity protection algorithm may have several optional implementation manners. For example, the base station determines the user plane integrity protection algorithm supported by the terminal device, and also belongs to the user plane integrity protection algorithm allowed by the base station, and belongs to At least one algorithm of the user plane integrity protection algorithm allowed by the service network determines a target user plane integrity protection algorithm from the at least one algorithm.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm according to priority order, determining, from the at least one algorithm, that the priority ordering is higher in the user plane integrity protection algorithm allowed by the base station. Or the highest algorithm as the target user plane integrity protection algorithm.
  • the base station determines, from the at least one algorithm, a priority in the user plane integrity protection algorithm supported by the terminal device. The higher or highest ranked algorithm is used as the target user plane integrity protection algorithm.
  • the base station determines, from the at least one algorithm, a priority in the user plane integrity protection algorithm allowed by the service network. Sort the higher or highest algorithm as the target user face complete Sex protection algorithm.
  • the network in the embodiment of the present application may include a 5G network or a network evolved by a 5G network.
  • the method further includes: when the security policy further includes the encryption indication information, and the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device, the base station sends the target user plane encryption algorithm to the terminal device.
  • the following describes the flow of the method for negotiating the target user plane encryption algorithm between the base station and the terminal device.
  • the user plane encryption algorithm allowed by the base station is a user plane encryption algorithm sorted according to priority.
  • the user plane encryption algorithm supported by the terminal device is a user plane encryption algorithm sorted according to priority.
  • the user plane encryption algorithm allowed by the base station can be prioritized according to at least the operator's preference, and can be sorted by the operator when the network is built, and can be pre-configured on the base station.
  • the user plane encryption algorithm supported by the terminal device can be prioritized according to the operator's preference, and can be sorted by the user when signing in the network.
  • the user plane encryption algorithm supported by the terminal device may be included in the security policy.
  • the method further includes an optional implementation, where the security policy includes at least one user plane encryption algorithm, and the base station directly determines a user plane encryption algorithm included in the at least one user plane encryption algorithm included in the security policy as the target user. Face encryption algorithm.
  • the base station determines the target user plane encryption algorithm according to the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station.
  • the base station determines that the target user plane encryption algorithm may have several optional implementation manners. For example, the base station determines at least one algorithm that belongs to both the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station, from the at least one algorithm. Determine the target user plane encryption algorithm.
  • the user plane encryption algorithm allowed by the base station is a user plane encryption algorithm sorted according to priority
  • the user plane encryption algorithm supported by at least one terminal device and the user plane encryption algorithm allowed by the base station are determined in the base station.
  • One of the allowed user plane encryption algorithms has a higher priority or the highest one as the target user plane encryption algorithm.
  • the base station determines from at least one user plane encryption algorithm supported by both the terminal device and the user plane encryption algorithm allowed by the base station.
  • the algorithm with higher priority or highest priority is used as the target user plane encryption algorithm in the user plane encryption algorithm supported by the terminal device.
  • the security policy further includes a user plane encryption algorithm allowed by the service network.
  • the user plane encryption algorithm allowed by the service network is a user plane encryption algorithm sorted according to priority.
  • the user plane encryption algorithm allowed by the service network may be pre-configured on the SMF.
  • the priority of the user plane encryption algorithm allowed by the service network can be sorted according to at least the operator's preference.
  • the base station determines the target user plane encryption algorithm according to the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station, including: the user plane encryption algorithm supported by the base station according to the user plane encryption algorithm allowed by the base station, and the user plane encryption algorithm supported by the terminal device And the user plane encryption algorithm allowed by the service network to determine the target user plane encryption algorithm.
  • the priority order allowed by the service network is selected as a primary condition; if the user plane encryption algorithm allowed by the service network is not prioritized, The priority of the user plane security algorithm allowed by the base station is the primary condition.
  • the base station determines that the target user plane encryption algorithm may have several optional implementation manners. For example, the base station determines the user plane encryption algorithm supported by the terminal device, and also belongs to the user plane encryption algorithm allowed by the base station, and belongs to the user plane allowed by the service network. At least one algorithm of the encryption algorithm, from the at least one user plane encryption algorithm supported by the terminal device, also belongs to the user plane encryption algorithm allowed by the base station, and also belongs to the user plane encryption algorithm allowed by the service network to determine the target user plane encryption algorithm .
  • the user plane encryption algorithm allowed by the base station is a user plane encryption algorithm sorted according to priority
  • at least one user plane encryption algorithm supported by the terminal device is also a user plane encryption algorithm allowed by the base station
  • the user plane encryption algorithm allowed by the service network determines the algorithm with higher priority or highest priority in the user plane encryption algorithm allowed by the base station as the target user plane encryption algorithm.
  • the terminal device supports The user plane encryption algorithm is a user plane encryption algorithm sorted according to priority.
  • the base station is from at least one user plane encryption algorithm supported by the terminal device, and belongs to the user plane encryption algorithm allowed by the base station, and belongs to the user plane allowed by the service network.
  • the encryption algorithm determines a higher priority or the highest priority in the user plane encryption algorithm supported by the terminal device as the target user plane encryption algorithm.
  • the base station obtains at least one user plane encryption algorithm supported by both the terminal device and the user plane encryption algorithm allowed by the base station.
  • the user plane encryption algorithm allowed by the service network determines the algorithm with higher priority or highest priority in the user plane encryption algorithm allowed by the service network as the target user plane encryption algorithm.
  • the base station when the security policy further includes a key length, sends the key length to the terminal device.
  • the key length includes the user plane integrity protection key length and the user plane encryption key key length.
  • the base station when the base station sends the information about the target user plane integrity protection algorithm, the target user plane encryption algorithm, and the key length to the terminal device, the information may be sent through a signaling, such as an RRC reconfiguration request, or Multiple messages are sent.
  • the RRC reconfiguration message may be used, and the RRC reconfiguration message may include: the current user plane encryption algorithm, Target user plane integrity protection algorithm, user plane encryption key length, user plane integrity protection key length, key mixing policy (also called DH whether to enable indication information, DRB-1 (QoS information), DRB-2 At least one of (QoS information) and other parameters.
  • the target user plane integrity protection algorithm is not transmitted.
  • the algorithm itself can indicate the key length
  • the key length indication information is Can not be carried, when the key mixing policy base station does not support, or does not need to be enabled, then there is no need to pass. This method is used when all DRBs use the same security capabilities because it does not pass security policies in each DRB, and the target security policy can be configured for all DRBs through one selection process.
  • the RRC reconfiguration message may include:
  • DRB-1 target user security encryption algorithm-1, [target user plane integrity protection algorithm-1], [user plane encryption key length-1], [user plane integrity protection key length-1], [Key mixing strategy], QoS parameters, other parameters);
  • DRB-2 target user surface security encryption algorithm-2, [target user plane integrity protection algorithm-2], [user plane encryption key length-2], [user plane integrity protection key length-2], [Key mixing strategy], QoS parameters, other parameters), other parameters).
  • the RRC reconfiguration message only shows the two situations of DRB-1 and DRB-2.
  • the format carried in the RRC reconfiguration message may be similar to the above example, and the parameter items may be carried or partially carried, such as the above.
  • the parameters marked with [] in the example may or may not be carried.
  • the target security policy can be configured for each DRB, and the target security policy of each DRB can be the same, and the target security policy of each DRB can be different.
  • RRC reconfiguration messages include:
  • DRB-1 (, [target user plane integrity protection algorithm-1], [user plane encryption key length -1], [user plane integrity protection key length -1], [key mixing strategy], QoS parameters ,Other parameters);
  • DRB-2 [target user plane integrity protection algorithm-2], [user plane encryption key length-2], [user plane integrity protection key length-2], [key mixing strategy], QoS parameters, Other parameters);
  • the method further includes: the base station from the SMF
  • the entity receives the quality of service of the current session of the terminal device.
  • the quality of service of the current session may be sent through a message with the security policy, or may be sent separately through multiple messages.
  • the base station also receives some basic information for generating a key from the AMF, such as a base key for generating a user plane integrity protection key, a base key for generating a user plane encryption key, and the like.
  • the base station allocates a Data Radio Bearer (DRB) to the terminal device according to at least one of a security policy and a quality of service, where the wireless data bearer is allocated by the base station.
  • the base station allocates a wireless data bearer for data transmitted to the terminal device based at least on the quality of service.
  • DRB Data Radio Bearer
  • one DRB can correspond to multiple qualities of service.
  • the target wireless data bearer is allocated to the terminal device according to at least one of a security policy and a quality of service.
  • the base station when the wireless data bearer whose history does not exist on the base station satisfies the first condition, and the wireless data bearer that does not exist at least one history satisfies the second condition, the base station according to the security policy and At least one of the quality of service creates the target wireless data bearer for the terminal device.
  • the base station when the wireless data bearer whose history does not exist on the base station satisfies the first condition, the base station creates a location for the terminal device according to at least one of the security policy and the quality of service.
  • the target wireless data bearer when the wireless data bearer whose history does not exist on the base station satisfies the first condition, the base station creates a location for the terminal device according to at least one of the security policy and the quality of service.
  • the base station creates the target wireless data bearer for the terminal device according to at least one of the security policy and the quality of service.
  • the previously established DRB of the history may be selected as the target wireless data bearer for the terminal device, or a new DRB may be created as the target wireless data bearer.
  • the terminal device may be selected as the target wireless data bearer directly from the historical wireless data bearer. If the historical wireless data bearer is not selected, a new device is created for the terminal device. The wireless data bearer acts directly as the target wireless data bearer.
  • the target wireless data bearer is one of at least one historical wireless data bearer that satisfies the first condition; wherein the at least the first condition is met
  • the quality of service supported by each of the wireless data bearers in a historical wireless data bearer is the same as the quality of service of the current session, and the security policy is the same as the security policy supported by each of the wireless data bearers.
  • the first condition includes: the supported quality of service is the same as the quality of the current session, and the security policy obtained in step 221 is the same as the supported security policy.
  • the information of the multiplexed DRB can be implemented by sending a message, for example, the first time to the terminal device: RRC reconfiguration message (target user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB- 2 (QoS information-2), other parameters)); second pass to the terminal device: RRC reconfiguration message (current user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB-2 (QoS information) -2), DRB-3 (current user plane encryption algorithm-2, QoS information -2/3/4) other parameters)), the implementation of the DRB-2 security policy is modified to achieve the purpose of reuse QoS. It can be seen from this example that the purpose of using the historical wireless data bearer as the target wireless data bearer is achieved by signaling.
  • the purpose of the DRB for implementing the multiplexing history is first delivered to the terminal device: RRC reconfiguration message (target user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB-2 (QoS information-2), other parameters)); second pass to the terminal device: RRC reconfiguration message (current user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB-2 (current user plane) Encryption algorithm-2, QoS information-2), other parameters)), the purpose of modifying the DRB-2 security policy and reusing QoS.
  • RRC reconfiguration message target user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB-2 (QoS information-2), other parameters
  • RRC reconfiguration message current user plane encryption algorithm-1, DRB-1 (QoS information-1), DRB-2 (current user plane) Encryption algorithm-2, QoS information-2), other parameters
  • the target wireless data bearer is wireless data that satisfies at least one history of the second condition according to the security policy.
  • each of the at least one historical wireless data bearers satisfying the second condition supports a quality of service supported by the wireless data bearer and the service of the current session
  • the quality is the same, and the security policy matches the security policy supported by each of the wireless data bearers; or the wireless data bearer supported service in the at least one historical wireless data bearer that satisfies the second condition
  • the quality matches the quality of service of the current session, and the security policy is the same as the security policy supported by each of the wireless data bearers; or the wireless data bearer of the at least one history that satisfies the second condition
  • the second condition includes: the quality of service of the current session of the supported quality of service matches, and the obtained security policy is the same as the supported security policy.
  • the second condition includes the same quality of service of the current session of the supported quality of service, and the obtained security policy matches the supported security policy.
  • the second condition comprises: a quality of service matching of the current session of the supported quality of service, and the obtained security policy and the supported security policy match.
  • the content of the security policy and the quality of service corresponding to the historical wireless data bearer is not exactly the same, but the difference is small, for example, the difference of the bandwidth requirement is within a preset range, so that historical The wireless data bearer makes the smallest changes.
  • the relationship between the wireless data bearer that satisfies the second condition and the target wireless data bearer may satisfy: the wireless data bearer that meets the second condition turns on user plane encryption protection, but does not enable user plane integrity protection; and the target wireless data bearer User plane encryption protection is enabled, and user plane integrity protection is enabled, and the wireless data bearer satisfying the second condition is the same as the target user plane encryption algorithm of the target wireless data bearer.
  • the base station since the base station resources are limited and a new one cannot be created, or the setting of the base station is to find a way to reuse the historical wireless data bearer, the base station uses multiple times to send an RRC reconfiguration message, and the integrity protection can be turned on. .
  • the embodiment of the present application provides a possible implementation manner: a message that the base station transmits to the terminal device for the first time, such as an RRC reconfiguration message (target user plane encryption algorithm, DRB-1 (QoS information-1), DRB-2 ( QoS information-2), other parameters)); the second such transmission is RRC reconfiguration message (current user plane encryption algorithm, DRB-1 (QoS information-1), DRB-2 (target user plane integrity protection algorithm) , QoS information-2, QoS information-3), other parameters)), so, resources of DRB-2 can be reused.
  • RRC reconfiguration message target user plane encryption algorithm, DRB-1 (QoS information-1), DRB-2 (QoS information-2), other parameters
  • RRC reconfiguration message current user plane encryption algorithm, DRB-1 (QoS information-1), DRB-2 (target user plane integrity protection algorithm) , QoS information-2, QoS information-3), other parameters
  • the base station pre-configures the association relationship between the wireless data bearer and the service quality and the security policy, and sets each association relationship with a corresponding identifier, such as a wireless access/frequency priority user profile identifier (Subscriber Profile ID for RAT/Frequency Priority, SPID).
  • a wireless access/frequency priority user profile identifier Subscriber Profile ID for RAT/Frequency Priority, SPID.
  • SPID Subscriber Profile ID for RAT/Frequency Priority
  • the base station sends the target user plane integrity protection algorithm to the terminal device, where the base station sends the target user plane integrity protection algorithm to the terminal device by using Radio Resource Control (RRC) signaling.
  • RRC Radio Resource Control
  • the RRC signaling includes an RRC Connection reconfiguration request.
  • the base station further needs to send the target user plane encryption algorithm to the terminal device.
  • the base station further needs to send the key length to the terminal device.
  • the key length may include the user plane encryption key length, if the integrity protection When the indication information indicates that the base station turns on the integrity protection for the terminal device, the key length may include the user plane integrity protection key length.
  • One or more of the target user plane encryption algorithm, the target user plane encryption algorithm, the key length, and the quality of service may be sent to the terminal device by one signaling. , such as RRC reconfiguration request.
  • the base station when the security policy further includes D-H indication information, and the D-H indication information is used to indicate that the base station turns on the D-H to the terminal device, the base station sends the D-H related key to the terminal device.
  • D-H indication information is used to indicate that the base station turns on the D-H to the terminal device.
  • the base station selects according to the D-H capability reported by the UE and the D-H capability allowed by the base station, and selects the D-H capability with the highest priority allowed by the base station.
  • the base station generates the public key P1 and the private key B1 according to the selected D-H capability, and the base station sends the public key p1 and the selected D-H capability to the terminal device, for example, through an RRC reconfiguration message.
  • the terminal device generates the public key P2 and the private key B2 based on the selected D-H capability, and generates the key Kdh using the private key B2 and the public key P1. Then use Kdh and Kan to perform key mixing.
  • KDF key derive function
  • PDCP COUNT a freshness parameter
  • Kdh and Kan directly for key mixing without using other parameters.
  • the RRC reconfiguration message is protected and sent to the base station by using the new user plane key.
  • the RRC reconfiguration message contains the public key P2.
  • the base station After obtaining the public key P2, the base station generates a New-Kan in the same manner as the terminal device according to the public key P2 and the private key B1, and further obtains a new user plane key by using the same method as the terminal device.
  • the RRC reconfiguration message is developed using the new user plane key. If the verification is successful, the base station starts to enable the new user plane key.
  • the base station receives the identifier of the security policy or the security policy, and the base station may provide the A user plane integrity protection algorithm in the information selection security policy is used as the target user plane integrity protection algorithm, wherein the security policy may include one or more user plane integrity protection algorithms; or the base station may not use the security policy.
  • the user plane integrity protection algorithm is used as the target user plane integrity protection algorithm; or, when the user plane integrity protection algorithm of the base station in the security policy is not in the list of user plane integrity protection algorithms allowed by the base station, the security policy is not used.
  • the user plane integrity protection algorithm is used as the target user plane integrity protection algorithm.
  • the user plane integrity protection algorithm in the security policy may be complete.
  • One of the user plane integrity protection algorithms other than the sexual protection algorithm is selected as the target user plane integrity protection algorithm.
  • one of the user plane integrity protection algorithms allowed by the base station may be selected as the target user plane integrity protection algorithm;
  • the base station can select the target user plane integrity protection algorithm according to the pre-configured security policy in the base station, for example, the base station may include a security policy in the pre-configured security policy.
  • multiple user plane integrity protection algorithms the base station selects one of the pre-configured security policies as the target user plane integrity protection algorithm. Other more embodiments can be found in the foregoing.
  • the user plane integrity protection algorithm in the foregoing security policy may be a user plane integrity protection algorithm allowed by the service network included in the security policy described in the foregoing content, or may be allowed by the SMF entity according to the service network.
  • the user plane integrity protection algorithm, the user plane integrity protection algorithm supported by the terminal device, and at least one of the user plane integrity protection algorithms allowed by the base station are determined.
  • the SMF entity may determine the target user plane integrity protection algorithm that belongs to both the user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection algorithm allowed by the base station.
  • the SMF entity may determine the user plane integrity protection algorithm supported by both the terminal device and the user plane integrity protection algorithm allowed by the base station, and an algorithm of the user plane integrity protection algorithm allowed by the service network is determined as Target user plane integrity protection algorithm.
  • the foregoing security policy may include a signaling plane integrity protection algorithm, that is, the security policy may include a signaling plane integrity protection algorithm and/or a user plane integrity protection algorithm.
  • the user plane integrity protection algorithm included in the security policy is also a signaling plane integrity protection algorithm, that is, the integrity protection algorithm included in the security policy, that is, the user plane integrity protection and signaling plane are simultaneously used. Integrity protection.
  • a person skilled in the art may know that there are multiple implementation manners for selecting a target user plane encryption algorithm, a target signaling plane integrity protection algorithm, and a target signaling plane encryption algorithm. For details, refer to the scheme description of the selected target user plane integrity protection algorithm. Here are a few examples of implementations.
  • the base station receives the identifier of the security policy or the security policy, and the base station may provide the A user plane encryption algorithm in the information selection security policy is used as the target user plane encryption algorithm, wherein the security policy may include one or more user plane encryption algorithms; or the base station may not use the user plane encryption algorithm in the security policy as The target user plane encryption algorithm is used; or the user plane encryption algorithm in the security policy is not in the user plane encryption algorithm list allowed by the base station, and the user plane encryption algorithm in the security policy is not used as the target user plane encryption algorithm.
  • the user plane encryption algorithm in the security policy is not used as the target user plane encryption algorithm
  • the base station if the base station enables user plane encryption protection, the user may be in addition to the user plane encryption algorithm in the security policy.
  • One of the face encryption algorithms is selected as the target user plane encryption algorithm.
  • one of the user plane encryption algorithms allowed by the base station may be selected as the target user plane encryption algorithm.
  • the user plane encryption algorithm in the foregoing security policy may be a user plane encryption algorithm allowed by the service network included in the security policy described in the foregoing content, or may be a user plane encryption algorithm allowed by the SMF entity according to the service network. And determining at least one of a user plane encryption algorithm supported by the terminal device and a user plane encryption algorithm allowed by the base station.
  • the SMF entity may determine the user plane encryption algorithm that belongs to both the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station.
  • the SMF entity may determine the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station, and an algorithm belonging to the user plane encryption algorithm allowed by the service network is determined as the target user plane encryption algorithm.
  • the foregoing security policy may include a signaling plane encryption algorithm, that is, the security policy may include a signaling plane encryption algorithm and/or a user plane encryption algorithm.
  • the user plane encryption algorithm included in the security policy is also a signaling plane encryption algorithm, that is, the encryption algorithm included in the security policy is used for both user plane encryption protection and signaling plane encryption protection.
  • the method shown in FIG. 2a further includes: acquiring, by the terminal device, a target user plane integrity protection algorithm. Specifically, the following two methods can be used:
  • Manner 1 The terminal device receives the target user plane integrity protection algorithm sent by the base station. For example, in step 2b of FIG. 2b, the target user plane integrity protection algorithm sent by the base station to the terminal device, and correspondingly, the terminal device receives the target user plane integrity protection algorithm sent by the base station.
  • the terminal device determines a target user plane integrity protection algorithm. For example, the terminal device inherits the target user plane integrity protection algorithm used before; for example, the terminal device uses a target signaling plane integrity protection algorithm (where the target signaling plane integrity protection algorithm can be sent by the base station to the terminal device) ) Determined as the target user plane integrity protection algorithm. This improves the flexibility of the terminal device to determine the target user plane integrity protection algorithm.
  • the terminal device may also determine a target user plane encryption algorithm, for example, the terminal device inherits the previously used target user plane encryption algorithm; for example, the terminal device determines the target signaling plane encryption algorithm as the target user plane encryption algorithm.
  • the method shown in FIG. 2 further includes: determining, by the base station, a target user plane integrity protection algorithm and/or a target user plane encryption algorithm.
  • the target signaling plane integrity protection algorithm in the target signaling plane protection algorithm determined in step 202 may also be used as the target user plane integrity protection algorithm, and may be in the target signaling plane protection algorithm determined in step 202.
  • the target signaling plane encryption algorithm is also used as the target user plane encryption algorithm.
  • the method further includes:
  • the base station enables user plane integrity protection; or, the terminal device and the base station enable user plane integrity protection; or the terminal device turns on user plane integrity protection.
  • the following uses the base station as an example to describe how to enable user plane integrity protection or enable user plane encryption protection:
  • the base station turns on user plane integrity protection when the conditions for the base station to turn on user plane integrity protection are met.
  • the condition for the base station to enable the user plane integrity protection may be that the base station receives the first preset user plane message, for example, the session establishment accept message; or the base station receives the user plane information, for example, the session ID or the QoS profile.
  • the user plane information may be preset user plane information, for example, a preset session ID or a preset QoS profile, where the preset session ID may refer to a specific session ID, or the base station is currently a terminal device. Allocating user plane resources or reallocating user plane resources for the terminal device.
  • the base station receives a message requesting to allocate user plane resources for the terminal device; if the base station is currently reallocating user plane resources for the terminal device, and the network running parameters meet the preset If the network allows the condition, the user plane integrity protection may be enabled.
  • the security policy received by the base station may include the integrity protection indication information, and the integrity protection indication information indicates that the user plane integrity protection is enabled.
  • the type of service of the session such as a pre-configured security policy, may include a preset session. Service type open relationship with the protection of the integrity of the user plane, upon receipt of the predefined service type of session you can open the user plane integrity protection.
  • the optional embodiments of the base station to enable the user plane integrity protection may be referred to the following embodiments c1-a1 through c1-a7.
  • the base station may enable user plane integrity protection when receiving the first preset user plane message within a preset time period; the first preset user plane message may be a session establishment accept message.
  • the base station receives the session establishment accept message within a preset time period (which may also be referred to as session establishment completion), it indicates that the base station is currently in the session establishment process, and in order to improve user plane signaling security, Turn on user plane integrity protection.
  • a preset time period which may also be referred to as session establishment completion
  • the base station may open the user plane integrity protection, where the user
  • the face information can be a session ID or a preset QoS profile.
  • the base station receives any session ID or any QoS profile within a preset time period (optionally, it can be received from the N2 port or directly from the terminal device side), the base station is currently in session establishment.
  • the process turns on user face integrity protection.
  • signaling plane protection can also be turned on.
  • the signaling plane protection may be at least one of enabling signaling plane integrity protection and enabling signaling plane encryption protection. This paragraph description applies to all embodiments of the present application, and will not be repeated in the following.
  • the preset user plane information may be a preset session ID or a preset QoS profile.
  • the association between the preset user plane information and the user plane integrity protection in the base station, and the association between the preset user plane information and the user plane integrity protection may be used as part of a pre-configured security policy in the base station.
  • whether to set the association between the user plane integrity protection and the session ID is enabled. In this manner, if the base station receives the preset session ID within a preset time period, the user plane integrity protection is enabled.
  • the default session ID corresponds to whether the user plane integrity protection is enabled in the association between the user plane integrity protection and the session ID.
  • the user plane integrity protection is enabled, so that if the base station receives the preset QoS profile within a preset time period, the user plane integrity protection is enabled.
  • the default session ID corresponds to whether the user plane integrity protection is enabled in the association between the user plane integrity protection and the session ID.
  • whether the association between the user plane integrity protection and the session ID is enabled may be preset in the base station, or may be an updated association relationship sent by other network elements received by the base station.
  • the base station may determine whether to enable user integrity protection according to the preset association relationship and the updated association relationship. For example, when the user plane integrity protection is enabled for the first time, whether the user integrity protection is enabled may be determined according to the preset association relationship; when there is an updated association relationship, the user relationship may be determined based on the latest association relationship. Integrity protection. It is also possible to perform comprehensive judgment in combination with specific preset association relationships, updated association relationships, and network load conditions. For example, if the base station re-allocates resources for the session due to overload, then in the process of re-allocating resources for the session, the system is closed. User face integrity protection that was originally opened by the session.
  • the user plane integrity protection can be turned on. For example, the base station receives a message requesting the terminal device to allocate the user plane resource in the preset time period, and the base station allocates the user plane resource for the terminal device or reallocates the user plane resource for the terminal device, where the user plane signaling is involved in the process. In order to improve the security of user plane signaling, user plane integrity protection can be turned on.
  • the user plane integrity protection may be enabled; wherein the network running parameter includes the network load amount and/or the packet loss rate.
  • the user plane security scheme corresponding to the resource allocated before the session of the terminal device is used.
  • the resource allocated before the session of the terminal device corresponds to the user plane integrity protection, and the session corresponding to the terminal device is re-enabled.
  • the assigned resources also correspond to the opening of user plane integrity protection.
  • the user plane security scheme corresponding to the reassigned resource corresponding to the session is re-determined according to the state of the base station. For example, the status of the base station indicates that the packet loss rate of a certain session is too high, because the user plane integrity protection is accompanied by an increased packet loss rate, so the user plane integrity protection is turned off in the process of reallocating resources for the session. For another example, if the base station re-allocates resources for the session due to overload, in the process of re-allocating resources for the session, the user plane integrity protection originally opened by the session is closed.
  • the base station re-allocates resources for one session, if the status of the base station is normal, the user plane integrity protection is maintained; or if the status of the base station is abnormal, such as the base station The overload re-allocates resources for the session. If the session originally turns on user plane integrity protection, the user plane integrity protection is turned off, and if the session loss rate is too high, the resources are re-allocated for the session. Because user plane integrity protection is accompanied by an increased packet loss rate, user plane integrity protection is turned off.
  • the situation may be pre-configured in the base station as part of the security policy (the security policy pre-configured in the base station may also be a security policy pre-configured in the base station as described above).
  • the base station may enable user plane integrity protection.
  • the integrity protection indication information may be an identifier of the integrity protection algorithm, bit indication information, or preset information.
  • the integrity protection indication information may be sent by, for example, an SMF entity.
  • the SMF entity sends an integrity protection indication information indicating that the user plane integrity protection is enabled when determining the SMF entity user plane integrity protection condition, wherein the SMF entity has multiple implementations in determining the SMF entity user plane integrity protection condition.
  • the security policy can be pre-configured in the base station.
  • the pre-configured security policy can include the association between the service type of the preset session and the user plane integrity protection.
  • the condition for the base station to enable the user plane integrity protection may be the service type of the preset session included in the security policy pre-configured by the base station.
  • the pre-configured security policy may include the association between the service type of the preset session and the user plane integrity protection.
  • the pre-configured security policy may be enabled.
  • the pre-configured security policy in the base station may be used.
  • the pre-configured security policy in the base station may be defined by the user plane data (such as the service type).
  • the pre-configured security policy in the base station specifies that the VoIP service corresponding process does not open the user plane integrity. Protection, when the base station determines that the current session corresponds to the VoIP service, the user plane integrity protection is not enabled.
  • the security policy may be preset pre-configured in the base station, or may have an updated security policy sent by other network elements received by the base station.
  • the base station may determine whether to enable user integrity protection according to the pre-configured security policy and the updated security policy. For example, when user plane integrity protection is enabled for the first time, you can decide whether to enable user integrity protection according to the pre-configured security policy. When there is an updated security policy, you can also determine whether to open the user plane based on the latest security policy. Integrity protection. It can also be combined with specific pre-configured security policies, updated security policies, and network load conditions. For example, if the base station re-allocates resources for the session due to overload, then in the process of re-allocating resources for the session, the system is closed. User face integrity protection that was originally opened by the session.
  • the method further includes: the base station sending, to the terminal device, integrity protection indication information, where the encryption indication information is used to indicate that the user plane integrity protection is enabled.
  • the integrity indication information may be integrity protection indication information included in a security policy received by the base station.
  • the method further includes:
  • the base station enables user plane encryption protection; or, the terminal device and the base station enable user plane encryption protection; or the terminal device enables user plane encryption protection.
  • the base station when the condition that the base station turns on the user plane encryption protection is satisfied, the base station turns on the user plane encryption protection.
  • the condition that the base station enables the user plane encryption protection may be that the base station receives the first preset user plane message, for example, the session establishment accept message; or the base station receives the user plane information, for example, the session ID or the QoS profile, where
  • the user plane information may be preset user plane information, for example, a preset session ID or a preset QoS profile, and the preset session ID may refer to a specific session ID; or the base station may currently allocate the terminal device.
  • the user plane resource or the user plane resource is reassigned to the terminal device.
  • the base station receives the message requesting the terminal device to allocate the user plane resource, or the security policy received by the base station includes the encryption indication information, and the encryption indication information indicates The user plane encryption protection is enabled.
  • the service type of the preset session is also used.
  • the pre-configured security policy may include the association between the service type of the preset session and the user interface encryption protection.
  • the user plane encryption protection can be enabled when the service type is enabled, or when the signaling plane protection is enabled. Open user plane encryption.
  • the method further includes: the base station sending, to the terminal device, the encryption indication information, where the encryption indication information is used to indicate that the user plane encryption protection is enabled.
  • the encryption indication information may be the encryption indication information included in the security policy received by the base station.
  • the base station may enable user plane encryption protection when receiving the first preset user plane message within a preset time period; the first preset user plane message may be a session establishment accept message.
  • the base station receives the session establishment accept message within a preset time period (which may also be referred to as session establishment completion), it indicates that the base station is currently in the session establishment process, and in order to improve user plane signaling security, Enable user plane encryption protection.
  • a preset time period which may also be referred to as session establishment completion
  • the base station may enable the user plane encryption protection, where the user plane information may be a session ID or a preset QoS profile.
  • the base station receives any session ID or any QoS profile within a preset time period (optionally, it can be received from the N2 port or directly from the terminal device side), the base station is currently in session establishment.
  • user plane encryption protection is enabled.
  • signaling plane protection can also be turned on.
  • the signaling plane protection may be at least one of enabling signaling plane encryption protection and enabling signaling plane encryption protection. This paragraph description applies to all embodiments of the present application, and will not be repeated in the following.
  • the user plane encryption protection can be enabled.
  • the preset user plane information may be a preset session ID or a preset QoS profile.
  • the association between the user plane information and the user plane encryption protection is enabled in the base station.
  • the association between the preset user plane information and whether the user plane encryption protection is enabled may be used as part of a pre-configured security policy in the base station.
  • the association between the user plane encryption protection and the session ID is enabled is set. Therefore, if the base station receives the preset session ID within the preset time period, the user plane encryption protection is enabled.
  • the preset session ID corresponds to whether the user plane encryption is enabled in the association between the user plane encryption protection and the session ID. protection.
  • whether to set the association between the user plane encryption protection and the QoS profile is enabled. If the base station receives the preset QoS profile within the preset time period, the user plane encryption protection is enabled.
  • the preset session ID corresponds to whether the user plane encryption protection is enabled in the association relationship between the user plane encryption protection and the session ID.
  • whether the association between the user plane encryption protection and the session ID is enabled may be preset in the base station, or may have an updated association relationship sent by other network elements received by the base station.
  • the base station may determine whether to enable user encryption protection according to the preset association relationship and the updated association relationship. For example, when the user plane encryption protection is enabled for the first time, whether the user encryption protection is enabled may be determined according to the preset association relationship. When the subsequent association relationship is updated, the user interface encryption protection may be determined based only on the latest association relationship. . It is also possible to perform comprehensive judgment in combination with specific preset association relationships, updated association relationships, and network load conditions. For example, if the base station re-allocates resources for the session due to overload, then in the process of re-allocating resources for the session, the system is closed. User plane encryption protection that was originally opened by the session.
  • the user plane encryption protection may be enabled. For example, the base station receives a message requesting the terminal device to allocate the user plane resource in the preset time period, and the base station allocates the user plane resource for the terminal device or reallocates the user plane resource for the terminal device, where the user plane signaling is involved in the process. To improve the security of user plane signaling, user plane encryption protection can be enabled.
  • the user plane encryption protection may be enabled; wherein the network running parameter includes the network load amount and/or the packet loss rate.
  • the user plane security scheme corresponding to the resource allocated before the session of the terminal device is used.
  • the resource allocated before the session of the terminal device corresponds to the user plane encryption protection, and the session device corresponding to the session is redistributed.
  • the corresponding resources also open the user face encryption protection.
  • the user plane security scheme corresponding to the reassigned resource corresponding to the session is re-determined according to the state of the base station. For example, the status of the base station indicates that the packet loss rate of a certain session is too high, because the user plane encryption protection is accompanied by an increase of the packet loss rate, so in the process of reallocating resources for the session, the user plane encryption protection is turned off. For another example, if the base station re-allocates resources for the session due to overload, in the process of re-allocating resources for the session, the user plane encryption protection originally opened by the session is closed.
  • the base station re-allocates resources for one session, if the status of the base station is normal, the user plane encryption protection is maintained; or if the status of the base station is abnormal, such as the base station is overloaded. Then re-allocate resources for this session, then if the session originally turned on user-side encryption protection, then the user-side encryption protection is turned off, and if the session loss rate is too high, the resource is re-allocated for the session because the user Encryption protection is accompanied by an increase in packet loss rate, so user plane encryption protection is turned off.
  • the situation may be pre-configured in the base station as part of the security policy (the security policy pre-configured in the base station may also be a security policy pre-configured in the base station as described above).
  • the base station can enable user plane encryption protection.
  • the encryption protection indication information may be an identifier of the encryption algorithm, bit position indication information, or may be preset information.
  • the ciphering protection indication information may be sent by, for example, an SMF entity.
  • the SMF entity sends an encryption protection indication information indicating that the user plane encryption protection is enabled when the SMF entity user plane encryption protection condition is met.
  • the SMF entity has multiple implementation manners in determining the manner of satisfying the SMF entity user plane encryption protection condition. See embodiments of the base station described in embodiments c1-b1 through embodiments c1-b5.
  • the security policy can be pre-configured in the base station.
  • the pre-configured security policy can include the association between the service type of the preset session and the user-side encryption protection.
  • the condition for the base station to enable the user plane encryption protection may be the service type of the preset session included in the security policy pre-configured by the base station.
  • the pre-configured security policy may include the association between the service type of the preset session and the user-side encryption protection.
  • the user plane encryption protection may be enabled.
  • the pre-configured security policy in the base station may be used.
  • the pre-configured security policy in the base station may be defined by the user plane data (such as the service type).
  • the pre-configured security policy in the base station specifies that the VoIP service corresponding process does not enable user plane encryption protection. The base station does not enable user plane encryption protection when determining that the current session corresponds to the VoIP service.
  • the security policy may be preset pre-configured in the base station, or may have an updated security policy sent by other network elements received by the base station.
  • the base station may determine whether to enable user encryption protection according to the pre-configured security policy and the updated security policy. For example, when user plane encryption protection is enabled for the first time, you can decide whether to enable user encryption protection according to the pre-configured security policy. When there is an updated security policy, you can also determine whether to enable user plane encryption protection based on the latest security policy. . It can also be combined with specific pre-configured security policies, updated security policies, and network load conditions. For example, if the base station re-allocates resources for the session due to overload, then in the process of re-allocating resources for the session, the system is closed. User plane encryption protection that was originally opened by the session.
  • the base station can also enable user plane encryption protection when the signaling plane protection (opening signaling plane integrity protection and/or signaling plane encryption protection) is enabled.
  • the signaling plane protection opening signaling plane integrity protection and/or signaling plane encryption protection
  • an optional implementation manner is further included after the step 202, and the base station also enables user plane encryption protection when the signaling plane protection is enabled.
  • the terminal device and the base station enable the signaling plane protection, but the user plane integrity protection is not enabled and the user plane encryption protection is not enabled, when the user plane integrity protection is enabled and the user plane encryption protection is enabled,
  • the state in which the signaling plane protection is enabled can be maintained.
  • the base station can send the integrity protection indication information and the encryption indication information to the terminal device, so that the terminal device can maintain the current signaling plane protection on state. For example, if the signaling device integrity protection is not enabled before the signaling plane integrity protection is enabled, the signaling plane integrity protection is maintained and the signaling plane encryption protection state is not enabled, and on the other hand, for complete protection.
  • the indication information enables user plane integrity protection, and user plane encryption protection is enabled according to the encryption indication information.
  • the base station may The integrity protection indication information for enabling the user plane integrity protection is sent only to the terminal device, and the terminal device can maintain the current signaling plane protection on state on the one hand (for example, if the terminal device is previously enabled, the signaling plane integrity protection is not enabled.
  • the signaling plane encryption protection continues to maintain the signaling plane integrity protection and does not enable the signaling plane encryption protection state.
  • the user plane integrity protection is enabled according to the complete protection indication information, and the encryption protection is continuously enabled.
  • the encryption indication information may be transmitted again to indicate that the user plane encryption protection is continuously turned on.
  • the following uses the terminal device as an example to explain the protection of user plane integrity or the protection of user plane integrity:
  • the terminal device When the condition that the terminal device turns on the user plane integrity protection is met, the terminal device turns on the user plane integrity protection.
  • the condition that the terminal device enables the user plane integrity protection may be that the terminal device receives the integrity protection indication information sent by the base station, and the integrity protection indication information indicates that the user plane integrity protection is enabled; or the terminal device sends the second preset.
  • User face message for example, a session establishment request message.
  • the terminal device may open the user plane integrity protection.
  • the terminal equipment When the terminal equipment is enabled to open the user plane integrity protection, the terminal device may open the user plane integrity protection.
  • the terminal device may open the user plane integrity protection.
  • the method further includes: the base station sending, to the terminal device, integrity protection indication information, where the integrity protection indication information is used to indicate Whether to enable user plane integrity protection.
  • the integrity protection indication information may be the integrity protection indication information included in the security policy acquired by the base station in the foregoing arrangement 221 of FIG. 2b, or may be the base station in the foregoing embodiments c1-a1 to c1-a7. Determined by any one of the embodiments.
  • the terminal device may enable user plane integrity protection.
  • the terminal device sends a session establishment request message within a preset time period, and the terminal device is currently in the session establishment process.
  • the terminal device in order to improve user plane security, can enable user plane integrity. protection.
  • the terminal device determines, according to the received integrity protection indication information, whether Turn on user plane integrity protection.
  • the method further includes: the base station sending, to the terminal device, the encryption indication information, where the encryption indication information is used to indicate whether the user plane is enabled. Encryption protection.
  • the encryption indication information may be the encryption indication information included in the security policy acquired by the base station in the foregoing arrangement 221 of FIG. 2b, or may be implemented by the base station by using any one of the foregoing embodiments c1-a1 to c1-a7. The way is determined.
  • the terminal device may enable the user plane encryption protection.
  • the terminal device sends the second preset user plane message within the preset time period
  • the user plane encryption protection may be enabled.
  • the terminal device sends a session establishment request message within a preset time period, and the terminal device is currently in the session establishment process.
  • the terminal device can enable user plane encryption protection. .
  • the terminal device determines whether to enable the user plane encryption based on the received encryption indication information. protection.
  • the terminal device may also enable user plane encryption protection when the signaling plane protection (opening signaling plane encryption protection and/or signaling plane encryption protection) is enabled.
  • the base station may also enable user plane encryption protection when the signaling plane protection is enabled.
  • the terminal device may determine whether to enable signaling plane protection (signaling plane integrity protection and/or signaling plane encryption protection) according to whether the second preset user plane message is sent within a preset time period.
  • the second preset signaling plane message may include a registration request or a service request.
  • the current process determines that the terminal device currently initiates a registration request (or a service request), and determines that the current process is a registration process (or a service process), because the user face has not been received in the process. Resource allocation information, the terminal device can enable signaling plane protection.
  • the terminal device may determine whether to complete the integrity protection of the signaling plane according to the received signaling plane integrity protection indication information, and determine whether to enable the encryption of the signaling plane according to the received signaling plane encryption indication information. protection.
  • the at least one of the signaling plane integrity protection indication information and the signaling plane encryption indication information received by the terminal device may also be sent by other network elements to the base station, and forwarded by the base station to the terminal device.
  • Other network elements may be, for example, SMF entities.
  • the method further includes:
  • the base station does not enable user plane integrity protection; or, the terminal device and the base station do not enable user plane integrity protection.
  • the base station When the condition that the base station does not turn on the user plane integrity protection is satisfied, the base station does not turn on the user plane integrity protection.
  • the condition that the foregoing base station does not enable the user plane integrity protection may be that the base station receives the first preset signaling plane message, for example, the registration request complete message or the service request completion message; and the base station may not be in the preset time period.
  • Receive user plane information or preset user plane information for example, session ID, QoS profile, or preset session ID, preset QoS profile; or the base station does not receive the terminal within the preset time period.
  • the device allocates the user plane resource or re-allocates the user plane resource request message to the terminal device, for example, the resource allocation request message; or the integrity protection indication information included in the security policy received by the base station indicates that the user plane integrity protection is not enabled;
  • the service type of the session may not be the service type of the preset session.
  • the pre-configured security policy may include the association between the preset service type and the user plane integrity protection, and the preset session is not received.
  • User plane integrity protection may not be enabled for the service type.
  • the user plane integrity protection key is not generated.
  • the method further includes:
  • the base station does not enable user plane encryption protection; or, the terminal device and the base station do not enable user plane encryption protection.
  • the base station When the condition that the base station does not enable user plane encryption protection is satisfied, the base station does not enable user plane encryption protection.
  • the condition that the base station does not enable the user plane encryption protection may be that the base station receives the first preset signaling plane message, for example, the registration request complete message or the service request completion message; and the base station may not receive the preset time period.
  • the user plane information or the preset user plane information for example, the session ID, the QoS profile, or the preset session ID, the preset QoS profile; or the base station does not receive the terminal device within the preset time period.
  • a request message for allocating a user plane resource or reallocating a user plane resource for the terminal device for example, a resource allocation request message; or the integrity protection indication information included in the security policy received by the base station indicates that the user plane encryption protection is not enabled;
  • the service type of the session is not the service type of the preset session.
  • the pre-configured security policy may include the association between the preset service type and the user plane encryption protection.
  • the user plane encryption key is not generated.
  • the following is an example of the terminal device not turning on user plane integrity protection as an example:
  • the terminal device When the condition that the terminal device does not turn on the user plane integrity protection is satisfied, the terminal device does not turn on the user plane integrity protection.
  • the condition that the terminal device does not enable the user plane integrity protection may be that the terminal device does not send the second preset user plane message, for example, the session establishment request message, in the preset time period;
  • the integrity protection indication information, and the integrity protection indication information indicates that the user plane integrity protection is enabled.
  • the terminal device may also receive the first preset signaling plane message within a preset time period, for example, the registration request complete message. Or service request completion message.
  • the user plane integrity protection key is not generated.
  • the user plane encryption key is not generated.
  • the terminal device When the condition that the terminal device does not enable the user plane encryption protection is satisfied, the terminal device does not enable the user plane encryption protection.
  • the condition that the terminal device does not enable the user plane encryption protection may be that the terminal device does not send the second preset user plane message, for example, the session establishment request message, in the preset time period; or the terminal device receives the encryption sent by the base station.
  • the indication information is protected, and the encryption protection indication information indicates that the user plane encryption protection is not turned on.
  • the user plane encryption key is not generated.
  • the user plane integrity protection mode is not enabled.
  • the user equipment integrity protection may be: the user plane integrity protection key is generated, but the user plane integrity protection key is not used for user plane integrity protection. . That is to say, when the user plane integrity protection is not turned on, the user plane integrity protection key can be formed, but the user plane integrity protection key is not used, and then the user plane is used in the case of turning on the user plane integrity protection.
  • the integrity protection key protects the user plane integrity.
  • the user plane integrity protection algorithm is obtained before the terminal device generates the user plane integrity protection key, for example, the signaling plane integrity protection algorithm can be used as the user plane integrity protection. algorithm.
  • the user plane integrity protection mode is not enabled.
  • the user equipment integrity protection may be: the user plane integrity protection key is generated, and the user plane integrity protection key is used for user plane integrity protection. That is to say, when it is impossible to determine whether to open the user plane integrity protection or to determine that the user plane integrity protection is not enabled, the user plane integrity protection key may not be generated, and the user plane integrity may be generated when the user plane integrity protection is turned on. Key.
  • the terminal device and the base station if it is determined that the terminal device and the base station do not always open the user plane integrity protection (for example, may be a preset condition, etc.), the user plane integrity protection key may not be generated.
  • the user plane integrity protection for example, may be a preset condition, etc.
  • the implementation manners in which the base station and the terminal device do not enable the integrity protection of the user plane may be the same or different.
  • the integrity protection mode of the user plane is not used, or the integrity protection of the user equipment is not used by the terminal device.
  • the base station uses the integrity protection mode 2 of the user plane.
  • the encryption protection mode of the user plane is not enabled.
  • the user equipment encryption protection is not enabled on the terminal device or the base station.
  • the user plane encryption protection key is generated, but the user plane encryption protection key is not used for user plane encryption protection. That is to say, when the user plane encryption protection is not enabled, the user can encrypt the protection key, but it is not used.
  • the user plane encryption protection key is used for user plane encryption protection.
  • the user plane encryption algorithm is obtained before the terminal device generates the user plane encryption protection key.
  • the signaling plane encryption algorithm can be used as the user plane encryption algorithm.
  • the encryption protection mode of the user plane is not enabled.
  • the user equipment or base station does not enable user plane encryption protection.
  • the user plane encryption protection key is generated when the user plane encryption protection is enabled, and the user plane encryption protection key is used for user plane encryption protection. That is to say, when it is impossible to determine whether the user plane encryption protection is enabled or the user plane encryption protection is not enabled, the user plane encryption protection key may not be generated, and the user plane integrity key is generated when the user plane encryption protection is enabled.
  • the terminal device and the base station if it is determined that the terminal device and the base station do not always enable user plane encryption protection (for example, may be a preset condition, etc.), the user plane encryption protection key may not be generated.
  • the implementation manner of the encryption protection of the user plane and the terminal device may be the same or different, for example, the encryption protection mode that does not enable the user plane is used, or the terminal device uses the encryption protection mode that does not enable the user plane.
  • the base station uses the encryption protection method 2 that does not open the user plane.
  • the base station and the terminal device have multiple implementation modes for enabling the user plane encryption protection.
  • the user plane encryption protection may be determined according to a preset rule. The preset requirement may be that the terminal device starts the user after receiving the AS security mode command. Face encryption protection, that is to say, satisfying the base station user plane encryption protection condition includes receiving the AS security mode command. Based on the example, for example, the user equipment integrity protection condition of the terminal device is met, and the terminal device receives the integrity protection indication information indicating that the user plane integrity protection is turned on, that is, the terminal device receives the AS security mode command. After the user plane integrity protection is enabled, the user plane integrity protection is required to notify the terminal device by sending the integrity protection indication information.
  • the terminal device does not enable the user without receiving the integrity protection indication information. Face integrity protection. Further, when the terminal device receives the integrity protection indication information indicating that the user plane integrity protection is turned on, the user plane integrity protection is turned on. In other words, the terminal device does not turn on the user plane integrity protection for a period of time, but it is possible to turn on the user plane integrity protection in another period of time, that is, the terminal device does not turn on the user plane integrity protection is temporary, which is temporary. It is different from the terminal device that does not always turn on user plane integrity protection.
  • the base station and the terminal device may further determine whether to enable signaling plane protection (including signaling plane integrity protection and/or signaling plane encryption protection) according to a preset rule, and the preset requirement may be that the terminal device receives the AS security mode. After the command, the signaling plane protection is enabled.
  • signaling plane protection including signaling plane integrity protection and/or signaling plane encryption protection
  • the terminal device or the base station turns on the signaling plane protection (turning on the signaling plane integrity protection and/or the signaling plane encryption protection)
  • the user plane encryption protection is enabled. That is to say, satisfying the base station user plane encryption protection condition includes enabling signaling plane protection.
  • the user plane encryption protection can be turned on together with the signaling plane protection, and the user plane integrity protection can be determined according to whether the base station user plane integrity protection condition is met or not.
  • the signaling plane protection opening the signaling plane integrity protection and/or the signaling plane encryption protection
  • the user plane encryption protection is enabled, and the user plane integrity protection is not enabled.
  • the above-described encryption indication information may not be provided.
  • the terminal device after the step 203 in FIG. 2, after the terminal device sends the AS security mode command to the terminal device, the terminal device enables the signaling plane protection to not open the user plane protection, and can generate a signaling plane key.
  • the signaling plane key is used for protection, and the user plane key can be saved. Use the user plane key again with user plane protection turned on.
  • the terminal device turns on the signaling plane protection, enables the user plane encryption protection, and does not enable the user plane integrity protection.
  • a signaling plane key (signaling plane integrity protection key and/or signaling plane encryption protection key), a user plane encryption key, and a user plane integrity protection key are generated.
  • the signaling plane key is used for protection, and the user plane encryption key is used for protection, and the user plane integrity protection key can be saved.
  • the user plane integrity protection key is used for integrity protection when user plane integrity protection is turned on.
  • the terminal device after the step 203 in FIG. 2, after the terminal device sends the AS security mode command to the terminal device, the terminal device enables the signaling plane protection to not open the user plane protection, and can generate a signaling plane key (signaling The face integrity protection key and/or the signaling plane encryption protection key) are protected by the signaling plane key, and no user plane key (user plane integrity protection key and/or user plane encryption protection key) is generated. ).
  • the request message in step 211 in FIG. 2b is a session establishment request
  • the base station after step 211, the base station sends an AS security mode command or an RRC reconfiguration message to the terminal device, and the terminal device receives the AS security mode command.
  • the user plane key is used for user plane security protection after the RRC reconfiguration message.
  • the terminal device turns on the signaling plane protection, enables the user plane encryption protection, and does not enable the user plane integrity protection.
  • a signaling plane key (signaling plane integrity protection key and/or a signaling plane encryption protection key) may be generated and protected using a signaling plane key to generate a user plane encryption key, and the user plane encryption key is used. The key is protected, but the user plane integrity protection key is not generated.
  • the request message in step 211 in FIG. 2b is a session establishment request
  • the base station sends an AS security mode command or an RRC reconfiguration message to the terminal device, and the terminal device receives the AS security mode command.
  • the user plane integrity protection key is generated, and the user plane integrity protection key is used for user plane security protection.
  • the terminal device may determine whether to complete the integrity protection of the user plane according to the integrity protection indication information sent by the received base station, and the terminal device may also determine whether to open the user plane integrity protection or not open the user plane integrity protection, and the following implementation manner C1 and embodiment c2 are introduced. Further, optionally, in order to save resources, if the terminal device determines that the integrity protection of the user plane is not enabled, the integrity protection algorithm of the user plane may not be sent, that is, in this optional implementation manner, An empty user plane integrity protection algorithm is sent, but if the terminal device does not enable encryption protection of the user plane, an empty user plane encryption algorithm is sent.
  • the integrity protection indication information, the encryption indication information, the signaling plane integrity protection indication information, and the signaling plane encryption indication sent by the base station to the terminal device At least one of the information may be carried in the preset message, such as predefining a field in the preset message, and carrying the integrity protection indication information, the encryption indication information, the signaling plane integrity protection indication information, and the predefined field in the preset message.
  • the signaling plane encrypts at least one of the indication information.
  • the preset message may be an AS security mode command or an RRC reconfiguration request.
  • the integrity protection indication information is transmitted to the terminal device in the form of an identifier of the algorithm shown by the following embodiment c1-1 (b7).
  • the integrity protection indication information, the encryption indication information, the signaling plane integrity protection indication information, and the signaling plane encryption indication information received by the base station are At least one item can be carried in the security policy, specifically c1-1(b2)-c1-1(b7).
  • the following describes various representations of integrity protection indication information and/or encryption indication information.
  • At least one of the integrity protection indication information, the encryption indication information, the signaling plane integrity protection indication information, and the signaling plane encryption indication information may be represented by setting a session ID in a predefined field. For example, when the base station does not receive the session ID, the session ID in the predefined field in the preset message sent to the terminal device is set to 0, which means that only the signaling plane protection is enabled, and the user plane integrity protection indication is not enabled. Information, user plane encryption indication information is not enabled. When the information of the session ID in the predefined field in the preset message received by the terminal device is 0, it may be determined that only the signaling plane protection is enabled (the signaling plane integrity protection is enabled and/or the signaling plane encryption protection is enabled). The user plane integrity protection indication information is not enabled, and the user plane encryption indication information is not enabled.
  • the signaling plane protection may be at least one of enabling signaling plane integrity protection and enabling signaling plane encryption protection, specifically opening signaling plane integrity protection, or enabling signaling plane encryption protection, or enabling signaling.
  • the face integrity protection and the signaling plane encryption protection can be determined according to preset rules, for example, the signaling plane integrity protection and the signaling plane encryption protection are enabled by default in the preset rule. The following is similar to the explanation in this paragraph and will not be repeated below.
  • the session ID in the predefined field in the preset message sent to the terminal device may be set as the current session ID.
  • the terminal device may enable user plane encryption protection and user plane integrity by default. protection.
  • the encryption algorithm of the signaling plane selected by the base station may also be used for the user plane, that is, the encryption algorithm selected by the base station is a signaling plane encryption algorithm and a user plane encryption algorithm, and similarly, the selected letter is selected.
  • the face integrity protection algorithm acts as a user plane integrity protection algorithm.
  • the terminal device may enable user plane integrity protection and/or The user plane encryption protection, whether the user plane encryption protection is enabled or the user plane integrity protection is enabled, or the user plane encryption protection and the user plane integrity protection are enabled, and the preset rules may be referred to, or may be described in other embodiments of the present application.
  • At least one of integrity protection indication information, encryption indication information, signaling plane integrity protection indication information, and signaling plane encryption indication information may be predefined in a preset message.
  • Set the relevant information of QoS in the field to indicate, for example, set the QFI value.
  • the usage of the QFI value may be similar to the manner in which the session ID is used. For example, when the base station does not receive the QFI, the QFI in the predefined field in the preset message sent to the terminal device is set to 0, indicating that only Enable the signaling plane protection.
  • the user plane integrity protection indication information is not enabled, and the user plane encryption indication information is not enabled.
  • the terminal device may determine that only the signaling plane protection is enabled, the user plane integrity protection indication information is not enabled, and the user plane encryption indication information is not enabled.
  • the integrity protection indication information and/or the encryption indication information may be represented by bit information in a predefined field in a preset message or a security policy, for example, 1 bit information may be included in a predefined field.
  • the one bit information in the predefined field is the integrity protection indication information.
  • the bit position in the predefined field is 1, which can be turned on.
  • User plane integrity protection; the bit position 0 in the predefined field can indicate that user plane integrity protection is not enabled.
  • the user plane integrity protection is not enabled and the user plane integrity protection is enabled
  • the one bit information in the predefined field is the encryption indication information.
  • the bit position in the predefined field is 1, The user plane encryption protection can be turned on.
  • the bit position 0 in the predefined field can indicate that the user plane encryption protection is not enabled.
  • user plane encryption protection is enabled and user plane integrity protection is enabled
  • one bit of information in the predefined field is integrity protection indication information and encryption indication information.
  • the bit position 1 in the predefined field may indicate that the user plane integrity protection is enabled and the user plane encryption protection is enabled.
  • the bit position 0 in the predefined field may indicate that the user plane integrity protection is not enabled and the user plane encryption protection is not enabled.
  • the integrity protection indication information and the encryption indication information may be represented by bit information in a preset message or a predefined field of the security policy.
  • the predefined field may include 2 pieces of information, where one bit information represents user plane encryption. Whether it needs to be turned on or off, another bit information represents whether the user plane integrity protection needs to be turned on or off, that is, one bit information is the encryption indication information, and the other bit information is the integrity protection indication information, For example, setting the bit information corresponding to the encryption indication information in the predefined field to 1 indicates that the user plane encryption protection is enabled; setting the bit information corresponding to the integrity protection indication information in the predefined field to 1 indicates that the terminal device opens the user plane integrity protection; Setting the bit information corresponding to the encryption indication information in the predefined field to 0 indicates that the user plane encryption protection is not enabled; setting the bit information corresponding to the integrity protection indication information in the predefined field to 0 indicates that the terminal device does not enable the user plane integrity protection.
  • Embodiment c1-1 (b4)
  • the integrity protection indication information and the encryption indication information may be represented by bit information in a predefined field in a preset message or a security policy, for example, four bits of information may be included in a predefined field, where one bit in the predefined field
  • the information indicates whether the user plane encryption protection is enabled. For example, if the bit information is set to 1, the user plane encryption protection is enabled, and 0 indicates that the user plane encryption protection is not enabled; a bit information in the predefined field indicates the length of the user plane encryption protection key. Is 128 bits or 256 bits.
  • the bit information is set to 1, indicating that the key length of the user plane encryption protection is 128 bits, and 0 means that the key length of the user plane encryption protection is 256 bits; one bit information in the predefined field Indicates whether the key length of the user plane integrity protection is 128 bits or 256 bits.
  • the bit information is set to 1, indicating that the key length of the user plane integrity protection is 128 bits, that is, generating a 32-bit MAC value, and setting 0 indicates that the user plane is complete.
  • the secret key length of the protection is 256 bits, that is, the 64-bit MAC value is generated; one bit information in the predefined field refers to The user plane integrity protection is turned on, for example, the bit information is set to 1, will indicate on the user plane integrity protection, set to 0 indicating the user plane integrity protection is not turned on.
  • the integrity protection indication information and/or the encryption indication information may be an example shown in the above-described embodiment c1-1 (b2), embodiment c1-1 (b3), and embodiment c1-1 (b4), and is bit information.
  • the integrity protection indication information and/or the encryption indication information may also be referred to as switch information.
  • the specific content of the switch information can be combined with a specific method. For example, if user plane encryption protection and user plane integrity protection are enabled; further, if the preset rule defines user plane encryption protection to be enabled by default, and user plane integrity protection needs to be flexibly determined, then only one bit can be carried in the preset field. Instructing information, the 1-bit indication information is used to indicate whether user plane integrity protection needs to be enabled; further, if the preset rule defines that the user plane encryption protection is not enabled before the integrity protection indication information and the encryption indication information are received, If the user plane integrity protection is not enabled, the 2-bit indication information may be carried in the preset field to indicate whether the user encryption protection is enabled and whether the user plane integrity protection is enabled.
  • the integrity protection indication information and/or the encryption indication information may be an identification of the algorithm.
  • the integrity protection indication information and/or the encryption indication information may be carried in a predefined field in a preset message or a security policy, or may be carried in a security policy.
  • the base station sends an identifier of the algorithm to the terminal device, and the identifier of the algorithm is used to indicate an algorithm, and the identifier of the algorithm is also integrity protection indication information and/or encryption indication information.
  • the AS SMC carried by the base station carries the numbers such as EIA and EEA in the LTE network to represent the selected integrity protection algorithm and encryption algorithm.
  • the integrity protection indication information, the encryption indication information, the signaling plane integrity protection indication information, and the signaling plane encryption indication information may be represented by a number carrying the EIA and the EEA. For example, the EIA number indicates that the integrity protection is turned on.
  • the identifier of the algorithm may be expanded into four preset fields, namely EIA-RRC, EEA-RRC, EIA-UP, EEA-UP, and the selected algorithm is put into the The corresponding location represents the method of this negotiation.
  • the identifier of the algorithm may not only indicate the integrity protection indication information, the encryption indication information, but also indicate the algorithm. That is to say, in the case of using the embodiment, the identifier of the sending algorithm can simultaneously indicate an algorithm (such as a target signaling plane integrity protection algorithm, a target signaling plane encryption algorithm, a target user plane integrity protection algorithm, and a target).
  • an algorithm such as a target signaling plane integrity protection algorithm, a target signaling plane encryption algorithm, a target user plane integrity protection algorithm, and a target).
  • User plane encryption algorithm as well as integrity protection indication information and encryption indication information.
  • the integrity protection indication information may be an identifier of the algorithm, for example, when the base station turns on the user plane integrity protection for the terminal device, the integrity protection The indication information may be an identification of the target user plane integrity protection algorithm.
  • the integrity protection indication information may be an identifier of the preset user plane integrity protection algorithm; or information that does not carry any integrity protection algorithm. That is, the identifier of the integrity protection algorithm is not sent or the identifier of the preset user plane integrity protection algorithm is sent, that is, the integrity protection indication information indicates that the integrity protection is not turned on. For example, suppose the identifier of the preset user plane integrity protection algorithm is X123. If the integrity protection indication information received by the terminal device is X123, the terminal device does not enable user plane integrity protection.
  • the base station may further send the encryption indication information to the terminal device, where the encryption indication information is used to indicate whether the base station enables user plane encryption protection for the terminal device.
  • the encryption indication information may be an identifier of the algorithm.
  • the encryption indication information is an identifier of the target user plane encryption algorithm.
  • the encryption indication information may preset the identifier of the user plane encryption algorithm, or be a null encryption algorithm. That is to say, the identifier of any encryption algorithm is not sent or the null encryption algorithm is sent or the identifier of the preset user plane encryption algorithm is sent, that is, the encryption indication information indicates that the encryption protection is not turned on. For example, suppose the identifier of the preset user plane encryption algorithm algorithm is X321. If the encryption protection indication information received by the terminal device is X321, the terminal device does not enable user plane encryption protection.
  • the base station may further send signaling plane integrity protection indication information to the terminal device, where the signaling plane integrity protection indication information is used. Indicates whether the base station enables signaling plane integrity protection for the terminal device.
  • the signaling plane integrity protection indication information may be an identifier of the algorithm.
  • the signaling plane integrity protection indication information is a target signaling plane integrity protection algorithm. logo.
  • the signaling plane integrity protection indication information may be an identifier of the preset signaling plane integrity protection algorithm, or does not carry any integrity. Protection algorithm information. For example, if the identifier of the preset signaling plane integrity protection algorithm is X456, if the signaling plane integrity protection indication information received by the terminal device is X456, the terminal device does not enable signaling plane integrity protection.
  • the base station may further send signaling plane encryption indication information to the terminal device, where the signaling plane encryption indication information is used to indicate whether the base station is The terminal device turns on signaling plane encryption protection.
  • the signaling plane encryption indication information may It is an identifier of the algorithm.
  • the signaling plane encryption indication information is an identifier of the target signaling plane encryption algorithm.
  • the signaling plane encryption indication information may preset the identifier of the signaling plane encryption algorithm, or be a null encryption algorithm. For example, suppose the identifier of the preset signaling plane encryption algorithm algorithm is X654. If the signaling plane encryption protection indication information received by the terminal device is X654, the terminal device does not enable signaling plane encryption protection.
  • the integrity protection indication information and/or the encryption indication information may be the session ID and the 4-bit information in the predefined field in the preset message or the security policy, and the terminal device needs to enable the corresponding user plane under the session ID according to the bit information.
  • Security for example, if the terminal device has multiple session IDs, the user plane security scheme corresponding to each session ID may be different. For example, a session ID corresponds to enabling user plane integrity protection and enabling user plane encryption protection. The other session ID may correspond to not opening the user plane integrity protection and enabling the user plane encryption protection.
  • Embodiment c1-1 (b7)
  • the integrity protection indication information and/or the encryption indication information may be an identifier of a session ID and an algorithm in a predefined field in a preset message or security policy.
  • the implementation manner of the identifier of the algorithm and the 4-bit information is a more flexible manner, because it can be clear whether the user plane encryption protection is enabled, and whether the user name integrity protection is Open.
  • the bit information can reuse (multiplex) the negotiated signaling plane algorithm (that is, the algorithm applicable to the signaling plane is also applicable to the user plane, such as the determined target signaling plane.
  • the integrity protection algorithm is also used as the target user plane integrity protection algorithm, and the determined target signaling plane encryption algorithm is also used as the target user plane encryption algorithm.
  • the algorithm identifier can implement the signaling plane algorithm and the user plane security algorithm differently. For example, the signaling plane encryption algorithm is different from the user plane encryption algorithm, and the signaling plane integrity protection algorithm is different from the user plane integrity protection algorithm.
  • the integrity protection indication information and/or the encryption indication information may be carried in the RRC reconfiguration request message and sent by the base station to the terminal device.
  • the user plane integrity protection is not enabled, but the current terminal device determines to enable user plane integrity protection.
  • the RRC reconfiguration request message may be only transmitted. Integrity protection instructions are sufficient.
  • the base station may generate and send the integrity protection indication information to the terminal device.
  • the base station after receiving the integrity protection indication information and the encryption indication information, the base station generates new indication information (the new indication information).
  • the integrity indication information may only be included, and the new indication information is further carried in the RRC reconfiguration request.
  • the integrity protection indication information and the encryption indication information may be from the N2 interface, and may be changed when the interface is sent. Therefore, the base station needs to indicate the integrity protection indication information to be carried according to the format in the RRC reconfiguration request message. Or encrypt the indication information to do some corresponding processing.
  • the base station may directly forward the integrity protection indication information and/or the encryption indication information to the terminal device.
  • the base station is the identifier of the algorithm according to the integrity protection indication information and/or the encryption indication information.
  • the base station may be obtained according to the The base station receives the integrity protection indication information and/or the encryption indication information that is determined by the base station, determines the identifier of the corresponding target algorithm, and sends the identifier of the corresponding target algorithm to the terminal device. For example, if the base station turns on user plane integrity protection, the target user plane integrity protection algorithm is determined, and the identifier of the target user plane integrity protection algorithm is sent to the terminal device, and the terminal device can open the user plane when received. Sex protection algorithm and user plane integrity protection using target user plane integrity protection algorithm.
  • the integrity protection indication information and/or the encryption indication information may be carried in the RRC reconfiguration request message and sent by the base station to the terminal device.
  • the integrity protection indication information and/or the encryption indication information is an identifier of the algorithm
  • the identifier of the algorithm may be carried in the RRC message.
  • the integrity protection indication information and/or the encryption indication information may be a list of algorithms.
  • the algorithm in the algorithm list corresponding to the integrity protection indication information and/or the encryption indication information is an integrity protection algorithm, and the integrity protection algorithm is not a null algorithm, and the base station determines the user plane integrity supported by the terminal device.
  • the protection algorithm, the user plane integrity protection algorithm allowed by the base station, and the algorithm in the algorithm list corresponding to the integrity protection indication information and/or the encryption indication information, the three do not intersect; the base station can select a user plane that is supported by the terminal device.
  • the integrity protection algorithm is also the user plane integrity protection algorithm allowed by the base station as the target user plane integrity protection algorithm. If the algorithm in the algorithm list corresponding to the integrity protection indication information and/or the encryption indication information is an empty algorithm, the base station does not select the target user plane integrity protection algorithm, and can be understood as not opening the user plane integrity protection.
  • the base station determines the user plane encryption algorithm supported by the terminal device, The user plane encryption algorithm allowed by the base station and the algorithm in the algorithm list corresponding to the integrity protection indication information and/or the encryption indication information do not intersect; the base station may select a user plane encryption algorithm supported by the terminal device, and The user plane encryption algorithm allowed by the base station is used as the target user plane encryption algorithm. If the algorithm in the algorithm list corresponding to the integrity protection indication information and/or the encryption indication information is a null encryption algorithm, the base station may select a null encryption algorithm as the target user plane encryption algorithm, which may be understood as not opening the user plane encryption protection.
  • the integrity protection indication information and/or the encryption indication information when the integrity protection indication information and/or the encryption indication information is an identifier of the algorithm, the integrity protection indication information and/or the encryption indication information may be an algorithm list, and an algorithm may be selected from the algorithm list. If the selected algorithm is an integrity protection algorithm, and the selected integrity protection algorithm is a preset integrity protection algorithm, optionally, the base station checks the selection before forwarding the selected integrity protection algorithm to the terminal device. Whether the integrity protection algorithm is both a user plane integrity protection algorithm supported by the terminal device and a user plane integrity protection algorithm allowed by the base station; if yes, the selected integrity protection algorithm is used as the target user plane integrity protection The algorithm is sent to the terminal device.
  • the selected integrity protection algorithm does not satisfy the user plane integrity protection algorithm supported by the terminal device and the condition of the user plane integrity protection algorithm allowed by the base station, and the selected integrity protection algorithm is not empty.
  • the algorithm, the base station selects a user plane integrity protection algorithm supported by the terminal device, and the algorithm of the user plane integrity protection algorithm allowed by the base station is sent to the terminal device as the target user plane integrity protection algorithm.
  • the selected integrity protection algorithm does not satisfy the user plane integrity protection algorithm supported by the terminal device and the condition of the user plane integrity protection algorithm allowed by the base station, and the selected integrity protection algorithm is empty.
  • the algorithm, the base station does not select the target user plane integrity protection algorithm, can be understood as not opening the user plane integrity protection.
  • the selected algorithm is an encryption algorithm
  • the selected encryption algorithm is a preset encryption algorithm
  • the base station forwards the selected encryption algorithm to the terminal device, Check whether the selected encryption algorithm is both a user plane encryption algorithm supported by the terminal device and a user plane encryption algorithm allowed by the base station; if yes, the selected encryption algorithm is sent to the terminal device as a target user plane encryption algorithm.
  • the base station selects one that is both The user plane encryption algorithm supported by the terminal device is also the algorithm of the user plane encryption algorithm allowed by the base station as the target user.
  • the face encryption algorithm is sent to the terminal device.
  • the selected encryption algorithm does not satisfy the condition that both the user plane encryption algorithm supported by the terminal device and the user plane encryption algorithm allowed by the base station, and the selected encryption algorithm is a null algorithm, the base station does not select the target.
  • the user plane encryption algorithm can be understood as not enabling user plane encryption protection.
  • the integrity protection indication information and/or the encryption indication information in the embodiment of the present application may be carried in an AS security mode command and sent to the terminal device by using the base station.
  • the signaling plane integrity protection indication information and/or the signaling plane encryption indication information may also be carried in the AS security mode command, and sent to the terminal device by using the base station.
  • the terminal device may verify the integrity protection of the AS security mode command before the terminal device turns on the user plane integrity protection.
  • the base station uses the user plane integrity protection algorithm to perform integrity protection on the AS security mode command.
  • the base station may determine, according to the security policy, that the user plane integrity protection is enabled, and the user plane integrity protection algorithm is used to perform integrity protection on the AS security mode command.
  • the terminal device uses the user plane integrity protection algorithm to verify whether the integrity protection of the AS security mode command is correct. For example, after detecting that the user plane integrity protection is activated, the terminal device uses the user plane integrity protection algorithm to verify whether the integrity protection of the AS security mode command is correct; the user plane integrity protection algorithm is not excluded as the currently used AS signaling plane. Integrity protection algorithm.
  • the base station receives the AS security mode end message replied by the terminal device.
  • the base station uses a user plane integrity protection algorithm to verify the integrity protection of the AS security mode end message.
  • the base station after detecting the integrity protection parameter MAC-I in the AS security mode end message, the base station performs integrity protection verification on the AS security mode end message; it is not excluded that the user plane integrity protection algorithm is currently used. AS signaling plane integrity protection algorithm.
  • the base station after receiving the security mode end message, the base station correspondingly opens the user plane integrity protection (for example, the integrity indication information and the encryption indication information indicate that the user plane integrity protection is enabled, and the user plane encryption protection is not enabled, the base station may User plane integrity protection is enabled after receiving the security mode end message, and user plane encryption protection is not enabled.
  • the base station may send an RRC reconfiguration request message to the terminal device after the corresponding user plane integrity protection is enabled; and further optionally, the terminal device returns an RRC reconfiguration complete message to the base station.
  • the integrity protection indication information when the user plane integrity protection is enabled, may be carried in the AS security mode command, and then the AS security mode command is carried in the RRC reconfiguration request message and passed.
  • the base station transmits to the terminal device.
  • at least one of the encryption indication information, the signaling plane integrity protection indication information, and the signaling plane encryption indication information may also be carried in the AS security mode command, and then the AS security mode command is carried in the RRC reconfiguration.
  • the request message is sent to the terminal device through the base station.
  • FIG. 3 exemplarily shows a schematic structural diagram of a base station provided by the present application.
  • the present application provides a base station 300 for performing any of the above methods.
  • the base station 300 includes a processor 301, a transceiver 302, a memory 303, and a communication interface 304; wherein the processor 301, the transceiver 302, the memory 303, and the communication interface 304 are connected to one another via a bus 305.
  • the bus 305 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 3, but it does not mean that there is only one bus or one type of bus.
  • the memory 303 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory.
  • RAM random-access memory
  • non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 303 may also include a combination of the above types of memories.
  • the communication interface 304 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface
  • it can be an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a WLAN interface.
  • the processor 301 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 301 may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 303 can also be used to store program instructions, and the processor 301 calls the program instructions stored in the memory 303 to perform one or more steps in the embodiment shown in the above scheme, or an optional implementation thereof.
  • the base station 300 implements the functions of the base station in the above method.
  • the processor 301 is configured to control the transceiver 302 to perform signal reception and signal transmission according to an instruction to perform memory storage.
  • the base station 300 can be configured to perform the following scheme.
  • the processor 301 is configured to obtain a security policy, where the security policy includes integrity protection indication information, where the integrity protection indication information is used to indicate whether the base station turns on integrity protection for the terminal device, and when the integrity protection indication information indicates that the base station turns on the terminal device.
  • the target user plane integrity protection algorithm is determined; the transceiver 302 is configured to send the target user plane integrity protection algorithm to the terminal device.
  • the security policy can flexibly select whether to enable the integrity protection for the terminal device, and only when the integrity protection is enabled for the terminal device, the base station sends the target user plane integrity protection algorithm to the terminal device.
  • the security algorithm improves the flexibility of the user plane security algorithm and the signaling plane security algorithm.
  • the integrity protection indication information is added, the target user plane integrity protection algorithm of the terminal device is improved. flexibility.
  • the transceiver 302 is configured to: send, by using radio resource control, RRC signaling, a target user plane integrity protection algorithm to the terminal device.
  • RRC signaling by using radio resource control, RRC signaling, a target user plane integrity protection algorithm.
  • the processor 301 is specifically configured to: determine a target user plane integrity protection algorithm according to a user plane integrity protection algorithm supported by the terminal device and a user plane integrity protection algorithm allowed by the base station.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm sorted according to priority; or the user plane integrity protection algorithm supported by the terminal device is a user plane integrity protection algorithm sorted according to priority .
  • the security policy further includes a user plane integrity protection algorithm allowed by the service network; the processor 301 is configured to: according to a user plane integrity protection algorithm allowed by the base station, a user plane integrity protection algorithm supported by the terminal device, and a service The user plane integrity protection algorithm allowed by the network determines the target user plane integrity protection algorithm.
  • the user plane integrity protection algorithm allowed by the service network is a user plane integrity protection algorithm sorted according to priority.
  • the processor 301 is further configured to: when the security policy further includes the encryption indication information, and the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device, sending, by the transceiver 302, the target user plane encryption algorithm to the terminal device. Or, when the security policy further includes the key length, the key length is sent to the terminal device through the transceiver 302; or when the security policy further includes the DH indication information, and the DH indication information is used to indicate that the base station turns on the DH to the terminal device. The DH related key is transmitted to the terminal device through the transceiver 302.
  • the transceiver 302 is configured to: receive a service quality of the current session of the terminal device from the session management function SMF entity, and the processor 301 is further configured to: use, according to at least one of the security policy and the service quality, the terminal The device allocates a target wireless data bearer.
  • the processor 301 is further configured to: according to the at least one of the security policy and the QoS, the specific manner of allocating the target wireless data bearer to the terminal device, refer to the content in the foregoing method embodiment, and details are not described herein again.
  • the processor 301 is configured to: create a target wireless data bearer for the terminal device according to at least one of a security policy and a quality of service.
  • the transceiver 302 is configured to: receive the security policy from the SMF entity; or receive the identifier of the security policy from the SMF entity, and obtain the security policy according to the identifier of the security policy.
  • the processor 301 is further configured to: obtain a signaling plane security algorithm supported by the terminal device; determine a target signaling plane security according to a signaling plane security algorithm supported by the terminal device, and a signaling plane security algorithm allowed by the base station.
  • the algorithm 302 is further configured to: carry the target signaling plane security algorithm in the access layer AS security mode command SMC and send the signal to the terminal device.
  • FIG. 4 exemplarily shows a schematic structural diagram of an SMF entity provided by the present application.
  • the present application provides an SMF entity 400 for performing any of the above methods.
  • the SMF entity 400 includes a processor 401, a transceiver 402, a memory 403, and a communication interface 404; wherein the processor 401, the transceiver 402, the memory 403, and the communication interface 404 are connected to one another via a bus 405.
  • the bus 405 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 4, but it does not mean that there is only one bus or one type of bus.
  • the memory 403 may include a volatile memory such as a random-access memory (RAM); the memory may also include a non-volatile memory such as a flash memory.
  • RAM random-access memory
  • the memory may also include a non-volatile memory such as a flash memory.
  • a hard disk drive (HDD) or a solid-state drive (SSD); the memory 403 may also include a combination of the above types of memories.
  • the communication interface 404 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a WLAN interface.
  • the processor 401 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • the processor 401 may further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 403 can also be used to store program instructions, and the processor 401 calls the program instructions stored in the memory 403, and can perform one or more steps in the embodiment shown in the above scheme, or an optional implementation thereof.
  • the SMF entity 400 implements the functions of the SMF entity in the above method.
  • the processor 401 is configured to control the transceiver 402 for signal reception and signal transmission according to instructions for executing the memory storage.
  • the SMF entity 400 can be used to perform the following scheme.
  • the transceiver 402 is configured to receive a request message, where the request message includes related parameters of the security policy, and send the security to the base station.
  • the identifier of the full policy or the security policy; the processor 401 is configured to obtain the identifier of the security policy or the security policy according to the relevant parameter of the security policy, where the security policy includes integrity protection indication information, and the integrity protection indication information is used to indicate the base station Whether to enable integrity protection for the terminal device.
  • the security algorithm of the user plane is separately negotiated, the flexibility of separately determining the user plane security algorithm and the signaling plane security algorithm is improved, and on the other hand, the target user of the terminal device is improved by adding the integrity protection indication information.
  • the flexibility of the face integrity protection algorithm since the security algorithm of the user plane is separately negotiated, the flexibility of separately determining the user plane security algorithm and the signaling plane security algorithm is improved, and on the other hand, the target user of the terminal device is improved by adding the integrity protection indication information. The flexibility of the face integrity protection algorithm.
  • the relevant parameters of the security policy include at least one of an identifier of the terminal device, a data network name DNN of the terminal device, an identifier of the slice of the terminal device, a quality of service of the terminal device, and a session identifier of the terminal device.
  • the security policy can be formulated from different angles or granularities according to different identifiers, and is more flexible.
  • the processor 401 is configured to: the related parameter of the security policy includes an identifier of the terminal device, and the SMF entity obtains a security policy according to the association between the identifier of the terminal device and the security policy, and the identifier of the terminal device, so that the terminal can be implemented in the terminal.
  • the determination of the security policy on the granularity of the device enables different terminal devices to correspond to different security policies.
  • the processor 401 is configured to: the related parameter of the security policy includes an identifier of the slice of the terminal device, and the SMF entity determines the association between the identifier of the slice and the security policy, and the identifier of the slice of the terminal device.
  • the security policy is obtained, so that the security policy at the granularity of the slice can be determined, and the terminal device that accesses different slices can be configured to correspond to different security policies.
  • the processor 401 is configured to: the related parameter of the security policy includes a session identifier of the terminal device, and the SMF entity obtains the security policy according to the association relationship between the session identifier and the security policy and the session identifier of the terminal device. Therefore, the determination of the security policy at the granularity of the session can be implemented, and the terminal device that initiates different sessions can be configured to correspond to different security policies.
  • the processor 401 is configured to: the related parameter of the security policy includes a quality of service of the terminal device; and the SMF entity obtains a security policy according to the quality of service of the terminal device, so that the granularity of the quality of service can be achieved.
  • the determination of the security policy on the device enables the terminal devices that initiate different quality of service to correspond to different security policies.
  • the security policy further includes: at least one of the following: the encryption indication information, where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device; the key length; the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH; and, the user plane integrity protection algorithm allowed by the service network.
  • the encryption indication information where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device
  • the key length the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH
  • the user plane integrity protection algorithm allowed by the service network the security policy can be more flexibly indicated, so that the final determined security policy is more suitable for complex application scenarios.
  • FIG. 5 is a schematic structural diagram of a base station according to an embodiment of the present application.
  • the embodiment of the present application provides a base station, which is used to perform any one of the foregoing method flows.
  • the base station 500 includes a receiving unit 501, a processing unit 502, and a transmitting unit 503.
  • the processing unit 502 is configured to obtain a security policy, where the security policy includes integrity protection indication information, where the integrity protection indication information is used to indicate whether the base station enables integrity protection for the terminal device, and the integrity protection indication information indicates that the base station turns on the terminal device.
  • the target user plane integrity protection algorithm is sent to the terminal device by the sending unit 503, and the sending unit 503 is configured to send the target user plane integrity protection algorithm to the terminal device.
  • the security policy can flexibly select whether to enable the integrity protection for the terminal device, and only when the integrity protection is enabled for the terminal device, the base station sends the target user plane integrity protection algorithm to the terminal device.
  • the security algorithm improves the flexibility of the user plane security algorithm and the signaling plane security algorithm.
  • the integrity protection indication information is added, the target user plane integrity protection algorithm of the terminal device is improved. flexibility.
  • the sending unit 503 is configured to: send, by using radio resource control RRC signaling, a target user plane integrity protection algorithm to the terminal device.
  • RRC signaling radio resource control
  • the processing unit 502 is further configured to: according to the user plane integrity protection algorithm supported by the terminal device and the user plane integrity protection allowed by the base station, before sending the target user plane integrity protection algorithm to the terminal device by using the sending unit 503. Algorithm to determine the target user plane integrity protection algorithm.
  • the user plane integrity protection algorithm allowed by the base station is a user plane integrity protection algorithm sorted according to priority; or the user plane integrity protection algorithm supported by the terminal device is a user plane integrity protection algorithm sorted according to priority .
  • the security policy further includes a user plane integrity protection algorithm allowed by the service network; the processing unit 502 is configured to: according to the user plane integrity protection algorithm allowed by the base station, the user plane integrity protection algorithm supported by the terminal device, and the service The user plane integrity protection algorithm allowed by the network determines the target user plane integrity protection algorithm.
  • the user plane integrity protection algorithm allowed by the service network is a user plane integrity protection algorithm sorted according to priority.
  • the processing unit 502 is further configured to: when the security policy further includes the encryption indication information, and the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device, the sending unit 503 sends the target user plane encryption algorithm to the terminal device. Or, when the security policy further includes the key length, the key length is sent to the terminal device by the sending unit 503; or when the security policy further includes the DH indication information, and the DH indication information is used to indicate that the base station turns on the DH to the terminal device. The DH related key is transmitted to the terminal device through the transmitting unit 503.
  • the receiving unit 501 is configured to: before the sending the target user plane integrity protection algorithm to the terminal device by using the sending unit 503, to: receive the quality of service of the current session of the terminal device from the session management function SMF entity; the processing unit 502 And being further configured to: allocate a target wireless data bearer to the terminal device according to at least one of a security policy and a quality of service.
  • the processing unit 502 is further configured to: according to the at least one of the security policy and the QoS, the specific manner of allocating the target wireless data bearer to the terminal device, refer to the content in the foregoing method embodiment, and details are not described herein again.
  • the processing unit 502 is configured to: create a target wireless data bearer for the terminal device according to at least one of a security policy and a quality of service.
  • the receiving unit 501 is configured to: receive a security policy from the SMF entity; or: receive an identifier of the security policy from the SMF entity, and obtain a security policy according to the identifier of the security policy.
  • the processing unit 502 is further configured to: obtain a signaling plane security algorithm supported by the terminal device; determine the target signaling plane security according to the signaling plane security algorithm supported by the terminal device, and the signaling plane security algorithm allowed by the base station.
  • the sending unit 503 is further configured to: send the target signaling plane security algorithm to the terminal device in the access layer AS security mode command SMC.
  • the receiving unit 501 and the sending unit 503 may be implemented by the transceiver 302, and the processing unit 502 may be implemented by the processor 301.
  • the base station 300 can include a processor 301, a transceiver 302, and a memory 303.
  • the memory 303 can be used to store the code when the processor 301 executes the solution, and the code can be a program/code pre-installed when the base station 300 is shipped.
  • FIG. 6 exemplarily shows a schematic structural diagram of an SMF entity provided by an embodiment of the present application.
  • the embodiment of the present application provides an SMF entity, which is used to perform any one of the foregoing method flows.
  • the SMF entity 600 includes a receiving unit 601, a processing unit 602, and optionally, a transmitting unit 603.
  • the receiving unit 601 is configured to receive a request message, where the request message includes a related parameter of the security policy, and send an identifier of the security policy or the security policy to the base station, where the processing unit 602 is configured to obtain the security policy or the security policy according to the relevant parameter of the security policy.
  • the security policy includes integrity protection indication information, and the integrity protection indication information is used to indicate whether the base station turns on integrity protection for the terminal device.
  • the relevant parameters of the security policy include at least one of an identifier of the terminal device, a data network name DNN of the terminal device, an identifier of the slice of the terminal device, a quality of service of the terminal device, and a session identifier of the terminal device.
  • the security policy can be formulated from different angles or granularities according to different identifiers, and is more flexible.
  • the processing unit 602 is configured to: the related parameter of the security policy includes an identifier of the terminal device, and the SMF entity obtains a security policy according to the association between the identifier of the terminal device and the security policy, and the identifier of the terminal device, so that the terminal can be implemented in the terminal.
  • the determination of the security policy on the granularity of the device enables different terminal devices to correspond to different security policies.
  • the processing unit 602 is configured to: the related parameter of the security policy includes an identifier of the slice of the terminal device, and the association between the identifier of the slice and the security policy of the SMF entity, and the identifier of the slice of the terminal device, The security policy is obtained, so that the security policy at the granularity of the slice can be determined, and the terminal device that accesses different slices can be configured to correspond to different security policies.
  • the processing unit 602 is configured to: the related parameter of the security policy includes a session identifier of the terminal device, and the SMF entity obtains the security policy according to the association relationship between the session identifier and the security policy and the session identifier of the terminal device. Therefore, the determination of the security policy at the granularity of the session can be implemented, and the terminal device that initiates different sessions can be configured to correspond to different security policies.
  • the processing unit 602 is configured to: the related parameter of the security policy includes a quality of service of the terminal device; and the SMF entity obtains a security policy according to the quality of service of the terminal device, so that the granularity of the quality of service can be achieved.
  • the determination of the security policy on the device enables the terminal devices that initiate different quality of service to correspond to different security policies.
  • the security policy further includes: at least one of the following: the encryption indication information, where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device; the key length; the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH; and, the user plane integrity protection algorithm allowed by the service network.
  • the encryption indication information where the encryption indication information is used to indicate that the base station turns on the encryption protection for the terminal device
  • the key length the DH indication information, where the DH indication information is used to indicate the base station to the terminal The device turns on DH
  • the user plane integrity protection algorithm allowed by the service network the security policy can be more flexibly indicated, so that the final determined security policy is more suitable for complex application scenarios.
  • the receiving unit 601 and the sending unit 603 may be implemented by the transceiver 402, and the processing unit 602 may be implemented by the processor 401.
  • the SMF entity 400 can include a processor 401, a transceiver 402, and a memory 403.
  • the memory 403 can be used to store the code when the processor 401 executes the solution, and the code can be a program/code pre-installed by the SMF entity 400 at the factory.
  • Computer program The product includes one or more instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the instructions may be stored on a computer storage medium or transferred from one computer storage medium to another computer storage medium, for example, instructions may be wired from a website site, computer, server or data center (eg, coaxial cable, fiber optic, digital user) Line (DSL) or wireless (eg infrared, wireless, microwave, etc.) transmission to another website site, computer, server or data center.
  • the computer storage medium can be any available media that can be accessed by the computer or a data storage device such as a server, data center, or the like, including one or more available media.
  • Usable media can be magnetic media (eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical media (eg, CD, DVD, BD, HVD, etc.), or semiconductor media (eg, ROM, EPROM, EEPROM, Non-volatile memory (NAND FLASH), solid state disk (SSD), etc.
  • magnetic media eg, floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.
  • optical media eg, CD, DVD, BD, HVD, etc.
  • semiconductor media eg, ROM, EPROM, EEPROM, Non-volatile memory (NAND FLASH), solid state disk (SSD), etc.
  • embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowcharts and/or block diagrams, and combinations of flow and/or blocks in the flowcharts and/or ⁇ RTIgt; These instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine such that instructions executed by a processor of a computer or other programmable data processing device are utilized for implementation A means of function specified in a flow or a flow and/or a block diagram of a block or blocks.
  • the instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种通信方法以及相关装置，基站获取安全策略，所述安全策略包括完整性保护指示信息，所述完整性保护指示信息用于指示所述基站是否对终端设备开启完整性保护；当所述完整性保护指示信息指示所述基站对所述终端设备开启完整性保护时，所述基站向所述终端设备发送目标用户面完整性保护算法。

Description

一种通信方法及相关装置
本申请要求在2017年05月05日提交中国专利局、申请号为PCT/CN2017/083362、发明名称为“一种通信方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种通信方法及相关装置。
背景技术
在长期演进(Long Term Evolution，LTE)系统中，终端设备和基站之间执行加密/解密和完整性保护的安全操作，对信令提供加密保护和完整性保护。由于不同终端设备的安全能力不同，例如，所支持的加密算法或完整性保护算法不同，因此在接入层(Access Stratum，AS)进行加密保护和完整性保护之前，需要在终端设备和基站间协商一套安全算法。协商安全算法的过程包括以下步骤：
1、终端设备通过基站向移动性管理实体(Mobility Management Entity，MME)发送附着请求；其中，附着请求中携带终端设备支持的算法。
2、基站根据预配置的服务网络允许使用的算法，并结合MME转发的终端设备支持的算法，选择服务网络所支持的安全算法。该安全算法包括加密算法和完整性保护算法。基站根据选择的加密算法生成AS的加密秘钥，根据完整性保护算法生成完整性保护密钥。其中，基站选择出的服务网络所支持的安全算法既是用户面的安全算法，也是应用于信令面的安全算法。
3、基站和终端设备通过AS安全模式命令(Security mode command，SMC)的流程使终端设备将基站选择出的安全算法应用于用户面和信令面。比如，将基站选择的加密算法和完整性保护算法携带在AS SMC中发送给终端设备。
现有技术中通过AS SMC流程确定出同时应用于用户面和信令面的一种安全算法，且安全算法包括加密算法和完整性保护算法，这种安全算法的协商方案较为固定，比如用户面和信令面适用同一套安全算法，不能拆分，再比如加密算法和完整性保护算法必须同时确定出，也不能拆分，可见这种安全协商算法较为固定，并不能适应现在灵活多变的应用场景。
发明内容
本申请实施例提供一种通信方法、相关装置及存储介质，用于能够灵活的单独协商用户面完整性保护算法的方案。
第一方面，本申请实施例提供一种通信方法，包括：基站获取安全策略，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护；当完整性保护指示信息指示基站对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法。如此，可根据安全策略灵活的为终端设备选择是否开启完整性保护，且仅在对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法，一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的 目标用户面完整性保护算法确定的灵活性。
可选地，所述完整性保护指示信息为用户面完整性保护算法的标识。也就是说若确定安全策略中携带用户面完整性保护算法的标识，则可确定基站对终端设备开启完整性保护。该实施例中安全策略中携带的用户面完整性保护算法的标识可以为一个或多个(可以称为算法列表)，该实施例中安全策略中携带的用户面完整性保护算法可以是根据服务网络允许的用户面完整性保护算法、终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法中的至少一项确定的；也可以说安全策略中携带的的用户面完整性保护算法是服务网络允许的用户面完整性保护算法。
可选地，基站获取安全策略可以是基站从其它网元接收安全策略，也可以是基站从预先存储在基站的至少一个安全策略中确定出安全策略。预先存储在基站侧的安全策略也可以成为预先配置在基站侧的安全策略。基站从预先存储在基站的至少一个安全策略中获取安全策略的方式有多种，比如可根据终端标识与预存储在基站的安全策略的对应关系，确定出终端设备的标识对应的且存储在基站的安全策略；再比如，可以根据会话标识与预存储在基站的安全策略的对应关系，确定出会话标识对应的且存储在基站的安全策略；方案可以与SMF实体获取安全策略的方案类似，在此不再赘述。
可选地，基站向终端设备发送目标用户面完整性保护算法，包括：基站通过RRC信令向终端设备发送目标用户面完整性保护算法。通过复用现有技术中的RRC信令的方式实现本申请实施例提供的方案，从而更好的兼容现有技术，且对现有技术改动较小。
一种可选地实现基站向终端设备发送目标用户面完整性保护算法的方式中，基站向终端设备发送目标信令面完整性保护算法，终端设备将接收到的目标信令面完整性保护算法也确定为目标用户面完整性保护算法，也就是说基站向终端设备发送完整性保护算法，该完整性保护算法既是信令面完整性保护算法也是用户面完整性保护算法。
可选地，在基站向终端设备发送目标用户面完整性保护算法之前，方法还包括：基站根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法。如此可既考虑终端设备的安全能力也考虑基站的安全能力，从而使确定出的目标用户面完整性保护算法同时与终端设备的安全能力和基站的安全能力匹配。
可选地，基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，如此可以选择出在基站侧更优的目标用户面完整性保护算法。或者，可选地，终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，如此可以选择出在终端设备侧更优的目标用户面完整性保护算法。
可选地，安全策略还包括服务网络允许的用户面完整性保护算法；基站根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法，包括：基站根据基站允许的用户面完整性保护算法，终端设备支持的用户面完整性保护算法，以及服务网络允许的用户面完整性保护算法，确定目标用户面完整性保护算法，如此可既考虑终端设备的安全能力也考虑基站的安全能力，同时还考虑到服务网络的实际状态，从而使确定出的目标用户面完整性保护算法一方面可与终端设备的安全能力和基站的安全能力匹配，另一方面与服务网络的实际状态更加匹配。
可选地，在安全策略还包括服务网络允许的用户面完整性保护算法的情况下，基站也可以将安全策略中所包括的服务网络允许的用户面完整性保护算法之外的算法确定为目 标用户面完整性保护算法。比如可以从基站允许的用户面完整性保护算法中确定出一个算法作为目标用户面完整性保护算法。
可选地，服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，如此可以选择出基于服务网络的更优的目标用户面完整性保护算法。
可选地，方法还包括：当安全策略还包括加密指示信息，且加密指示信息用于指示基站对终端设备开启加密保护时，基站向终端设备发送目标用户面加密算法；或者，当安全策略还包括密钥长度时，基站向终端设备发送密钥长度；或者，当安全策略还包括D-H指示信息，且D-H指示信息用于指示基站对终端设备开启D-H时，基站向终端设备发送D-H相关密钥。如此，可以更加灵活的对安全策略中的任一个信息进行指示，使最终确定的安全策略更加适应复杂的应用场景。
可选地，在基站向终端设备发送目标用户面完整性保护算法之前，还包括：基站从SMF实体接收终端设备的当前会话的服务质量；基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载。
为了节省资源，可选地，基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载，包括：当基站上存在至少一个历史的无线数据承载满足第一条件时，基站将满足第一条件的至少一个历史的无线数据承载中的一个确定为目标无线数据承载；其中，满足所述第一条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略相同。
可选地，第一条件包括：两个无线数据承载的服务质量相同，且两个无线数据承载的安全策略相同。
为了节省资源，另一种可选地方案中，基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载，包括：当基站上不存在历史的无线数据承载满足第一条件，但存在至少一个历史的无线数据承载满足第二条件时，基站将满足第二条件的至少一个历史的无线数据承载中的一个进行更新后确定为目标无线数据承载；其中，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略相同；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略匹配。
可选地，第二条件包括：两个无线数据承载的服务质量匹配，且两个无线数据承载的安全策略相同。或者，可选地，第二条件包括：两个无线数据承载的服务质量相同，且两个无线数据承载的安全策略匹配。或者，可选地，第二条件包括：两个无线数据承载的服务质量匹配，且两个无线数据承载的安全策略匹配。
为了选择出合适的目标无线数据承载，另一种可选地方案中，基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载，包括：当基站上不存在历史的无线数据承载满足第一条件，且不存在至少一个历史的无线数据承载满足第二条件时，基站根据安全策略和服务质量中的至少一种，为终端设备创建目标无线数据承载。
为了选择出合适的目标无线数据承载，另一种可选地方案中，基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载，包括：当基站上不存在历史的无线数据承载满足第一条件时，基站根据安全策略和服务质量中的至少一种，为终端设备创建目标无线数据承载。
为了选择出合适的目标无线数据承载，另一种可选地方案中，基站根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载，包括：基站根据安全策略和服务质量中的至少一种，为终端设备创建目标无线数据承载。
可选地，基站获取安全策略，包括：基站从SMF实体接收安全策略；或者；基站从SMF实体接收安全策略的标识，并根据安全策略的标识，获取安全策略。
可选地，本申请实施例中还包括：基站获取终端设备支持的信令面安全算法；基站根据终端设备支持的信令面安全算法，以及基站允许的信令面安全算法，确定目标信令面安全算法；基站将目标信令面安全算法携带在接入层AS安全模式命令SMC中发送给终端设备，如此可实现信令面的算法与用户面安全算法的解耦合，从而使用户面安全算法和信令面安全算法单独协商，从而为更加灵活的确定用户面安全算法提供了基础。
可选地，基站在确定开启用户面完整性保护的情况下，开启用户面完整性保护。
可选地，基站在确定开启用户面加密保护的情况下，开启用户面加密保护。
可选地，基站在确定暂时不开启用户面完整性保护的情况下或者当前无法确定是否开启用户面完整性保护的情况下，不开启用户面完整性保护。
可选地，基站在确定暂时不开启用户面加密保护的情况下或者当前无法确定是否需要开启用户面加密保护的情况下，不开启用户面加密保护。
其中，暂时的意思是指具有一个时间段，暂时不开启用户面完整性保护是指一个时间段内不开启用户面完整性保护，在另一个时间段内开启用户面完整性保护。暂时不开启用户面加密保护是指一个时间段内不开启用户面加密保护，在另一个时间段内开启用户面加密保护。
一种可选地实施方式中，网络规定的在接收到AS安全模式命令后可以开启用户面加密保护，而用户面完整性保护是否开启由RRC重配置消息来通知终端设备，这种情况下终端设备无法确定是否开启用户面完整性保护。
另一种可选地实施方式中，网络规定的在接收到AS安全模式命令后，只开启信令面安全(开启信令面完整性保护和/或信令面加密保护)，而用户面完整性保护是否开启以及用户面加密保护是否开启都由RRC重配置消息来通知终端设备，在这种情况下无法确定是否开启用户面完整性保护，也无法确定是否开启用户面加密保护。
可选地，不开启用户面完整性保护包括：在无法确定是否开启用户面完整性保护或者确定暂时不开启用户面完整性保护的情况下，生成用户面完整性保护密钥，但是不使用用户面完整性保护密钥进行用户面完整性保护，在确定开启用户面完整性保护的情况下使用用户面完整性保护密钥进行用户面完整性保护。这种实施方式中，在生成用户面完整性保护密钥之前获取用户面完整性保护算法，比如可以将信令面完整性保护算法也作为用户面完整性保护算法。
可选地，不开启用户面完整性保护包括：在确定开启用户面完整性保护的情况下生成用户面完整性保护密钥，并使用用户面完整性保护密钥进行用户面完整性保护；也就是说，在无法确定是否开启用户面完整性保护或者确定暂时不开启用户面完整性保护的情况下， 用户面完整性保护的情况下可以不生成用户面完整性保护密钥。相对应的，比如针对终端设备和基站，若确定终端设备和基站永久不开启用户面完整性保护(比如可以是预设的条件等等)，则可以不生成用户面完整性保护密钥。
可选地，不开启用户面加密保护包括：在无法确定是否开启用户面加密保护或者确定暂时不开启用户面加密保护的情况下，生成用户面加密密钥，但是不使用用户面加密密钥进行用户面加密保护，在确定开启用户面加密保护的情况下使用用户面加密密钥进行用户面加密保护。这种实施方式中，在生成用户面加密密钥之前获取用户面加密算法，比如可以将信令面加密算法也作为用户面加密算法。可选地，不开启用户面加密保护包括：在确定开启用户面加密保护的情况下生成用户面加密密钥，并使用用户面加密密钥进行用户面加密保护；也就是说，在无法确定是否开启用户面加密保护或者确定暂时不开启用户面加密保护的情况下，可以不生成用户面加密密钥。相对应的，比如针对终端设备和基站，若确定终端设备和基站永久不开启用户面加密保护(比如可以是预设的条件等等)，则可以不生成用户面加密密钥。
可选地，基站获取完整性保护指示信息和/或加密指示信息，根据获取的完整性保护指示信息确定是否开启完整性保护；或者，根据加密指示信息确定是否开启用户面加密保护。其中，完整性保护指示信息用于指示是否开启用户面完整性保护，加密指示信息用于指示是否开启用户面加密保护。
可选地，基站获取完整性保护指示信息和/或加密指示信息的方式有多种，比如是基站判断后生成或者是接收到其它网元发送的完整性保护指示信息和加密指示信息中的至少一项。其它网元可以是SMF实体。
可选地，基站可以向终端设备发送完整性保护指示信息和加密指示信息中的至少一项，以使终端设备确定是否开启用户面完整性保护和/或是否开启用户面加密保护。或者终端设备自己判断并确定是否开启用户面完整性保护和/或是否开启用户面加密保护。
可选地，完整性保护指示信息和/或加密指示信息可以是比特信息或算法的标识。比如，完整性保护指示信息为目标用户面完整性保护算法的标识；再比如加密指示信息为目标用户面加密保护算法的标识，再比如，用1比特信息指示完整性保护指示信息或加密指示信息，再比如，用2比特信息指示完整性保护指示信息和加密指示信息。第二方面，本申请实施例提供一种通信方法，包括：SMF实体接收请求消息，请求消息包括安全策略的相关参数；SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识；SMF实体向基站发送安全策略或安全策略的标识；其中，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护。一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
可选地，所述完整性保护指示信息为用户面完整性保护算法的标识。也就是说若确定安全策略中携带用户面完整性保护算法的标识，则可确定基站对终端设备开启完整性保护。该实施例中安全策略中携带的用户面完整性保护算法的标识可以为一个或多个(可以称为算法列表)，该实施例中安全策略中携带的用户面完整性保护算法可以是根据服务网络允许的用户面完整性保护算法、终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法中的至少一项确定的；也可以说安全策略中携带的的用户面完整性保护算 法是服务网络允许的用户面完整性保护算法。
可选地，安全策略的相关参数包括终端设备的标识，终端设备的数据服务网络名称DNN，终端设备的切片的标识，终端设备的服务质量和终端设备的会话标识中的至少一种。如此，可根据不同的标识从不同的角度或粒度实现安全策略的制定，更加灵活。
可选地，SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识，包括：安全策略的相关参数包括终端设备的标识，SMF实体根据终端设备的标识与安全策略的关联关系以及终端设备的标识，获得安全策略，如此可实现在终端设备的粒度上的安全策略的确定，实现不同的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识，包括：安全策略的相关参数包括终端设备的切片的标识，SMF实体根据切片的标识和安全策略的关联关系以及终端设备的切片的标识，获得安全策略，如此可实现在切片的粒度上的安全策略的确定，实现接入不同的切片的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识，包括：安全策略的相关参数包括终端设备的会话标识，SMF实体根据会话标识和安全策略的关联关系以及终端设备的会话标识，获得安全策略，如此可实现在会话的粒度上的安全策略的确定，实现发起不同会话的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识，包括：安全策略的相关参数包括终端设备的服务质量；SMF实体根据终端设备的服务质量，获得安全策略，如此可实现在服务质量的粒度上的安全策略的确定，实现发起不同服务质量的终端设备可对应不同的安全策略的目的。
可选地，安全策略还包括以下内容中至少一种：加密指示信息，加密指示信息用于指示基站对终端设备开启加密保护；密钥长度；D-H指示信息，D-H指示信息用于指示基站对终端设备开启D-H；和，服务网络允许的用户面完整性保护算法。如此，可以更加灵活的对安全策略中的任一个信息进行指示，使最终确定的安全策略更加适应复杂的应用场景。
可选地，SMF实体向基站发送完整性保护指示信息和/或加密指示信息。完整性保护指示信息用于指示是否开启用户面完整性保护，加密指示信息用于指示是否开启加密保护。可选地，SMF实体判断是否开启用户面完整性保护和/或是否开启用户面加密保护有多种实施方式，可以参见后续实施例，也可以参见基站判断是否开启用户面完整性保护和/或是否开启用户面加密保护的实施方式，在此不再赘述。
第三方面，本申请实施例提供一种基站，基站包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，基站用于执行上述第一方面或第一方面中任一种方法。
第四方面，本申请实施例提供一种SMF实体，SMF实体包括存储器、收发器和处理器，其中：存储器用于存储指令；处理器用于根据执行存储器存储的指令，并控制收发器进行信号接收和信号发送，当处理器执行存储器存储的指令时，SMF实体用于执行上述第二方面或第二方面中任一种方法。
第五方面，本申请实施例提供一种基站，用于实现上述第一方面或第一方面中的任意 一种方法，包括相应的功能模块，分别用于实现以上方法中的步骤。
第六方面，本申请实施例提供一种SMF实体，用于实现上述第二方面或第二方面中的任意一种的方法，包括相应的功能模块，分别用于实现以上方法中的步骤。
第七方面，本申请实施例提供一种计算机存储介质，计算机存储介质中存储有指令，当其在计算机上运行时，使得计算机执行第一方面或第一方面的任意可能的实现方式中的方法。
第八方面，本申请实施例提供一种计算机存储介质，计算机存储介质中存储有指令，当其在计算机上运行时，使得计算机执行第二方面或第二方面的任意可能的实现方式中的方法。
第九方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行第一方面或第一方面的任意可能的实现方式中的方法。
第十方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行第二方面或第二方面的任意可能的实现方式中的方法。
本申请实施例中，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护，基站获取安全策略，当完整性保护指示信息指示基站对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法。如此，可根据安全策略灵活的为终端设备选择是否开启完整性保护，且仅在对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法，一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
附图说明
图1为本申请实施例适用的一种系统架构示意图；
图2为本申请实施例提供的一种通信方法流程示意图；
图2a为本申请实施例提供的另一种通信方法流程示意图；
图2b为本申请实施例提供的另一种通信方法流程示意图；
图3为本申请实施例提供的一种基站的结构示意图；
图4为本申请实施例提供的一种终端设备的结构示意图；
图5为本申请实施例提供的另一种基站的结构示意图；
图6为本申请实施例提供的另一种终端设备的结构示意图。
具体实施方式
图1示例性示出了本申请实施例适用的一种系统架构示意图，如图1所示，在5G系统架构中，包括终端设备101。终端设备101可以经无线接入网(Radio Access Network，简称RAN)与一个或多个核心网进行通信，终端设备可以指用户设备(User Equipment，简称终端设备)、接入终端设备、用户单元、用户站、移动站、移动台、远方站、远程终端设备、移动设备、用户终端设备、终端设备、无线通信设备、用户代理或用户装置。接入终端设备可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，简称SIP)电话、无线本地环路(Wireless Local Loop，简称WLL)站、个人数字处理(Personal  Digital Assistant，简称PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端设备等。
与终端设备101连接的基站102。可选地，基站102可为5G基站(generation Node B，gNB)，可为演进的eNB，也可以为LTE基站eNB，3G基站NB,或者演进的5G基站等新型基站，英文也可写为(R)AN。基站102可以是用于与终端设备进行通信的设备，例如，可以是GSM系统或CDMA中的基站(Base Transceiver Station，BTS)，也可以是WCDMA系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(Evolutional Node B，eNB或eNodeB)，还可以是5G基站或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络侧设备或未来演进的PLMN网络中的网络设备等。
会话管理功能(Session Management Function，SMF)实体103，可以是LTE中移动性管理模块(Mobility Management Entity，MME)的功能拆分，可主要负责用户的会话建立，用户的会话建立后，才可以收发数据。LTE系统中的MME是核心网侧负责安全、移动性管理和会话管理的网元。安全，即终端设备101在初始入网的时候，需要和网络进行相互认证。在互相认证之后，终端设备101和核心网会生成密钥。生成密钥后，终端设备101和MME会进行算法协商，也就是安全能力协商。移动性管理就是记录终端设备101的位置信息，根据终端设备101的位置信息为终端设备101选择合适的用户面网元设备。会话管理就是负责建立终端设备101的用户面链路，在建立好用户的数据面联络后，终端设备101才可以上网。
用户面功能(User Plane Function，UPF)实体104可以是LTE系统中中服务网关(Serving GateWay，S-GW)和公用数据网网关(Public Data Network GateWay，P-GW)的合体，是终端设备101用户面的功能网元，主要负责连接外部网络。
专用网络(Dedicated Network，DN)105可为终端设备101提供服务的网络，比如有些DN可以为终端设备101提供上网功能，有些DN可以为终端设备101提供短信功能。还包括策略控制功能(Policy Control Funtion,PCF)106。
鉴权服务器功能(Authentication Server Function，AUSF)实体107与认证凭证存储和处理功能(Authentication Credential Repository and Processing Function，ARPF)交互，并且终结来自SEAF的鉴权请求。也是从LTE系统的归属签约用户服务器(Home Subscriber Server，HSS)拆分出来的功能。AUSF107可以是独立的网元。LTE系统中的HSS可以存储用户的签约信息，以及用户的长期密钥。
ARPF可以合并到用户数据管理(User Data Management，UDM)实体108中作为UDM的一部分。ARPF是从LTE的HSS中拆分出来的。主要用于存储长期密钥。与长期密钥相关的处理也在这里完成。
接入和移动性管理(Access and Mobility Management Function,AMF)实体109的功能是管理终端设备101的接入问题，还管理终端设备101的移动性。可以是LTE中MME中的移动性管理模块(Mobility Management，MM)功能，同时加入了接入管理的功能。还可包括切片选择功能(Slice select Function，SSF)110。
安全锚点功能(Security anchor function，SEAF)实体111负责终端设备101和网络侧的鉴权功能，会在鉴权成功后存储锚点密钥(anchor key)。
安全上下文管理功能(Security Context Management Function，SCMF)实体112，从SEAF111获得密钥，进一步衍生其他密钥。是从MME拆分出来的功能。在实际情况中， SEAF111和SCMF112可能进一步独立成为一个单独的鉴权功能(Authentication function，AUF)实体。如图1所示，SEAF111和SCMF112合并到AMF109中组成一个网元。
图1中还示出了各个网元中的接口的可能实现方式，比如基站102和AMF实体109之间的NG2接口，基站102与UPF实体104之间的NG9接口等等，在此不再一一赘述。
图2示例性示出了本申请实施例提供的一种通信方法流程示意图。
基于上述内容，本申请实施例提供的一种通信方法，如图2所示，该方法包括：
步骤201，基站获取终端设备支持的信令面安全算法；可选地，有多种方式获取终端设备支持的信令面安全算法，终端设备支持的信令面安全算法至少包括至少一种信令面加密算法和至少一种信令面完整性保护算法，比如从AMF处接收，再比如通过信令消息直接从终端设备处获得，或者预配置在基站上。
本申请实施例中提供一种方案用于实现上述步骤201，具体来说，终端设备向基站发送非接入层(Non-Access Stratum，NAS)消息。NAS消息是终端设备和核心网交互的信令面消息，如LTE的附着请求(attach request)，或者5G的注册请求(Registration Request)。本实施例以5G的注册请求消息为例进行说明，其他NAS消息遇到类似的步骤可做相同处理。终端设备向基站发送注册请求(Registration Request)，在该注册请求种携带终端设备支持的信令面安全算法。
上述示例中可选地，注册请求中也可携带终端设备支持的用户面安全算法。终端设备支持的用户面安全算法可包括终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法。终端设备支持的信令面加密算法、终端设备支持的信令面完整性保护算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法中的任两种算法可相同或不同。一种可选地方案中，终端设备可以将终端设备支持的信令面完整性保护算法、终端设备支持的信令面加密算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法这四者可以分别上报，或者，若这四个算法中存在至少两个算法相同，则对于相同的两个算法可以进上报一个算法，比如，若终端设备支持的信令面完整性保护算法和终端设备支持的用户面完整性保护算法相同，则终端设备仅上报终端设备支持的信令面完整性保护算法和终端设备支持的用户面完整性保护算法对应的相同的一个算法；若终端设备支持的信令面加密算法和终端设备支持的用户面加密算法相同，则终端设备仅上报终端设备支持的信令面加密算法和终端设备支持的用户面加密算法对应的相同的一个算法。
另一种可选地实施方式中，终端设备支持的信令面加密算法、终端设备支持的信令面完整性保护算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法都相同，则终端设备可仅上报一种算法用于指示该四种算法即可。比如，终端设备上报的算法分别为EEA1，EEA2，EIA1，EIA2；那么EEA1和EEA2可以既用于信令面加密算法选择，又用于用户面加密算法选择，同理EIA1和EIA2可以既用于信令面完整性保护算法选择，又可以用于用户面完整性保护算法选择。
再比如，终端设备上报的算法分别为EEA11，EEA12，EIA11，EIA12，EEA21，EEA23，EIA21，EIA22，那么EEA11和EEA12可以用于信令面加密算法选择，EEA21和EEA23用于用户面加密算法选择，EIA11和EIA12用于信令面完整性保护算法选择，EIA21和EIA22用于用户面完整性保护算法选择。再比如，终端设备上报的算法分别为EEA11，EEA12，EIA1，EIA2，EEA21，EEA23，EIA21，EIA22，那么EEA11和EEA12可以用 于信令面加密算法选择，EEA21和EEA23用于用户面加密算法选择，EIA1和EIA2可以既用于信令面完整性保护算法选择，又可以用于用户面完整性保护算法选择。再比如，终端设备上报的算法分别为EEA1，EEA1，EIA11，EIA12，EIA21，EIA22，那么EEA1和EEA2可以既用于信令面加密算法选择，又用于用户面加密算法选择，EIA11和EIA12用于信令面完整性保护算法选择，EIA21和EIA22用于用户面完整性保护算法选择。
另一方面，一种可选地实施方案中，终端设备可以通过多条信令来上报终端设备支持的信令面安全算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法，其中一条信令中包括一种算法。另一种可选地方案中，通过一条或多条信令来上报终端设备支持的信令面安全算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法，其中一条信令中包括一种或多种算法，当一条信令中包括多种算法时，可在该条信令中预定义一些字段，这些字段用于承载对应算法，比如依次设置第一字段、第二字段和第三字段，第一字段预定义用于放置终端设备支持的信令面安全算法，第二字段预定义用于放置终端设备支持的用户面完整性保护算法，第三字段预定义用于放置终端设备支持的用户面加密算法。或者，当三种算法都相同时，仅在一条信令中上报一个算法，其它网元默认该一个算法同时为终端设备支持的信令面安全算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法。比如，终端设备上报的安全能力为EEA1，EEA2，EIA1，EIA2，那么EEA1和EEA2可以既用于信令面加密算法选择，又用于用户面加密算法选择，同理EIA1和EIA2可以既用于信令面完整性保护算法选择，又可以用于用户面完整性保护算法选择。再比如，UE上报的安全能力为EEA11，EEA12，EIA11，EIA12，EEA21，EEA23，EIA21，EIA22那么EEA11和EEA12可以用于信令面加密算法选择，EEA21和EEA23用于用户面加密算法选择，EIA11和EIA12用于信令面完整性保护算法选择，EIA21和EIA22用于用户面完整性保护算法选择。再比如，UE上报的安全能力为EEA11，EEA12，EIA1，EIA2，EEA21，EEA23，EIA21，EIA22那么EEA11和EEA12可以用于信令面加密算法选择，EEA21和EEA23用于用户面加密算法选择，EIA1和EIA2可以既用于信令面完整性保护算法选择，又可以用于用户面完整性保护算法选择。
可选地，基站将注册请求转发给AMF，可选地，在AMF与基站之间进行双向鉴权并与其它核心网网元，比如SEAF、AUSF、SMF、PCF或UDM等进行其它注册流程之后，AMF发送第一注册接受消息(Registration Accept)给基站，基站将接收到的该第一注册接受信息转发给终端设备，转发的意思是不对消息本身进行改变，但由于承载消息的接口功能不同，会有额外参数添加到消息外，以实现消息传输功能，比如第一注册接受消息是通过N2接口发给基站，N2接口除了第一注册接受消息外，还有基站需要知道的信息。基站转发第一注册消息给UE是通过RRC消息，RRC消息中除了第一注册消息外，至少还会有其他UE需要知道的信息，或者能够找到UE的信息；或者将第一注册接受消息进行一定的转换，比如根据接口的不同进行格式转换等，将转换后的第一注册接受消息转发给终端设备。在此步骤中，若AMF和基站之间的接口为NG2，则第一注册接受消息用NG2消息承载。第一注册接受消息中还携带有AMF或SEAF为基站生成的基础密钥(Kan)和终端设备上报的终端设备支持的信令面安全算法。可选地，注册请求消息可以放到NAS容器中，基础密钥(Kan)和终端设备的安全能力，可能放到NAS容器中，也可能放到NAS容器外。
步骤202，基站根据终端设备支持的信令面安全算法，以及基站允许的信令面安全算 法，确定目标信令面安全算法。
在步骤202中，可选地，基站可预配置基站允许的信令面安全算法，可选地，该基站允许的信令面安全算法中包括的算法为进行优先级排序的，比如根据运营商的偏好进行优先级排序，根据本地现实环境配置的优先级排序。可选地，该基站允许的信令面安全算法可以是通过网络管理设备配置给基站的，也可以在基站建立之初在安装软件环境的过程中配置完成，也可以通过其他方式进行配置。
步骤202中，一种可能的实现方式为，基站根据终端设备支持的信令面安全算法和具有优先级排序的基站允许的信令面安全算法，选择出具有优先级最高的同时又是终端设备支持的信令面安全算法作为目标信令面安全算法，目标信令面安全算法可包括一个加密算法和/或一个完整性保护算法。
其中一种可能的具体实现方式为，基站选出既存在于终端设备支持的信令面安全算法，且存在于基站允许的信令面安全算法中所有算法的集合，并从该算法的集合中选择出在基站允许的信令面安全算法中优先级较高的算法作为目标信令面安全算法。
这里需要说明的是，基站会至少根据运营商的喜好被配置或预配置有基站允许的信令面安全算法和基站允许的用户面安全算法。基站允许的信令面安全算法包括至少一个基站允许的信令面加密算法和/或至少一个基站允许的信令面完整性保护算法。基站允许的用户面安全算法包括至少一个基站允许的用户面加密算法和/或至少一个基站允许的用户面完整性保护算法。并且基站允许的信令面安全算法的至少一个基站允许的信令面加密算法和/或至少一个基站允许的信令面完整性保护算法是有优先级排序的，优先级排序可以由运营商决定。基站允许的用户面安全算法可以有优先级排序，也可以没有优先级排序。当基站允许的用户面安全算法和基站允许的信令面安全算法相同，并且基站允许的用户面安全算法的优先级排序和基站允许的信令面安全算法的优先级排序相同时，则基站可以只存一套有优先级排序的算法，即存储基站允许的且有优先级排序的用户面安全算法或存储基站允许的且有优先级排序的信令面安全算法。
可选地，基站基于该目标信令面安全算法仅仅生成信令面的相关密钥，比如信令面完整性保护密钥和信令面加密密钥。信令面的相关密钥比如为无线资源控制(Radio Resource Control，RRC)相关密钥，具体来说可为RRC完整性保护密钥(Krrc-int)和RRC加密密钥(Krrc-enc)。基站生成密钥时可以基于基础密钥(Kan)来生成。Kan是基站从核心网网元获得的，比如接入和移动性管理功能(Access and mobility management Function，AMF)，AUSF。
步骤203，基站将目标信令面安全算法携带在接入层(Access Stratum，AS)安全模式命令(Security mode command，SMC)中发送给终端设备。
可选地，在步骤203中有多种实现方式，基站可以向终端设备发送AS SMC，其中AS SMC中包括目标信令面安全算法的指示信息，比如目标信令面安全算法的标识。
进一步，基站还可在AS SMC中携带终端设备支持的信令面安全算法。可选地，AS SMC可以用基站生成的信令面完整性保护密钥进行完整性保护。
可选地，终端设备接收到AS SMC之后，基于目标信令面安全算法的指示信息确定目标信令面安全算法，并且生成信令面的相关密钥(终端设备生成信令面的相关密钥的方法与基站的生成信令面的相关密钥的方法相同)，并根据信令面完整性加密密钥对AS SMC的完整性保护进行检查。如果确定AS SMC完整性保护合格，即确定终端设备侧的信令面 完整性保护密钥与基站用于对AS SMC的信令面完整性保护密钥相同。则可选地，在步骤203之后，还包括步骤204，终端设备向基站发送AS安全模式命令完成(Security mode command complete，SMP)。
可选地，终端设备可以用生成的信令面的相关密钥对AS SMP进行加密和/或完整性保护。可选地，基站检查AS SMP消息的加密保护和/或完整性保护正确后。可选地，基站检查AS SMP消息的加密保护和完整性保护正确后，基站将接收到的该第一注册接受信息转发给终端设备，或者将第一注册接受消息进行一定的转换，比如根据接口的不同进行格式转换等，得到第二注册接受消息(Registration Accept)消息，将第二注册接受消息发送给终端设备。之后可选的，终端设备回复注册完成(Registration Complete)给AMF。
基于上述示例可见，本申请实施例中通过AS SMC流程仅仅实现基站与终端设备协商目标信令面安全算法的目的，实现了信令面安全算法和用户面安全算法的解耦，由于可以分开确定信令面安全算法和用户面安全算法，因此提高了通信的灵活性。
进一步，在上述示例中，一种可选地方案为终端设备通过发送注册请求上报终端设备支持的信令面安全算法，可选地，终端设备也可将终端设备支持的用户面完整性保护算法、终端设备支持的用户面加密算法携带在注册请求中上报。具体上报的可选方案可参照上述实施例，在此不再赘述。
可选地，终端设备支持的信令面安全算法也可分为NAS层的终端设备支持的信令面安全算法和AS层的终端设备支持的信令面安全算法，其中，AS层的终端设备支持的信令面安全算法也可称为RRC层的终端设备支持的信令面安全算法。终端设备将上述终端设备支持的信令面安全算法、终端设备支持的用户面完整性保护算法、终端设备支持的用户面加密算法上报的时候可以为每个安全算法增加指示信息，也可以通过预定义一些字段，并在相应字段中放置相应算法的方式标识出每个安全算法是属于信令面还是用户面，或者是NAS层还是AS层的，举个例子，比如预定义一个字段用于放置信令面的安全算法，预定义另一个字段用于放置用户面安全算法，再比如，预定义一个字段用于放置NAS层的安全算法，预定义另一个字段用于放置AS层安全算法。或者终端设备将终端设备支持的所有安全算法全部上报给AMF，终端设备并不对这些安全算法是信令面还是用户面的进行区分，而由AMF做区分。或者由AMF转发给基站后，由基站做区分。
相应地，在上述AMF向基站发送第一注册接受消息给基站时，可以将终端设备上报的所有安全算法均发送给基站，比如信令面安全算法、终端设备支持的用户面完整性保护算法和终端设备支持的用户面加密算法。或者仅仅将基站协商目标信令面安全算法需要的终端设备支持的信令面安全算法发送给基站。或者仅仅传递RRC层的终端设备支持的信令面安全算法。
为了与现有技术兼容，可选地，基站在AS SMC消息中可以增加一个仅协商目标信令面安全算法的指示信息，当终端设备解析AS SMC信息后发现存在仅协商目标信令面安全算法的指示信息，则仅仅根据确定的目标信令面安全算法生成信令面相关密钥。如此，终端设备和基站之间仍然只协商出来一套目标信令面安全算法。若终端设备解析AS SMC信息后发现不存在仅协商目标信令面安全算法的指示信息，则根据确定的目标信令面安全算法就变成目标安全算法，用于生成信令面相关密钥和用户面的相关密钥，用户面的相关密钥包括用户面加密密钥和用户面完整性保护密钥。信令面相关密钥包括信令面加密密钥和信令面完整性保护密钥。如此，终端设备和基站之间协商出来一套目标信令面安全算法， 一套目标用户面安全算法。
可选地，为了与现有技术兼容，基站可在在AS SMC信息中增加用于指示协商目标信令面安全算法的指示信息和/或协商用户面的相关密钥的指示信息的信息，比如增加一个比特位，该比特位可以为新增的也可复用目前的比特位，比如该比特位为0，则表示仅协商目标信令面安全算法，若该比特位为1，则表示同时协商目标信令面安全算法和用户面的相关密钥。
本申请实施例中目标信令面安全算法包括目标信令面整性保护算法和目标信令面加密算法。可选地，可通过AS SMC流程协商出两个不同的目标信令面整性保护算法和目标信令面加密算法，或者协商出一个目标信令面安全算法，既作为目标信令面整性保护算法，也作为目标信令面加密算法。
另一种可选地实施方案中，可通过AS SMC流程至少协商出目标信令面整性保护算法和目标信令面加密算法中的至少一种算法，另一种目标信令面安全算法可通过其它流程协商。
可选地，基站和终端设备协商出的目标信令面安全算法可以用算法的标识来表示，一种可选地实施方案中，无论目标信令面整性保护算法和目标信令面加密算法相同或不同，则均用两个算法的标识分别表示，另一种可选地实施方案中，若目标信令面完整性保护算法和目标信令面加密算法相同，则可用一个算法的标识表示该目标信令面整性保护算法和目标信令面加密算法，若目标信令面整性保护算法和目标信令面加密算法不同，则用两个算法的标识表示该目标信令面整性保护算法和目标信令面加密算法。
另一种可选地方案中，本申请实施例中包括目标信令面安全算法和目标用户面安全算法，一种可选地实施方案中，无论目标信令面安全算法和目标用户面安全算法相同或不同，则均用两套算法的标识分别表示，另一种可选地实施方案中，若目标信令面安全算法和目标用户面安全算法相同，则可用一套算法的标识表示该目标信令面安全算法和目标用户面安全算法，若目标信令面安全算法和目标用户面安全算法不同，则用两套算法的标识表示目标信令面安全算法和目标用户面安全算法。其中，目标信令面安全算法对应的一套算法的标识包括至少一个目标信令面整性保护算法的标识和至少一个目标信令面加密算法的标识，目标信令面安全算法对应的一套算法的标识依据上述示例中所示，可以用一个算法的标识也可分别用两个算法的标识来表示目标信令面整性保护算法和目标信令面加密算法。相应地，其中，目标用户面安全算法对应的一套算法的标识包括至少一个目标信令面整性保护算法的标识和至少一个目标用户面加密算法的标识，目标用户面安全算法对应的一套算法的标识依据上述示例中所示，可以用一个算法的标识也可分别用两个算法的标识来表示目标信令面整性保护算法和目标用户面加密算法。
图2a示例性示出了本申请实施例提供的另一种通信方法流程示意图。
基于上述论述，本申请实施例提供另一种通信方法，如图2a所示，该方法包括：
可选地，步骤211，SMF实体接收请求消息，请求消息可包括终端设备的标识。可选地，SMF实体接收请求消息可以包括多种，比如注册请求(Registration Request)、服务请求(Service Request)或会话建立请求(Session Establishment Request)，其中，会话建立请求也可称为PDU会话建立请求。
可选地，若请求消息消息为服务请求，则该服务请求可以首先由终端设备发送给基站，由基站转发给AMF，之后AMF直接转发，转发即不改变原消息的内容将消息发送给AMF， 发送给AMF的时候可能会根据接口等因素增加其他参数，或者根据接口信息对其进行转换后，再发送给SMF。若基站和AMF之间的之间的接口为N2接口，AMF与SMF之间的接口为N11，则基站向AMF转发的服务请求为与N2接口匹配的请求，AMF向SMF转发的服务请求为与N11接口匹配的请求。服务请求为NAS层的请求。可选地，请求消息也可为注册请求。
可选地，若请求消息为会话建立请求，则该会话建立请求可以首先由终端设备发送给AMF，之后AMF直接转发，转发即不改变原消息的内容将消息发送给AMF，发送给AMF的时候可能会或根据接口等因素增加其他参数，或者根据接口信息对其进行转换后再发送给SMF。
可选地，在终端设备发送会话建立请求之前，终端设备可能处于会话连接断开的状态，可选地，终端设备与基站之间可以再次进行上述步骤的注册流程，即终端设备可以向基站发送注册请求，从而实现终端设备的注册，在注册流程中的AS SMC和AS SMP中重新协商终端设备和基站之间的目标信令面安全算法。
在上述步骤中，终端设备的标识可包括：IMSI、IMEI和临时身份标识中的任一项或任多项等。
步骤212，SMF实体根据安全策略的相关参数，获得安全策略或者安全策略的标识；
步骤213，SMF实体向基站发送安全策略或安全策略的标识；其中，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护。
可选地，SMF或其他与SMF连接的网元上存储安全策略和安全策略标识的对应关系。此时安全策略已经完全预配置在SMF、基站、UE、或者其他与SMF连接的网元上。比如根据具体的业务配置，如VoIP话音业务的安全策略。比如根据服务的厂商配置，如水表厂。配置方式依据有多种，在此不一一列举。当SMF通过终端设备的标识或者其他参数，为终端设备确定安全策略后，就可以得带与安全策略对应的安全策略标识。SMF将安全策略标识传递给基站，基站就可以根据安全策略标识对应的安全策略，进行用户面安全保护。比如，SMF预配置有安全策略和安全策略标识的对应关系，SMF根据服务请求消息中的内容，比如终端设备的标识，确定安全策略标识。再比如，PCF有预配置的安全策略和安全策略标识对应的关系，则SMF需要从PDC处获得安全策略标识。再比如，SMF和PCF处都与预配置的安全策略标识，则PCF处预配置的安全策略标识可以覆盖SMF处配置的安全策略标识，即SMF将从PCF处获得的安全策略标识传递给基站。
一种可选地实施方式中，SMF实体直接向基站发送安全策略或安全策略的标识，比如根据终端设备的标识以及预设的终端设备和安全策略的标识的预设关系，将终端设备标识对应的安全策略发给基站。预设的安全策略，可以预设在SMF上，也可以与设在PCF上或其他网元上。预设的安全策略和安全策略的标识，可以预设在SMF上，也可以与设在PCF上或其他网元上。另一种可选地实施方式中，SMF实体接收请求消息之后，根据请求消息，向基站发送安全策略或安全策略的标识之前，还包括：SMF实体根据请求消息，获得安全策略。另一种可选地实施方式中，SMF实体接收请求消息之后，根据请求消息，向基站发送安全策略或安全策略的标识之前，还包括：SMF根据安全策略，获得安全策略标识。
另一个方面，可选地，SMF实体向基站发送的安全策略或安全策略的标识所标识的安全策略可以是以前生成的安全策略，也可以是此次新生成的安全策略。
上述步骤213中，SMF实体向基站发送安全策略或安全策略的标识有多种形式，比如，SMF实体可以根据安全策略的相关参数去生成安全策略。比如根据终端设备标识或者会话标识生成安全策略，也可以预设一些生成规则，也可以预配置好所有安全策略。
可选地，基站可根据请求消息中携带的一些信息，将终端设备适用的或者终端设备此次的请求消息所适用的安全策略或安全策略的标识发送过去。可选地，安全策略的相关参数包括终端设备的标识，终端设备的数据网络名称(Data network name，DNN)，终端设备的切片的标识，终端设备的服务质量和终端设备的会话标识中的至少一种。可选地，安全策略的相关参数包括终端设备的标识，终端设备的DNN，终端设备的切片的标识，终端设备的服务质量，终端设备的会话标识和流标识中的至少一种。
本申请实施例中的关联关系可以包括对应关系，也可包括一些规则，或者也可包括一些相关性的关系。举个例子，比如可以预设相关参数和安全策略的对应关系，之后找到相关参数对应的安全策略，比如，根据切片的标识确定切片标识对应的安全策略，再比如根据会话标识确定会话标识对应的安全策略，再比如根据会话标识、切片标识和安全策略这三者之间的关联关系确定会话标识和切片标识对应的安全策略。
另一种可选地实施方式中，安全策略的相关参数包括终端设备的标识，SMF实体根据终端设备的标识与安全策略的关联关系以及终端设备的标识，获得安全策略。举例来说，可在SMF或其它与SMF连接的网元上存储终端设备与安全策略的对应关系，如终端设备与安全策略有对应关系，比如，用户签约数据中有IMSI和安全策略的对应关系，如此，可以针对不同的终端设备比如终端设备的一些服务性能要求等等设置不同的安全策略。
再比如，可以预设终端设备的标识与安全策略的关联关系，比如终端设备的标识关联了多个安全策略，之后可以从终端设备的标识所关联的多个安全策略中选择一个安全策略，也可再根据相关参数中除终端设备的标识之外的其它参数进一步确定安全策略，比如结合会话标识从终端设备的标识关联的多个安全策略中选择出一个于该会话标识相关联的安全策略。再比如，根据服务质量确定服务质量流标识，再根据服务质量流标识确定对应的服务质量的安全策略。
举个例子，比如一个物联网的终端设备，只负责抄送水表，即每月定期将水表数据发送给水厂。那么这个终端设备的安全策略是固定的，可以设置终端设备的标识对应一个安全策略，可选地，可以从UDM中保存的用户的签约数据获取。
为了更清楚的介绍本申请实施例，下面再详细介绍几种根据根据相关参数发送安全策略或安全策略的标识的例子，详见下述实施方式a1、实施方式a2、实施方式a3和实施方式a4。
实施方式a1
终端设备的切片的标识为5G应用场景中终端设备所接入的切片的信息，用于表示终端设备会接入哪个切片。
安全策略的相关参数包括终端设备的切片的标识，SMF实体根据切片的标识和安全策略的关联关系以及终端设备的切片的标识，获得安全策略。具体来说，一个终端设备可以对应至少一个切片的标识，比如终端设备可以接入不同的切片，终端设备用户面数据在不同的切片下可以对应不同的安全策略。
终端设备在SR消息中，或者PDU会话建立请求(session establishement request)中，携带切片选择辅助信息(network slice selection assistance information，NSSAI)。SMF会获 得NSSAI对应的安全策略，如果这个NSSAI对应的切片的安全策略是唯一的，那么终端设备接入该切片时获取的安全策略唯一。如果NSSAI信息中包含至少一个切片，则需要根据终端设备当前接入的切片的安全策略进行选择(不同切片的安全策略可不同)。如果在确定了接入的切片后，当前切片的安全策略唯一，那么终端设备接入该切片时获取的安全策略唯一。如果当前切片的安全策略不唯一，那么终端设备需要根据其他信息进一步确定安全策略，终端设备需要根据其他信息进一步确定安全策略的实施方式有多种，比如根据相关参数中除了切片标识之外的其它至少一种标识进行选择，比如通过终端设备标识或会话标识等等。
实施方式a2
终端设备的会话标识为终端设备此次请求消息所对应的会话所对应的会话标识。会话，英文可称为session，比如终端设备进行因特网(internet)业务(如，浏览网页、看视频、微信聊天)，是一个会话。终端设备接入了终端设备所在公司的内网，使用公司特定的业务(如，公司会议)，这又是一个会话。终端设备接入拨打VoIP电话的网络，这个又是一个会话。这里我们可以设置接入因特网(internet)业务的会话标识为1；公司内网的会话标识为2；VoIP电话的会话标识为3。
安全策略的相关参数包括终端设备的会话标识，SMF实体根据会话标识和安全策略的关联关系以及终端设备的会话标识，获得安全策略。如此，针对同一个终端设备，当终端设备发起不同的会话时，可以为不同的会话选择不同的安全策略。
举个例子，比如一个正常的终端设备，这个终端设备只开通了打电话和发短信的业务。这2种业务分部属于2个会话。那么服务质量和安全策略就是根据会话的不同而不同。对于打电话业务，不需要开启用户面完整性保护，不需要密钥混合，用户面加密算法用128比特的即可，用户面加密密钥长度128bit。而对于短信息业务，需要开启用户面完整性保护，需要密钥混合，用户面加密算法用128bit，用户面加密密钥用128bit(比特)，用户面完整性保护算法用256bit，用户面完整性保护密钥用256bit。
举个例子，比如会话标识所对应的业务是超低时延业务，则可能为了保证时延低，安全策略中就要使用安全级别较低的用户面完整性保护算法和用户面加密算法，比如128bit用户面完整性保护算法和用户面加密算法，以及128bit的用户面完整性保护密钥和用户面加密密钥；或不启用用户面完整性保护算法和用户面加密算法。再比如会话标识所对应的业务是可靠性要求高的业务，则不仅需要用户面加密密钥进行加密保护，还需要用户面完整性保护密钥进行完整性保护，而且要选择安全级别较高的用户面完整性保护算法和用户面加密算法，比如256bit的用户面完整性保护算法和用户面加密算法，以及256bit的用户面加密密钥和用户面加密密钥。再比如会话标识所对应的业务是一般普通的业务，如话音业务，可能只需要用户面加密密钥保护，而不需要用户面完整性保护，并且可能需要256bit的用户面加密算法，但密钥用128bit用户面加密密钥就够了。可见，本申请实施例中基于不同的业务可以选择出不同的安全策略，满足用户面安全的动态需求。
实施方式a3
终端设备接入一个切片后可能发起多个会话，因此一个切片标识可能对应多个会话标识，这里所说的对应关系是逻辑上的对应关系，实际应用中，并不代表一定可以明确说明会话标识与切片标识的对应关系。
SMF实体根据终端设备的标识、切片的标识、会话标识和安全策略四者之间的关联关 系，获得切片的标识和会话标识对应的安全策略。如此，可以得到更细粒度的划分，为同一个终端设备，接入同一个切片中发起的不同的会话分别选择安全策略。
实施方式a4
可选地，SMF实体根据流标识和安全策略的关联关系，获得终端设备的安全策略。如此，可以得到更细粒度的划分，为同一个终端设备，接入同一个网络中发起相同的会话，却根据会话的具体内容分别选择安全策略。
举个例子，比如终端设备支持上网业务，那么上网的数据流可以是浏览网页，可以是看视频。对于这个终端设备，上网业务都属于会话1，那么浏览网页是流1，看视频是流2。SMF会在发现没有支持流1的服务质量的时候，为流1创建服务质量。对于流2的同理。如果SMF发现流1和流2的服务质量都有了，那么就会直接将这些服务质量发给基站。
实施方式a4
安全策略的相关参数包括终端设备的服务质量；SMF实体根据终端设备的服务质量，获得安全策略。可选地，可根据请求消息中包括的终端设备标识，获取该终端设备标识对应的一些服务质量，该服务质量比如为该终端设备要求时延低，安全性好等等，之后根据服务质量为终端设备设置一套安全策略。本申请实施例中，安全策略可以预配置在SMF或PCF上，也可以从UPF和、或UDM中获取到DNN对应的服务质量，之后根据服务质量得到一个安全策略。默认的服务质量UDM是在签约的时候录入的。UPF可以从外部的处理电话或短信的网络中了解到动态服务质量，也可以从PCF处了解到，也可以预配置。
可选地，安全策略的相关参数包括终端设备的DNN，根据DNN对应设置一套安全策略，比如DNN为优酷，优酷网络中视频业务较多，则为终端设备设置的安全策略中时延可以低一些，再比如，DNN为与财务相关的网站，则为终端设备设置的安全策略中安全性要高一些。
进一步，可以根据DNN从核心网网元，比如PCF/UPF或UDM中获取该DNN对应的服务质量，服务质量中携带有安全策略，或者之后根据服务质量设置安全策略。其中，从PCF获得的是动态的服务质量信息，从UDM中获得是用户签约时默认的服务质量信息。
可选地，SMF从UDM获取信息可以通过向UDM发送签约数据请求(Subscription Data Request)，以及从UDM接收签约数据响应(Subscription Data Response)来获取。SMF与PCF之间可以通过PDU-CAN会话修改(PDU-CAN session modification)信息进行获取。SMF与UPF之间可以通过向UPF发送会话建立/修改请求(Session Establishment/Modification Request)，以及从UDM接收会话建立/修改响应(Session Establishment/Modification Response)来获取。
在实施方式a4中，服务质量可被服务质量流(Quality of Service flow，QoS flow)，用标识(Identification，ID)标识，可称为QoS Flow ID，简称QFI。在本申请实施例中，服务质量内容(QoS Profile)用QFI进行标识。
服务质量中可包括多个参数，比如5GQoS指示(QoS Indicator，5QI)。5QI用于标识性能特征(Performance characteristics)，可包括：资源类型((Guaranteed flow bit rate，GBR)还是Non-GBR的)、数据包延迟度和误码率中的任一项或任多项，可能还包括其它参数。5QI是网元为服务质量分配资源的基础参数。
服务质量中还可包括分配和保留优先级(allocation and retention Priority，ARP)。可用1到15标识优先级。表示为服务质量请求资源的优先级，是否可以因为资源限制而拒绝建 立无线数据承载。
服务质量中还可包括2个参数，用于定义是否可以抢占其他服务质量对应的资源(比如无线数据承载)或者该服务质量建立的无线数据承载是否可以被其他服务质量抢占。
可选地，对于有GBR的数据内容，服务质量中还可包括：GBR保证数据传输速率(Guaranteed flow bit rate)，可用于上下行。其中，GBR的数据内容GBR可以是一种会话或者是一种流，GBR数据拥有对应的服务级别，不同的服务级别也会对应不同的服务质量。Non-GBR数据对应的都是默认的服务级别。比如说，对于运营商，通话一定是要保障的，所以打电话就有GBR的保证。而对于普通的短消息业务，就是non-GBR，稍微延迟一会也不会有什么问题。还有一种情况，举例来说，就是如果腾讯游戏买了运营商的服务，那么原来腾讯游戏non-GBR的业务流就会变成GBR的。
可选地，服务质量中还包括最大传输速率(Maximum Flow Bit Rate，MFBR)，一个会话的所有流(flow)加起来不可以超过这个速率。一旦超过了，可能就需要参考ARP要不要拒绝建立或者抢占其他资源了。
可选地，服务质量中还包括通知控制(Notification control)。这个设定为开或关，如果出现了无法为该服务质量建立无线数据承载的情况，要根据这个开关判断是否要通知终端设备。
可选地，安全策略还包括以下内容中至少一种：加密指示信息，加密指示信息用于指示基站对终端设备开启加密保护；密钥长度；D-H指示信息，D-H指示信息用于指示基站对终端设备开启D-H；服务网络允许的用户面完整性保护算法。也就是说，安全策略还可包括是否开启用户面加密，是否开启用户面完整性保护，加解密算法是128bit还是256bit，密钥长度是128bit还是256bit，是否开启密钥混合中的一种或多种等等这些内容的任一项或任多项。举一些具体例子，比如用比特位来指示安全策略中包括的内容，比如比特序列0000000，代表不开启用户面加密保护且不开启用户面完整性保护，因为都没开启，所以后面都是0。再比如比特序列1010100，即指示开启用户面加密保护但不开启用户面完整性保护，使用128比特的加密算法，不开启密钥混合。请注意给出的只是示例，符合此原则的示例都被此专利覆盖。本申请实施例中密钥混合即是指D-H，D-H为一种密钥混合算法。
可选地，SMF实体在确定该终端设备的安全策略中需要开启加密指示信息时，安全策略中还可包括服务网络允许的用户面加密算法。或者，安全策略中出现允许的用户面加密算法，就代表用户面加密是需要开启的。可选地，服务网络是为终端设备提供服务的网络。
可选地，安全策略中可包括用户面完整性保护算法的密钥长度，也可包括用户面加密算法的密钥长度。或者，安全策略中出现允许的用户面加密算法，算法是256bite，就代表使用256bite的密钥长度。
可选地，在基站获取安全策略之前，方法还包括：基站向接入和移动性管理AMF实体发送第一优先级指示信息，第一优先级指示信息用于指示基站允许的用户面完整性保护算法未按照优先级排序。
可选地，AMF将第一优先级指示信息转发给SMF，如此，SMF在获取该第一优先级指示信息后，知道基站允许的用户面完整性保护算法未按照优先级排序，因此SMF会对服务网络允许的用户面完整性保护算法进行优先级排序或者对该终端设备支持的用户面完整性保护算法并进行优先级排序，该终端设备支持的用户面完整性保护算法从AMF处 获得。
另一种可选地实施方式中，如果SMF未获取该第一优先级指示信息，或者SMF根据其它方式知道基站允许的用户面完整性保护算法按照优先级排序，则SMF可选的不对服务网络允许的用户面完整性保护算法进行优先级排序。可选地，对服务网络允许的用户面完整性保护算法进行优先级排序可以根据很多元素，比如可根据当前运营商的喜好、当地的服务网络环境等因素。
可选地，在基站获取安全策略之前，方法还包括：基站向接入和移动性管理AMF实体发送第二优先级指示信息，第二优先级指示信息用于指示基站允许的用户面加密是否未按照优先级排序。
可选地，AMF将第二优先级指示信息转发给SMF，如此，SMF在获取该第二优先级指示信息后，知道基站允许的用户面加密算法未按照优先级排序，因此SMF会对服务网络允许的用户面加密算法进行优先级排序或者对该终端设备支持的用户面加密算法并进行优先级排序，该终端设备支持的用户面加密算法从AMF处获得。
另一种可选地实施方式中，如果SMF未获取该第二优先级指示信息，或者SMF根据其它方式知道基站允许的用户面加密算法按照优先级排序，则SMF可选的不对服务网络允许的用户面加密算法进行优先级排序。可选地，对服务网络允许的用户面加密算法进行优先级排序可以根据很多元素，比如可根据当前运营商的喜好、当地的服务网络环境等因素。
上述示例中，对用户面加密算法和用户面完整性保护算法的优先级进行了分别介绍，另一种可选地实施方式中，用户一个指示信息同时指示用户面加密算法和用户面完整性保护算法的优先级问题。
可选地，在基站获取安全策略之前，方法还包括：基站向接入和移动性管理AMF实体发送第三优先级指示信息，第三优先级指示信息用于指示基站允许的用户面加密算法和用户面的完整性保护算法均未按照优先级排序。用户面加密算法和用户面的完整性保护算法可以相同也可不同。
可选地，AMF将第三优先级指示信息转发给SMF，如此，SMF在获取该第三优先级指示信息后，知道基站允许的用户面加密算法和用户面的完整性保护算法未按照优先级排序，因此SMF会对服务网络允许的用户面加密算法和用户面的完整性保护算法进行优先级排序或者对该终端设备支持的用户面加密算法和用户面的完整性保护算法并进行优先级排序，该终端设备支持的用户面加密算法和用户面的完整性保护算法从AMF处获得。
另一种可选地实施方式中，如果SMF未获取该第三优先级指示信息，或者SMF根据其它方式知道基站允许的用户面加密算法和用户面的完整性保护算法按照优先级排序，则SMF可选的不对服务网络允许的用户面加密算法进行优先级排序。可选地，对服务网络允许的用户面加密算法和用户面的完整性保护算法进行优先级排序可以根据很多元素，比如可根据当前运营商的喜好、当地的网络环境等因素。
图2b示例性示出了本申请实施例提供的另一种通信方法流程示意图。
基于上述内容，本申请实施例提供的一种通信方法，如图2b所示，该方法包括：
步骤221，基站获取安全策略，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护。
与前述内容类似，可选地，安全策略，还可以包括允许的用户面加密算法、服务网络 允许的用户面完整性保护算法，以及是否开启密钥混合的指示信息。可选地，服务网络允许的用户面加密算法可包括开启用户面加密保护和密钥长度信息。比如用户面加密算法是256比特的，就使用256比特的密钥。可选地，如果服务网络允许的用户面加密算法出现了空加密算法，则允许基站不开启用户面加密保护。可选地，如果安全策略中出现了服务网络允许的用户面完整性保护算法，则基站开启用户面完整性保护。可选地，根据完整性算法的比特信息确定密钥长度，即256比特的完整性算法就使用256比特的密钥。可选地，允许的用户面完整性保护算法不会出现空算法，如果安全策略中没有出现完整性保护算法，则就是不开启完整性保护。可选地，也可以用其他信息告知基站密钥长度信息，如通过比特位信息。
步骤222，当完整性保护指示信息指示基站对终端设备开启完整性保护时，基站确定目标用户面完整性保护算法；
步骤223，基站向终端设备发送目标用户面完整性保护算法。基站如何向终端设备发送目标用户面完整性保护算法参考上述内容，在此不再赘述。
可选地，在上述步骤221和步骤223之间还可包括上述AS SMC和AS SMP流程，用于重新协商基站和终端设备之间的目标信令面安全算法。具体来说，可以再上述步骤221和步骤223之间增加上述步骤201至步骤204。
可选地，基站获取安全策略包括：基站从SMF实体接收安全策略。或者，可选地，在基站预先存储安全策略，之后当基站从SMF实体接收安全策略的标识，并根据安全策略的标识，获取安全策略。
可选地，在基站可定义(Directory System Protocol，SDAP)层，用于将服务质量映射到分组数据汇聚协议(Packet Data Convergence Protocol，PDCP)层。每个PDCP层对应一个DRB。因此，之前我们定义的安全级别，需要在RAN侧更进一步细分。如果安全依然是在PDCP层做，即用户面的加解密和完整性保护依然在PDCP层完成。因为一个PDCP层对应一个DRB，因此在RAN侧只能做到DRB级别的安全处理。如果安全或者部分安全处理可以上移到SDAP层做，则可以做到QoS flow级别的安全处理。部分安全是指如果只有用户面完整性保护基于流粒度，则只需要将完整性保护相关的安全处理放到SDAP层。如果用户面加解密和完整性保护处理都是基于流粒度，则都需要在SDAP层完成。所以基于流粒度的级别的安全处理的前提是，安全或部分安全放到SDAP层做。
比如一个会话中中有4个业务流(IP-flow)，3个QoS flow。NAS-level mapping表示第一次QoS处理。是将IP flow映射成为QoS flow。用QFI(QoS flow ID)表示。可以看到IP lfow1和IP flow4放到了QFI1中，其他的都是单独的一个QFI。在SDAP层，SDAP层会将不同给的QFI映射到不同的PDCP层。可以看到QFI1和QFI2被放到了一个PDCP Entity(PDCP实体)，就说明这QFI1和QFI2通过一个DRB传输。(一个PDCP实体对应一个DRB承载)QFI-3放到了另一个PDCP Entity-2，就是另一个DRB承载。
可选地，基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。或者，终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。基站允许的用户面完整性保护算法可根据当地运营商喜好，或者当地环境等内容进行优先级排序，可预先配置在基站上。终端设备支持的用户面完整性保护算法可根据终端设备入网签约内容，或/和终端设备的喜好等内容进行优先级排序，可以由终端设备在签约时或者购买更多服务的时候进行排序。可选地，安全策略中可包括终端设备支持的用户面 完整性保护算法。
可选地，在上述步骤222中，一种可选地实施方案中，安全策略中包括至少一个用户面完整性保护算法，基站直接将安全策略中包括的至少一个用户面完整性保护算法中的一个用户面完整性保护算法确定为目标用户面完整性保护算法。另一种可选地方案中，所述基站确定所述目标用户面完整性保护算法，包括：基站根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法。
基站确定目标用户面完整性保护算法可存在几种可选地实施方式，比如基站确定既属于终端设备支持的用户面完整性保护算法，也属于基站允许的用户面完整性保护算法的至少一个算法，从该至少一个算法中确定目标用户面完整性保护算法。可选地，若基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，则从至少一个算法中确定在基站允许的用户面完整性保护算法中优先级排序较高或者最高的算法作为目标用户面完整性保护算法。可选地，若终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，则基站从至少一个算法中确定在终端设备支持的用户面完整性保护算法中优先级排序较高或者最高的算法作为目标用户面完整性保护算法。
可选地，安全策略还包括服务网络允许的用户面完整性保护算法，可选地，服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。可选地，服务网络允许的用户面完整性保护算法可为预先配置在SMF上的。服务网络允许的用户面完整性保护算法的优先级可以根据运营商喜好，和\或当地环境等因素进行排序。可选地，基站根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法，包括：基站根据基站允许的用户面完整性保护算法，终端设备支持的用户面完整性保护算法，以及服务网络允许的用户面完整性保护算法，确定目标用户面完整性保护算法。具体的,服务网络允许的用户面完整性保护算法有优先级排序的时候，以服务网络允许的优先级排序为首要条件或以基站允许的优先级排序为首要条件进行选择，究竟根据哪个优先级排序由当地运营商的策略决定，也可以根据其他信息决定，比如当前基站允许的用户面完整性保护算法是近期更新的，而服务网络允许的用户面完整性保护算法的是很久之前更新的，则以基站允许的用户面完整性保护算法的优先级排序为首要条件；再比如，默认的就是以基站允许的用户面完整性保护算法的优先级排序为首要条件；如果服务网络允许的用户面完整性保护算法没有优先级排序的时候，则以基站允许的用户面完整性保护算法的优先级排序为首要条件。
基站确定目标用户面完整性保护算法可存在几种可选地实施方式，比如基站确定既属于终端设备支持的用户面完整性保护算法，也属于基站允许的用户面完整性保护算法，且还属于服务网络允许的用户面完整性保护算法的至少一个算法，从该至少一个算法中确定目标用户面完整性保护算法。可选地，若基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，则从至少一个算法中确定在基站允许的用户面完整性保护算法中优先级排序较高或者最高的算法作为目标用户面完整性保护算法。可选地，若终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，则基站从至少一个算法中确定在终端设备支持的用户面完整性保护算法中优先级排序较高或者最高的算法作为目标用户面完整性保护算法。可选地，若服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法，则基站从至少一个算法中确定在服务网络允许的用户面完整性保护算法中优先级排序较高或者最高的算法作为目标用户面完整 性保护算法。可选地，本申请实施例中网络可包括5G网络或由5G网络演进的网络。
可选地，方法还包括：当安全策略还包括加密指示信息，且加密指示信息用于指示基站对终端设备开启加密保护时，基站向终端设备发送目标用户面加密算法。
基于上述内容，下面介绍基站和终端设备还需协商目标用户面加密算法方法流程。
可选地，基站允许的用户面加密算法为按照优先级排序的用户面加密算法。或者，终端设备支持的用户面加密算法为按照优先级排序的用户面加密算法。基站允许的用户面加密算法可至少根据运营商喜好进行优先级排序，可以由运营商在建网时进行排序，可预先配置在基站上。终端设备支持的用户面加密算法可根据运营商喜好进行优先级排序，可以由用户在入网签约时进行排序。可选地，安全策略中可包括终端设备支持的用户面加密算法。
可选地，还包括一种可选地实施方案，安全策略中包括至少一个用户面加密算法，基站直接将安全策略中包括的至少一个用户面加密算法中的一个用户面加密算法确定为目标用户面加密算法。另一种可选地方案中，基站根据终端设备支持的用户面加密算法和基站允许的用户面加密算法，确定目标用户面加密算法。
基站确定目标用户面加密算法可存在几种可选地实施方式，比如基站确定既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法的至少一个算法，从该至少一个算法中确定目标用户面加密算法。可选地，若基站允许的用户面加密算法为按照优先级排序的用户面加密算法，则从至少一个既属于终端设备支持的用户面加密算法也属于基站允许的用户面加密算法中确定在基站允许的用户面加密算法中优先级排序较高或者最高的一个算法作为目标用户面加密算法。可选地，若终端设备支持的用户面加密算法为按照优先级排序的用户面加密算法，则基站从至少一个既属于终端设备支持的用户面加密算法也属于基站允许的用户面加密算法中确定在终端设备支持的用户面加密算法中优先级排序较高或者最高的算法作为目标用户面加密算法。
可选地，安全策略还包括服务网络允许的用户面加密算法，可选地,服务网络允许的用户面加密算法为按照优先级排序的用户面加密算法。可选地，服务网络允许的用户面加密算法可为预先配置在SMF上的。服务网络允许的用户面加密算法的优先级可以至少根据运营商喜好进行排序。可选地，基站根据终端设备支持的用户面加密算法和基站允许的用户面加密算法，确定目标用户面加密算法，包括：基站根据基站允许的用户面加密算法，终端设备支持的用户面加密算法，以及服务网络允许的用户面加密算法，确定目标用户面加密算法。具体的,服务网络允许的用户面加密算法有优先级排序的时候,以服务网络允许的优先级排序为首要条件进行选择；如果服务网络允许的用户面加密算法没有优先级排序的时候,则以基站允许的用户面安全算法的优先级为首要条件.
基站确定目标用户面加密算法可存在几种可选地实施方式，比如基站确定既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法的至少一个算法，从该至少一个既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法中确定目标用户面加密算法。可选地，若基站允许的用户面加密算法为按照优先级排序的用户面加密算法，则从至少一个既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法中确定在基站允许的用户面加密算法中优先级排序较高或者最高的算法作为目标用户面加密算法。可选地，若终端设备支持的用 户面加密算法为按照优先级排序的用户面加密算法，则基站从至少一个既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法中确定在终端设备支持的用户面加密算法中优先级排序较高或者最高的算法作为目标用户面加密算法。可选地，若服务网络允许的用户面加密算法为按照优先级排序的用户面加密算法，则基站从至少一个既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法中确定在服务网络允许的用户面加密算法中优先级排序较高或者最高的算法作为目标用户面加密算法。
可选地，当安全策略还包括密钥长度时，基站向终端设备发送密钥长度。密钥长度包括用户面完整性保护密钥长度和用户面加密密钥密钥长度。可选地，本申请实施例中基站向终端设备发送目标用户面完整性保护算法、目标用户面加密算法、密钥长度等信息时，可以通过一条信令，比如RRC重配置请求发送，或者通过多条信息发送。
一种可选地实施方式中，若使用RRC重配置请求发送的时候，则发送方式可以有多种，比如可以采用RRC重配置消息，该RRC重配置消息种可包括：目前用户面加密算法、目标用户面完整性保护算法、用户面加密密钥长度、用户面完整性保护密钥长度、密钥混合策略(也可称为D-H是否开启指示信息、DRB-1(QoS信息)、DRB-2(QoS信息)和其他参数中的至少一种。
一种可选地实施方式中，若用户面完整性不开启的时候，则不会传递目标用户面完整性保护算法,当算法本身可以指示密钥长度的时候,则密钥长度的指示信息是可以不携带的,当密钥混合策略基站不支持,或者不需要启用的时候,则也不需要传递。此方法因为没有在每个DRB中传递安全策略，所以适用于所有DRB都使用相同的安全能力的时候使用,并且可以通过一次选择过程为所有的DRB配置目标安全策略。
另一种可选地实施方式中，RRC重配置消息中可包括：
重配置参数；
DRB-1(目标用户面安加密算法-1,[目标用户面完整性保护算法-1],[用户面加密密钥长度-1],[用户面完整性保护密钥长度-1],[密钥混合策略],QoS参数,其他参数)；
DRB-2(目标用户面安加密算法-2,[目标用户面完整性保护算法-2],[用户面加密密钥长度-2],[用户面完整性保护密钥长度-2],[密钥混合策略]，QoS参数,其他参数),其他参数)。
该RRC重配置消息中仅仅示意性示出了DRB-1和DRB-2两种情况，RRC重配置消息中携带的格式可类似上述示例，其中的参数项可全部携带也可部分携带，比如上述示例中用[]标出的参数可以携带也可不携带。如此，可针对每个DRB配置目标安全策略,可以做到每个DRB的目标安全策略相同，也可以做到每个DRB的目标安全策略不同。
上面两种方法也可以结合使用，即某些目标安全策略可以所有DRB公用，某种安全策略针对DRB不同而不同，如RRC重配置消息包括：
目标用户面安加密算法；
DRB-1(,[目标用户面完整性保护算法-1],[用户面加密密钥长度-1],[用户面完整性保护密钥长度-1],[密钥混合策略],QoS参数,其他参数)；
DRB-2([目标用户面完整性保护算法-2],[用户面加密密钥长度-2],[用户面完整性保护密钥长度-2],[密钥混合策略]，QoS参数,其他参数)；
其他参数等。
可选地，在基站向终端设备发送目标用户面完整性保护算法之前，还包括：基站从SMF 实体接收终端设备的当前会话的服务质量。可选地，当前会话的服务质量可以和安全策略通过一条消息发送，也可通过多条消息分别发送。可选地，基站还从AMF接收一些用于生成密钥的基本信息，比如用于生成用户面完整性保护密钥的基础密钥，用于生成用户面加密密钥的基础密钥等等。
可选地，基站根据安全策略和服务质量中的至少一种，为终端设备分配无线数据承载(Data Radio Bearer，DRB)，无线数据承载由基站分配的。基站至少根据服务质量，为传递给终端设备的数据分配无线数据承载。在5G中，一个无线数据承载中，可能有多种服务质量对应的数据流。
可选地，一个DRB可以对应多个服务质量。根据安全策略和服务质量中的至少一种为终端设备分配目标无线数据承载。
可选地，当所述基站上不存在历史的无线数据承载满足所述第一条件，且不存在至少一个历史的无线数据承载满足所述第二条件时，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载。
可选地，当所述基站上不存在历史的无线数据承载满足所述第一条件时，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载。
可选地，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载。
可选地，可以为终端设备选择历史的以前建立的DRB作为目标无线数据承载，也可以新建一个DRB作为目标无线数据承载。
一种可选地实施方式中，可以直接先从历史的无线数据承载中为终端设备选择一个作为目标无线数据承载，若从历史的无线数据承载中选择不出，则为终端设备创建一个新的无线数据承载直接作为目标无线数据承载。
或者根据一些预设的规则，先确定是否允许该终端设备使用历史的无线数据承载，若允许，则可以先从历史的无线数据承载中为终端设备选择一个作为目标无线数据承载，若从历史的无线数据承载中选择不出，则为终端设备创建一个新的无线数据承载直接作为目标无线数据承载。为了更详细的介绍上述方案，下面通过以下几种详细的示例进行介绍。
实施方式b1
当基站上存在至少一个历史的无线数据承载满足第一条件时，目标无线数据承载为满足第一条件的至少一个历史的无线数据承载中的一个；其中，满足所述第一条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略相同。
可选地，第一条件包括：支持的服务质量和当前会话的服务质量相同，且步骤221获取的安全策略和支持的安全策略相同。
复用DRB的信息可以通过发送消息来实现，举个例子，比如第一次传递给终端设备：RRC重配置消息(目标用户面加密算法-1,DRB-1(QoS信息-1)，DRB-2(QoS信息-2),其他参数))；第二次传递给终端设备：RRC重配置消息(目前用户面加密算法-1,DRB-1(QoS信息-1)，DRB-2(QoS信息-2),DRB-3(目前用户面加密算法-2,QoS信息-2/3/4)其他参数))，则实现了修改DRB-2的安全策略，达到重用QoS的目的。通过该示例可以看到，通过发送信令实现了将历史的无线数据承载作为目标无线数据承载的目的。
再举一个例子，用于实现复用历史的DRB的目的，第一次传递给终端设备：RRC重配置消息(目标用户面加密算法-1,DRB-1(QoS信息-1)，DRB-2(QoS信息-2),其他参数))；第二次传递给终端设备：RRC重配置消息(目前用户面加密算法-1,DRB-1(QoS信息-1)，DRB-2(目前用户面加密算法-2,QoS信息-2),其他参数))，则实现了修改DRB-2的安全策略，重用QoS的目的。
实施方式b2
当基站上不存在历史的无线数据承载满足第一条件，但存在至少一个历史的无线数据承载满足第二条件时，目标无线数据承载为根据安全策略对满足第二条件的至少一个历史的无线数据承载中的一个进行更新后的无线数据承载，其中，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略相同；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略匹配。
可选地，第二条件包括：支持的服务质量的当前会话的服务质量匹配，获取的安全策略和支持的安全策略相同。或者，可选地，第二条件包括支持的服务质量的当前会话的服务质量相同，获取的安全策略和支持的安全策略匹配。或者，可选地，第二条件包括：支持的服务质量的当前会话的服务质量匹配，获取的安全策略和支持的安全策略匹配。
也就是说，找到历史的无线数据承载与目的无线数据承载对应的安全策略和服务质量的内容不完全相同，但是差别很小，比如带宽要求的差值在预设范围内，如此可以使用历史的无线数据承载做最小幅度的修改。比如，满足第二条件的无线数据承载与目标无线数据承载之间的关系可以满足：满足第二条件的无线数据承载开启用户面加密保护，但没有开启用户面完整性保护；而目标无线数据承载开启用户面加密保护，且开启用户面完整性保护，且满足第二条件的无线数据承载和目标无线数据承载的目标用户面加密算法相同。在该种情况下，由于基站资源受限了，无法创建新的，或者基站的设置就是想办法重用历史的无线数据承载，则基站利用多次发送RRC重配置消息，开启完整性保护就可以了。
本申请实施例提供一种可能的实现方式：基站在第一次传给终端设备的消息如：RRC重配置消息(目标用户面加密算法,DRB-1(QoS信息-1)，DRB-2(QoS信息-2),其他参数))；第二次这样传递则为RRC重配置消息(目前用户面加密算法,DRB-1(QoS信息-1)，DRB-2(目标用户面完整性保护算法，QoS信息-2，QoS信息-3),其他参数))，如此，可重用DRB-2的资源。当然具体实现有多种方式，这里只是举例。
实施方式b3
直接根据安全策略或服务质量中的至少一种，新建一个无线数据承载。
实施方式b4
基站会预先配置无线数据承载跟服务质量和安全策略这三者之间的关联关系，并且将每个关联关系设置对应的标识，比如无线接入/频率优先的用户配置文件标识(Subscriber Profile ID for RAT/Frequency Priority，SPID)。也就是说SMF不管根据session ID，IMSI，DNN，NSSAI中的任何一个或多个，也不管是否去了UDM，UPF和PCF查找，总之会得 到一个SPID。那么SMF将SPID下发给RAN，RAN通过SPID就可以找到预置的QoS策略和安全策略。这个时候SMF不需要下发任何安全策略，只需要下发SPID。然后RAN就可以根据SPID确定使用的DRB，使用的DRB会满足QoS策略和安全策略。
可选地，基站向终端设备发送目标用户面完整性保护算法，包括：基站通过无线资源控制(Radio Resource Control，RRC)信令向终端设备发送目标用户面完整性保护算法。可选地，RRC信令包括RRC重配置请求(RRC Connection reconfiguration request)。
可选地，若安全策略中指示基站和终端设备需要协商出目标用户面加密算法，则基站还需向终端设备发送目标用户面加密算法。可选地，基站还需向终端设备发送密钥长度，若安全策略中指示基站和终端设备需要协商出目标用户面加密算法，则密钥长度可包括用户面加密密钥长度，若完整性保护指示信息指示基站对终端设备开启完整性保护时，则密钥长度可包括用户面完整性保护密钥长度。目标用户面加密算法、目标用户面加密算法、密钥长度和服务质量中的一项或任多项可通过一条信令发送给终端设备。，比如RRC重配置请求。
可选地，当安全策略还包括D-H指示信息，且D-H指示信息用于指示基站对终端设备开启D-H时，基站向终端设备发送D-H相关密钥。下面举个例子，详细描述若D-H指示信息用于指示基站对终端设备开启D-H时，基站和终端设备之间的信令交互流程。
如果密钥混合策略开启，则基站会根据UE上报的D-H能力和基站允许的D-H能力进行选择，选择基站允许的优先级最高的D-H能力。并且基站根据选择出来的D-H能力，生成公钥P1和私钥B1，基站将公钥p1和选择出来的D-H能力发送给终端设备，比如可通过RRC重配置消息。终端设备基于选择的D-H能力，生成公钥P2和私钥B2，并利用私钥B2和公钥P1生成密钥Kdh。然后使用Kdh与Kan进行密钥混合，混合方法可以为New-Kan＝KDF(Kdh，Kan，其他参数)，其中，KDF(key derive function)为密钥生成函数，比如哈希256算法，其他参数可以为新鲜性参数，比如PDCP COUNT。也可以不使用其他参数，直接使用Kdh和Kan做密钥混合。密钥混合后，再根据New-Kan和目标用户面安全算法生成新用户面密钥。并使用新用户面密钥，对RRC重配置消息进行保护后发送给基站，RRC重配置消息中，含有公钥P2。基站在得到公钥P2后，根据公钥P2和私钥B1，采用与终端设备相同的方法生成New-Kan，并进一步使用与终端设备相同的方法得到新用户面密钥。并使用新用户面密钥研制RRC重配置消息。如果验证成功，则基站开始启用新用户面密钥。
在图2a或图2b所示实施例的一种可选地实施方式中，在上述图2b的步骤213之后还包括基站接收到安全策略或安全策略的标识，则基站可以根据安全策略中提供的信息选择安全策略中的一个用户面完整性保护算法作为目标用户面完整性保护算法，其中，安全策略中可以包括一个或多个用户面完整性保护算法；或者，基站也可以不使用安全策略中的用户面完整性保护算法作为目标用户面完整性保护算法；或者，基站在安全策略中的用户面完整性保护算法不在基站允许的用户面完整性保护算法列表中的情况下，不使用安全策略中的用户面完整性保护算法作为目标用户面完整性保护算法。进一步可选地，当不使用安全策略中的用户面完整性保护算法作为目标用户面完整性保护算法的情况下，若基站开启用户面完整性保护，则可以在除安全策略中的用户面完整性保护算法之外的用户面完整性保护算法中选择一个作为目标用户面完整性保护算法，比如可以从基站允许的用户面完整性保护算法中选择一个作为目标用户面完整性保护算法；再比如，若基站中预配置安全 策略，则基站在未收到其它网元下发的安全策略的情况下，基站可以根据基站中预配置的安全策略选择目标用户面完整性保护算法等，比如预配置的安全策略中可以包括一个或多个用户面完整性保护算法，基站从预配置的安全策略中选择一个作为目标用户面完整性保护算法。其它更多实施方式可参见前述内容。
可选地，上述安全策略中的用户面完整性保护算法可以是前述内容中所述的安全策略中所包括的服务网络允许的用户面完整性保护算法，也可以是SMF实体根据服务网络允许的用户面完整性保护算法、终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法中的至少一项确定的。比如，SMF实体可以将既属于终端设备支持的用户面完整性保护算法，也属于基站允许的用户面完整性保护算法的一个算法中确定为目标用户面完整性保护算法。再比如，SMF实体可以将既属于终端设备支持的用户面完整性保护算法，也属于基站允许的用户面完整性保护算法，且还属于服务网络允许的用户面完整性保护算法的一个算法确定为目标用户面完整性保护算法。
其中，上述安全策略中可以包括信令面完整性保护算法，也就是说，安全策略中可以包括信令面完整性保护算法和/或用户面完整性保护算法。比如，安全策略中包括的用户面完整性保护算法，也是信令面完整性保护算法，也就是说，安全策略中包括的完整性保护算法，即同时用于用户面完整性保护和信令面完整性保护。
本领域技术人员可知，基站选择目标用户面加密算法、目标信令面完整性保护算法和目标信令面加密算法的实施方式有多种，可以参见上述选择目标用户面完整性保护算法的方案描述，下面简单列举几种实施方式。
在图2a或图2b所示实施例的一种可选地实施方式中，在上述图2b的步骤213之后还包括基站接收到安全策略或安全策略的标识，则基站可以根据安全策略中提供的信息选择安全策略中的一个用户面加密算法作为目标用户面加密算法，其中，安全策略中可以包括一个或多个用户面加密算法；或者，基站也可以不使用安全策略中的用户面加密算法作为目标用户面加密算法；或者，基站在安全策略中的用户面加密算法不在基站允许的用户面加密算法列表中的情况下，不使用安全策略中的用户面加密算法作为目标用户面加密算法。进一步可选地，当不使用安全策略中的用户面加密算法作为目标用户面加密算法的情况下，若基站开启用户面加密保护，则可以在除安全策略中的用户面加密算法之外的用户面加密算法中选择一个作为目标用户面加密算法，比如可以从基站允许的用户面加密算法中选择一个作为目标用户面加密算法，其它更多实施方式可参见前述内容。
可选地，上述安全策略中的用户面加密算法可以是前述内容中所述的安全策略中所包括的服务网络允许的用户面加密算法，也可以是SMF实体根据服务网络允许的用户面加密算法、终端设备支持的用户面加密算法和基站允许的用户面加密算法中的至少一项确定的。比如，SMF实体可以将既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法的一个算法中确定为目标用户面加密算法。再比如，SMF实体可以将既属于终端设备支持的用户面加密算法，也属于基站允许的用户面加密算法，且还属于服务网络允许的用户面加密算法的一个算法确定为目标用户面加密算法。
其中，上述安全策略中可以包括信令面加密算法，也就是说，安全策略中可以包括信令面加密算法和/或用户面加密算法。比如，安全策略中包括的用户面加密算法，也是信令面加密算法，也就是说，安全策略中包括的加密算法，即同时用于用户面加密保护和信令面加密保护。
可选地，在图2a所示实施例的一种实施方式中，图2a所示的方法还包括：终端设备获取目标用户面完整性保护算法。具体可以采用如下两种方式：
方式一、终端设备接收基站发送的目标用户面完整性保护算法。例如，图2b中步骤223基站向终端设备发送的目标用户面完整性保护算法，相应地，终端设备接收该基站发送的目标用户面完整性保护算法。
方式二、终端设备确定目标用户面完整性保护算法。比如，终端设备沿用之前使用的目标用户面完整性保护算法；再比如，终端设备将目标信令面完整性保护算法(其中，该目标信令面完整性保护算法可以由基站发送给该终端设备)确定为目标用户面完整性保护算法。如此可提高终端设备确定目标用户面完整性保护算法的灵活性。
此外，终端设备还可以确定目标用户面加密算法，比如，终端设备沿用之前使用的目标用户面加密算法；再比如，终端设备将目标信令面加密算法确定为目标用户面加密算法。
在上述图2所示实施例的一种实施方式中，图2所示的方法还包括：基站确定目标用户面完整性保护算法和/或目标用户面加密算法。比如，可以将步骤202中确定的目标信令面保护算法中的目标信令面完整性保护算法也作为目标用户面完整性保护算法，可以将步骤202中确定的目标信令面保护算法中的目标信令面加密算法也作为目标用户面加密算法。
可选地，在上述图2、图2a和图2b所示的实施例中的一种实现方式中，还包括：
基站开启用户面完整性保护；或者，终端设备和基站开启用户面完整性保护；或者，终端设备开启用户面完整性保护。
下面以基站为例对开启用户面完整性保护或开启用户面加密保护进行说明：
示例性地，当满足基站开启用户面完整性保护的条件时，基站开启用户面完整性保护。
其中，上述基站开启用户面完整性保护的条件可以是基站收到第一预设用户面消息，例如，会话建立接受消息；还可以是基站收到用户面信息，例如，会话ID或Qos Profile，其中，该用户面信息可以指预设的用户面信息，例如，预设的会话ID或预设的Qos Profile，该预设的会话ID可以指特定的会话ID；也可以是基站当前为终端设备分配用户面资源或者为终端设备重新分配用户面资源，例如，基站接收到请求为终端设备分配用户面资源的消息；若基站当前在为终端设备重新分配用户面资源，且网络运行参数满足预设网络允许条件，则可以开启用户面完整性保护；也可以是基站接收到的安全策略中包含完整性保护指示信息，且该完整性保护指示信息指示开启用户面完整性保护；也可以是预设的会话的业务类型，例如预配置的安全策略中可以包括预设的会话的业务类型与开启用户面完整性保护的关联关系，在收到预设的会话的业务类型时则可以开启用户面完整性保护。
当满足基站开启用户面完整性保护的条件时，基站开启用户面完整性保护的几种可选地具体实施方式可以参见下述实施方式c1-a1至实施方式c1-a7。
实施方式c1-a1
例如，基站在在预设时间段内收到第一预设用户面消息时可以开启用户面完整性保护；第一预设用户面消息可以是会话建立接受消息。
举个例子，如果基站在预设时间段内收到会话建立接受消息(也可以称之为会话建立完成)，则说明基站当前处于会话建立流程中，则为了提高用户面信令安全性，可以开启用户面完整性保护。
实施方式c1-a2
基站在在预设时间段内收到用户面信息时，可以开启用户面完整性保护，其中，用户 面信息可以是会话ID或预设的Qos Profile。
举个例子，基站若在预设时间段内收到任一会话ID或任一QoS profile(可选地，可以从N2口接收，也可以直接从终端设备侧获得)，则基站当前处于会话建立流程，则开启用户面完整性保护。可选地，还可以开启信令面保护。
可选地，开启信令面保护可以是开启信令面完整性保护和开启信令面加密保护中的至少一项。本段说明适用于本申请所有实施例，下述内容中不再重述。
实施方式c1-a3
基站在预设时间段内收到预设用户面信息时，可以开启用户面完整性保护。其中，预设用户面信息可以是预设的会话ID或预设的Qos Profile。基站中预设用户面信息和是否开启用户面完整性保护的关联关系，该预设用户面信息和是否开启用户面完整性保护的关联关系可以作为基站中预配置的安全策略中的一部分。
举个例子，设置是否开启用户面完整性保护和会话ID二者之间的关联关系，如此，基站在预设时间段内若接收到预设的会话ID，则开启用户面完整性保护。其中，预设的会话ID在是否开启用户面完整性保护和会话ID二者之间的关联关系中所对应的是开启用户面完整性保护。
再举个例子，设置是否开启用户面完整性保护和Qos Profile二者之间的关联关系，如此，基站在预设时间段内若接收到预设的Qos Profile，则开启用户面完整性保护。其中，预设的会话ID在是否开启用户面完整性保护和会话ID二者之间的关联关系中所对应的是开启用户面完整性保护。
进一步，是否开启用户面完整性保护和会话ID二者之间的关联关系可以是预设在基站中的，也可以有基站接收到的其它网元发送的更新后的关联关系。可选的，基站可以根据预设的关联关系和更新后的关联关系，决定是否开启用户完整性保护。比如，在首次开启用户面完整性保护的时候，可以依据预设的关联关系决定是否开启用户完整性保护；当后续有更新的关联关系时，也可以仅依据最新的关联关系确定是否开启用户面完整性保护。还可以结合具体的预设的关联关系、更新的关联关系和网络负荷情况进行综合判定，比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面完整性保护。
实施方式c1-a4
若基站当前在为终端设备分配用户面资源或者为终端设备重新分配用户面资源，则可以开启用户面完整性保护。例如，基站在预设时间段内接收到请求为终端设备分配用户面资源的消息，则基站为终端设备分配用户面资源或为终端设备重新分配用户面资源，该流程中涉及到用户面信令，为了提高用户面信令的安全性，则可以开启用户面完整性保护。
实施方式c1-a5
若基站当前在为终端设备重新分配用户面资源，且网络运行参数满足预设网络允许条件，则可以开启用户面完整性保护；其中，网络运行参数包括网络负荷量和/或丢包率。
需要指出的是，在基站重新为一个会话分配资源的过程中，可以采用如下两种可选的实施方式：
方式一，沿用终端设备的该会话之前所分配的资源对应的用户面安全方案，比如终端设备的会话之前所分配的资源对应的是开启用户面完整性保护，则终端设备的该会话对应的重新分配的资源对应的也是开启用户面完整性保护。
方式二，根据基站的状态重新确定该会话对应的重新分配的资源对应的用户面安全方案。比如，基站的状态显示某个会话丢包率过高，因为用户面完整性保护是附升高丢包率的，因此在为这个会话重新分配资源的过程中，关掉用户面完整性保护。再比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面完整性保护。
显然上述两种可选地实施方式可以结合，比如，如果基站重新为一个会话分配资源，那么若基站的状态正常，则维持开启用户面完整性保护；或者，若基站的状态异常，如基站因为过载再为这个会话重新分配资源，那么如果这个会话原来开启了用户面完整性保护，则关掉用户面完整性保护，再比如某个会话丢包率过高，因此为这个会话重新分配资源，因为用户面完整性保护是附升高丢包率的，因此关掉用户面完整性保护。可选的，这种情况可作为安全策略的一部分预配置在基站内(预配置在基站内的安全策略也可如上述内容所述为预配置在基站内的安全策略)。
实施方式c1-a6
若基站接收到的安全策略中包括完整性保护指示信息，且该完整性保护指示信息指示开启用户面完整性保护，则基站可以开启用户面完整性保护。可选地，完整性保护指示信息可以是完整性保护算法的标识、比特位指示信息、也可以是预设的信息。该完整性保护指示信息可以是比如SMF实体发送的。SMF实体在确定满足SMF实体用户面完整性保护条件时发送指示开启用户面完整性保护的完整性保护指示信息，其中，SMF实体在确定满足SMF实体用户面完整性保护条件的方式有多种实施方式，也可以参见实施方式c1-a1至实施方式c1-a5中所描述的基站的实施方式。
实施方式c1-a7
基站中可以预配置安全策略，预配置的安全策略中可以包括预设的会话的业务类型与开启用户面完整性保护的关联关系。基站开启用户面完整性保护的条件可以是基站预配置的安全策略中包含的预设的会话的业务类型。例如预配置的安全策略中可以包括预设的会话的业务类型与开启用户面完整性保护的关联关系，在收到预设的会话的业务类型时则可以开启用户面完整性保护。可选地，若基站没有收到网元发送的安全策略，那么可以使用基站中预配置的安全策略。
举个例子，基站中预配置的安全策略可以是以用户面数据(比如业务类型)为维度去规定的，比如基站中预配置的安全策略中规定：VoIP业务对应的流程不开启用户面完整性保护，则基站在判断当前会话对应VoIP业务时，不开启用户面完整性保护。
进一步，安全策略可以是预设预配置在基站中的，也可以有基站接收到的其它网元发送的更新后的安全策略。可选的，基站可以根据预配置的安全策略和更新后的安全策略，决定是否开启用户完整性保护。比如，在首次开启用户面完整性保护的时候，可以依据预配置的安全策略决定是否开启用户完整性保护；当后续有更新的安全策略时，也可以仅依据最新的安全策略确定是否开启用户面完整性保护。还可以结合具体的预配置的安全策略、更新的安全策略和网络负荷情况进行综合判定，比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面完整性保护。
进一步可选地，上述方法还包括：基站向终端设备发送完整性保护指示信息，该加密指示信息用于指示开启用户面完整性保护。其中，该完整性指示信息可以是基站接收的安全策略中包含的完整性保护指示信息。
可选地，在上述图2、图2a和图2b所示的实施例中的另一种实现方式中，还包括：
基站开启用户面加密保护；或者，终端设备和基站开启用户面加密保护；或者，终端设备开启用户面加密保护。
示例性地，当满足基站开启用户面加密保护的条件时，基站开启用户面加密保护。
其中，上述基站开启用户面加密保护的条件可以是基站收到第一预设用户面消息，例如，会话建立接受消息；还可以是基站收到用户面信息，例如，会话ID或Qos Profile，其中，该用户面信息可以指预设的用户面信息，例如，预设的会话ID或预设的Qos Profile，该预设的会话ID可以指特定的会话ID；也可以是基站当前为终端设备分配用户面资源或者为终端设备重新分配用户面资源，例如，基站接收到请求为终端设备分配用户面资源的消息；也可以是基站接收到的安全策略中包含加密指示信息，且该加密指示信息指示开启用户面加密保护；也可以是预设的会话的业务类型，例如预配置的安全策略中可以包括预设的会话的业务类型与开启用户面加密保护的关联关系，在收到预设的会话的业务类型时则可以开启用户面加密保护；也可以是开启信令面保护时则可以开启用户面加密保护。
进一步可选地，上述方法还包括：基站向终端设备发送加密指示信息，该加密指示信息用于指示开启用户面加密保护。其中，该加密指示信息可以是基站接收的安全策略中包含的加密指示信息。
基站开启用户面加密保护的条件时，基站开启用户面加密保护的几种可选地具体实施方式可以参见下述实施方式c1-b1至实施方式c1-b8。
实施方式c1-b1
例如，基站在在预设时间段内收到第一预设用户面消息时可以开启用户面加密保护；第一预设用户面消息可以是会话建立接受消息。
举个例子，如果基站在预设时间段内收到会话建立接受消息(也可以称之为会话建立完成)，则说明基站当前处于会话建立流程中，则为了提高用户面信令安全性，可以开启用户面加密保护。
实施方式c1-b2
基站在在预设时间段内收到用户面信息时，可以开启用户面加密保护，其中，用户面信息可以是会话ID或预设的Qos Profile。
举个例子，基站若在预设时间段内收到任一会话ID或任一QoS profile(可选地，可以从N2口接收，也可以直接从终端设备侧获得)，则基站当前处于会话建立流程，则开启用户面加密保护。可选地，还可以开启信令面保护。
可选地，开启信令面保护可以是开启信令面加密保护和开启信令面加密保护中的至少一项。本段说明适用于本申请所有实施例，下述内容中不再重述。
实施方式c1-b3
基站在预设时间段内收到预设用户面信息时，可以开启用户面加密保护。其中，预设用户面信息可以是预设的会话ID或预设的Qos Profile。基站中预设用户面信息和是否开启用户面加密保护的关联关系，该预设用户面信息和是否开启用户面加密保护的关联关系可以作为基站中预配置的安全策略中的一部分。
举个例子，设置是否开启用户面加密保护和会话ID二者之间的关联关系，如此，基站在预设时间段内若接收到预设的会话ID，则开启用户面加密保护。其中，预设的会话ID在是否开启用户面加密保护和会话ID二者之间的关联关系中所对应的是开启用户面加密 保护。
再举个例子，设置是否开启用户面加密保护和Qos Profile二者之间的关联关系，如此，基站在预设时间段内若接收到预设的Qos Profile，则开启用户面加密保护。其中，预设的会话ID在是否开启用户面加密保护和会话ID二者之间的关联关系中所对应的是开启用户面加密保护。
进一步，是否开启用户面加密保护和会话ID二者之间的关联关系可以是预设在基站中的，也可以有基站接收到的其它网元发送的更新后的关联关系。可选的，基站可以根据预设的关联关系和更新后的关联关系，决定是否开启用户加密保护。比如，在首次开启用户面加密保护的时候，可以依据预设的关联关系决定是否开启用户加密保护；当后续有更新的关联关系时，也可以仅依据最新的关联关系确定是否开启用户面加密保护。还可以结合具体的预设的关联关系、更新的关联关系和网络负荷情况进行综合判定，比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面加密保护。
实施方式c1-b4
若基站当前在为终端设备分配用户面资源或者为终端设备重新分配用户面资源，则可以开启用户面加密保护。例如，基站在预设时间段内接收到请求为终端设备分配用户面资源的消息，则基站为终端设备分配用户面资源或为终端设备重新分配用户面资源，该流程中涉及到用户面信令，为了提高用户面信令的安全性，则可以开启用户面加密保护。
实施方式c1-b5
若基站当前在为终端设备重新分配用户面资源，且网络运行参数满足预设网络允许条件，则可以开启用户面加密保护；其中，网络运行参数包括网络负荷量和/或丢包率。
需要指出的是，在基站重新为一个会话分配资源的过程中，可以采用如下两种可选的实施方式：
方式一，沿用终端设备的该会话之前所分配的资源对应的用户面安全方案，比如终端设备的会话之前所分配的资源对应的是开启用户面加密保护，则终端设备的该会话对应的重新分配的资源对应的也是开启用户面加密保护。
方式二，根据基站的状态重新确定该会话对应的重新分配的资源对应的用户面安全方案。比如，基站的状态显示某个会话丢包率过高，因为用户面加密保护是附升高丢包率的，因此在为这个会话重新分配资源的过程中，关掉用户面加密保护。再比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面加密保护。
显然上述两种可选地实施方式可以结合，比如，如果基站重新为一个会话分配资源，那么若基站的状态正常，则维持开启用户面加密保护；或者，若基站的状态异常，如基站因为过载再为这个会话重新分配资源，那么如果这个会话原来开启了用户面加密保护，则关掉用户面加密保护，再比如某个会话丢包率过高，因此为这个会话重新分配资源，因为用户面加密保护是附升高丢包率的，因此关掉用户面加密保护。可选的，这种情况可作为安全策略的一部分预配置在基站内(预配置在基站内的安全策略也可如上述内容所述为预配置在基站内的安全策略)。
实施方式c1-b6
若基站接收到的安全策略中包括加密保护指示信息，且该加密保护指示信息指示开启 用户面加密保护，则基站可以开启用户面加密保护。可选地，加密保护指示信息可以是加密算法的标识、比特位指示信息、也可以是预设的信息。该加密保护指示信息可以是比如SMF实体发送的。SMF实体在确定满足SMF实体用户面加密保护条件时发送指示开启用户面加密保护的加密保护指示信息，其中，SMF实体在确定满足SMF实体用户面加密保护条件的方式有多种实施方式，也可以参见实施方式c1-b1至实施方式c1-b5中所描述的基站的实施方式。
实施方式c1-b7
基站中可以预配置安全策略，预配置的安全策略中可以包括预设的会话的业务类型与开启用户面加密保护的关联关系。基站开启用户面加密保护的条件可以是基站预配置的安全策略中包含的预设的会话的业务类型。例如预配置的安全策略中可以包括预设的会话的业务类型与开启用户面加密保护的关联关系，在收到预设的会话的业务类型时则可以开启用户面加密保护。可选地，若基站没有收到网元发送的安全策略，那么可以使用基站中预配置的安全策略。
举个例子，基站中预配置的安全策略可以是以用户面数据(比如业务类型)为维度去规定的，比如基站中预配置的安全策略中规定：VoIP业务对应的流程不开启用户面加密保护，则基站在判断当前会话对应VoIP业务时，不开启用户面加密保护。
进一步，安全策略可以是预设预配置在基站中的，也可以有基站接收到的其它网元发送的更新后的安全策略。可选的，基站可以根据预配置的安全策略和更新后的安全策略，决定是否开启用户加密保护。比如，在首次开启用户面加密保护的时候，可以依据预配置的安全策略决定是否开启用户加密保护；当后续有更新的安全策略时，也可以仅依据最新的安全策略确定是否开启用户面加密保护。还可以结合具体的预配置的安全策略、更新的安全策略和网络负荷情况进行综合判定，比如，如基站因为过载再为会话重新分配资源，那么在重新为该会话分配资源的过程中，关闭该会话原来开启的用户面加密保护。
实施方式c1-b8
基站在开启信令面保护(开启信令面完整性保护和/或信令面加密保护)时可以也开启用户面加密保护。比如在上述图2所示的实施方式中，在步骤202之后还包括一种可选地实施方式，基站在开启信令面保护时，也开启用户面加密保护。
在这种实施方式下，若终端设备和基站开启了信令面保护，但是未开启用户面完整性保护且未开启用户面加密保护，在开启用户面完整性保护且开启用户面加密保护时，可以继续维持开启信令面保护的状态，这种实施方式下，基站可以向终端设备发送完整性保护指示信息和加密指示信息，如此，终端设备一方面可以维持当前信令面保护的开启状态(比如若终端设备之前开启了信令面完整性保护未开启信令面加密保护，则继续维持信令面完整性保护且不开启信令面加密保护的状态)，另一方面根据用于完整保护指示信息开启用户面完整性保护，且根据加密指示信息开启用户面加密保护。
另一种可选地实施方案中，若终端设备和基站开启了信令面保护，且已经开启用户面加密保护，但是未开启用户面完整性保护，在开启用户面完整性保护时，基站可以只向终端设备发送用于开启用户面完整性保护的完整性保护指示信息，终端设备一方面可以维持当前信令面保护的开启状态(比如若终端设备之前开启了信令面完整性保护未开启信令面加密保护，则继续维持信令面完整性保护且不开启信令面加密保护的状态)，另一方面根据完整保护指示信息开启用户面完整性保护，加密保护持续开启。另一种可选地实施方式 中，可以再次传输加密指示信息，用于指示用户面加密保护持续开启。
下面以终端设备为例对开启用户面完整性保护或开启用户面完整性保护进行说明：
当满足终端设备开启用户面完整性保护的条件时，终端设备开启用户面完整性保护。
其中，终端设备开启用户面完整性保护的条件可以终端设备接收基站发送的完整性保护指示信息，且该完整性保护指示信息指示开启用户面完整性保护；还可以是终端设备发送第二预设用户面消息，例如，会话建立请求消息。
当满足终端设备开启用户面完整性保护的条件时，终端设备开启用户面完整性保护的几种可选地具体实施方式可以参见下述实施方式c1-c1至实施方式c1-c2。
实施方式c1-c1
在上述图2a和图2b所示的实施例中的一种可选地实施方式中，在步骤211之后还包括：基站向终端设备发送完整性保护指示信息，该完整性保护指示信息用于指示是否开启用户面完整性保护。其中，该完整性保护指示信息可以是基站在上述图2b的布置221中获取的安全策略中包含的完整性保护指示信息，也可以是基站在通过上述实施方式c1-a1至c1-a7中的任一种实施方式确定的。
终端设备在接收到完整性保护指示信息，且该完整性保护指示信息指示开启用户面完整性保护，则终端设备可以开启用户面完整性保护。
实施方式c1-c2
举个例子，终端设备在预设时间段内发送了会话建立请求消息，终端设备当前则处于会话建立流程中，在这种情况下，为了提高用户面安全性，终端设备可以开启用户面完整性保护。
进一步可选地，若终端设备采用实施方式c1-c2，且终端设备还收到了完整性保护指示信息，若二者出现矛盾，则终端设备以收到的完整性保护指示信息为依据去确定是否开启用户面完整性保护。
在上述图2a和图2b所示的实施例中的一种可选地实施方式中，在步骤211之后还包括：基站向终端设备发送加密指示信息，该加密指示信息用于指示是否开启用户面加密保护。其中，该加密指示信息可以是基站在上述图2b的布置221中获取的安全策略中包含的加密指示信息，也可以是基站在通过上述实施方式c1-a1至c1-a7中的任一种实施方式确定的。
例如，终端设备在接收到加密指示信息，且该加密指示信息指示开启用户面加密保护，则终端设备可以开启用户面加密保护。
例如，终端设备在预设时间段内发送第二预设用户面消息，则可以开启用户面加密保护。举个例子，终端设备在预设时间段内发送了会话建立请求消息，终端设备当前则处于会话建立流程中，在这种情况下，为了提高用户面安全性，终端设备可以开启用户面加密保护。
进一步可选地，若终端设备采用实施方式c1-c2，且终端设备还收到了加密指示信息，若二者出现矛盾，则终端设备以收到的加密指示信息为依据去确定是否开启用户面加密保护。
再例如，终端设备在开启信令面保护(开启信令面加密保护和/或信令面加密保护)时可以也开启用户面加密保护。比如在上述图2所示的实施方式中，在步骤203和步骤204之间，还包括基站在开启信令面保护时，也可以开启用户面加密保护。
终端设备可以根据预设时间段内是否发送第二预设用户面消息判断是否开启信令面保护(信令面完整性保护和/或信令面加密保护)。第二预设信令面消息可以包括注册请求或服务请求。具体来说，当前所处的流程确定终端设备当前发起的是注册请求(或服务请求)，则确定当前所处的流程为注册流程(或服务流程)，由于该流程中还未收到用户面资源分配信息，终端设备可以开启信令面保护。
进一步可选地，终端设备可以根据接收到的信令面完整性保护指示信息确定是否开启信令面的完整性保护，可以根据接收到的信令面加密指示信息确定是否开启信令面的加密保护。其中，终端设备接收到的信令面完整性保护指示信息和信令面加密指示信息中的至少一项也可以是由其它网元发送给基站，并由基站转发给终端设备的。其它网元比如可以是SMF实体等。
可选地，在上述图2、图2a和图2b所示的实施例中的一种实现方式中，还包括：
基站不开启用户面完整性保护；或者，终端设备和基站不开启用户面完整性保护。
下面以基站不开启用户面完整性保护为例进行说明：
当满足基站不开启用户面完整性保护的条件时，基站不开启用户面完整性保护。
其中，上述基站不开启用户面完整性保护的条件可以是基站接收到第一预设的信令面消息，例如，注册请求完整消息或服务请求完成消息；还可以基站在预设时间段内未收到用户面信息或预设的用户面信息，例如，会话ID，QoS profile，或者，预设的会话ID，预设的QoS profile；也可以是基站在预设时间段内未收到为终端设备分配用户面资源或为终端设备重新分配用户面资源的请求消息，例如，资源分配请求消息；也可以是基站接收的安全策略包含的完整性保护指示信息指示不开启用户面完整性保护；也可以是会话的业务类型不是预设的会话的业务类型，例如预配置的安全策略中可以包括预设的话的业务类型与开启用户面完整性保护的关联关系，在未收到预设的会话的业务类型时则可以不开启用户面完整性保护。
例如，当预设的默认条件指示基站是永久不开启时，不生成用户面完整性保护密钥。
可选地，在上述图2、图2a和图2b所示的实施例中的一种实现方式中，还包括：
基站不开启用户面加密保护；或者，终端设备和基站不开启用户面加密保护。
下面以基站不开启用户面加密保护为例进行说明：
当满足基站不开启用户面加密保护的条件时，基站不开启用户面加密保护。
其中，上述基站不开启用户面加密保护的条件可以是基站接收到第一预设的信令面消息，例如，注册请求完整消息或服务请求完成消息；还可以基站在预设时间段内未收到用户面信息或预设的用户面信息，例如，会话ID，QoS profile，或者，预设的会话ID，预设的QoS profile；也可以是基站在预设时间段内未收到为终端设备分配用户面资源或为终端设备重新分配用户面资源的请求消息，例如，资源分配请求消息；也可以是基站接收的安全策略包含的完整性保护指示信息指示不开启用户面加密保护；也可以是会话的业务类型不是预设的会话的业务类型，例如预配置的安全策略中可以包括预设的话的业务类型与开启用户面加密保护的关联关系。
例如，当预设的默认条件指示基站是永久不开启时，不生成用户面加密密钥。
下面以终端设备不开启用户面完整性保护为例进行说明：
当满足终端设备不开启用户面完整性保护的条件时，终端设备不开启用户面完整性保护。
其中，上述终端设备不开启用户面完整性保护的条件可以是在预设时间段内终端设备未发送第二预设用户面消息，例如，会话建立请求消息；还可以是终端设备接收基站发送的完整性保护指示信息，且该完整性保护指示信息指示开启用户面完整性保护；还可以是终端设备在预设时间段内接收到第一预设的信令面消息，例如，注册请求完整消息或服务请求完成消息。
例如，当预设的默认条件指示终端设备是永久不开启时，不生成用户面完整性保护密钥。
例如，当预设的默认条件指示基站是永久不开启时，不生成用户面加密密钥。
下面以终端设备不开启用户面加密保护为例进行说明：
当满足终端设备不开启用户面加密保护的条件时，终端设备不开启用户面加密保护。
其中，上述终端设备不开启用户面加密保护的条件可以是在预设时间段内终端设备未发送第二预设用户面消息，例如，会话建立请求消息；还可以是终端设备接收基站发送的加密保护指示信息，且该加密保护指示信息指示不开启用户面加密保护。
例如，当预设的默认条件指示终端设备是永久不开启时，不生成用户面加密密钥。
其中，终端设备或基站不开启用户面的完整性保护有多种实施方式，如下：
不开启用户面的完整性保护方式一，终端设备或基站不开启用户面完整性保护可以为：生成用户面完整性保护密钥，但是不使用用户面完整性保护密钥进行用户面完整性保护。也就是说，在不开启用户面完整性保护时可以先生成用户面完整性保护密钥，但是不使用用户面完整性保护密钥，然后在开启用户面完整性保护的情况下，使用用户面完整性保护密钥进行用户面完整性保护。
在上述不开启用户面的完整性保护方式一中，在终端设备生成用户面完整性保护密钥之前获取用户面完整性保护算法，比如可以将信令面完整性保护算法作为用户面完整性保护算法。
不开启用户面的完整性保护方式二，终端设备或基站不开启用户面完整性保护可以为：生成用户面完整性保护密钥，并使用用户面完整性保护密钥进行用户面完整性保护。也就是说，在无法确定是否开启用户面完整性保护或者确定不开启用户面完整性保护时，可以不生成用户面完整性保护密钥，在开启用户面完整性保护时再生成用户面完整性密钥。
相对应的，比如针对终端设备和基站，若确定终端设备和基站始终不开启用户面完整性保护(比如可以是预设的条件等等)，则可以不生成用户面完整性保护密钥。
其中，基站和终端设备不开启用户面的完整性保护的实施方式可以相同，也可以不同，比如都使用不开启用户面的完整性保护方式一，或者终端设备使用不开启用户面的完整性保护方式一，基站使用不开启用户面的完整性保护方式二。
终端设备或基站不开启用户面的加密保护有多种实施方式，如下：
不开启用户面的加密保护方式一，终端设备或基站不开启用户面加密保护包括：生成用户面加密保护密钥，但是不使用用户面加密保护密钥进行用户面加密保护。也就是说，在不开启用户面加密保护时可以先生成用户面加密保护密钥，但是不使用，在开启用户面加密保护的情况下，使用用户面加密保护密钥进行用户面加密保护。
在不开启用户面的加密保护方式一种，在终端设备生成用户面加密保护密钥之前获取用户面加密算法，比如可以将信令面加密算法作为用户面加密算法。
不开启用户面的加密保护方式二，终端设备或基站不开启用户面加密保护包括：在开 启用户面加密保护时生成用户面加密保护密钥，并使用用户面加密保护密钥进行用户面加密保护。也就是说，在无法确定是否开启用户面加密保护或者确定不开启用户面加密保护时，可以不生成用户面加密保护密钥，在开启用户面加密保护时再生成用户面完整性密钥。
相对应的，比如针对终端设备和基站，若确定终端设备和基站始终不开启用户面加密保护(比如可以是预设的条件等等)，则可以不生成用户面加密保护密钥。
其中，基站和终端设备不开启用户面的加密保护的实施方式可以相同，也可以不同，比如都使用不开启用户面的加密保护方式一，或者终端设备使用不开启用户面的加密保护方式一，基站使用不开启用户面的加密保护方式二。
此外，基站和终端设备开启用户面加密保护有多种实施方式，比如可以根据预设的规定确定是否开启用户面加密保护，预设的规定可以是终端设备在接收到AS安全模式命令后开启用户面加密保护，也就是说满足基站用户面加密保护条件包括接收到AS安全模式命令。基于该示例，举个例子，比如满足终端设备用户面完整性保护条件包括终端设备接收到指示开启用户面完整性保护的完整性保护指示信息，也就是说，终端设备在接收到AS安全模式命令后开启用户面加密保护，而用户面完整性保护是否开启需要基站通过发送完整性保护指示信息通知终端设备，这种情况下终端设备在没有收到完整性保护指示信息的情况下，不开启用户面完整性保护。进一步，当终端设备接收到指示开启用户面完整性保护的完整性保护指示信息的情况下，开启用户面完整性保护。换言之，终端设备在一个时间段内不开启用户面完整性保护，但是在另一个时间段内有可能开启用户面完整性保护，也就是说终端设备不开启用户面完整性保护是暂时的，这与终端设备始终不开启用户面完整性保护有区别。基站和终端设备还可以根据预设的规定确定是否开启信令面保护(包括信令面完整性保护和/或信令面加密保护)，预设的规定可以是终端设备在接收到AS安全模式命令后开启信令面保护。
再比如，终端设备或基站在开启信令面保护(开启信令面完整性保护和/或信令面加密保护)时，开启用户面加密保护。也就是说，满足基站用户面加密保护条件包括开启信令面保护。换言之，用户面加密保护可以和信令面保护一起开启，而开启或不开启用户面完整性保护可以根据是否满足基站用户面完整性保护条件来确定。比如，在基站收到注册接受或服务请求接受后可以开启信令面保护(开启信令面完整性保护和/或信令面加密保护)且开启用户面加密保护，不开启用户面完整性保护。进一步，在这种实施方式中，也可以不设置上述加密指示信息。
举个例子，上述图2中的步骤203之后，即终端设备在基站向终端设备发送AS安全模式命令之后，终端设备开启信令面保护不开启用户面保护，可以生成信令面密钥(信令面完整性保护密钥和/或信令面加密保护密钥)、用户面密钥(用户面完整性保护密钥和/或用户面加密保护密钥)。但是仅使用信令面密钥进行保护，可以保存用户面密钥。在开启用户面保护的情况下再使用用户面密钥。
再比如，上述图2中的步骤203之后，即终端设备在基站向终端设备发送AS安全模式命令之后，终端设备开启信令面保护、开启用户面加密保护且不开启用户面完整性保护，可以生成信令面密钥(信令面完整性保护密钥和/或信令面加密保护密钥)、用户面加密密钥和用户面完整性保护密钥。但是仅使用信令面密钥进行保护，使用用户面加密密钥进行保护，可以保存用户面完整性保护密钥。在开启用户面完整性保护的情况下再使用用户面完整性保护密钥进行完整性保护。
再比如，上述图2中的步骤203之后，即终端设备在基站向终端设备发送AS安全模式命令之后，终端设备开启信令面保护不开启用户面保护，可以生成信令面密钥(信令面完整性保护密钥和/或信令面加密保护密钥)且使用信令面密钥进行保护，不生成用户面密钥(用户面完整性保护密钥和/或用户面加密保护密钥)。再比如，上述图2b中的步骤211中的请求消息是会话建立请求时，在步骤211之后，基站再向终端设备发送AS安全模式命令或RRC重配置消息，终端设备在接收到AS安全模式命令或RRC重配置消息后使用用户面密钥进行用户面安全保护。
再比如，上述图2中的步骤203之后，即终端设备在基站向终端设备发送AS安全模式命令之后，终端设备开启信令面保护、开启用户面加密保护，且不开启用户面完整性保护，可以生成信令面密钥(信令面完整性保护密钥和/或信令面加密保护密钥)且使用信令面密钥进行保护，生成用户面加密密钥，且使用用户面加密密钥进行保护，但不生成用户面完整性保护密钥。再比如，上述图2b中的步骤211中的请求消息是会话建立请求时，在步骤211之后，基站再向终端设备发送AS安全模式命令或RRC重配置消息，终端设备在接收到AS安全模式命令或RRC重配置消息后，生成用户面完整性保护密钥，且使用用户面完整性保护密钥进行用户面安全保护。
终端设备可以根据接收到的基站发送的完整性保护指示信息确定是否开启用户面的完整性保护，终端设备也可以判断后开启用户面完整性保护或不开启用户面完整性保护，下面通过实施方式c1和实施方式c2进行介绍。进一步，可选地，为了节省资源，若终端设备确定不开启用户面的完整性保护，则可以不发送用户面的完整性保护算法，也就是说，在这种可选地实施方式中，不能发送空的用户面完整性保护算法，但是若终端设备不开启用户面的加密保护，则发送空的用户面加密算法。
需要说明的是，上述各实施例及其各种可选的实施方式中，基站向终端设备发送的完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项可以承载在预设消息中，比如在预设消息中预定义一个字段，在该预定义字段承载完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项。预设消息可以是AS安全模式命令或者RRC重配置请求。例如，采用用下述实施方式c1-1(b7)的方式所示的算法的标识的形式向终端设备发送完整性保护指示信息。
需要说明的是，上述各实施例及其各种可选的实施方式中，基站接收的完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项可以携带在安全策略中，具体可以采用c1-1(b2)-c1-1(b7)。
下面介绍了完整性保护指示信息和/或加密指示信息的各种表现方式。
实施方式c1-1(b1)
完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项可以通过在预定义字段设置会话ID来表示。比如当基站没有收到会话ID的时候，将发送给终端设备的预设消息中的预定义字段中的会话ID设置为0，则表示只开启信令面保护，不开启用户面完整性保护指示信息，不开启用户面加密指示信息。终端设备接收到的预设消息中的预定义字段中的会话ID为0的信息时，可以确定只开启信令面保护(开启信令面完整性保护和/或开启信令面加密保护)，不开启用户面完整性保护指示信息，不开启用户面加密指示信息。
进一步，开启信令面保护可以是开启信令面完整性保护和开启信令面加密保护中的至少一种，具体开启信令面完整性保护，还是开启信令面加密保护，还是开启信令面完整性保护和信令面加密保护，可以根据预设的规则等确定，比如预设规则中默认开启信令面完整性保护和信令面加密保护。下述内容中与此段解释类似，下面不再重复。
再比如，基站在收到会话ID的情况下，比如可以将发送给终端设备的预设消息中的预定义字段中的会话ID设置为当前的会话ID。若终端设备接收到的基站发送的预设消息，预设消息中的预定义字段中包括会话ID，且会话ID为当前会话的ID，则终端设备会默认开启用户面加密保护和用户面完整性保护。可选地，可以将基站选择的信令面的加密算法也用于用户面，也就是基站选择出来的加密算法即为信令面加密算法也为用户面加密算法，类似地，将选择的信令面完整性保护算法作为用户面完整性保护算法。进一步，若终端设备接收到的基站发送的预设消息，预设消息中的预定义字段中包括会话ID，且会话ID不为空的情况下，终端设备可以开启用户面完整性保护和/或用户面加密保护，具体开启用户面加密保护还是开启用户面完整性保护，还是开启用户面加密保护和用户面完整性保护，可以参考预设规则，也可以根据本申请其它实施例中的描述。
另一种可选地实施方式中，完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项可以通过在预设消息中的预定义字段中设置QoS的相关信息来指示，比如设置QFI值。QFI值的使用方式可以与上述会话ID的使用方式相类似，比如当基站没有收到QFI的时候，将发送给终端设备的预设消息中的预定义字段中的QFI设置为0，则表示只开启信令面保护，不开启用户面完整性保护指示信息，不开启用户面加密指示信息。终端设备在接收到预定义字段中的QFI为0的信息时，可以确定只开启信令面保护，不开启用户面完整性保护指示信息，不开启用户面加密指示信息。
实施方式c1-1(b2)
完整性保护指示信息和/或加密指示信息可以通过在预设消息或安全策略中的预定义字段中的比特信息来表示，比如预定义字段中可以包括1个比特信息。
例如，在默认情况下，开启用户面加密保护且不开启用户面完整性保护，则预定义字段中的1个比特信息就是完整性保护指示信息，该预定义字段中比特位置1，可以表示开启用户面完整性保护；该预定义字段中比特位置0，可以表示不开启用户面完整性保护。
再比如，在默认情况下，不开启用户面加密保护且开启用户面完整性保护，则预定义字段中的1个比特信息就是加密指示信息，具体地，该预定义字段中的比特位置1，可以表示开启用户面加密保护，该预定义字段中的比特位置0，可以表示不开启用户面加密保护。
再比如，在默认情况下，开启用户面加密保护且开启用户面完整性保护，则预定义字段中的1个比特信息就是完整性保护指示信息和加密指示信息。该预定义字段中的比特位置1可以表示开启用户面完整性保护且开启用户面加密保护，预定义字段中的比特位置0可以表示不开启用户面完整性保护且不开启用户面加密保护。
实施方式c1-1(b3)
完整性保护指示信息和加密指示信息可以通过在预设消息中或安全策略的预定义字段中的比特信息来表示，比如预定义字段中可以包括2个比特信息，其中一个比特信息代表用户面加密是否需要开启或关闭，另一比特信息代表用户面完整性保护是否需要开启或关闭，即其中一个比特信息是加密指示信息，另一个比特信息是完整性保护指示信息，比 如，将预定义字段中加密指示信息对应的比特信息置1表示开启用户面加密保护；将预定义字段中完整性保护指示信息对应的比特信息置1表示终端设备开启用户面完整性保护；将预定义字段中加密指示信息对应的比特信息置0表示不开启用户面加密保护；将预定义字段中完整性保护指示信息对应的比特信息置0表示终端设备不开启用户面完整性保护。
实施方式c1-1(b4)
完整性保护指示信息和加密指示信息可以通过在预设消息或安全策略中的预定义字段中的比特信息来表示，比如预定义字段中可以包括4个比特信息，其中，预定义字段中一个比特信息指示用户面加密保护是否开启，比如，该比特信息置1，表示开启用户面加密保护，置0表示不开启用户面加密保护；预定义字段中一个比特信息指示用户面加密保护的秘钥长度是128比特还是256比特，比如，该比特信息置1，表示用户面加密保护的秘钥长度是128比特，置0表示用户面加密保护的秘钥长度是256比特；预定义字段中一个比特信息指示用户面完整性保护的秘钥长度是128比特还是256比特，该比特信息置1，表示用户面完整性保护的秘钥长度是128比特，即生成32bit的MAC值，置0表示用户面完整性保护的秘钥长度是256比特，即生成64bit的MAC值；预定义字段中一个比特信息指示用户面完整性保护是否开启，比如，该比特信息置1，表示开启用户面完整性保护，置0表示不开启用户面完整性保护。
完整性保护指示信息和/或加密指示信息可以为上述实施方式c1-1(b2)、实施方式c1-1(b3)和实施方式c1-1(b4)中所示的例子，为比特信息，也可以称完整性保护指示信息和/或加密指示信息为开关信息。
进一步，开关信息的具体内容，可以结合具体方法。比如，若开启用户面加密保护和用户面完整性保护；进一步，如果预设规则定义用户面加密保护默认开启，而用户面完整性保护则需要灵活确定，则可以在预设字段只携带1比特指示信息，该1比特指示信息用于指示是否需要开启用户面完整性保护；进一步，如果预设规则定义在没有收到完整性保护指示信息和加密指示信息前，不开启用户面加密保护，也不开启用户面完整性保护，则可以在预设字段携带2比特指示信息，分别用于指示是否开启用户加密保护，以及是否开启用户面完整性保护。
实施方式c1-1(b5)
完整性保护指示信息和/或加密指示信息可以是算法的标识。这种情况下完整性保护指示信息和/或加密指示信息可以承载在预设消息或安全策略中的预定义字段中，也可以承载在安全策略中。换言之，基站向终端设备发送算法的标识，该算法的标识用于指示算法，该算法的标识也是完整性保护指示信息和/或加密指示信息。
一种可选地实施方式中，基站传递的AS SMC中，携带如LTE网络中的EIA和EEA的号码代表选择的完整性保护算法和加密算法。可以通过携带EIA和EEA的号码表示完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息，例如，EIA的号码表示开启完整性保护。
另一种可选地实施方式中，可以将算法的标识扩充为4个预设字段，分别为EIA-RRC，EEA-RRC，EIA-UP，EEA-UP，并通过将选择的算法放到其相应位置，代表此次协商的方法。比如，基站选择了EIA-RRC＝3，EEA-RRC＝2，则完整性保护指示信息、加密指示信息、信令面完整性保护指示信息和信令面加密指示信息可以是(EIA-RRC＝3，EEA-RRC＝2，EIA-UP＝0，EEA-UP＝0)；从而，终端设备接收到该信息后，由于EIA-RRC不是0， 因此开启信令面完整性保护；由于EEA-RRC不是0，因此开启信令面加密保护；由于EIA-UP是0，因此不开启用户面完整性保护；或者，由于EEA-UP是0，因此不开启用户面加密保护。
进一步，在该实施方式中，算法的标识不仅可以指示出完整性保护指示信息、加密指示信息，还可以指示出算法。也就是说，运用该实施例的情况下，发送算法的标识，即可以同时指示出算法(比如目标信令面完整性保护算法、目标信令面加密算法、目标用户面完整性保护算法和目标用户面加密算法)，以及完整性保护指示信息、加密指示信息。
比如，EIA-RRC＝3还可以指示出信令面完整性保护算法，再比如EEA-RRC＝2还可以指示出信令面加密保护算法，再EIA-UP＝0还可以指示出用户面完整性保护算法，再比如EEA-UP＝0还可以指示出用户面加密保护算法，
在图2a或图2b所示实施例的一种可选地实施方式中，完整性保护指示信息可以是算法的标识，比如当基站对终端设备开启用户面完整性保护的情况下，完整性保护指示信息可以是目标用户面完整性保护算法的标识。
可选地，当基站对终端设备不开启用户面完整性保护的情况下，完整性保护指示信息可以为预设用户面完整性保护算法的标识；或者，不携带任何完整性保护算法的信息。也就是说，不发送任何完整性保护算法的标识或者发送预设用户面完整性保护算法的标识，即表示完整性保护指示信息指示不开启完整性保护。举个例子，假设预设用户面完整性保护算法的标识为X123，若终端设备接收到的完整性保护指示信息是X123的情况下，终端设备不开启用户面完整性保护。
在图2a或图2b所示实施例的一种可选地实施方式中，基站还可以向终端设备发送加密指示信息，加密指示信息用于指示基站是否对终端设备开启用户面加密保护。在基站对终端设备开启用户面加密保护的情况下，加密指示信息可以是算法的标识，比如，加密指示信息是目标用户面加密算法的标识。
可选地，当基站对终端设备不开启加密保护的情况下，加密指示信息可以预设用户面加密算法的标识，或者为空加密算法。也就是说，不发送任何加密算法的标识或者发送空加密算法或者发送预设用户面加密算法的标识，即表示加密指示信息指示不开启加密保护。举个例子，假设预设用户面加密算法算法的标识为X321，若终端设备接收到的加密保护指示信息是X321的情况下，终端设备不开启用户面加密保护。
在图2，图2a或图2b所示实施例的另一种可选地实施方式中，基站还可以向终端设备发送信令面完整性保护指示信息，信令面完整性保护指示信息用于指示基站是否对终端设备开启信令面完整性保护。在基站对终端设备开启信令面完整性保护的情况下，信令面完整性保护指示信息可以是算法的标识，比如，信令面完整性保护指示信息是目标信令面完整性保护算法的标识。
可选地，当基站对终端设备不开启信令面完整性保护的情况下，信令面完整性保护指示信息可以为预设信令面完整性保护算法的标识，或者为不携带任何完整性保护算法的信息。举个例子，假设预设信令面完整性保护算法的标识为X456，若终端设备接收到的信令面完整性保护指示信息是X456的情况下，终端设备不开启信令面完整性保护。
在图2，图2a或图2b所示实施例的另一种可选地实施方式中，基站还可以向终端设备发送信令面加密指示信息，信令面加密指示信息用于指示基站是否对终端设备开启信令面加密保护。在基站对终端设备开启信令面加密保护的情况下，信令面加密指示信息可以 是算法的标识，比如，信令面加密指示信息是目标信令面加密算法的标识。
可选地，当基站对终端设备不开启信令面加密保护的情况下，信令面加密指示信息可以预设信令面加密算法的标识，或者为空加密算法。举个例子，假设预设信令面加密算法算法的标识为X654，若终端设备接收到的信令面加密保护指示信息是X654的情况下，终端设备不开启信令面加密保护。
实施方式c1-1(b6)
完整性保护指示信息和/或加密指示信息可以是预设消息或安全策略中的预定义字段中的会话ID和4比特信息，那么终端设备需要根据比特信息，开启这个会话ID下相应的用户面安全，举个例子，比如终端设备有多个会话ID，则每个会话ID对应的用户面安全方案可以是不同的，比如一个会话ID对应的是开启用户面完整性保护和开启用户面加密保护，另一个会话ID对应的可以是不开启用户面完整性保护和开启用户面加密保护。
实施方式c1-1(b7)
完整性保护指示信息和/或加密指示信息可以是预设消息或安全策略中的预定义字段中的会话ID和算法的标识。
通过上述实施例可以看出，上述实施方式中，算法的标识和4比特位信息对应的实施方式是较为灵活的用方式，因为可以明确到用户面加密保护是否开启，以及用户名完整性保护是否开启。通过上述实施例可以看出比特位信息可以重用(复用)协商过的信令面算法(也就是说将适用于信令面的算法也适用于用户面，比如将确定出的目标信令面完整性保护算法也作为目标用户面完整性保护算法，将确定出的目标信令面加密算法也作为目标用户面加密算法)，而算法的标识可以实现信令面算法和用户面安全算法不同，比如信令面加密算法和用户面加密算法不同，信令面完整性保护算法和用户面完整性保护算法不同。
完整性保护指示信息和/或加密指示信息可以承载于RRC重配置请求消息中，由基站发送给终端设备。在这种情况下，若当前终端设备已经开启用户面加密保护，未开启用户面完整性保护，但是当前终端设备确定开启用户面完整性保护，可选地，RRC重配置请求消息中可以只传递完整性保护指示信息就够了。
基站可以生成并将完整性保护指示信息发送给终端设备，另一种可选地实施方式中，基站接收到完整性保护指示信息和加密指示信息之后，生成新的指示信息(该新的指示信息中可以只包括完整性保护指示信息)，进一步将该新的指示信息承载在RRC重配置请求中。由于完整性保护指示信息、加密指示信息可来自于N2接口，发出去的时候可能换了接口，所以基站还是需要根据RRC重配置请求消息中的格式，对将要承载的完整性保护指示信息和/或加密指示信息做一些相应处理。
基站发送完整性保护指示信息和/或加密指示信息的一种方式中，基站也可以将完整性保护指示信息和/或加密指示信息直接转发给终端设备。
基站发送完整性保护指示信息和/或加密指示信息的另一种方式中，基站根据完整性保护指示信息和/或加密指示信息是算法的标识，这种情况下，基站可以根据获取的(例如，基站接收或者是基站判断得到的)完整性保护指示信息和/或加密指示信息，确定对应的目标算法的标识，并将对应的目标算法的标识发送给终端设备。举个例子，比如基站开启用户面完整性保护，则确定目标用户面完整性保护算法，并将目标用户面完整性保护算法的标识发送给终端设备，终端设备在接收到时可以开启用户面完整性保护算法，且使用目标用户面完整性保护算法进行用户面完整性保护。
完整性保护指示信息和/或加密指示信息可以承载在RRC重配置请求消息中，由基站发送给终端设备。可选地，在完整性保护指示信息和/或加密指示信息为算法的标识的情况下，RRC消息中可以携带算法的标识。
举个例子，比如当完整性保护指示信息和/或加密指示信息为算法的标识，则完整性保护指示信息和/或加密指示信息可以是一个算法列表。可选地，如果完整性保护指示信息和/或加密指示信息对应的算法列表中的算法是完整性保护算法，并且完整性保护算法不是空算法，且基站若确定终端设备支持的用户面完整性保护算法、基站允许的用户面完整性保护算法以及完整性保护指示信息和/或加密指示信息对应的算法列表中的算法，这三者没有交集；则基站可以选择一个既是终端设备支持的用户面完整性保护算法，又是基站允许的用户面完整性保护算法作为目标用户面完整性保护算法。如果完整性保护指示信息和/或加密指示信息对应的算法列表中的算法是是空算法，则基站不选择目标用户面完整性保护算法，可以理解为不开启用户面完整性保护。
进一步，可选地，如果完整性保护指示信息和/或加密指示信息对应的算法列表中的算法是加密算法，并且加密算法不是空加密算法，且基站若确定终端设备支持的用户面加密算法、基站允许的用户面加密算法以及完整性保护指示信息和/或加密指示信息对应的算法列表中的算法，这三者没有交集；则基站可以选择一个既是终端设备支持的用户面加密算法，又是基站允许的用户面加密算法作为目标用户面加密算法。如果完整性保护指示信息和/或加密指示信息对应的算法列表中的算法是是空加密算法，则基站可以选择一个空加密算法作为目标用户面加密算法，可以理解为不开启用户面加密保护。
再举个例子，当完整性保护指示信息和/或加密指示信息为算法的标识，则完整性保护指示信息和/或加密指示信息可以是一个算法列表，可以从该算法列表中选择一个算法，若选择出的算法为完整性保护算法，且该选择出的完整性保护算法是预设完整性保护算法，则可选的，基站在转发选择出的完整性保护算法给终端设备之前，检查选择出的完整性保护算法是否既是终端设备支持的用户面完整性保护算法，又是基站允许的用户面完整性保护算法；若是，则该选择出的完整性保护算法即作为目标用户面完整性保护算法发送给终端设备。
另一方面，若选择出的完整性保护算法不满足既是终端设备支持的用户面完整性保护算法，又是基站允许的用户面完整性保护算法的条件，且选择出的完整性保护算法不是空算法，则基站要选择一个既是终端设备支持的用户面完整性保护算法，又是基站允许的用户面完整性保护算法的算法作为目标用户面完整性保护算法发送给终端设备。另一方面，若选择出的完整性保护算法不满足既是终端设备支持的用户面完整性保护算法，又是基站允许的用户面完整性保护算法的条件，且选择出的完整性保护算法是空算法，则则基站不选择目标用户面完整性保护算法，可以理解为不开启用户面完整性保护。
进一步，另一方面，可选地，若选择出的算法为加密算法，且该选择出的加密算法是预设加密算法，则可选的，基站在转发选择出的加密算法给终端设备之前，检查选择出的加密算法是否既是终端设备支持的用户面加密算法，又是基站允许的用户面加密算法；若是，则该选择出的加密算法即作为目标用户面加密算法发送给终端设备。
另一方面，若选择出的加密算法不满足既是终端设备支持的用户面加密算法，又是基站允许的用户面加密算法的条件，且选择出的加密算法不是空算法，则基站要选择一个既是终端设备支持的用户面加密算法，又是基站允许的用户面加密算法的算法作为目标用户 面加密算法发送给终端设备。另一方面，若选择出的加密算法不满足既是终端设备支持的用户面加密算法，又是基站允许的用户面加密算法的条件，且选择出的加密算法是空算法，则则基站不选择目标用户面加密算法，可以理解为不开启用户面加密保护。
本申请实施例中完整性保护指示信息和/或加密指示信息可以承载在AS安全模式命令中，并通过基站发送给终端设备。可选地，也可以将信令面完整性保护指示信息和/或信令面加密指示信息承载在AS安全模式命令中，并通过基站发送给终端设备。
一种可选地实施方式中，在终端设备在开启用户面完整性保护前，终端设备可以验证AS安全模式命令的完整性保护。可选的，基站使用用户面完整性保护算法对AS安全模式命令进行完整性保护。可选的，基站可以根据安全策略判断用户面完整性保护开启后，使用用户面完整性保护算法对AS安全模式命令进行完整性保护。可选的，终端设备使用用户面完整性保护算法验证AS安全模式命令的完整性保护是否正确。比如，终端设备是在发现用户面完整性保护激活后，使用用户面完整性保护算法验证AS安全模式命令的完整性保护是否正确；不排除用户面完整性保护算法为当前使用的AS信令面完整性保护算法。进一步，基站接收到终端设备回复的AS安全模式结束消息。可选的，基站使用用户面完整性保护算法，验证AS安全模式结束消息的完整性保护。可选的，基站是在发现AS安全模式结束消息中携带了完整性保护参数MAC-I后，对AS安全模式结束消息进行完整性保护验证；不排除，用户面完整性保护算法为当前使用的AS信令面完整性保护算法。可选地，基站在接收到安全模式结束消息之后，相应的开启用户面完整性保护(比如完整性指示信息和加密指示信息指示开启用户面完整性保护，不开启用户面加密保护，则基站可以在收到安全模式结束消息之后开启用户面完整性保护，不开启用户面加密保护)。进一步，可选地，基站在相应的开启用户面完整性保护之后可以向终端设备发送RRC重配置请求消息；进一步可选地终端设备向基站返回RRC重配置完成消息。
另一种可选地实施方式中，开启用户面完整性保护的情况，完整性保护指示信息可以承载在AS安全模式命令中，再将AS安全模式命令承载在RRC重配置请求消息中，并通过基站发送给终端设备。可选地，加密指示信息、信令面完整性保护指示信息和信令面加密指示信息中的至少一项，也可以承载在AS安全模式命令中，再将AS安全模式命令承载在RRC重配置请求消息中，并通过基站发送给终端设备。
图3示例性示出了本申请提供的一种基站的结构示意图。
基于相同构思，本申请提供一种基站300，用于执行上述方法中的任一个方案。如图3所示，基站300包括处理器301、收发器302、存储器303和通信接口304；其中，处理器301、收发器302、存储器303和通信接口304通过总线305相互连接。
总线305可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图3中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器303可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器303还可以包括上述种类的存储器的组合。
通信接口304可以为有线通信接入口，无线通信接口或其组合，其中，有线通信接口 例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为WLAN接口。
处理器301可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器301还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
可选地，存储器303还可以用于存储程序指令，处理器301调用该存储器303中存储的程序指令，可以执行上述方案中所示实施例中的一个或多个步骤，或其中可选的实施方式，使得基站300实现上述方法中基站的功能。
处理器301用于根据执行存储器存储的指令，并控制收发器302进行信号接收和信号发送，当处理器301执行存储器存储的指令时，基站300可用于执行下述方案。
处理器301，用于获取安全策略，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护；当完整性保护指示信息指示基站对终端设备开启完整性保护时，确定目标用户面完整性保护算法；收发器302，用于向终端设备发送目标用户面完整性保护算法。如此，可根据安全策略灵活的为终端设备选择是否开启完整性保护，且仅在对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法，一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
可选地，收发器302，用于：通过无线资源控制RRC信令向终端设备发送目标用户面完整性保护算法。通过复用现有技术中的RRC信令的方式实现本申请实施例提供的方案，从而更好的兼容现有技术，且对现有技术改动较小。具体可选地实施方式可以参考上述内容，在此不再赘述。
可选地，处理器301，具体用于：根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法。
可选地，基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法；或者，终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
可选地，安全策略还包括服务网络允许的用户面完整性保护算法；处理器301，用于：根据基站允许的用户面完整性保护算法，终端设备支持的用户面完整性保护算法，以及服务网络允许的用户面完整性保护算法，确定目标用户面完整性保护算法。
可选地，服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
可选地，处理器301，还用于：当安全策略还包括加密指示信息，且加密指示信息用于指示基站对终端设备开启加密保护时，通过收发器302向终端设备发送目标用户面加密算法；或者，当安全策略还包括密钥长度时，通过收发器302向终端设备发送密钥长度；或者，当安全策略还包括D-H指示信息，且D-H指示信息用于指示基站对终端设备开启D-H时，通过收发器302向终端设备发送D-H相关密钥。
可选地，收发器302，具体用于：从会话管理功能SMF实体接收终端设备的当前会话的服务质量；处理器301，还用于：根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载。
处理器301，还用于：根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载的具体方式参见上述方法实施例中的内容，在此不再赘述。
一种可选地实施方案中，处理器301，用于：根据安全策略和服务质量中的至少一种，为终端设备创建目标无线数据承载。
可选地，收发器302，用于：从SMF实体接收安全策略；或者；从SMF实体接收安全策略的标识，并根据安全策略的标识，获取安全策略。
可选地，处理器301，还用于：获取终端设备支持的信令面安全算法；根据终端设备支持的信令面安全算法，以及基站允许的信令面安全算法，确定目标信令面安全算法；收发器302，还用于：将目标信令面安全算法携带在接入层AS安全模式命令SMC中发送给终端设备。
图4示例性示出了本申请提供的一种SMF实体的结构示意图。
基于相同构思，本申请提供一种SMF实体400，用于执行上述方法中的任一个方案。如图4所示，SMF实体400包括处理器401、收发器402、存储器403和通信接口404；其中，处理器401、收发器402、存储器403和通信接口404通过总线405相互连接。
总线405可以是外设部件互连标准(peripheral component interconnect，PCI)总线或扩展工业标准结构(extended industry standard architecture，EISA)总线等。总线可以分为地址总线、数据总线、控制总线等。为便于表示，图4中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器403可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器403还可以包括上述种类的存储器的组合。
通信接口404可以为有线通信接入口，无线通信接口或其组合，其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为WLAN接口。
处理器401可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。处理器401还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
可选地，存储器403还可以用于存储程序指令，处理器401调用该存储器403中存储的程序指令，可以执行上述方案中所示实施例中的一个或多个步骤，或其中可选的实施方式，使得SMF实体400实现上述方法中SMF实体的功能。
处理器401用于根据执行存储器存储的指令，并控制收发器402进行信号接收和信号发送，当处理器401执行存储器存储的指令时，SMF实体400可用于执行下述方案。
收发器402，用于接收请求消息，请求消息包括安全策略的相关参数；向基站发送安 全策略或安全策略的标识；处理器401，用于根据安全策略的相关参数，获得安全策略或者安全策略的标识；其中，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护。一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
一种可选地实施方案中，安全策略的相关参数包括终端设备的标识，终端设备的数据网络名称DNN，终端设备的切片的标识，终端设备的服务质量和终端设备的会话标识中的至少一种。如此，可根据不同的标识从不同的角度或粒度实现安全策略的制定，更加灵活。
可选地，处理器401，用于：安全策略的相关参数包括终端设备的标识，SMF实体根据终端设备的标识与安全策略的关联关系以及终端设备的标识，获得安全策略，如此可实现在终端设备的粒度上的安全策略的确定，实现不同的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理器401，用于：安全策略的相关参数包括终端设备的切片的标识，SMF实体根据切片的标识和安全策略的关联关系以及终端设备的切片的标识，获得安全策略，如此可实现在切片的粒度上的安全策略的确定，实现接入不同的切片的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理器401，用于：安全策略的相关参数包括终端设备的会话标识，SMF实体根据会话标识和安全策略的关联关系以及终端设备的会话标识，获得安全策略，如此可实现在会话的粒度上的安全策略的确定，实现发起不同会话的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理器401，用于：安全策略的相关参数包括终端设备的服务质量；SMF实体根据终端设备的服务质量，获得安全策略，如此可实现在服务质量的粒度上的安全策略的确定，实现发起不同服务质量的终端设备可对应不同的安全策略的目的。
可选地，安全策略还包括以下内容中至少一种：加密指示信息，加密指示信息用于指示基站对终端设备开启加密保护；密钥长度；D-H指示信息，D-H指示信息用于指示基站对终端设备开启D-H；和，服务网络允许的用户面完整性保护算法。如此，可以更加灵活的对安全策略中的任一个信息进行指示，使最终确定的安全策略更加适应复杂的应用场景。
图5示例性示出了本申请实施例提供的一种基站的结构示意图。
基于相同构思，本申请实施例提供一种基站，用于执行上述方法流程中的任一个方案。如图5所示，基站500包括接收单元501、处理单元502和发送单元503。
处理单元502，用于获取安全策略，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护；当完整性保护指示信息指示基站对终端设备开启完整性保护时，通过发送单元503向终端设备发送目标用户面完整性保护算法；发送单元503，用于向终端设备发送目标用户面完整性保护算法。如此，可根据安全策略灵活的为终端设备选择是否开启完整性保护，且仅在对终端设备开启完整性保护时，基站向终端设备发送目标用户面完整性保护算法，一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
可选地，发送单元503，用于：通过无线资源控制RRC信令向终端设备发送目标用户面完整性保护算法。通过复用现有技术中的RRC信令的方式实现本申请实施例提供的方案，从而更好的兼容现有技术，且对现有技术改动较小。具体可选地实施方式可以参考上述内容，在此不再赘述。
可选地，处理单元502，在通过发送单元503向终端设备发送目标用户面完整性保护算法之前，还用于：根据终端设备支持的用户面完整性保护算法和基站允许的用户面完整性保护算法，确定目标用户面完整性保护算法。
可选地，基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法；或者，终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
可选地，安全策略还包括服务网络允许的用户面完整性保护算法；处理单元502，用于：根据基站允许的用户面完整性保护算法，终端设备支持的用户面完整性保护算法，以及服务网络允许的用户面完整性保护算法，确定目标用户面完整性保护算法。
可选地，服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
可选地，处理单元502，还用于：当安全策略还包括加密指示信息，且加密指示信息用于指示基站对终端设备开启加密保护时，通过发送单元503向终端设备发送目标用户面加密算法；或者，当安全策略还包括密钥长度时，通过发送单元503向终端设备发送密钥长度；或者，当安全策略还包括D-H指示信息，且D-H指示信息用于指示基站对终端设备开启D-H时，通过发送单元503向终端设备发送D-H相关密钥。
可选地，还包括接收单元501，在通过发送单元503向终端设备发送目标用户面完整性保护算法之前，用于：从会话管理功能SMF实体接收终端设备的当前会话的服务质量；处理单元502，还用于：根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载。
处理单元502，还用于：根据安全策略和服务质量中的至少一种，为终端设备分配目标无线数据承载的具体方式参见上述方法实施例中的内容，在此不再赘述。
一种可选地实施方案中，处理单元502，用于：根据安全策略和服务质量中的至少一种，为终端设备创建目标无线数据承载。
可选地，接收单元501，用于：从SMF实体接收安全策略；或者；从SMF实体接收安全策略的标识，并根据安全策略的标识，获取安全策略。
可选地，处理单元502，还用于：获取终端设备支持的信令面安全算法；根据终端设备支持的信令面安全算法，以及基站允许的信令面安全算法，确定目标信令面安全算法；发送单元503，还用于：将目标信令面安全算法携带在接入层AS安全模式命令SMC中发送给终端设备。
应理解，以上各个单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。本申请实施例中，接收单元501和发送单元503可以由收发器302实现，处理单元502可以由处理器301实现。如图3所示，基站300可以包括处理器301、收发器302和存储器303。其中，存储器303可以用于存储处理器301执行方案时的代码，该代码可为基站300出厂时预装的程序/代码。
图6示例性示出了本申请实施例提供的一种SMF实体的结构示意图。
基于相同构思，本申请实施例提供一种SMF实体，用于执行上述方法流程中的任一个方案。如图6所示，SMF实体600包括接收单元601、处理单元602，可选地，还包括发送单元603。
接收单元601，用于接收请求消息，请求消息包括安全策略的相关参数；向基站发送安全策略或安全策略的标识；处理单元602，用于根据安全策略的相关参数，获得安全策略或者安全策略的标识；其中，安全策略包括完整性保护指示信息，完整性保护指示信息用于指示基站是否对终端设备开启完整性保护。一方面，由于单独协商用户面的安全算法，提高了用户面安全算法和信令面安全算法分开确定的灵活性，另一方面，由于增加了完整性保护指示信息，提高了终端设备的目标用户面完整性保护算法确定的灵活性。
一种可选地实施方案中，安全策略的相关参数包括终端设备的标识，终端设备的数据网络名称DNN，终端设备的切片的标识，终端设备的服务质量和终端设备的会话标识中的至少一种。如此，可根据不同的标识从不同的角度或粒度实现安全策略的制定，更加灵活。
可选地，处理单元602，用于：安全策略的相关参数包括终端设备的标识，SMF实体根据终端设备的标识与安全策略的关联关系以及终端设备的标识，获得安全策略，如此可实现在终端设备的粒度上的安全策略的确定，实现不同的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理单元602，用于：安全策略的相关参数包括终端设备的切片的标识，SMF实体根据切片的标识和安全策略的关联关系以及终端设备的切片的标识，获得安全策略，如此可实现在切片的粒度上的安全策略的确定，实现接入不同的切片的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理单元602，用于：安全策略的相关参数包括终端设备的会话标识，SMF实体根据会话标识和安全策略的关联关系以及终端设备的会话标识，获得安全策略，如此可实现在会话的粒度上的安全策略的确定，实现发起不同会话的终端设备可对应不同的安全策略的目的。
另一种可选地实施方式中，处理单元602，用于：安全策略的相关参数包括终端设备的服务质量；SMF实体根据终端设备的服务质量，获得安全策略，如此可实现在服务质量的粒度上的安全策略的确定，实现发起不同服务质量的终端设备可对应不同的安全策略的目的。
可选地，安全策略还包括以下内容中至少一种：加密指示信息，加密指示信息用于指示基站对终端设备开启加密保护；密钥长度；D-H指示信息，D-H指示信息用于指示基站对终端设备开启D-H；和，服务网络允许的用户面完整性保护算法。如此，可以更加灵活的对安全策略中的任一个信息进行指示，使最终确定的安全策略更加适应复杂的应用场景。
应理解，以上各个单元的划分仅仅是一种逻辑功能的划分，实际实现时可以全部或部分集成到一个物理实体上，也可以物理上分开。本申请实施例中，接收单元601和发送单元603可以由收发器402实现，处理单元602可以由处理器401实现。如图4所示，SMF实体400可以包括处理器401、收发器402和存储器403。其中，存储器403可以用于存储处理器401执行方案时的代码，该代码可为SMF实体400出厂时预装的程序/代码。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现、当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产 品包括一个或多个指令。在计算机上加载和执行计算机程序指令时，全部或部分地产生按照本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。指令可以存储在计算机存储介质中，或者从一个计算机存储介质向另一个计算机存储介质传输，例如，指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，(例如，软盘、硬盘、磁带、磁光盘(MO)等)、光介质(例如，CD、DVD、BD、HVD等)、或者半导体介质(例如ROM、EPROM、EEPROM、非易失性存储器(NAND FLASH)、固态硬盘(Solid State Disk，SSD))等。
本领域内的技术人员应明白，本申请实施例可提供为方法、系统、或计算机程序产品。因此，本申请实施例可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种通信方法，其特征在于，包括：
    基站获取安全策略，所述安全策略包括完整性保护指示信息，所述完整性保护指示信息用于指示所述基站是否对终端设备开启完整性保护；
    当所述完整性保护指示信息指示所述基站对所述终端设备开启完整性保护时，所述基站确定目标用户面完整性保护算法；
    所述基站向所述终端设备发送所述目标用户面完整性保护算法。
  2. 如权利要求1所述的方法，其特征在于，所述基站向所述终端设备发送所述目标用户面完整性保护算法，包括：
    所述基站通过无线资源控制RRC信令向所述终端设备发送所述目标用户面完整性保护算法。
  3. 如权利要求1或2所述的方法，其特征在于，所述基站确定所述目标用户面完整性保护算法，包括：
    所述基站根据所述终端设备支持的用户面完整性保护算法和所述基站允许的用户面完整性保护算法，确定所述目标用户面完整性保护算法。
  4. 如权利要求3所述的方法，其特征在于，所述基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法；或者，
    所述终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
  5. 如权利要求3所述的方法，其特征在于，所述安全策略还包括服务网络允许的用户面完整性保护算法；
    所述基站根据所述终端设备支持的用户面完整性保护算法和所述基站允许的用户面完整性保护算法，确定所述目标用户面完整性保护算法，包括：
    所述基站根据所述基站允许的用户面完整性保护算法，所述终端设备支持的用户面完整性保护算法，以及所述服务网络允许的用户面完整性保护算法，确定所述目标用户面完整性保护算法。
  6. 如权利要求5所述的方法，其特征在于，所述服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述方法还包括：
    当所述安全策略还包括加密指示信息，且所述加密指示信息用于指示所述基站对所述终端设备开启加密保护时，所述基站向所述终端设备发送目标用户面加密算法；或者，
    当所述安全策略还包括密钥长度时，所述基站向所述终端设备发送所述密钥长度；或者，
    当所述安全策略还包括D-H指示信息，且所述D-H指示信息用于指示所述基站对所述终端设备开启D-H时，所述基站向所述终端设备发送D-H相关密钥。
  8. 如权利要求1-7任一项所述的方法，其特征在于，在所述基站向所述终端设备发送所述目标用户面完整性保护算法之前，还包括：
    所述基站从会话管理功能SMF实体接收所述终端设备的当前会话的服务质量；
    所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备分配目标 无线数据承载。
  9. 如权利要求8所述的方法，其特征在于，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备分配目标无线数据承载，包括：
    当所述基站上存在至少一个历史的无线数据承载满足第一条件时，所述基站将满足所述第一条件的至少一个历史的无线数据承载中的一个确定为所述目标无线数据承载；其中，满足所述第一条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略相同；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件，但存在至少一个历史的无线数据承载满足第二条件时，所述基站将满足所述第二条件的所述至少一个历史的无线数据承载中的一个进行更新后确定为所述目标无线数据承载；其中，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略相同；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件，且不存在至少一个历史的无线数据承载满足所述第二条件时，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件时，所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载；
    或者，
    所述基站根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载。
  10. 如权利要求1-9任一项所述的方法，其特征在于，所述基站获取安全策略，包括：
    所述基站从SMF实体接收所述安全策略；或者；
    所述基站从SMF实体接收所述安全策略的标识，并根据所述安全策略的标识，获取所述安全策略。
  11. 如权利要求1-10任一项所述的方法，其特征在于，所述方法还包括：
    所述基站获取所述终端设备支持的信令面安全算法；
    所述基站根据所述终端设备支持的信令面安全算法，以及所述基站允许的信令面安全算法，确定目标信令面安全算法；
    所述基站将所述目标信令面安全算法携带在所述接入层AS安全模式命令SMC中发送给所述终端设备。
  12. 一种通信方法，其特征在于，包括：
    会话管理功能SMF实体接收请求消息，所述请求消息包括安全策略的相关参数；
    所述SMF实体根据所述安全策略的相关参数，获得安全策略或者所述安全策略的标识；
    所述SMF实体向基站发送所述安全策略或所述安全策略的标识；
    其中，所述安全策略包括完整性保护指示信息，所述完整性保护指示信息用于指示所述基站是否对所述终端设备开启完整性保护。
  13. 如权利要求12所述的方法，其特征在于，所述安全策略的相关参数包括终端设备的标识，所述终端设备的数据网络名称DNN，所述终端设备的切片的标识，所述终端设备的服务质量和所述终端设备的会话标识中的至少一种。
  14. 如权利要求13所述的方法，其特征在于，所述SMF实体根据所述安全策略的相关参数，获得安全策略或者所述安全策略的标识，包括：
    所述安全策略的相关参数包括所述终端设备的标识，所述SMF实体根据所述终端设备的标识与安全策略的关联关系以及所述终端设备的标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的切片的标识，所述SMF实体根据所述切片的标识和安全策略的关联关系以及所述终端设备的切片的标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的会话标识，所述SMF实体根据所述会话标识和安全策略的关联关系以及所述终端设备的会话标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的服务质量；所述SMF实体根据所述终端设备的服务质量，获得所述安全策略。
  15. 如权利要求12-14任一项所述的方法，其特征在于，所述安全策略还包括以下内容中至少一种：
    加密指示信息，所述加密指示信息用于指示所述基站对所述终端设备开启加密保护；
    密钥长度；
    D-H指示信息，所述D-H指示信息用于指示所述基站对所述终端设备开启D-H；和，服务网络允许的用户面完整性保护算法。
  16. 一种基站，其特征在于，包括：
    处理器，用于获取安全策略，所述安全策略包括完整性保护指示信息，所述完整性保护指示信息用于指示所述基站是否对终端设备开启完整性保护；当所述完整性保护指示信息指示所述基站对所述终端设备开启完整性保护时，确定目标用户面完整性保护算法；
    所述收发器，用于向所述终端设备发送所述目标用户面完整性保护算法。
  17. 如权利要求16所述的基站，其特征在于，所述收发器，用于：
    通过无线资源控制RRC信令向所述终端设备发送所述目标用户面完整性保护算法。
  18. 如权利要求16或17所述的基站，其特征在于，所述处理器，具体用于：
    根据所述终端设备支持的用户面完整性保护算法和所述基站允许的用户面完整性保护算法，确定所述目标用户面完整性保护算法。
  19. 如权利要求18所述的基站，其特征在于，所述基站允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法；或者，
    所述终端设备支持的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
  20. 如权利要求18所述的基站，其特征在于，所述安全策略还包括服务网络允许的用户面完整性保护算法；
    所述处理器，用于：
    根据所述基站允许的用户面完整性保护算法，所述终端设备支持的用户面完整性保护算法，以及所述服务网络允许的用户面完整性保护算法，确定所述目标用户面完整性保护算法。
  21. 如权利要求20所述的基站，其特征在于，所述服务网络允许的用户面完整性保护算法为按照优先级排序的用户面完整性保护算法。
  22. 如权利要求12-21任一项所述的基站，其特征在于，所述处理器，还用于：
    当所述安全策略还包括加密指示信息，且所述加密指示信息用于指示所述基站对所述终端设备开启加密保护时，通过所述收发器向所述终端设备发送目标用户面加密算法；或者，
    当所述安全策略还包括密钥长度时，通过所述收发器向所述终端设备发送所述密钥长度；或者，
    当所述安全策略还包括D-H指示信息，且所述D-H指示信息用于指示所述基站对所述终端设备开启D-H时，通过所述收发器向所述终端设备发送D-H相关密钥。
  23. 如权利要求12-22任一项所述的基站，其特征在于，所述收发器，在向所述终端设备发送所述目标用户面完整性保护算法之前，还用于：
    从会话管理功能SMF实体接收所述终端设备的当前会话的服务质量；
    所述处理器，还用于：
    根据所述安全策略和所述服务质量中的至少一种，为所述终端设备分配目标无线数据承载。
  24. 如权利要求23所述的基站，其特征在于，所述处理器，用于：
    当所述基站上存在至少一个历史的无线数据承载满足第一条件时，将满足所述第一条件的至少一个历史的无线数据承载中的一个确定为所述目标无线数据承载；其中，满足所述第一条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略相同；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件，但存在至少一个历史的无线数据承载满足第二条件时，将满足所述第二条件的所述至少一个历史的无线数据承载中的一个进行更新后确定为所述目标无线数据承载；其中，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量相同，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略相同；或者，满足所述第二条件的所述至少一个历史的无线数据承载中的每个无线数据承载支持的服务质量与所述当前会话的所述服务质量匹配，且所述安全策略与所述每个无线数据承载支持的安全策略匹配；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件，且不存在至少一个历史的无线数据承载满足所述第二条件时，根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载；
    或者，
    当所述基站上不存在历史的无线数据承载满足所述第一条件时，根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载；
    或者，
    根据所述安全策略和所述服务质量中的至少一种，为所述终端设备创建所述目标无线数据承载。
  25. 如权利要求12-24任一项所述的基站，其特征在于，所述收发器，用于：
    从SMF实体接收所述安全策略；或者；
    从SMF实体接收所述安全策略的标识，并根据所述安全策略的标识，获取所述安全策略。
  26. 如权利要求12-25任一项所述的基站，其特征在于，所述处理器，还用于：
    获取所述终端设备支持的信令面安全算法；
    根据所述终端设备支持的信令面安全算法，以及所述基站允许的信令面安全算法，确定目标信令面安全算法；
    所述收发器，还用于：
    将所述目标信令面安全算法携带在所述接入层AS安全模式命令SMC中发送给所述终端设备。
  27. 一种会话管理功能SMF实体，其特征在于，包括：
    收发器，用于接收请求消息，所述请求消息包括安全策略的相关参数；向基站发送所述安全策略或所述安全策略的标识；
    处理器，用于根据所述安全策略的相关参数，获得安全策略或者所述安全策略的标识；
    其中，所述安全策略包括完整性保护指示信息，所述完整性保护指示信息用于指示所述基站是否对所述终端设备开启完整性保护。
  28. 如权利要求27所述的SMF实体，其特征在于，所述安全策略的相关参数包括终端设备的标识，所述终端设备的数据网络名称DNN，所述终端设备的切片的标识，所述终端设备的服务质量和所述终端设备的会话标识中的至少一种。
  29. 如权利要求28所述的SMF实体，其特征在于，所述处理器，用于：
    所述安全策略的相关参数包括所述终端设备的标识，根据所述终端设备的标识与安全策略的关联关系以及所述终端设备的标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的切片的标识，根据所述切片的标识和安全策略的关联关系以及所述终端设备的切片的标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的会话标识，所述会话标识和安全策略的关联关系以及所述终端设备的会话标识，获得所述安全策略；或者，
    所述安全策略的相关参数包括所述终端设备的服务质量；根据所述终端设备的服务质量，获得所述安全策略。
  30. 如权利要求27-29任一项所述的SMF实体，其特征在于，所述安全策略还包括以下内容中至少一种：
    加密指示信息，所述加密指示信息用于指示所述基站对所述终端设备开启加密保护；密钥长度；
    D-H指示信息，所述D-H指示信息用于指示所述基站对所述终端设备开启D-H；和，服务网络允许的用户面完整性保护算法。
PCT/CN2017/095348 2017-05-05 2017-07-31 一种通信方法及相关装置 WO2018201630A1 (zh)

Priority Applications (13)

Application Number Priority Date Filing Date Title
EP20175304.3A EP3796694A1 (en) 2017-05-05 2017-07-31 Communication method and related apparatus
AU2017413023A AU2017413023B2 (en) 2017-05-05 2017-07-31 Communication method and related apparatus
ES17908356T ES2830778T3 (es) 2017-05-05 2017-07-31 Método de comunicación y aparato relacionado
CN201780031003.3A CN109219965B (zh) 2017-05-05 2017-07-31 一种通信方法及相关装置
BR122020023465-2A BR122020023465B1 (pt) 2017-05-05 2017-07-31 Sistema de comunicação, método, entidade de função de gerenciamento de sessão, estação de base, dispositivo terminal e mídia de armazenamento legível por computador
EP23209521.6A EP4340537A3 (en) 2017-05-05 2017-07-31 Communication method and related apparatus
KR1020197035424A KR102162678B1 (ko) 2017-05-05 2017-07-31 통신 방법 및 관련 장치
EP17908356.3A EP3541105B1 (en) 2017-05-05 2017-07-31 Communication method and related apparatus
BR112019023041-6A BR112019023041B1 (pt) 2017-05-05 2017-07-31 Método de comunicação e aparelho relacionado
JP2019560709A JP6943978B2 (ja) 2017-05-05 2017-07-31 通信方法および関連する装置
US16/386,462 US10798578B2 (en) 2017-05-05 2019-04-17 Communication method and related apparatus
US16/728,764 US10798579B2 (en) 2017-05-05 2019-12-27 Communication method and related apparatus
US16/993,729 US11272360B2 (en) 2017-05-05 2020-08-14 Communication method and related apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
PCT/CN2017/083362 WO2018201506A1 (zh) 2017-05-05 2017-05-05 一种通信方法及相关装置
CNPCT/CN2017/083362 2017-05-05

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/386,462 Continuation US10798578B2 (en) 2017-05-05 2019-04-17 Communication method and related apparatus

Publications (1)

Publication Number Publication Date
WO2018201630A1 true WO2018201630A1 (zh) 2018-11-08

Family

ID=64015949

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2017/083362 WO2018201506A1 (zh) 2017-05-05 2017-05-05 一种通信方法及相关装置
PCT/CN2017/095348 WO2018201630A1 (zh) 2017-05-05 2017-07-31 一种通信方法及相关装置

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/083362 WO2018201506A1 (zh) 2017-05-05 2017-05-05 一种通信方法及相关装置

Country Status (9)

Country Link
US (3) US10798578B2 (zh)
EP (3) EP4340537A3 (zh)
JP (1) JP6943978B2 (zh)
KR (1) KR102162678B1 (zh)
CN (6) CN113038461A (zh)
AU (1) AU2017413023B2 (zh)
BR (2) BR122020023465B1 (zh)
ES (1) ES2830778T3 (zh)
WO (2) WO2018201506A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111641944A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 一种通信方法及设备
CN113950806A (zh) * 2019-04-29 2022-01-18 瑞典爱立信有限公司 4g系统中的用户平面完整性保护
US11277745B2 (en) 2017-11-08 2022-03-15 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Integrity protection control method, network device and computer storage medium
US11722899B2 (en) 2018-03-15 2023-08-08 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Data processing method, access network device, and core network device

Families Citing this family (46)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110493774B (zh) * 2017-05-06 2023-09-26 华为技术有限公司 密钥配置方法、装置以及系统
US11297502B2 (en) * 2017-09-08 2022-04-05 Futurewei Technologies, Inc. Method and device for negotiating security and integrity algorithms
US11153158B2 (en) * 2017-09-15 2021-10-19 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Method for configuring a frequency priority, terminal device, base station, and core network device
US11129017B2 (en) * 2017-09-28 2021-09-21 Futurewei Technologies, Inc. System and method for security activation with session granularity
ES2973317T3 (es) 2017-10-30 2024-06-19 Huawei Tech Co Ltd Método y dispositivo para obtener capacidades de seguridad del equipo de usuario
US11330642B2 (en) * 2017-11-15 2022-05-10 Lg Electronics Inc. Method for supporting and providing LADN service in wireless communication system and apparatus therefor
EP3791537A4 (en) * 2018-05-09 2022-01-19 Nokia Technologies Oy SECURITY MANAGEMENT FOR EDGE PROXIES AT AN INTERNETWORK INTERFACE IN A COMMUNICATION SYSTEM
EP3804262A1 (en) * 2018-06-08 2021-04-14 Telefonaktiebolaget Lm Ericsson (Publ) Application of integrity protection in a wireless communication network
US11051319B2 (en) * 2018-09-04 2021-06-29 Qualcomm Incorporated Techniques for low latency communications in wireless local area networks
CN113557699B (zh) * 2018-12-11 2024-04-12 索尼集团公司 通信装置、基础设施设备、核心网络设备和方法
KR20210145121A (ko) 2019-03-21 2021-12-01 광동 오포 모바일 텔레커뮤니케이션즈 코포레이션 리미티드 정책 결정 방법 및 장치, 단말기
EP3949325A1 (en) * 2019-03-26 2022-02-09 IDAC Holdings, Inc. Methods, apparatus and systems for secured radio resource control (rrc) signaling over a pc5 interface for unicast communication
KR102637405B1 (ko) * 2019-03-29 2024-02-15 오피노 엘엘씨 비공개 네트워크에 대한 과금 제어
CN111800369B (zh) * 2019-04-08 2022-03-29 华为技术有限公司 通信方法与设备
CN110113623B (zh) * 2019-04-18 2021-07-27 浙江工业大学 一种基于sip协议的音视频切片传输平台
CN111865569B (zh) * 2019-04-28 2022-08-26 华为技术有限公司 一种密钥协商方法及装置
CN111988782B (zh) * 2019-05-23 2022-04-12 华为技术有限公司 安全会话方法和装置
WO2021026744A1 (zh) * 2019-08-12 2021-02-18 Oppo广东移动通信有限公司 一种策略配置方法、网络设备、终端设备
CN112449400B (zh) * 2019-08-15 2022-03-29 大唐移动通信设备有限公司 一种通信方法、装置及系统
KR20210020690A (ko) * 2019-08-16 2021-02-24 삼성전자주식회사 무선 통신 시스템에서 정보를 보호하기 위한 방법 및 장치
CN110677853B (zh) * 2019-09-06 2023-04-11 京信网络系统股份有限公司 信令处理方法、装置、基站设备和存储介质
KR20210038352A (ko) 2019-09-30 2021-04-07 삼성전자주식회사 Ue의 이동성 절차 처리 방법 및 ue
CN112672339A (zh) * 2019-10-15 2021-04-16 中国移动通信有限公司研究院 一种终端能力信息的通知方法、终端及基站
CN112929876B (zh) * 2019-12-05 2022-05-17 大唐移动通信设备有限公司 一种基于5g核心网的数据处理方法及装置
CN113381966B (zh) * 2020-03-09 2023-09-26 维沃移动通信有限公司 信息上报方法、信息接收方法、终端及网络侧设备
BR112022019408A2 (pt) * 2020-04-01 2022-12-06 Apple Inc Negociação de política de segurança de veículo para tudo (v2x) entre os equipamentos de usuário (ues) de mesmo nível
EP4145787A4 (en) * 2020-05-29 2023-05-31 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND DEVICE
WO2022025566A1 (en) 2020-07-27 2022-02-03 Samsung Electronics Co., Ltd. Methods and systems for deriving cu-up security keys for disaggregated gnb architecture
US12022545B2 (en) * 2020-07-27 2024-06-25 T-Mobile Usa, Inc. Dynamic PCRF/PCF selection
CN115550924A (zh) * 2020-07-30 2022-12-30 华为技术有限公司 一种通信方法及装置
KR20220015667A (ko) * 2020-07-31 2022-02-08 삼성전자주식회사 차세대 이동 통신 시스템에서 무결성 보호 또는 검증 절차로 인한 단말 프로세싱 부하를 줄이는 방법 및 장치
CN114079915A (zh) * 2020-08-06 2022-02-22 华为技术有限公司 确定用户面安全算法的方法、系统及装置
CN116158111A (zh) * 2020-08-10 2023-05-23 华为技术有限公司 一种通信的方法及装置
CN114079919B (zh) * 2020-08-17 2024-02-27 中国电信股份有限公司 安全模式配置方法、装置、系统和计算机可读存储介质
CN113572801B (zh) * 2020-09-30 2022-08-12 中兴通讯股份有限公司 会话建立方法、装置、接入网设备及存储介质
JP7395455B2 (ja) * 2020-11-06 2023-12-11 株式会社東芝 転送装置、鍵管理サーバ装置、通信システム、転送方法及びプログラム
CN112399609B (zh) * 2020-12-03 2023-08-11 中国联合网络通信集团有限公司 一种资源配置方法及装置
KR102522709B1 (ko) * 2020-12-28 2023-04-18 국방과학연구소 암호 알고리즘 식별 장치 및 방법, 컴퓨터 판독 가능한 기록 매체 및 컴퓨터 프로그램
KR20220135792A (ko) * 2021-03-31 2022-10-07 삼성전자주식회사 데이터 보호를 위한 nas 메시지 이용 방법 및 장치
CN115643576A (zh) * 2021-07-19 2023-01-24 华为技术有限公司 控制终端接入网络的方法、设备、系统、装置及存储介质
US11683351B2 (en) * 2021-08-30 2023-06-20 Qualcomm Incorporated Protection level indication and configuration
CN113905380A (zh) * 2021-11-01 2022-01-07 中国电信股份有限公司 接入层安全算法处理方法、系统、设备及存储介质
CN114222303A (zh) * 2021-12-09 2022-03-22 北京航空航天大学 实现ue定制机密性和完整性保护算法的方法及装置
CN114205850A (zh) * 2021-12-13 2022-03-18 中国电信股份有限公司 业务处理方法、基站、核心网系统和业务处理系统
CN114339761A (zh) * 2021-12-30 2022-04-12 天翼物联科技有限公司 一种用于网络切片的用户面数据完整性保护方法和系统
WO2024030574A1 (en) * 2022-08-05 2024-02-08 Intel Corporation Enhanced quality of service-level security for wireless communications

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102264066A (zh) * 2010-05-27 2011-11-30 中兴通讯股份有限公司 一种实现接入层安全算法同步的方法及系统
US20120066727A1 (en) * 2010-09-15 2012-03-15 Takahiko Nozoe Transmitting apparatus and receiving apparatus
CN102448058A (zh) * 2011-01-10 2012-05-09 华为技术有限公司 一种Un接口上的数据保护方法与装置

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101064921B (zh) * 2006-04-30 2011-12-21 华为技术有限公司 一种用户设备与网络侧实现加密协商的方法
CN101075865B (zh) * 2006-05-16 2011-02-02 华为技术有限公司 一种用户面加密的启动方法
CN101001252A (zh) * 2006-06-25 2007-07-18 华为技术有限公司 一种注册方法和一种用户面安全算法的协商方法及装置
CN101242629B (zh) * 2007-02-05 2012-02-15 华为技术有限公司 选择用户面算法的方法、系统和设备
CN101242645B (zh) * 2007-02-09 2011-02-09 华为技术有限公司 移动终端从空闲态进入激活态的方法及系统
CN102413461B (zh) * 2007-05-08 2014-06-04 华为技术有限公司 安全能力协商的方法及系统
WO2010012821A1 (en) 2008-08-01 2010-02-04 Nokia Siemens Networks Oy Method, apparatus, system and computer program product for supporting legacy p-cscf to indicate to the s-cscf to skip authentication
CN101355811B (zh) * 2008-09-08 2012-04-25 华为终端有限公司 承载信道重建的方法、系统及设备
CN101478752B (zh) * 2009-01-12 2014-11-05 中兴通讯股份有限公司 一种密钥更替方法、系统及设备
CN101483865A (zh) * 2009-01-19 2009-07-15 中兴通讯股份有限公司 一种密钥更替方法、系统及设备
CN101854625B (zh) 2009-04-03 2014-12-03 华为技术有限公司 安全算法选择处理方法与装置、网络实体及通信系统
US20120047551A1 (en) 2009-12-28 2012-02-23 Interdigital Patent Holdings, Inc. Machine-To-Machine Gateway Architecture
CN102149088A (zh) * 2010-02-09 2011-08-10 工业和信息化部电信传输研究所 一种保护移动用户数据完整性的方法
US20110261961A1 (en) * 2010-04-22 2011-10-27 Qualcomm Incorporated Reduction in bearer setup time
US20110312299A1 (en) * 2010-06-18 2011-12-22 Qualcomm Incorporated Methods and apparatuses facilitating synchronization of security configurations
CN102487507B (zh) 2010-12-01 2016-01-20 中兴通讯股份有限公司 一种实现完整性保护的方法及系统
CN103179559B (zh) 2011-12-22 2016-08-10 华为技术有限公司 一种低成本终端的安全通信方法、装置及系统
EP2861020B1 (en) 2012-06-08 2017-04-05 Huawei Technologies Co., Ltd. Signalling plane of a target base station carried out by another base station
US9433032B1 (en) * 2012-06-14 2016-08-30 Cisco Technology, Inc. Interface selection for quality of service enforcement
GB2509937A (en) * 2013-01-17 2014-07-23 Nec Corp Providing security information to a mobile device in which user plane data and control plane signalling are communicated via different base stations
CN104936171B (zh) * 2014-03-21 2019-07-16 中兴通讯股份有限公司 安全算法的确定方法及装置
CN106375989B (zh) * 2015-07-20 2019-03-12 中兴通讯股份有限公司 实现接入层安全的方法及用户设备和无线接入小节点
US10412056B2 (en) * 2015-07-24 2019-09-10 Futurewei Technologies, Inc. Ultra dense network security architecture method
JP6548348B2 (ja) * 2015-08-13 2019-07-24 ホアウェイ・テクノロジーズ・カンパニー・リミテッド メッセージ保護方法、ならびに関連デバイスおよびシステム
US10582522B2 (en) * 2015-09-04 2020-03-03 Lg Electronics Inc. Data transmission and reception method and device of terminal in wireless communication system
US10015740B2 (en) * 2015-09-30 2018-07-03 Apple Inc. Voice and data continuity between wireless devices
CN109560929B (zh) 2016-07-01 2020-06-16 华为技术有限公司 密钥配置及安全策略确定方法、装置
CN113630773B (zh) 2017-01-24 2023-02-14 华为技术有限公司 安全实现方法、设备以及系统
EP3606115B1 (en) 2017-03-20 2022-05-04 LG Electronics Inc. Method for interaction between layers in wireless communication system and apparatus therefor
WO2018177656A1 (en) * 2017-03-31 2018-10-04 Telefonaktiebolaget Lm Ericsson (Publ) Application topology aware user plane selection in nr and 5gc

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102264066A (zh) * 2010-05-27 2011-11-30 中兴通讯股份有限公司 一种实现接入层安全算法同步的方法及系统
US20120066727A1 (en) * 2010-09-15 2012-03-15 Takahiko Nozoe Transmitting apparatus and receiving apparatus
CN102448058A (zh) * 2011-01-10 2012-05-09 华为技术有限公司 一种Un接口上的数据保护方法与装置

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
"3GPP GENERATION PARTNERSHIP PROJECT. '' 3GPP TR 33.899 VI. 1.0", TECHNICAL SPECIFICATION GROUP SERVICES AND SYSTEM ASPECTS, 31 March 2017 (2017-03-31), XP055481694 *
"3GPP GENERATION PARTNERSHIP PROJECT. ''3GPP TR 33.899 VI. 1.0", TECHNICAL SPECIFICATION GROUP SERVICES AND SYSTEM ASPECTS, 31 March 2017 (2017-03-31), XP055481694 *
CATT: "3GPP TSG SA WG3 (Security) Meeting #86", SECURITY PROCEDURE FOR NETWORK SLICING, 10 February 2017 (2017-02-10), pages 3 - 170114, XP051217481 *
ERICSSON: "Service Request procedure updates", SA WG2 MEETING #119, 17 January 2018 (2018-01-17), pages 2 - 171375, XP051234490 *

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11277745B2 (en) 2017-11-08 2022-03-15 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Integrity protection control method, network device and computer storage medium
US11722899B2 (en) 2018-03-15 2023-08-08 Guangdong Oppo Mobile Telecommunications Corp., Ltd. Data processing method, access network device, and core network device
CN111641944A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 一种通信方法及设备
CN113950806A (zh) * 2019-04-29 2022-01-18 瑞典爱立信有限公司 4g系统中的用户平面完整性保护
JP2022530487A (ja) * 2019-04-29 2022-06-29 テレフオンアクチーボラゲット エルエム エリクソン（パブル） ４ｇシステムにおけるユーザプレーン完全性保護
JP7286801B2 (ja) 2019-04-29 2023-06-05 テレフオンアクチーボラゲット エルエム エリクソン（パブル） ４ｇシステムにおけるユーザプレーン完全性保護
CN113950806B (zh) * 2019-04-29 2024-03-08 瑞典爱立信有限公司 4g系统中的用户平面完整性保护

Also Published As

Publication number Publication date
EP3541105A4 (en) 2019-11-20
CN109618335A (zh) 2019-04-12
CN113038460A (zh) 2021-06-25
US10798578B2 (en) 2020-10-06
BR112019023041A2 (pt) 2020-06-02
EP3541105A1 (en) 2019-09-18
EP4340537A2 (en) 2024-03-20
JP2020519190A (ja) 2020-06-25
BR112019023041B1 (pt) 2021-04-06
KR102162678B1 (ko) 2020-10-07
CN109219965B (zh) 2021-02-12
BR122020023465B1 (pt) 2021-08-17
WO2018201506A1 (zh) 2018-11-08
US20190246282A1 (en) 2019-08-08
CN109640324B (zh) 2019-11-19
CN109561427A (zh) 2019-04-02
ES2830778T3 (es) 2021-06-04
CN109219965A (zh) 2019-01-15
CN109640324A (zh) 2019-04-16
JP6943978B2 (ja) 2021-10-06
US20200374691A1 (en) 2020-11-26
EP4340537A3 (en) 2024-05-29
US20200137577A1 (en) 2020-04-30
EP3796694A1 (en) 2021-03-24
US10798579B2 (en) 2020-10-06
CN109561427B (zh) 2019-11-19
CN113038461A (zh) 2021-06-25
CN109618335B (zh) 2020-03-17
AU2017413023A1 (en) 2019-12-05
KR20200003120A (ko) 2020-01-08
US11272360B2 (en) 2022-03-08
EP3541105B1 (en) 2020-09-09
AU2017413023B2 (en) 2021-10-21

Similar Documents

Publication Publication Date Title
WO2018201630A1 (zh) 一种通信方法及相关装置
US10462828B2 (en) Policy and billing services in a cloud-based access solution for enterprise deployments
US11546771B2 (en) Communication method, communications apparatus, and system
US20200128614A1 (en) Session processing method and device
KR102066188B1 (ko) 로밍 연결을 확립하기 위한 방법
US11140545B2 (en) Method, apparatus, and system for protecting data
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
CN108141867B (zh) 用于通信系统中数据流传输的改进的优先级处理的方法
KR20220044341A (ko) 보안 보호 모드 결정 방법 및 장치
US20190349936A1 (en) Service Data Transmission Method, First Communications Node, and Base Station
CN109792407B (zh) 服务质量等级指示结构及对应的控制器和控制方法
WO2021073382A1 (zh) 注册方法及装置
WO2024032244A1 (zh) 通信方法和通信装置
CN117376900A (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17908356

Country of ref document: EP

Kind code of ref document: A1

DPE1 Request for preliminary examination filed after expiration of 19th month from priority date (pct application filed from 20040101)
ENP Entry into the national phase

Ref document number: 2017908356

Country of ref document: EP

Effective date: 20190612

WWE Wipo information: entry into national phase

Ref document number: 122020023465

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2019560709

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112019023041

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 20197035424

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2017413023

Country of ref document: AU

Date of ref document: 20170731

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 112019023041

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20191101