WO2018205427A1 - 密钥配置方法、装置以及系统 - Google Patents

密钥配置方法、装置以及系统 Download PDF

Info

Publication number
WO2018205427A1
WO2018205427A1 PCT/CN2017/095301 CN2017095301W WO2018205427A1 WO 2018205427 A1 WO2018205427 A1 WO 2018205427A1 CN 2017095301 W CN2017095301 W CN 2017095301W WO 2018205427 A1 WO2018205427 A1 WO 2018205427A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
algorithm
security
session
key
Prior art date
Application number
PCT/CN2017/095301
Other languages
English (en)
French (fr)
Inventor
张博
吴�荣
甘露
李岩
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to BR112019023236A priority Critical patent/BR112019023236A2/pt
Priority to EP17909068.3A priority patent/EP3611949A4/en
Priority to CN201780090099.0A priority patent/CN110574406B/zh
Publication of WO2018205427A1 publication Critical patent/WO2018205427A1/zh
Priority to US16/674,697 priority patent/US20200084631A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications

Definitions

  • the present invention relates to the field of communications, and in particular, to a key configuration method, apparatus, and system.
  • the data security protection adopts the hop-by-hop method, that is, segmentation for security protection.
  • the terminal device-base station-serving gateway-PDN gateway performs a security protection
  • the base station-service gateway performs a security protection
  • the service gateway-PDN gateway Performing a security protection during the data transmission process, if there is a problem with the intermediate node, it may lead to data leakage.
  • a PDCD air interface protection mechanism is adopted between the terminal device and the base station.
  • the PDCD air interface protection mechanism only supports a set of user data protection mechanisms. That is, even if multiple types of service data are transmitted between the terminal device and the base station, these multiple types of service data can only use the same encryption algorithm and integrity. The protection algorithm is secured. It can be seen that the prior art does not support differentiated security protection, and all service data on the base station side need to be uniformly protected.
  • the network element in the 5G network is required to support the service-based security policy negotiation.
  • the security algorithm negotiation in the LTE is only used for the security algorithm negotiation of the user plane or the control plane.
  • Service-based security policy negotiation is not supported. Therefore, the existing LTE negotiation mechanism cannot be directly applied to future 5G communication.
  • the embodiment of the invention discloses a key configuration method, device and system, which can implement user face protection key configuration in the 5G communication, and improve user plane data transmission security and network security. protection.
  • the embodiment of the present invention provides a key configuration method, which is applied to a policy function network element side of a communication system, and the method includes:
  • the policy function network element receives a request for communication between the user equipment and the network device; the request includes a session identifier, a user equipment identifier, and indication information of the security requirement, where the indication information of the security requirement is used to indicate the security requirement of the user equipment and/or Or business security needs;
  • the policy function network element determines the user based on the request, and at least one of the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the service security requirement fed back by the application function network element AF.
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, and/or whether integrity protection is required.
  • the policy function network element sends the user plane protection mechanism to the AN device; wherein the AN device is configured to determine security protection based on the user plane protection mechanism An algorithm, configured to generate a first user plane protection key based on the security protection algorithm; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment is generated based on the security protection algorithm a second user plane protection key;
  • the policy function network element sends the user face protection to an algorithm network element.
  • the algorithm network element is configured to determine a security protection algorithm based on the user plane protection mechanism, generate a first user plane protection key based on the security protection algorithm, and use the first user plane protection key Sending to the CN device; the algorithm network element is further configured to send the security protection algorithm to the user equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm;
  • the second user plane protection key when the first user plane protection key is used for security protection of user plane data, the second user plane protection key is used to restore user plane data; when the second user plane protection When the key is used for security protection of the user plane data, the first user plane protection key is used to restore user plane data; wherein the security protection is encrypted by the user plane protection mechanism , and / or, integrity protection.
  • the request further includes at least one of a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the request is an attach request; the attach request is initiated by the user equipment to the authentication server network element AUSF; the attach request is used for mutual authentication between the network device and the AUSF, and is also used to trigger the policy.
  • the functional network element determines a user plane protection mechanism
  • the request is a session request; the session request is initiated by the user equipment to the session management network element SMF, or is initiated to the SMF by the access and mobility management network element AMF; the session request is used for Establishing a session between the network device and the SMF, and is further configured to trigger the policy function network element to determine a user plane protection mechanism;
  • the policy request is sent by the SMF to the policy function network element, where the policy request is used to trigger the policy function network element to determine a user plane protection mechanism;
  • the user plane protection mechanism is further configured to indicate a security protection algorithm, a key length, and a secret to be used for indicating user plane data transmitted between the user equipment and the network device. At least one of the key update cycles.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and a CN device.
  • the CN device is a user plane node UPF; the algorithm network element includes at least one of the PCF, the AUSF, the AMF, the SMF, and the AN device.
  • the AN device is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and an algorithm priority list supported by the AN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • the algorithm network element is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and the algorithm priority list supported by the CN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • the network device is an AN device
  • the protection algorithm when the network device is an AN device, based on the security The protection algorithm generates a first user plane protection key, including:
  • the first user plane protection key KDF (K_AN, UP algorithm ID), wherein after the authentication is successful, the AMF is derived based on the authenticated base key or the key derived after authentication again. a base station key, the AN device obtains the K_AN from the AMF;
  • generating a first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID), wherein after the K_ algorithm network element is successfully authenticated, the AMF or the AUSF is based on the verified basic key or Deriving the obtained key again after the authentication, and deriving the base station key, and the algorithm network element obtains the K_ algorithm network element from the AMF or the AUSF;
  • the UP algorithm ID is an identifier of the encryption algorithm, or an identifier of the integrity protection algorithm; and the KDF is a key derivation function.
  • the user plane data is carried by a QoS flow channel
  • the method Before determining the user plane protection mechanism, the method includes: determining a QoS flow ID corresponding to the QoS flow transmission channel;
  • Determining the user plane protection mechanism includes: determining a user plane protection mechanism corresponding to the QoS flow ID; wherein the QoS flow ID has a mapping relationship with the user plane protection mechanism.
  • determining a QoS flow ID corresponding to the Qos flow transmission channel includes:
  • a new Qos flow transmission channel is created, and a QoS flow ID corresponding to the QoS flow transmission channel is generated.
  • the security requirement is a security requirement indicated by at least one of the indication information, the UE registration information, the subscription service data, and the service security requirement of the AF feedback; the Qos requirement is a communication network.
  • the user plane data is carried by a data radio bearer DRB transmission channel;
  • the method Before determining the user plane protection mechanism, the method includes: determining a data radio bearer identifier DRB ID corresponding to the DRB transmission channel;
  • Determining the user plane protection mechanism including: determining a user plane protection mechanism corresponding to the DRB ID; wherein the DRB ID has a mapping relationship with the user plane protection mechanism.
  • determining a DRB ID corresponding to the DRB transmission channel includes:
  • a new DRB transmission channel is created, and a DRB ID corresponding to the DRB transmission channel is generated.
  • the security requirement is a security requirement indicated by at least one of the indication information, the UE registration information, the subscription service data, and the service security requirement of the AF feedback; the Qos requirement is a communication network.
  • the user plane data is transmitted through a session session Load
  • the method Before determining the user plane protection mechanism, the method includes: determining a session identifier session ID corresponding to the session transmission channel;
  • Determining the user plane protection mechanism includes: determining a user plane protection mechanism corresponding to the session ID; wherein the session ID has a mapping relationship with the user plane protection mechanism.
  • determining a user plane protection mechanism further includes:
  • generating the first user plane protection key based on the security protection algorithm includes:
  • the first user plane protection key KDF (K_AN, UP algorithm ID); or,
  • the first user plane protection key KDF (K_AN, UP algorithm ID, flow ID); or
  • the first user plane protection key KDF (K_AN, UP algorithm ID, session ID); or,
  • the first user plane protection key KDF (K_AN, UP algorithm ID, DRB ID);
  • generating a first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID); or
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID, flow ID); or
  • the method before determining the user plane protection mechanism, the method further includes:
  • the user equipment Based on the session request, the user equipment performs secondary authentication with the data network DN, and feeds back the authentication result to the policy function network element, so that the policy function network element determines the user plane protection by referring to the authentication result. mechanism.
  • the embodiment of the present invention provides a policy function network element, where the method function network element includes: a receiving module, a policy module, and a sending module, where:
  • the receiving module is configured to receive a request for communication between the user equipment and the network device; the request includes a session identifier, a user equipment identifier, and indication information of a security requirement, where the indication information of the security requirement is used to indicate a security requirement of the user equipment And/or business security requirements;
  • the policy module is configured to determine a user based on the request, and at least one of UE registration information fed back by the unified data management network element UDM, subscription service data fed back by the UDM, and service security requirements fed back by the application function network element AF.
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the sending module is configured to: when the network device is an access network AN device, send the user plane protection mechanism to the AN device; wherein the AN device is configured to determine security based on the user plane protection mechanism a protection algorithm, configured to generate a first user plane protection key based on the security protection algorithm; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment is based on the security protection algorithm Generating a second user plane protection key;
  • the sending module is further configured to: when the network device is a core network CN device, send the user plane protection mechanism to an algorithm network element, where the algorithm network element is used to determine security based on the user plane protection mechanism a protection algorithm, generating a first user plane protection key based on the security protection algorithm, and transmitting the first user plane protection key to the
  • the device network element is further configured to send the security protection algorithm to the user equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the embodiment of the present invention provides another policy function network element, where the policy function network element includes a processor, a memory and a transmitter, and a receiver, where the processor, the memory, and the transmitter and the receiver are connected (such as connecting to each other through the bus).
  • the processor is configured to read the program code stored in the memory, and perform the following steps:
  • the receiver Receiving, by the receiver, a request for communication between the user equipment and the network device; the request includes a session identifier, a user equipment identifier, and indication information of the security requirement, where the indication information of the security requirement is used to indicate the security requirement of the user equipment and/or Business security needs;
  • the user plane protection mechanism Determining, by the processor, the user plane protection mechanism based on the request, and at least one of the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the service security requirement fed back by the application function network element AF;
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the user plane protection mechanism is sent to the AN device by using a transmitter, where the AN device is configured to determine a security protection algorithm based on the user plane protection mechanism, based on The security protection algorithm generates a first user plane protection key; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment generates a second user based on the security protection algorithm Face protection key;
  • the user plane protection mechanism is sent to the algorithm network element by using a transmitter, where the algorithm network element is configured to determine a security protection algorithm based on the user plane protection mechanism, based on the The security protection algorithm generates a first user plane protection key, and sends the first user plane protection key to the CN device; the algorithm network element is further configured to send the security protection algorithm to the user And a device, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the request further includes at least one of a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the request is an attach request; the attach request is initiated by the user equipment to an authentication server network element AUSF; the attach request is used by the network device and the The two-way authentication is performed between the AUSFs, and is also used to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a session request; the session request is initiated by the user equipment to a session management network element SMF, or the access and mobility management network element AMF is SMF initiated; the session request is used to establish a session between the network device and the SMF, and is also used to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a policy request
  • the policy request is initiated by the SMF to the policy function network element, where the policy request is used to trigger the policy function network element.
  • the user plane protection mechanism is further configured to indicate a security protection algorithm, a key length, and a secret to be used for indicating user plane data transmitted between the user equipment and the network device. At least one of the key update cycles.
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that the user plane data transmitted between the user equipment and the network device can adopt.
  • the policy function network element includes a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • PCF policy control node
  • AUSF authentication server network element
  • AMF access and mobility management function network element
  • SMF session management network element
  • AN device an AN device.
  • the CN device is a user plane node UPF; the algorithm network element includes at least one of the PCF, the AUSF, the AMF, the SMF, and the AN device.
  • the AN device is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and an algorithm priority list supported by the AN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • the algorithm network element is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and the algorithm priority list supported by the CN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • generating the first user plane protection key based on the security protection algorithm includes:
  • the first user plane protection key KDF (K_AN, UP algorithm ID), wherein after the authentication is successful, the AMF is derived based on the authenticated base key or the key derived after authentication again. a base station key, the AN device obtains the K_AN from the AMF;
  • generating a first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID), wherein after the K_ algorithm network element is successfully authenticated, the AMF or the AUSF is based on the verified basic key or Deriving the obtained key again after the authentication, and deriving the base station key, and the algorithm network element obtains the K_ algorithm network element from the AMF or the AUSF;
  • the UP algorithm ID is an identifier of the encryption algorithm, or an identifier of the integrity protection algorithm; and the KDF is a key derivation function.
  • the user plane data is carried by a QoS flow Qos flow transmission channel
  • the QoS flow transmission is selected.
  • the channel transmits user plane data; otherwise, a new Qos flow transmission channel is created, and a QoS flow ID corresponding to the QoS flow transmission channel is generated;
  • the Qos flow transmission channel is selected to transmit the user plane data; otherwise, the new Qos flow transmission channel is generated, and the The QoS flow ID corresponding to the QoS flow transmission channel;
  • the Qos requirement is a requirement for a quality of service parameter in a communication network.
  • the user plane data carries a DRB transmission channel through a data radio bearer Carry
  • the DRB transmission channel is selected to transmit the user data; Otherwise, a new DRB transmission channel is created, and a DRB ID corresponding to the DRB transmission channel is generated;
  • the DRB transmission channel is selected to transmit the user data; otherwise, the DRB transmission channel is newly created, and the DRB transmission channel is generated. DRB ID.
  • the DRB ID has a mapping relationship with the user plane protection mechanism.
  • the user plane data is carried by a session session transmission channel
  • the session transmission channel is selected to transmit the user data; otherwise, Create a new session transport channel and generate a session ID corresponding to the session transport channel.
  • the session transmission channel is selected to transmit user data; otherwise, the session transmission channel is newly created, and a session corresponding to the session transmission channel is generated. Session ID.
  • the session ID has a mapping relationship with the user plane protection mechanism.
  • the session ID and the mapping of the QoS flow ID to the DRB ID are established, and QoS flows with the same user plane protection mechanism are mapped to the same DRB.
  • generating the first user plane protection key based on the security protection algorithm includes:
  • the first user plane protection key KDF (K_AN, UP algorithm ID); or,
  • the first user plane protection key KDF (K_AN, UP algorithm ID, flow ID); or
  • the first user plane protection key KDF (K_AN, UP algorithm ID, session ID); or,
  • the first user plane protection key KDF (K_AN, UP algorithm ID, DRB ID).
  • generating a first user plane protection key based on the security protection algorithm includes:
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID); or
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID, flow ID); or
  • the embodiment of the present invention provides a communication system, including: a user equipment, a policy function network element, a network device, a unified data management network element UDM, an application function network element AF, and an algorithm network element,
  • the policy function network element is connected to the user equipment and the network device, and the policy function network element is further connected to the UDM and the AF, and the algorithm network element is connected to the policy function network element and the network device.
  • the policy function network element is configured to receive a request for communication between the user equipment and the network device; the request includes a session identifier, a user equipment identifier, and indication information of a security requirement, where the indication information of the security requirement is used to indicate the user equipment Security requirements and/or business security requirements;
  • the policy function network element is further configured to determine user plane protection based on the request, and at least one of UE registration information of the UDM feedback, subscription service data of the UDM feedback, and service security requirement of the AF feedback.
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the policy function network element is further configured to send the user plane protection mechanism to the AN device;
  • the AN device is configured to determine security based on the user plane protection mechanism a protection algorithm;
  • the AN device is further configured to generate a first user plane protection key based on the security protection algorithm;
  • the AN device is further configured to send the security protection algorithm to the user equipment; Generating a second user plane protection key based on the security protection algorithm;
  • the policy function network element is configured to send the user plane protection mechanism to an algorithm network element; the algorithm network element is further configured to determine security protection based on the user plane protection mechanism.
  • the algorithm network element is further configured to generate a first user plane protection key based on the security protection algorithm; the algorithm network element is further configured to send the first user plane protection key to the CN device;
  • the algorithm network element is further configured to send the security protection algorithm to the user equipment; the user equipment is configured to generate a second user plane protection key based on the security protection algorithm.
  • an embodiment of the present invention provides a key configuration method, including:
  • the user equipment sends a request, where the request includes an identifier of the user equipment
  • the user equipment receives a response, and the response carries a security protection algorithm, where the security protection algorithm is determined by a user plane protection mechanism, where the user plane protection mechanism is based on the request by the policy function network element, and the unified data management network element Determining, by the at least one of the UE registration information of the UDM, the subscription service data of the UDM, and the service security requirement of the application function network element AF, wherein the user plane protection mechanism is used to indicate the user equipment and Whether the user plane data transmitted between network devices needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time;
  • the user equipment determines a user plane protection key based on the security protection algorithm, and the user plane protection key is used to perform security protection on user plane data transmitted between the user equipment and the network equipment.
  • the request further includes at least one of a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the request is an attach request;
  • the attach request is initiated by the user equipment to an authentication server network element AUSF;
  • the attach request is used for mutual authentication between the network device and the AUSF, and
  • the request is a session request; the session request is initiated by the user equipment to the session management network element SMF, or is initiated to the SMF by the access and mobility management network element AMF; the session request is used for Establishing a session between the network device and the SMF, and is further configured to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a policy request; the policy request is initiated by the SMF to the policy function network element, and the policy request is used to trigger the policy function network element to determine a user plane protection mechanism.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device.
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • Determining, by the user equipment, the user plane protection key based on the security protection algorithm including:
  • the user plane protection key KDF (K_AN, UP algorithm ID), wherein, after the authentication is successful, the AMF is based on the authenticated base key or the key derived after the authentication, and the base station is deduced. Key, the AN device obtains the K_AN from the AMF;
  • generating a first user plane protection key based on the security protection algorithm including:
  • KDF K_ algorithm network element, UP algorithm ID
  • the UP algorithm ID is an identifier of the encryption algorithm, or an identifier of the integrity protection algorithm; and the KDF is a key derivation function.
  • the network device is an access network AN device or a user plane node UPF.
  • an embodiment of the present invention provides a key configuration method, including:
  • the user plane node receives a response, and the response carries a security protection algorithm, where the security protection algorithm is determined by a user plane protection mechanism, where the user plane protection mechanism is based on the request by the policy function network element, and the unified data management network element UDM Determining, by the at least one of the UE registration information, the subscription service data of the UDM feedback, and the service security requirement of the application function network element AF, wherein the user plane protection mechanism is used to indicate the user equipment and the user Whether the user plane data transmitted between the node nodes needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time;
  • the user plane node determines a user plane protection key based on the security protection algorithm, and the user plane protection key is used to perform security protection on user plane data transmitted between the user equipment and the user plane node.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device. .
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • an embodiment of the present invention provides a key configuration method, including:
  • the access network device receives the user plane protection mechanism, where the user plane protection mechanism is based on the request by the policy function network element, and the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the application function. Determined by at least one of the service security requirements of the NE AF feedback; wherein the user plane protection mechanism is used to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity is required Protection, or whether encryption and integrity protection are required at the same time;
  • the access network device determines a security protection algorithm based on the user plane protection mechanism, and generates a first user plane protection key based on the security protection algorithm;
  • the access network device sends the security protection algorithm to the user equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device. .
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • the access network device is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism and an algorithm priority list supported by the access network device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • generating the first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_AN, UP algorithm ID), wherein after the authentication is successful, the AMF is derived based on the authenticated base key or the key derived after authentication again. a base station key, the access network device obtaining the K_AN from the AMF;
  • the UP algorithm ID is an identifier of the encryption algorithm or an identifier of the integrity protection algorithm; the KDF is a key derivation function.
  • an embodiment of the present invention provides a key configuration method, including:
  • the session management network element receives a request for communication between the user equipment and the network device; the request includes the session identifier, the user equipment identifier, and the indication information of the security requirement, where the indication information of the security requirement is used to indicate the security requirement of the user equipment and/or Or business security needs;
  • the session management network element determines the user based on the request, and at least one of the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the service security requirement fed back by the application function network element AF.
  • a user plane protection mechanism configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time;
  • the session management network element sends the user plane protection mechanism to the AN device; wherein the AN device is configured to determine security protection based on the user plane protection mechanism An algorithm, configured to generate a first user plane protection key based on the security protection algorithm; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment is generated based on the security protection algorithm a second user plane protection key;
  • the session management network element sends the user plane protection mechanism to an algorithm network element, where the algorithm network element is used to determine a security protection algorithm based on the user plane protection mechanism. Generating a first user plane protection key based on the security protection algorithm, and transmitting the first user plane protection key to the CN device; the algorithm network element is further configured to send the security protection algorithm to The user equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the request further includes a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment. At least one of the security capabilities.
  • the request is an attach request;
  • the attach request is initiated by the user equipment to an authentication server network element AUSF;
  • the attach request is used for mutual authentication between the network device and the AUSF, and
  • the request is a session request; the session request is initiated by the user equipment to the session management network element SMF, or is initiated to the SMF by the access and mobility management network element AMF; the session request is used for Establishing a session between the network device and the SMF, and is further configured to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a policy request; the policy request is initiated by the SMF to the policy function network element, and the policy request is used to trigger the policy function network element to determine a user plane protection mechanism.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device. .
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the session management network element determines that the user plane data is carried by a QoS flow transmission channel
  • the QoS flow transmission is selected.
  • the channel transmits user plane data; otherwise, a new Qos flow transmission channel is created, and a QoS flow ID corresponding to the QoS flow transmission channel is generated;
  • the Qos flow transmission channel is selected to transmit the user plane data; otherwise, the new Qos flow transmission channel is generated, and the The QoS flow ID corresponding to the QoS flow transmission channel;
  • the Qos requirement is a requirement for a quality of service parameter in a communication network.
  • the session management network element determines that the user plane data is carried by the data radio bearer DRB transmission channel
  • the DRB transmission channel is selected to transmit the user data; Otherwise, a new DRB transmission channel is created, and a DRB ID corresponding to the DRB transmission channel is generated;
  • the DRB transmission channel is selected to transmit the user data; otherwise, the DRB transmission channel is newly created, and the DRB transmission channel is generated. DRB ID.
  • the DRB ID has a mapping relationship with the user plane protection mechanism.
  • the session management network element determines that the user plane data is carried by the session session transmission channel
  • the session transmission channel is selected to transmit the user data; otherwise, Create a new session transport channel and generate a session ID corresponding to the session transport channel.
  • the session transmission channel is selected to transmit user data; otherwise, a new session transmission channel is created, and a session ID corresponding to the session transmission channel is generated.
  • the session ID has a mapping relationship with the user plane protection mechanism.
  • an embodiment of the present invention provides a readable non-volatile storage medium storing computer instructions, including computer instructions, which are executed to implement the method described in the first aspect above.
  • embodiments of the present invention provide a readable non-volatile storage medium storing computer instructions, including computer instructions, which are executed to implement the method described in the fifth aspect above.
  • an embodiment of the present invention provides a readable non-volatile storage medium storing computer instructions, including computer instructions, which are executed to implement the method described in the sixth aspect above.
  • an embodiment of the present invention provides a readable non-volatile storage medium storing computer instructions, including computer instructions, which are executed to implement the method described in the seventh aspect above.
  • the embodiments of the present invention provide a readable non-volatile storage medium storing computer instructions, including computer instructions, which are executed to implement the method described in the eighth aspect above.
  • the embodiment of the present invention provides a computer program product, when the computer program product runs on a computer, is executed to implement the first aspect, or the fifth aspect, or the sixth aspect, or the seventh aspect, Or the method described in the eighth aspect.
  • a communication architecture based on the future 5G can be implemented.
  • the user equipment and the network device the access network device or the core network device
  • the user equipment and the network device complete the strategy.
  • the user equipment and the network device complete the configuration of the user plane protection key, thereby implementing security protection on the user plane data.
  • the embodiments of the present invention can implement network security protection based on Qos flow, DRB, and session granularity, avoid the disadvantages of the hop-by-hop segmentation protection mode, and improve the security of user plane data transmission.
  • FIG. 1 is a schematic structural diagram of a mobile communication network according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a data transmission channel according to an embodiment of the present invention.
  • FIG. 18 are schematic flowcharts of a key configuration method according to an embodiment of the present invention.
  • FIG. 19 is a schematic structural diagram of a policy function network element according to an embodiment of the present disclosure.
  • FIG. 20 is a schematic structural diagram of still another policy function network element according to an embodiment of the present invention.
  • FIG. 1 is a network architecture of a future mobile communication.
  • the network architecture includes a user equipment and a carrier network.
  • the carrier network includes a core network and a data network, and the user equipment accesses the carrier network through the access network node. details as follows:
  • the user equipment is a logical entity.
  • the UE may be any one of a terminal equipment (Terminal Equipment), a communication device (Communication Device), and an Internet of Things (IoT) device.
  • the terminal device may be a smart phone, a smart watch, a smart tab let, or the like.
  • the communication device can be a server, a gateway (Gateway, GW), a controller and many more.
  • IoT devices can be sensors, electricity meters, water meters, and the like.
  • AN Access network
  • AN is responsible for user equipment access
  • AN can be a wireless access point, such as: base station, Wireless Fidelity (Wi-Fi) access point, and Bluetooth access Points, etc.
  • Wi-Fi Wireless Fidelity
  • Bluetooth access Points etc.
  • wired access points such as: gateway, modem, fiber access, IP access, and so on.
  • a data network which may be an external network of an operator or a network controlled by an operator, is used to provide service services to users.
  • the core network serves as the interface of the bearer network to the DN, and provides the UE with communication connection, authentication, management, policy control, and bearer for data services.
  • the CN further includes: an access and mobility management network element, a session management network element, an authentication server network element, a policy control node, an application function network element, a user plane node, etc., and the related descriptions are as follows:
  • the Access and Mobility Management Function is used to manage access and mobility of the UE.
  • a Session Management Function is used for session management, and performs session establishment, flow, or bearer establishment and management. .
  • AUSF Authentication Server Function
  • AUSF a node that performs mutual authentication between the UE and the carrier network.
  • AUSF can be deployed as a separate logical functional entity or in a device such as AMF/SMF.
  • UDM Unified Data Manager
  • PCF policy control function
  • the PCF is deployed with a policy control function
  • the function of the policy control refers to completing the negotiation of the user plane protection mechanism according to the security requirement, and determining the function of the user plane protection mechanism in the network.
  • the PCF can be used as an independent logical function entity or in other network elements.
  • the policy control function can be deployed in the PCF or in other network elements, for example, in a Mobility Management (MM) network element or a session management network element ( Session Management, SM), Authentication Server Function (AUSF), Policy charging and rules function (PCRF), Mobility Management Entity (MME), Home Subscriber Server ( Home Subscriber Server (HSS), Authentication Center (AuC), Authentication Credential Repository and Processing Function (ARPF), Security Context Management Function (SCMF) Access and Mobility Management Function (AMF), Session Management Function (SMF), Access Network (AN), User plane function (User plane function, In the network element such as UPF).
  • MM Mobility Management
  • AUSF Authentication Server Function
  • PCRF Policy charging and rules function
  • MME Mobility Management Entity
  • HSS Home Subscriber Server
  • AuC Authentication Center
  • ARPF Authentication Credential Repository and Processing Function
  • SCMF Security Context Management Function
  • AMF Access and Mobility Management Function
  • SMSF Session Management Function
  • AN User
  • Application Function Element Used to store service security requirements and provide PCF with policy decision information.
  • UPF User Plane Function
  • server can be gateway, server, controller, user Surface function network element, etc.
  • the UPF can be set inside the operation network or outside the operation network.
  • network elements may be deployed separately, or two or two or more network elements may be integrated into one entity.
  • AMF and SMF can be deployed in one entity; or AMF and SMF can be deployed in separate entities.
  • the user equipment when the user equipment needs to communicate with the carrier network, it includes at least two aspects of communication: (1) communication between the user equipment and the access network, referred to as UE-AN communication, and UE-AN communication is directly Communication, the UE communicates with the AN through the air interface. In order to achieve security of UE-AN communication, a user plane protection mechanism needs to be established between the UE and the AN. (2) Communication between the user equipment and the core network, referred to as UE-CN communication. The UE-CN communication belongs to indirect communication, and the UE communicates with the CN through the access network. In this process, the access network plays the role of transparent transmission or forwarding. In order to achieve the security of UE-CN communication, a user plane protection mechanism needs to be established between the UE and the CN.
  • the hardware infrastructure in a communication network can segment multiple virtual end-to-end networks, called network slices.
  • the process of each network slice from user equipment to access network to core network is logical. Isolation to accommodate the different needs of various types of services. Wherein, one network slice may include one or more sessions.
  • different types of services may use different bearers.
  • the bearer is UE-AN.
  • a logical transmission channel is provided between or between the UE and the CN, and each bearer is associated with a Quality of Service (QoS) parameter set describing the attributes of the transmission channel, such as a bit rate, a delay, an error rate, and the like.
  • QoS Quality of Service
  • the transmission channel includes a session (such as a PDU session), a radio bearer (such as a Data Radio Bearer), and a stream (such as a QoS flow).
  • a session such as a PDU session
  • a radio bearer such as a Data Radio Bearer
  • a stream such as a QoS flow
  • FIG. 2 is a simplified schematic diagram of a data transmission channel according to an embodiment of the present invention.
  • the UE may be in communication connection with the AN, and the UE may also be in communication connection with the UPF in the core network.
  • the network slice in the communication connection has multiple transmission channels, including one PDU session logically set between the UE and the UPF and one or more QoS flows, and one or more Radio Bearers logically disposed between the UE and the AN.
  • the logic is set in an N3 tunnel between the AN and the UPF. The details are as follows:
  • the PDU session is a coarse-grained data transmission channel between the UE and the UPF.
  • the PDU session includes a radio bearer (Radio Bearer) segment and an N3 tunnel segment, and includes a finer-grained QoS flow in the PDU session.
  • the PUD session includes an N3 tunnel, a plurality of Radio Bearers (Radio Bearer 1, Radio Bearer 2), and a plurality of QoS flows (QoS flow 1, QoS flow 2, QoS flow 3).
  • the Radio Bearer is a bearer channel between the UE and the AN.
  • the Radio Bearer supports signaling radio bearers and data radio bearers (DRBs), and different Radio Bearers may include different QoS flows.
  • DRBs data radio bearers
  • the Radio Bearer 1 includes For QoS flow1 and QoS flow2, Radio Bearer2 only includes QoS flow3.
  • the N3 tunnel is a data transmission channel between the AN and the UPF, and can be used to transmit QoS flow data of the user equipment.
  • the N3 tunnel includes QoS flow1, QoS flow2, and QoS flow3.
  • the QoS flow is a fine-grained data transmission channel between the UE and the UPF.
  • the QoS flow has a uniform QoS requirement, and different QoS flows have different Qos flow identifiers (QFI IDs).
  • the embodiment of the present invention provides a key configuration method, which is briefly described as follows:
  • the policy function network element receives a request for communication between the user equipment and the network device;
  • the policy function network element is one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and a CN device.
  • the request is an attach request; or the request is a session request; or the request is a policy;
  • the request includes a session identifier, a user equipment identifier, and an indication of a security requirement, where the indication information of the security requirement is used to indicate a user equipment security requirement and/or a service security requirement; the request may further include a service identifier, At least one of a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the policy function network element is based on the request, and at least one of the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the service security requirement fed back by the application function network element AF. Determine the user plane protection mechanism;
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, and/or whether integrity protection is required.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device.
  • the policy function network element sends the user plane protection mechanism to the AN device;
  • the AN device generates a first user plane protection key based on the security protection algorithm
  • the policy function network element sends the user plane protection mechanism to the algorithm network element;
  • the algorithm network element is one of the PCF, the AUSF, the AMF, the SMF, and the AN device.
  • the algorithm network element determines a security protection algorithm based on the user plane protection mechanism
  • the user equipment uses the second user plane protection key to protect the security of the user plane data.
  • the network device may restore the protected user plane data according to the first user plane protection key to obtain the user Face data.
  • the network device uses the first user plane protection key to protect the security of the user plane data, obtains protected user plane data, and then sends the protected user to the user equipment.
  • the user equipment restores the protected user plane data according to the second user plane protection key to obtain The user plane data is obtained.
  • the embodiment of the present invention will describe the key configuration method provided by the embodiment of the present invention from the perspective of the granularity and the granularity of the granularity according to the UE-AN and the UE-CN according to the network architecture of FIG.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication information of a security requirement, where the indication information of the security requirement is used to indicate the security requirement of the device.
  • UE ID user equipment identifier
  • the attach request may further include a service ID and a UE service ID.
  • the attach request may further include a Data Network Name (DNN), the DNN representing a data network identifier that the UE wishes to access. among them:
  • the user equipment identifier is used to identify the identity of the user equipment that issued the attach request.
  • the UE ID may be a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, an International Mobile Equipment Identity (IMEI), and an International Mobile Subscriber Identity (International Mobile Subscriber Identity (IMSI), IP Multimedia Private Identity (IMPI), Temporary Mobile Subscriber Identity (TMSI), IP Multimedia Public Identity (IMPU), globally unique One or more of the Globally Unique Temporary UE Identity (GUTI) and the like.
  • MAC Media Access Control
  • IP Internet Protocol
  • IMEI International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • TMSI Temporary Mobile Subscriber Identity
  • IMPU IP Multimedia Public Identity
  • GUI Globally Unique Temporary UE Identity
  • the user equipment security capability is used to represent a security protection algorithm that the user equipment can support, a key length that can be supported, a key update period that can be supported, and the like. It can be understood that the storage capacity and operation speed of different user equipments are different. Therefore, the security protection algorithms supported by different user equipments, the supported key lengths, and the supported key update periods are different.
  • the Internet of Things (IoT) device has a small storage capacity and a low computing speed, and cannot support a highly complex security protection algorithm; the storage capacity of the smartphone is large and the operation speed is relatively high, which can support A more complex security protection algorithm. Therefore, the user equipment needs to inform the AMF of the user equipment security capability, so that the AMF can determine the user plane protection mechanism in combination with the user equipment security capability.
  • IoT Internet of Things
  • the security protection algorithm includes an encryption algorithm and an integrity protection algorithm.
  • the security protection algorithm may be any one of null, AES, Snow 3G, ZUC, and the like, where null represents Empty algorithm.
  • the key length can be any of 64-bit, 96-bit, 128-bit, 192-bit, and 256-bit, and so on.
  • the key update time may be any one of 6 hours, 12 hours, 24 hours, and 48 hours, and the like.
  • the device security requirement is used to indicate the security requirement of the user equipment side, that is, the device security requirement is used to indicate to the AMF what kind of user plane protection mechanism the UE needs.
  • the user plane protection mechanism is used to indicate a protection mode of the user plane data transmission, for example, indicating whether the UE needs to encrypt and/or integrity protect the user plane data.
  • the user plane protection mechanism can be "requires encryption + no integrity protection required”; or "requires encryption + does not require integrity protection”; or “requires encryption + requires integrity protection”.
  • the encryption refers to After the user plane data is processed by the encryption algorithm, it becomes an unreadable ciphertext, so as to prevent the data from being illegally stolen and read.
  • the integrity protection refers to that after the user plane data is processed by the integrity protection algorithm, the data is not illegally added, deleted, replaced, etc. during the transmission process.
  • the user plane protection mechanism may also be used to indicate a security protection algorithm, a key length acceptable to the UE, a key update period acceptable to the UE, and the like.
  • the user plane protection mechanism may also be used to indicate a security protection algorithm, including an indication encryption algorithm and an indication integrity protection algorithm, where the indication encryption algorithm is specifically: the specification adopts, but is not limited to, null (an empty algorithm, indicating that no encryption is performed. Which encryption algorithm in AES, Snow 3G or ZUC encrypts the user plane data; the indication integrity protection algorithm is specifically: the specification includes but not limited to null (empty algorithm, means no integrity protection), AES Which integrity protection algorithm in Snow 3G, ZUC, HMAC, and CMAC protects the integrity of user plane data.
  • An algorithm that may be secure in a security requirement includes multiple encryption algorithms and/or multiple integrity protection algorithms; in this case, the security requirements also include prioritization of the algorithm, ie indicating which algorithm to use preferentially.
  • the key length acceptable by the UE indicated by the user plane protection mechanism includes 64, 128, 256, or 512 bits, and the like.
  • the key update period acceptable to the UE indicated by the user plane protection mechanism may be 6 hours, 12 hours, 24 hours, 48 hours, and the like.
  • the business security requirements are used to characterize at least one of a service acceptable security algorithm, an acceptable key length, and an acceptable key update period. It can be understood that different services have different requirements for security algorithms, key lengths, and key update periods. For example, financial services have higher requirements for security algorithms, while video download services have lower requirements for security algorithms. Therefore, the first device needs to inform the AMF of the service security requirements, so that the AMF can generate the user plane protection mechanism in combination with the service security requirements.
  • the service ID is used to identify the service supported by the UE. For example, if the service is WeChat, the service ID is a WeChat ID (WeChat ID).
  • the UE service ID is used to identify the identifier of the service that the UE needs to transmit in the service supported by the UE. For example, if the service is WeChat, the UE service ID is a WeChat user ID (WeChat User ID).
  • the UE before performing actual service transmission, the UE first needs to attach to the subscription network to obtain authorization on the subscription network.
  • the UE may trigger an attach procedure when the device is powered on, and send an attach request to the AN.
  • the UE may also re-trigger the attach process and send an attach request to the AN when the network needs to be connected to the network after being completely removed from the network for a period of time.
  • the AN After receiving the attach request, the AN forwards the attach request to the AMF.
  • the AMF sends the UE ID to the AUSF.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is then identified.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • AMF determines the user plane protection mechanism.
  • the function of the policy control is deployed in the AMF, and the AMF can determine the user plane protection mechanism in multiple ways:
  • the AMF can determine the user plane protection mechanism according to the indicator. Including: (1) AMF based on the indicator to obtain the security requirements of the user equipment side (ie, user equipment security requirements), then, AMF can be based on user equipment security requirements Determine the user plane protection mechanism. (2) AMF obtains the security requirements of the service based on the indicator (that is, the service security requirement). Then, AMF can determine the user plane protection mechanism according to the service security requirements.
  • the AMF can determine the user plane protection mechanism according to the UE registration information.
  • the UE registration information is obtained by the AMF from the UDM. Specifically, after receiving the attach request of the UE, the AMF sends the UE ID to the UDM, the UE registration information obtained from the UDM, or the UE registration information obtained from the UDM through the AUSF.
  • the registration information is preset in the UDM, and the UE registration information includes a preset UE security requirement.
  • the UE security requirement is used to indicate whether the UE needs to be encrypted, or whether the UE needs to perform integrity protection, or whether the UE needs both encryption and integrity protection.
  • the AMF can determine the user plane protection mechanism based on the contracted service data. Specifically, the AMF sends the service ID to the UDM, or sends a data network identifier (DNN) to the UDM; the UDM confirms the contracted service data preset therein based on the service ID or the DNN, and sends the related contracted service data to the AMF, where
  • the subscription service data includes a preset service security requirement, where the preset service security requirement is used to indicate a user plane protection mechanism required by the service, such as indicating whether the service needs to be encrypted, or whether the service needs integrity protection, or Whether the service requires both encryption and integrity protection.
  • the AMF can determine the user plane protection mechanism according to the service security requirements of the AF feedback. Specifically, the PCF sends a request to the AF, and the AF feeds back the service security requirement to the PCF based on the request, where the request may include at least one of a UE ID, a service ID, a service UE ID, or a DNN, and the PCF needs the service security requirement. Sent to AMF, and AMF gets business security needs.
  • the service security requirement is used to indicate what kind of user plane protection mechanism the service needs, such as indicating whether the service needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the AMF may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. That is to say, the AMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements preset by the network side or the security requirements of the service.
  • the AMF sends the user plane protection mechanism to the AN.
  • the AN receives the user plane protection mechanism.
  • the AN determines the security protection algorithm and determines the user plane protection key.
  • the AN determines whether the user plane protection mechanism between the UE and the AN is encrypted, whether integrity protection is needed, and then the AN supports the algorithm according to the UE security capability.
  • the priority list determines the security protection algorithm. For example, when the user plane protection mechanism is “requires encryption+requires integrity protection”, the AN determines the encryption algorithm as AES according to the UE security capability and the algorithm priority list supported by the AN, and the integrity protection algorithm. For AES.
  • the user plane protection mechanism directly defines a security protection algorithm
  • the AN can directly obtain the security protection algorithm from the user plane protection mechanism.
  • the AMF may obtain an algorithm priority list supported by the AN, and determine an air interface protection algorithm based on the algorithm priority list supported by the AN and the algorithm supported by the UE and the security capability of the user equipment, for example, Under the user plane protection mechanism of "requires encryption + integrity protection", AMF further determines that the encryption algorithm is AES, the integrity protection algorithm is AES, and carries the above security protection algorithm in the user plane protection mechanism.
  • the user plane protection mechanism directly specifies the encryption algorithm and the integrity protection algorithm
  • the AN obtains the user plane protection mechanism, the encryption algorithm and the integrity protection algorithm can be directly obtained from the user plane protection mechanism.
  • the same security protection algorithm, the same key length, and the same key update time are used to encrypt and protect the user plane data.
  • Different security protection algorithms may be used.
  • the key length and the different key update times are used to encrypt and integrity protect the user plane data.
  • the security protection algorithm adopted is Snow 3G algorithm, the key length is 64 bits, and the key update time is 6 hours.
  • the security protection algorithm is Snow 3G algorithm, the key length is 64 bits, and the key update time is It is 6 hours.
  • the security protection algorithm adopted for the encryption is the Snow 3G algorithm
  • the key length is 64 bits
  • the key is updated.
  • the time is 6 hours; for integrity, the security protection algorithm adopted by AN/UE is ZUC algorithm, the key length is 128 bits, and the key update time is 12 hours.
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID), wherein, after the authentication is successful, the AMF is based on the authenticated base key or the key that is derived again after the authentication.
  • the derived base station key K_AN may also be referred to as an intermediate key
  • the K_AN is sent directly to the AN by the AMF transmission, or the K_AN is carried by the AMF to the AN in the user plane protection mechanism
  • the UP algorithm ID may be an identifier of the encryption algorithm or an identifier of the integrity protection algorithm
  • KDF is a Key Derivation Function (KDF), including but not limited to the following cryptographic derivation function: HMAC (such as HMAC- SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC and VMAC, HASH algorithm and so on.
  • HMAC such as HMAC- SHA256, HMAC-SHA1
  • NMAC such as HMAC- SHA256, HMAC-SHA
  • the user plane protection mechanism addresses different security requirements, for example, the user plane protection mechanism 1 requires a protection key length of 256 bits; and the user plane protection mechanism 2 requires a protection key length of 128 bits; Different key derivation algorithms are used to meet the requirements of different user protection mechanisms for different protection key lengths (for example, HMAC-SHA1 is used to generate a 128-bit protection key, and HMAC-SHA256 is used to generate a 256-bit protection key).
  • the AN sends a security protection algorithm to the UE.
  • the UE receives the user plane security protection algorithm.
  • the AN determines the security protection algorithm in step 6, and then the AN directly sends the security protection algorithm to the UE.
  • the user plane protection mechanism may include a security protection algorithm. Then, the AN may send a user plane protection mechanism to the UE. After receiving the user plane protection mechanism, the UE obtains the security protection in the user plane protection mechanism. algorithm.
  • the UE generates a user plane protection key according to the user plane security algorithm and K_AN.
  • the UE may generate a user plane protection key based on the security protection algorithm. Specifically, the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID), where K_AN is derived by the UE according to the authenticated base key or the key derived after authentication again.
  • Base station key the UP algorithm ID may be an identifier of the encryption algorithm or an identifier of the integrity protection algorithm
  • KDF is a key derivation function (Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (eg HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC and VMAC, HASH algorithm and so on.
  • the first air interface user plane protection key and the second air interface user plane protection key may be the same key.
  • the UE may perform cryptographic protection and/or integrity protection on the user plane data based on the second air interface user plane protection key.
  • the AN After receiving the user plane data sent by the UE, the AN is based on the first air interface user plane.
  • the protection key decrypts and/or checks the integrity of the user plane data.
  • the AN performs cryptographic protection and/or integrity protection on the user plane data based on the first air interface user plane protection key.
  • the UE is based on the second air interface user plane protection.
  • the key decrypts and/or checks the integrity of the user plane data.
  • Possibility 1 If the AMF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the AMF may determine the user plane protection mechanism before the mutual authentication (ie, step 4 may be placed before step 3).
  • FIG. 3 is only an example and should not be construed as limiting the invention.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation, and the AMF needs the security requirements according to the user equipment side (including the security requirements of different services).
  • the security requirements preset on the network side determine the user plane protection mechanism, and the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID.
  • DNN DNN
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AMF may send the user equipment security capability, the indication information of the security requirement, the service ID, the UE service ID, and the DNN to the AUSF; or, the AMF directly attaches the request.
  • the content is further forwarded to AUSF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • AUSF determines the user plane protection mechanism.
  • the AUSF may determine user plane protection according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, contracted service data, and AF security service security requirements. mechanism. That is to say, the AUSF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset by the network side.
  • an indicator user equipment security requirement and/or service security requirement
  • the AUSF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset by the network side.
  • the AUSF sends the user plane protection mechanism to the AMF, and the AMF then sends the user plane protection mechanism to the AN. Accordingly, the AN receives the user plane protection mechanism.
  • the AN determines the security protection algorithm and determines the user plane protection key.
  • step 6 For details, refer to the description of step 6 in the embodiment of FIG. 3, and details are not described herein again.
  • the AN sends a security protection algorithm to the UE.
  • the UE receives the user plane security protection algorithm.
  • the UE generates a user plane protection key according to the user plane security algorithm and K_AN.
  • step 8 For details, refer to the description of step 8 in the embodiment of FIG. 3, and details are not described herein again.
  • Possibility 1 If the AUSF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the AUSF may determine the user plane protection mechanism before the mutual authentication.
  • the AUSF needs security requirements (including security requirements of different services) and security requirements preset by the network side according to the security requirements of the user equipment side in the process of attaching the network. Determine the user plane protection mechanism.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation.
  • the UE and the AN respectively determine the security protection algorithm and the key, thereby Realize the security protection of user plane data.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the AMF sends a session request to the SMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the AMF and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identification (session ID).
  • the SMF sends the SMF response information to the AMF, and the AMF sends the SMF response information to the AN. Accordingly, the AN receives the SMF response information.
  • the SMF response information may include security requirements preset by the network side, for example, UE registration information including UDM feedback, or subscription service data fed back by UDM, or service security requirements of AF feedback, etc., in addition, the SMF The response information may further include an authentication result of the secondary authentication of the UE and the data network DN. For example, after the UE performs secondary authentication by the SMF and the data network DN based on the session request, the SMF writes the authentication result to the SMF response. In the information, the SMF response information is sent to the AN.
  • the AN After the AN obtains the authentication result, if the authentication result is found to be correct (ie, through authentication), then the following process of determining the user plane protection mechanism is performed; if the authentication result is found to be an error (ie, Through authentication), the subsequent process of determining the user plane protection mechanism will not be performed.
  • AN determines the user plane protection mechanism.
  • the AN may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. . That is to say, the AN can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side.
  • an indicator user equipment security requirement and/or service security requirement
  • the AN can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side.
  • the AN determines the security protection algorithm and determines the user plane protection key.
  • step 6 For details, refer to the description of step 6 in the embodiment of FIG. 3, and details are not described herein again.
  • the AN sends a security protection algorithm to the UE.
  • the UE receives the user plane security protection algorithm.
  • the UE generates a user plane protection key according to the user plane security algorithm and K_AN.
  • step 8 For details, refer to the description of step 8 in the embodiment of FIG. 3, and details are not described herein again.
  • Possibility 1 If the AN does not need the information of the indicator in determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the AN may determine the user plane protection mechanism before step 4 (the AMF sends a session request to the SMF).
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • FIG. 5 the related description of the embodiment of FIG. 3 may be referred to.
  • FIG. 5 embodiment is only an example and should not be construed as limiting the present invention.
  • the AN is preset according to the security requirements of the user equipment side (including the security requirements of different services) and the network side in the related process of session establishment. Security requirements determine the user plane protection mechanism.
  • the UE-AN completes the policy negotiation. After the user plane protection mechanism is determined by the AN, the UE and the AN respectively determine the security protection algorithm and the key, thereby implementing the pair. User plane data security protection.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the AMF sends a session request to the SMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the AMF and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identification (session ID).
  • the UE and the DN perform secondary authentication.
  • the UE performs secondary authentication by using the SMF and the DN. If the authentication is passed, the authentication result is correct. If the authentication fails, the authentication result is an error, and the SMF obtains the authentication result.
  • this step is an optional step.
  • the SMF sends the SMF response message to the AMF.
  • the SMF generates SMF response information.
  • the SMF response information may include security requirements preset by the network side, for example, UE registration information including UDM feedback, or subscription service data fed back by UDM, or service security requirements of AF feedback, etc., so that the AMF obtains the After the SMF response information, the user plane protection mechanism can be further determined according to the security requirements in the SMF response information.
  • the SMF response information may further include an authentication result of the secondary authentication of the UE and the data network DN.
  • the SMF writes the authentication result.
  • the SMF response information is sent to the AMF, and after the AMF learns the authentication result, if the authentication result is found to be correct (ie, through authentication), then the following process of determining the user plane protection mechanism is performed; if the authentication is found; The result is an error (ie, by authentication), then the subsequent process of determining the user plane protection mechanism will not be performed.
  • AMF determines the user plane protection mechanism.
  • the AMF may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. That is to say, the AMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side. In addition, the AMF may also determine whether the user plane protection mechanism can be determined according to the relevant security requirements (such as the service security of the AF feedback) according to the SMF response information (including the authentication result), determine whether to perform the step of determining the user plane protection mechanism, and the like.
  • the relevant security requirements such as the service security of the AF feedback
  • SMF response information including the authentication result
  • the AMF sends the user plane protection mechanism to the AN.
  • the AN determines the security protection algorithm and determines the user plane protection key.
  • step 6 For details, refer to the description of step 6 in the embodiment of FIG. 3, and details are not described herein again.
  • the AN sends a security protection algorithm to the UE.
  • the UE receives the user plane security protection algorithm.
  • the UE generates a user plane protection key according to the user plane security algorithm and K_AN.
  • step 8 For details, refer to the description of step 8 in the embodiment of FIG. 3, and details are not described herein again.
  • Possibility 1 If the AMF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the AMF may determine the user plane protection mechanism before step 4.
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • FIG. 3 may be referred to in the embodiment of FIG. 6 in detail.
  • FIG. 4 is only an example and should not be construed as limiting the invention.
  • the AMF is preset according to the security requirements of the user equipment side (including the security requirements of different services) and the network side in the related process of session establishment. Security requirements determine the user plane protection mechanism.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation.
  • the user plane protection mechanism is determined by the AMF, the UE and the AN respectively determine the security protection algorithm and the key, thereby Realize the security protection of user plane data.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the UE sends a session request to the SMF through the AN and the AMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the UE and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identifier (session ID).
  • the session request may further include a user equipment identifier (UE ID), an indication of security requirements, or a DNN, a service ID, and a UE service. ID, etc.
  • the service ID, the UE service ID may be carried in the session request when the UE establishes the session.
  • the UE and the DN perform secondary authentication.
  • the SMF determines the user plane protection mechanism.
  • the SMF may be according to one of the indicator (user equipment security requirements and/or service security requirements), the UE registration information, the contracted service data, and the AF security service security requirements, or two items, or Three, or all, information identifies the user plane protection mechanism. That is to say, the SMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side, the security requirements preset by the network side, or the security requirements of the service. Specifically, the SMF may obtain the UE registration information from the UDM by sending at least one of a UE ID, a service ID, a service UE ID, or a DNN to the UDM.
  • the SMF may obtain the contracted service data from the UDM by transmitting at least one of a UE ID, a service ID, a service UE ID, or a DNN to the UDM.
  • the SMF sends a request to the PCF, and the PCF sends a request to the AF, and the AF feeds back the service security requirement to the PCF based on the request, where the request may include at least one of a UE ID, a service ID, a service UE ID, or a DNN, and the PCF will Business security requirements are sent to the SMF, and the SMF gains business security requirements.
  • the service security requirement is used to indicate what kind of user plane protection mechanism the service needs, such as indicating whether the service needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the SMF sends the user plane protection mechanism to the AMF, and the AMF sends the user plane protection mechanism to the AN. Accordingly, the AN receives the user plane protection mechanism.
  • the AN determines the security protection algorithm and determines the user plane protection key.
  • step 6 For details, refer to the description of step 6 in the embodiment of FIG. 3, and details are not described herein again.
  • the AN sends a security protection algorithm to the UE.
  • the UE receives the user plane security protection algorithm.
  • the UE generates a user plane protection key according to the user plane security algorithm and K_AN.
  • step 8 For details, refer to the description of step 8 in the embodiment of FIG. 3, and details are not described herein again.
  • Possibility 1 If the SMF does not require the information of the indicator in determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the SMF may determine the user plane protection mechanism before step 5.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the session request includes at least a session identifier (session ID).
  • the session request may further include a user equipment identifier (UE ID), an indication of a security requirement, or a DNN, Service ID, UE service ID, etc.
  • the user equipment identifier (UE ID), the indication information of the security requirement, or the DNN, the service ID, and the UE service ID may be obtained by the AMF from the received attach request, and the attach request carries the foregoing information.
  • the method for determining the user plane protection mechanism by the SMF can refer to the method for determining the user plane protection mechanism by the AMF in the embodiment of FIG.
  • the method for the AN and the UE to derive the user plane protection key may also be based on the method of FIG. 12, including a method based on session ID, slice ID, flow ID, or DRB ID. After the DRB ID is selected by the AN, it is sent to the UE.
  • the SMF needs the security requirements (including the security requirements of different services) and the security requirements preset by the network side in the session establishment process according to the security requirements of the user equipment side. Determine the user plane protection mechanism.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation, and after determining the user plane protection mechanism by using the SMF, the UE and the AN respectively determine the security protection algorithm and the key, thereby Realize the security protection of user plane data.
  • the key configuration method provided by the embodiment of the present invention is described below based on the UE-CN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID in the attach request, and determines that the UE is a legitimate user.
  • AMF determines the user plane protection mechanism.
  • the AMF may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. That is to say, the AMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side.
  • an indicator user equipment security requirement and/or service security requirement
  • UE registration information UE registration information
  • subscription service data e.g., subscription service data
  • AF security service security requirements e.g., AF security service security requirements.
  • the AMF sends a session request and a user plane protection mechanism to the SMF. Accordingly, the SMF receives the session request and the user plane protection mechanism.
  • the session request is used to request that a session be established between the AMF and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identification (session ID).
  • the user plane protection mechanism is carried in the session request, that is, the AMF sends a session request to the SMF, and the session request includes a user plane protection mechanism.
  • the AMF sends a session request and a user plane protection mechanism to the SMF, respectively.
  • the UE and the DN perform secondary authentication.
  • the SMF determines the security protection algorithm and determines the user plane protection key.
  • the SMF determines whether the user plane protection mechanism between the UE and the CN needs to be encrypted, and whether integrity protection is required. Then, the SMF determines the security protection algorithm according to the received UE security capability and the algorithm priority list supported by the UPF, where The algorithm priority list supported by the UPF may be preset in the SMF, or may be preset in the UPF, and the SMF obtains the algorithm priority list supported by the UPF from the UPF.
  • the SMF determines that the encryption algorithm is AES according to the UE security capability, the algorithm priority list supported by the UPF, and the algorithm supported by the UE, and the integrity protection algorithm is AES.
  • the user plane protection mechanism directly specifies a security protection algorithm
  • the SMF can directly obtain the security protection algorithm from the user plane protection mechanism.
  • the AMF may determine an air interface protection algorithm based on an algorithm priority list supported by the UPF, a UE supported algorithm, and a user equipment security capability, where the UPF supported algorithm priority list It can be preset to the AMF, or it can be preset in the UPF.
  • the AMF obtains the algorithm priority list supported by the UPF from the UPF. For example, under the user plane protection mechanism that requires encryption + integrity protection, AMF further determines that the encryption algorithm is AES, the integrity protection algorithm is AES, and carries the above security protection algorithm in the user plane protection mechanism. In this case, since the user plane protection mechanism directly specifies the encryption algorithm and the integrity protection algorithm, after the SMF obtains the user plane protection mechanism, the encryption algorithm and the integrity protection algorithm can be directly obtained from the user plane protection mechanism.
  • the SMF may further determine the user plane protection key, specifically:
  • KDF KDF (K_SMF, UP algorithm ID, flow ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, session ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, DRB ID);
  • the AMF derives the key based on the authenticated key or the key derived after the authentication. Specifically, the AMF sends the K_SMF to the SMF; or, after the K_SMF is successfully authenticated, the AUSF sends the K_SMF to the SMF according to the key after the authentication or the key derived after the authentication, and the AUSF sends the K_SMF.
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID.
  • the SMF sends a security protection algorithm or a user plane protection key to the UPF.
  • the UPF receives the security protection algorithm or the user plane protection key.
  • the UPF may obtain the user plane protection key based on the security protection algorithm and the K_SMF calculation (refer to the related description above),
  • the user plane protection key is the user plane protection key of the UPF.
  • the AMF derives the key according to the key obtained after the authentication or the key derived after the authentication, and specifically, the AMF sends the K_SMF to the UPF; or, after the authentication succeeds, the AUSF
  • the AUSF sends the K_SMF to the UPF based on the key after the authentication or the key derived after the authentication, and the derived key.
  • the user plane protection key is used as the user plane protection key of the UPF.
  • the SMF sends a security protection algorithm to the AMF.
  • the SMF sends a security protection algorithm to the AMF.
  • the SMF sends a security protection algorithm to the AMF, where the SMF sends a session response to the AMF, where the session response carries a security protection algorithm.
  • the security protection algorithm is that the AMF can be determined based on the algorithm priority list supported by the UPF, the algorithm supported by the UE, and the security capability of the user equipment, the SMF does not need to send a security protection algorithm to the AMF.
  • the AMF sends a security protection algorithm and a user plane protection mechanism to the AN, wherein the user plane protection mechanism is optional.
  • the AN sends a security protection algorithm and a user plane protection mechanism to the UE, where the user plane protection mechanism is optional.
  • the UE generates a user plane protection key according to the user plane security algorithm, the user plane protection mechanism, and the K_SMF. Or the UE generates a user plane protection key according to the user plane security algorithm and K_SMF.
  • the UE may further determine a user plane protection key, where the user plane protection key is a user plane protection key of the UE, specifically:
  • KDF KDF (K_SMF, UP algorithm ID, flow ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, session ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, DRB ID);
  • the K_SMF is the key derived by the UE after the authentication succeeds or the key derived after the authentication, and the AMF sends the K_SMF to the UE; or, after the authentication succeeds, the AUSF The AUSF sends the K_SMF to the UE according to the key after the authentication or the key derived after the authentication, and the derived key.
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID.
  • Possibility 1 If the AMF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • step 8 and step 9 may be performed simultaneously, and step 8 may also be placed before or after step 9.
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • Possibility 4 If the user plane protection mechanism includes a specific security protection algorithm, the AMF can also send the user plane protection mechanism to the UPF through the SMF, and the UPF obtains the security protection algorithm in the user plane protection mechanism.
  • the SMF sends the session ID, QFI and user plane protection mechanisms to the AMF.
  • AMF sends session ID, QFI and user plane protection mechanism to AN;
  • the AN sends the session ID, QFI and user plane protection mechanism to the UE;
  • the UE generates a second K_UP based on the K_SMF. After the K_SMF is successfully authenticated, the UE derives the key based on the authenticated key or the key derived after authentication.
  • the UPF and the UE negotiate a security protection algorithm based on the session ID, the QFI, and the user plane protection mechanism, and then generate the user plane protection key of the UPF and the user plane protection key of the UE based on the first K_UP and the second K_UP, respectively.
  • the AMF is in accordance with the security requirements required by the user equipment side in the related process of the session establishment (including the security of different services).
  • the user requirements protection mechanism is determined by the security requirements preset on the network side.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation.
  • the UE and the CN respectively determine the user plane protection key, thereby implementing Security protection of user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • the key configuration method provided by the embodiment of the present invention is described below based on the UE-CN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID in the attach request, and determines that the UE is a legitimate user.
  • AUSF determines the user plane protection mechanism.
  • the AUSF may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. That is to say, the AUSF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset by the network side.
  • an indicator user equipment security requirement and/or service security requirement
  • UE registration information UE registration information
  • subscription service data subscription service data
  • AF security service security requirements AF security service security requirements
  • the AUSF sends a user plane protection mechanism to the SMF. Accordingly, the SMF receives the user plane protection mechanism.
  • the AMF sends a session request to the SMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the AMF and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identification (session ID).
  • the UE and the DN perform secondary authentication.
  • the SMF determines the security protection algorithm and determines the user plane protection key.
  • the SMF sends a security protection algorithm and a user plane protection key to the UPF.
  • the UPF receives the security protection algorithm and the user plane protection key.
  • the security protection algorithm is optional.
  • the SMF sends a security protection algorithm and a user plane protection mechanism to the AMF.
  • the user plane protection mechanism is optional.
  • the AMF sends a security protection algorithm and a user plane protection mechanism to the AN.
  • the user plane protection mechanism is optional.
  • the AN sends a security protection algorithm and a user plane protection mechanism to the UE.
  • the user plane protection mechanism is optional.
  • the UE generates a user plane protection key according to the user plane security algorithm, the user plane protection mechanism, and the K_SMF. Alternatively, the UE generates a user plane protection key according to the user plane security algorithm and K_SMF.
  • Possibility 1 If the AMF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • step 9 and step 10 may be performed simultaneously, and step 8 may also be placed before or after step 9.
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • Possibility 4 If the user plane protection mechanism includes a specific security protection algorithm, the AUSF can also send the user plane protection mechanism to the UPF through the SMF, and the UPF obtains the security protection algorithm in the user plane protection mechanism.
  • the SMF sends the session ID, QFI, and the user plane protection key to the UPF; in addition, the UPF also obtains the first K_SMF, wherein, after the first K_SMF is successfully authenticated, the AMF is based on the authenticated key or After the authentication, the obtained key is derived again, and the derived key is derived. Specifically, the AMF sends the K_SMF to the UPF; or, after the K_SMF is successfully authenticated, the AUSF sends the K_SMF to the UPF according to the key after the authentication or the key derived after the authentication, and the AUSF sends the K_SMF.
  • SMF sends session ID, QFI and user plane protection mechanism to AMF;
  • AMF sends session ID, QFI and user plane protection mechanism to AN;
  • the AN sends a session ID, QFI and user plane protection mechanism to the UE;
  • the UPF and the UE negotiate a security protection algorithm based on the session ID, the QFI, and the user plane protection mechanism, and then generate a user plane protection key of the UPF and a user plane protection key of the UE based on the first K_SMF and the second K_SMF, respectively.
  • the AMF derives the key according to the key after the authentication or the key derived after the authentication.
  • the AMF sends the K_SMF to the UE; or, after the K_SMF is successfully authenticated, the AUSF sends the K_SMF to the UE according to the key after the authentication or the key derived after the authentication, and the AUSF sends the K_SMF.
  • the AUSF is preset according to the security requirements of the user equipment side (including the security requirements of different services) and the network side in the related process of session establishment. Security requirements determine the user plane protection mechanism.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation.
  • the UE and the CN respectively determine the user plane protection key, thereby implementing Security protection of user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • the key configuration method provided by the embodiment of the present invention is described below based on the UE-CN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AN, and the AN sends the attach request to the AMF, and the AMF sends the UE ID to the AUSF.
  • the attach request includes a user equipment identifier (UE ID), a user equipment security capability, and an indication of a security requirement.
  • the attach request may further include a service ID and a UE service ID. And DNN.
  • the AMF identifies the UE ID in the attach request and sends the UE ID to the AUSF; in another specific embodiment, the AMF sends the authentication request directly to the AUSF, which receives the authentication request The UE ID in the authentication request is later identified, wherein the authentication request includes a UE ID.
  • the AUSF performs authentication with the UE based on the UE ID in the attach request, and determines that the UE is a legitimate user.
  • the AMF sends a session request to the SMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the UE and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the session request includes at least a session identifier (session ID).
  • the session request may further include a user equipment identifier (UE ID), an indication of security requirements, or a DNN, a service ID, and a UE service. ID, etc.
  • UE ID user equipment identifier
  • the user equipment identifier (UE ID), the security requirement indication information (indicator), or the DNN, the service ID, and the UE service ID may be carried in the session request when the UE establishes the session.
  • the UE and the DN perform secondary authentication.
  • the SMF determines the user plane protection mechanism.
  • the SMF may determine the user plane protection mechanism according to at least one of an indicator (user equipment security requirement and/or service security requirement), UE registration information, subscription service data, and AF security service security requirements. That is to say, the SMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side.
  • an indicator user equipment security requirement and/or service security requirement
  • UE registration information UE registration information
  • subscription service data e.g., subscription service data
  • AF security service security requirements e.g., AF security service security requirements.
  • the SMF can comprehensively determine the user plane protection mechanism according to the security requirements required by the user equipment side and the security requirements or service security requirements preset on the network side.
  • the related content description of the AMF determining user plane protection mechanism in the embodiment of FIG. 3 can be similarly referred to, and details are not described herein again.
  • the SMF determines the security protection algorithm and determines the user plane protection key.
  • the SMF sends a security protection algorithm or a user plane protection key to the UPF.
  • the UPF receives the security protection algorithm or the user plane protection key.
  • the SMF sends a security protection algorithm to the AMF.
  • the AMF sends a security protection algorithm and a user plane protection mechanism to the AN.
  • the user plane protection mechanism is optional.
  • the A N sends a security protection algorithm and a user plane protection mechanism to the UE.
  • the user plane protection mechanism is optional.
  • the UE generates a user plane protection key according to the user plane security algorithm, the user plane protection mechanism, and the K_SMF. Alternatively, the UE generates a user plane protection key according to the user plane security algorithm and K_SMF.
  • Possibility 1 If the SMF does not require the information of the indicator in determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • Possibility 2 This embodiment does not limit the sequence of the above process steps.
  • the SMF may determine the user plane protection mechanism before step 5.
  • step 8 and step 9 can be performed simultaneously, and step 8 can also be placed before or after step 9.
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • Possibility 4 If the user plane protection mechanism includes a specific security protection algorithm, the SMF may also send the user plane protection mechanism to the UPF. Further, the UPF acquires the security protection algorithm in the user plane protection mechanism.
  • the SMF is preset according to the security requirements of the user equipment side (including the security requirements of different services) and the network side in the related process of session establishment. Security requirements determine the user plane protection mechanism.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation.
  • the SMF determines the user plane protection mechanism
  • the UE and the CN respectively determine the user plane protection key, thereby implementing Security protection of user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the UE and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the SMF sends a policy request to the PCF.
  • the policy control function is deployed in the PCF, and the SMF sends a policy request to the PCF, so that the PCF determines the corresponding user plane protection mechanism according to the policy request.
  • the policy request includes at least a session identifier (session ID), and may further include a user equipment identifier (UE ID), an indication of a security requirement, a user equipment security capability, a service ID, a UE service ID, and a DNN.
  • the indication of the security requirement is used to indicate the device security requirement and/or the service security requirement; wherein the session ID, the UE ID, the indicator, the user equipment security capability, the service ID, and the UE service ID
  • the DNN may be obtained by the SMF from the received session request; wherein:
  • the session identifier (session ID) is used to identify the identity of the session, and the session has a unique session identifier.
  • the session identifier may be generated by any one of a UE, an AN, an AMF, and an SMF.
  • the session identifier is generated when the UE prepares to create a new session.
  • the session identifier is generated by any one of AN, AMF, and SMF
  • the session identifier is received by any one of AN, AMF, and SMF.
  • Generated when a request is sent by another network element. For example, when the SMF receives a session request sent from the AN, the SMF generates a session ID based on the session request.
  • the session identifier may be a newly created identifier, or may be multiplexed with other identifiers, for example, an existing session identifier, an air interface identifier, a radio bearer identifier, a slice identifier, an air interface resource identifier, a device permanent identifier, a device temporary identifier, and a Any of the permanent identification of the user, the temporary identifier of the user, and the like.
  • the user equipment identifier is used to identify the identity of the user equipment that issues the session request.
  • the UEID may be a Media Access Control (MAC) address, an Internet Protocol (IP) address, a mobile phone number, an International Mobile Equipment Identity (IMEI), and an International Mobile Subscriber Identity (International).
  • MAC Media Access Control
  • IP Internet Protocol
  • IMEI International Mobile Equipment Identity
  • International Mobile Subscriber Identity International Mobile Subscriber Identity
  • IMSI IP Multimedia Private Identity
  • TMSI Temporary Mobile Subscriber Identity
  • IMPU IP Multimedia Public Identity
  • Global Unique Temporary One or more of the UE Globally Unique Temporary UE Identity, GUTI
  • the user equipment security capability is used to represent a security protection algorithm that the user equipment can support, a key length that can be supported, a key update period that can be supported, and the like. It can be understood that the storage capacity and operation speed of different user equipments are different. Therefore, the security protection algorithms supported by different user equipments, the supported key lengths, and the supported key update periods are different.
  • the Internet of Things (IoT) device has a small storage capacity and a low computing speed, and cannot support a highly complex security protection algorithm; the storage capacity of the smartphone is large and the operation speed is relatively high, which can support A more complex security protection algorithm. Therefore, the user equipment needs to inform the PCF of the user equipment security capability, so that the PCF determines the user plane protection mechanism in combination with the user equipment security capability.
  • IoT Internet of Things
  • the device security requirement is used to indicate a required security requirement of the user equipment, that is, the device security requirement is used to indicate to the PCF how the user plane protection mechanism is required by the UE, for example, indicating that "encryption is required. + does not require integrity protection; or "requires encryption + does not require integrity protection”; or “requires encryption + requires integrity protection”, etc., can also indicate the security protection algorithm required by the UE, the key acceptable to the UE Length, key update period acceptable to the UE, etc.
  • the business security requirements are used to characterize at least one of a service acceptable security algorithm, an acceptable key length, and an acceptable key update period. It can be understood that different services have different requirements for security algorithms, key lengths, and key update periods. For example, financial services have higher requirements for security algorithms, while video download services have lower requirements for security algorithms. Therefore, the first device needs to inform the PCF of the service security requirement, so that the PCF can generate the user plane protection mechanism in combination with the service security requirement.
  • the PCF determines the user plane protection mechanism.
  • the PCF can determine the user plane protection mechanism in a variety of ways. Specifically, the PCF may determine the user plane protection mechanism according to at least one of a policy request, a UE registration information, a subscription service data, and an AF security service security requirement, that is, the PCF may be based on an indicator, a service security requirement, a UE registration information, and a subscription. At least one of the business security requirements of the business data and the AF feedback determines the user plane protection mechanism.
  • the registration information is preset in the UDM, and the PCF obtains the UE registration information from the UDM. For example, the PCF sends the UE ID in the policy request to the UDM, and thus the UE registration information obtained from the UDM.
  • the UE registration information includes a preset UE security requirement. The UE security requirement is used to indicate whether the UE needs to be encrypted, or whether the UE needs to perform integrity protection, or whether the UE needs both encryption and integrity protection.
  • the SMF may also send the UE registration information to the PCF. At this time, the SMF obtains the UE registration information by sending the UE ID to the UDM.
  • the contracted service data is preset in the UDM, and the PCF obtains the number of the contracted services from the UDM.
  • the PC sends the service ID in the policy request to the UDM, or sends the DNN to the UDM in the policy request;
  • the UDM is based on the service ID or
  • the DNN confirms the contracted service data preset therein and sends the related contracted service data to the PCF.
  • the PCF sends the UEID and the service ID in the policy request to the UDM, or sends the UE ID and the DNN to the UDM in the policy request;
  • the UDM confirms the preset subscription service data based on the UE ID and the service ID, or the UE ID and the DNN, and
  • the relevant contracted business data is sent to the PCF.
  • the PCF sends the service UE ID to the UDM for the UDM to make a judgment.
  • the subscription service data includes a preset service security requirement, where the preset service security requirement is used to indicate a user plane protection mechanism required by the service, such as indicating whether the service needs to be encrypted, or whether the service needs integrity. Protection, or whether the business requires both encryption and integrity protection.
  • the service security requirement of the AF feedback is preset in the AF. Specifically, the PCF sends a request to the AF, and the AF feeds back the service security requirement to the PCF based on the request, where the request may include the UE ID, the service ID, and the service UE. ID, or at least one of the DNNs.
  • the service security requirement of the AF feedback is used to indicate what kind of user plane protection mechanism the service needs, such as indicating whether the service needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the user plane protection mechanism is used to indicate a protection mode of the user plane data transmission, for example, indicating whether the UE needs to encrypt and/or integrity protect the user plane data.
  • the user plane protection mechanism can be "requires encryption + no integrity protection required”; or "requires encryption + does not require integrity protection”; or "requires encryption + requires integrity protection”.
  • the user plane protection mechanism may also be used to indicate a security protection algorithm, a key length acceptable to the UE, a key update period acceptable to the UE, and the like.
  • the user plane protection mechanism may be a Service Data Flow Security Protection (SDFSP).
  • SDFSP Service Data Flow Security Protection
  • the user plane protection mechanism is taken as an example of the SDFSP.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF. Accordingly, the SMF obtains the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the PCF sends the SDFSP directly to the SMF.
  • the PCF encapsulates the SDFSP in a particular parameter and sends the specific parameters to the SMF.
  • the PCF encapsulates the SDFSP in the PCC rule, and the PCF sends a PCC rule to the SMF. Accordingly, after the SMF obtains the PCC rule, the SDFSP is obtained from the PCC rule.
  • the SMF determines the QoS flow protection mechanism based on the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF when the user plane data needs to adopt the QoS flow transmission channel for data transmission, in order to obtain the QoS flow-based security mechanism (fine granularity), the SMF needs to determine the QoS flow (QFI) corresponding to the user plane data, and further The security mechanism corresponding to the QoS flow needs to be determined.
  • QFI QoS security protection
  • QFISP QFI security protection
  • the SMF may determine the QoS flow according to the SDFSP requirement and the QoS requirement in the PCC rule, where the SDFSP requirement is a security requirement involved in the user plane protection mechanism, where the QoS requirement is delay, bandwidth, and The need for quality of service parameters such as error rates.
  • the SMF may determine the QoS flow according to the SDFSP requirement, where the SDFSP requirement is a security requirement involved in the user plane protection mechanism.
  • a QoS flow channel is pre-configured in the communication architecture.
  • the identifier corresponding to the preset QoS flow channel is QoS flow ID1, QoS flow ID2, QoS flow ID3, and QoS flow ID4.
  • (1) SMF It is possible to determine the existing QoS flow according to the SDFSP requirement and the QoS requirement in the PCC rule to transmit the user plane data, for example, select the QoS flow ID2; (2) the SMF may also find that the QoS flow ID1 cannot be adopted according to the SDFSP requirement and the QoS requirement in the PCC rule.
  • QoS flow ID2 or QoS flow ID3 or QoS flow ID4 is used to transmit user plane data. Therefore, a new QoS flow channel needs to be created, for example, QoS flow ID5 is generated to transmit user plane data.
  • the manner in which QoS flow is selected only according to SDFSP is similar to the above.
  • QoS flow includes SDF1 and SDF2, and SDFSP1 corresponding to SDF1 and SDFSP2 corresponding to SDF2 support only encryption/no integrity protection.
  • QoS flow data can be protected by a set of QFISP.
  • QFISP is the same as SDFSP.
  • the SDFSP can include a variety of QFISPs.
  • SDF1 and SDF2 with the same security requirements use QFISP1 (corresponding to QoS flow ID1) as the security mechanism
  • SDF3 and SDF4 with the same security requirements adopt QFISP2 ( Corresponding to QoS flow ID2) as a security mechanism.
  • the SMF may only perform QoS flow selection according to the SDFSP requirement, and determine the QoS flow. If there is a QoS flow ID that satisfies the SDFSP requirement, the QoS flow corresponding to the QoS flow ID is used; otherwise, the QoS flow is regenerated.
  • the SMF after determining the QFISP corresponding to the user plane data, the SMF generates a QoS rule, and the QFISP is included in the QoS rule.
  • the QoS rule is a parameter used to provide the UE with QFISP corresponding to the user plane data.
  • the SMF after determining the QFISP corresponding to the user plane data, the SMF generates a QoS profile, and the QFISP is included in the QoS profile.
  • the QoS profile is a parameter used to provide the AN with the QFISP corresponding to the user plane data.
  • the SMF sends a QoS flow protection mechanism (QFISP) and a QoS flow ID to the AN through the AMF.
  • QFISP QoS flow protection mechanism
  • the SMF directly sends the QFISP and the QoS flow ID to the AN through the AMF.
  • the SMF sends a QoS rule, a QoS profile, and a QoS flow ID to the AN through the AMF.
  • the QFISP is included in the QoS profile.
  • the SMF may also send a session ID to the AN through the AMF.
  • the AN determines the security protection algorithm and the protection key.
  • the AN establishes a mapping of the session ID and the QoS flow ID to the DRB according to the QoS profile.
  • the AN selects the DRB, it can map the QoS flows with the same security protection requirements to the same DRB.
  • the AN can determine the user plane protection mechanism of the data in the DRB (that is, the data with the same DRB ID) by determining the DRB ID.
  • the AN may use a key to encrypt or integrity protect the user plane data.
  • the AN determines the security according to the UE security capability, the algorithm priority list supported by the AN, and the user plane protection mechanism. Protection algorithm, for example, when the user plane protection mechanism is "requires encryption + requires integrity protection", the AN is based on The UE security capability, the algorithm priority list supported by the AN determines that the encryption algorithm is AES, and the integrity protection algorithm is AES.
  • the encryption algorithm is empty. If integrity protection is not required, the integrity protection algorithm is empty.
  • the AN can directly obtain a security protection algorithm from QFISP.
  • the PCF may obtain an algorithm priority list supported by the AN, and determine an air interface protection algorithm based on the algorithm priority list supported by the AN and the algorithm supported by the UE and the security capability of the user equipment. For example, under the user plane protection mechanism that requires encryption + integrity protection, the PCF further determines that the encryption algorithm is AES, the integrity protection algorithm is AES, and carries the above security protection algorithm in the user plane protection mechanism.
  • the user plane protection mechanism QFISP
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, DRBID);
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, flow ID);
  • the AMF derives the base station key (K_AN may also be referred to as an intermediate key) according to the authenticated base key or the key derived after authentication, and the AMF sends the K_AN to the AN.
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID; the encryption algorithm ID is used to indicate a corresponding encryption algorithm, and the integrity protection algorithm ID is used to indicate a corresponding integrity protection algorithm.
  • the AN sends a session ID, a QoS flow ID, a security protection algorithm, and a QoS flow protection mechanism (QFISP) to the UE.
  • QFISP QoS flow protection mechanism
  • the QFISP may be carried in the Qos rule and sent to the UE.
  • the QoS flow protection mechanism is optional.
  • the UE determines the user plane protection key.
  • the UE obtains the session ID, the QFI, the user plane security algorithm, and the K_AN, and generates a user plane protection key accordingly, where the K_AN is obtained after the authentication is successful, and the UE re-derives the information according to the verified base key or the authentication. Key, derived base station key.
  • the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, DRBID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, flow ID);
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID
  • KDF is a key derivation Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (such as HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC and VMAC, HASH algorithm, etc. Wait.
  • the first air interface user plane protection key and the second air interface user plane protection key may be the same key.
  • the UE may perform cryptographic protection and/or integrity protection on the user plane data based on the second air interface user plane protection key.
  • the AN After receiving the user plane data sent by the UE, the AN is based on the first air interface user plane.
  • the protection key decrypts and/or checks the integrity of the user plane data.
  • the AN performs cryptographic protection and/or integrity protection on the user plane data based on the first air interface user plane protection key.
  • the UE is based on the second air interface user plane protection.
  • the key decrypts and/or checks the integrity of the user plane data.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the contents of steps 7 and 8 may be replaced by: the PCF directly determines the QoS flow protection mechanism, and sends the QoS flow protection mechanism to the SMF.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • FIG. 11 is only an example and should not be construed as limiting the invention.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation based on the granularity of the flow transmission channel, and the security required by the user equipment side by the PCF.
  • the requirements (including the security requirements of different services) and the security requirements preset on the network side determine the user plane protection mechanism, and the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the UE determines the session ID according to the user data, and then confirms the QoS flow ID. For example, the UE determines that the uplink user data (IP packet) adopts the session ID1 (PDU session1), and further confirms that the QFI is the QoS flow ID1. Then, the UE determines the QoS flow ID1 corresponding to the UE-AN based on the negotiation of the method flow shown in FIG.
  • the security protection mechanism obtains the security protection algorithm, including the encryption algorithm and the integrity protection algorithm. Therefore, the UE performs security protection of the user plane data by using the corresponding protection key based on the encryption algorithm and the integrity protection algorithm.
  • the AN confirms the QoS flow ID1 according to the air interface identifier RB ID1 (or DRB ID1). Then, the UE determines the security protection mechanism (QFISP) corresponding to the QoS flow ID1 through the negotiation of the UE-AN based on the method flow shown in FIG.
  • QFISP security protection mechanism
  • Obtaining a security protection algorithm, including an encryption algorithm and an integrity protection algorithm after the AN obtains the user plane data uploaded by the UE, The security protection of the user plane data can be performed using the corresponding key based on the encryption algorithm and the integrity protection algorithm. It should be noted that the AN can directly determine the security protection mechanism according to the QFI in the protocol stack, or the UE determines the QFI according to the marking in the air interface protocol stack, and then determines the security mechanism.
  • the AN can confirm the security protection mechanism according to the method shown in FIG. 11 according to the QFI, for example, determining that the QFI is the QoS flow ID3, and determining that the QoS flow ID3 corresponds to the air interface identifier RB ID3 (DRB). ID3), and then determine the security protection mechanism (QFISP) corresponding to QoS flow ID3, obtain the security protection algorithm, including the encryption algorithm and the integrity protection algorithm, and perform security protection of the user plane data by using the corresponding key based on the encryption algorithm and the integrity protection algorithm. .
  • QFISP security protection mechanism
  • the UE confirms that the QFI is the QoS flow ID3 according to the DRB ID3, and the AN can confirm the security protection mechanism (QFISP) corresponding to the QoS flow ID3 according to the method flow shown in FIG. 11 to obtain the security protection algorithm, including the encryption algorithm and integrity.
  • the protection algorithm can perform security protection of the user plane data by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • the UE may also directly determine the security protection mechanism according to the QFI in the protocol stack, or the UE determines the QFI according to the marking in the air interface protocol stack, and then determines the security mechanism.
  • a key configuration method based on the DRB provided by the embodiment of the present invention is described below based on the UE-AN. As shown in FIG. 12, the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the attach request includes at least a user equipment identifier (UE ID).
  • the attach request may further include a service ID, a UE service ID, or a DNN.
  • the attach request may further include an indication of a security requirement.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the SMF sends a policy request to the PCF.
  • the PCF determines the user plane protection mechanism.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF. Accordingly, the SMF obtains the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF determines the QoS flow protection mechanism based on the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF sends a QoS flow protection mechanism (QFISP) and a QoS flow ID to the AN through the AMF.
  • QFISP QoS flow protection mechanism
  • the SMF directly sends the QFISP to the AN through the AMF;
  • the SMF sends a QoS rule and a QoS profile to the AN through the AMF.
  • the QFISP is included in the QoS rule, and the QoS rule is used to provide the UE with QFISP corresponding to the user plane data.
  • the QFISP is included in the QoS profile, and the QoS profile is used to provide the QFISP corresponding to the user plane data to the AN.
  • the SMF may also send a session ID to the AN through the AMF.
  • the AN determines the DRB and determines the DRB protection mechanism.
  • the user plane data may implement a security protection mechanism in data transmission based on the DRB.
  • the AN needs to determine the DRB corresponding to the QoS flow, establish a mapping between the session ID and the QoS flow ID to the DRB ID, and further determine the security corresponding to the DRB ID.
  • the security mechanism corresponding to the DRB ID is called the DRB security protection (DRBSP).
  • the AN can determine the DRB ID according to the requirements of the QFISP requirement and the QoS, and the DRB ID needs to meet the QoS requirement in the QoS profile and meet the QFISP requirement.
  • the QFISP requirement is a security requirement involved in the QoS flow (for example, only encryption, no integrity protection is required), and the QoS requirement is a requirement for a service quality parameter such as delay, bandwidth, and error rate in the communication network. .
  • the AN may determine the DRB ID according to the QFISP requirement, and the DRB ID needs to meet the QFISP requirement.
  • a DRB channel is pre-configured in the communication architecture.
  • the identifier corresponding to the preset DRB channel is DRB ID1, DRB ID2, DRB ID3, and DRB ID4.
  • the SMF may determine the existing DRB to carry the QoS flow or user plane data according to the QFISP requirements and the QoS requirements in the profile, for example, select the DRB ID1; (2) the SMF may also be based on the QFISP requirements and the profile for the QoS.
  • the requirement is that DRB ID1 or DRB ID2 or DRB ID3 or DRB ID4 cannot be used to carry QoS flow or user plane data. Therefore, a new DRB channel needs to be created, for example, DRB ID5 is generated to carry QoS flow or user plane data.
  • DRBSPs can be used for security protection for QoS flows with the same security requirements.
  • DRB includes QoS flow1 and QoS flow2, QFISP1 corresponding to QoS flow1 and QFISP2 corresponding to QoS flow2 support only encryption/no integrity protection.
  • the data carried by the DRB can be protected by a set of DRBSPs.
  • DRBs may have different DRBSPs.
  • QoS flow1 and QoS flow2 with the same security requirements use DRBSP1 (corresponding to DRB ID1) as the security mechanism and QoS with the same security requirements.
  • Flow3 and QoS flow4 use DRBSP2 (corresponding to DRB ID2) as the security mechanism.
  • the AN can determine the DRB ID only according to the QFISP requirement, and determine the DRB. If there is a DRB ID that meets the QFISP requirement, the DRB corresponding to the DRB ID is used; otherwise, the DRB is regenerated.
  • the AN determines the security protection algorithm and the user plane protection key.
  • the AN determines the security according to the UE security capability, the algorithm priority list supported by the AN, and the user plane protection mechanism. Protection algorithm For example, DRBSP requires encryption, but does not require integrity protection.
  • UE security capability supports AES encryption/ZUC encryption, but AN supports AES encryption as the first priority, then AN selects encryption algorithm AES, and integrity protection algorithm is Empty algorithm.
  • the AN can directly obtain the security protection algorithm from the DRBSP. .
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, DRB ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, flow ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, DRB ID),
  • the AMF sends the K_AN to the AN based on the authenticated base key or the key derived after the authentication, and the AMF sends the K_AN to the AN;
  • the UP algorithm ID can be the encryption algorithm ID.
  • the integrity protection algorithm ID may also be used; the encryption algorithm ID is used to indicate a corresponding encryption algorithm, and the integrity protection algorithm ID is used to indicate a corresponding integrity protection algorithm.
  • the AN sends a session ID, a QoS flow ID, a security protection algorithm, a QoS flow protection mechanism (QFISP), and a DRB protection mechanism (DRBSP) to the UE.
  • QFISP QoS flow protection mechanism
  • DRBSP DRB protection mechanism
  • the QFISP and/or the DRBSP may be carried in the Qos rule and sent to the UE.
  • QFISP is optional.
  • DRBSP is optional.
  • the UE determines the user plane protection key.
  • the UE obtains a session ID, QFI, user plane security algorithm, QFISP, DRBSP, and K_AN, and generates a user plane protection key accordingly;
  • the UE obtains the session ID, QFI, and user plane security algorithm.
  • the UE generates a user plane protection key according to the obtained session ID, QFI, user plane security algorithm, and K_AN.
  • the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, DRB ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, flow ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID, DRB ID).
  • the K_AN is the base station key derived by the UE based on the authenticated base key or the key derived after the authentication, and the UP algorithm ID may be the encryption algorithm ID or the integrity protection.
  • Algorithm ID; KDF is Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (such as HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC and VMAC, HASH algorithm and so on.
  • HMAC Key Derivation Function
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the contents of steps 7 and 8 may be replaced by: the PCF directly determines the QoS flow protection mechanism, and sends the QoS flow protection mechanism to the SMF.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • the difference between the embodiment of FIG. 12 and the embodiment of FIG. 11 is that the UE-AN adopts the DRB transmission channel granularity for policy negotiation.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation based on the granularity of the DRB transmission channel, and the PCF needs the security requirements according to the user equipment side (including different The security requirements of the service and the security requirements preset on the network side determine the user plane protection mechanism.
  • the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the user plane data is based on the uplink transmission process of the DRB key configuration method.
  • the UE determines the session ID according to the user data, and then confirms the QFI and the DRB ID, further determines the security protection mechanism (DRBSP) according to the DRB ID, and uses the corresponding user plane protection after determining the encryption algorithm and the integrity protection algorithm.
  • DRBSP security protection mechanism
  • the AN determines the corresponding security protection mechanism (DRBSP) according to the DRB ID, and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm.
  • DRBSP security protection mechanism
  • the AN may be based on The encryption algorithm and the integrity protection algorithm use the corresponding key to perform security protection of the user plane data.
  • the user plane data is based on the downlink transmission process of the DRB key configuration method.
  • the AN On the AN side, when the AN needs to transmit the user plane data in downlink, the AN confirms the DRB according to the QFI, and then determines the DRB corresponding security protection mechanism (DRBSP) to obtain a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, based on the encryption algorithm and The integrity protection algorithm uses the corresponding key to perform security protection of user plane data.
  • DRBSP security protection mechanism
  • the UE confirms the corresponding security protection mechanism (DRBSP) according to the DRB ID, and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, and performs user plane data by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • DRBSP security protection mechanism
  • a session-based key configuration method is described below based on the UE-AN. As shown in FIG. 13, the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the attach request includes at least a user equipment identifier (UE ID).
  • the attach request may further include a service ID, a UE service ID, or a DNN.
  • the attach request may further include an indication of a security requirement.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the SMF sends a policy request to the PCF.
  • the PCF determines the user plane protection mechanism.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF.
  • SDFSP User Plane Protection Mechanism
  • the SMF obtains the user plane protection mechanism. (SDFSP).
  • the SMF determines the session protection mechanism.
  • the security protection mechanism in the data transmission may also be implemented based on the session.
  • the SMF can determine the session protection mechanism based on the SDFSP in different PCC rules. Or the SMF receives the session protection mechanism directly from the PCF.
  • the SMF sends QFISP, session protection mechanism, and QoS flow ID to the AN through the AMF.
  • the SMF directly sends the session ID, the session protection mechanism, and the QoS flow ID to the AN through the AMF.
  • the SMF sends a QoS rule, a QoS profile, and a QoS flow ID to the AN through the AMF.
  • the QoS rule includes a session protection mechanism, and the QoS rule is used to provide the session protection mechanism corresponding to the user plane data to the UE.
  • the QoS profile includes the session protection mechanism, and the QoS profile is used to provide the session protection mechanism corresponding to the user plane data to the AN.
  • the SMF may also send a session ID to the AN through the AMF.
  • the AN determines the security protection algorithm and the user plane protection key.
  • the AN supports the algorithm priority list and the user plane supported by the AN according to the UE security capability.
  • the protection mechanism determines the security protection algorithm. For example, the session protection mechanism requires encryption, but does not require integrity protection.
  • the UE security capability supports AES encryption/ZUC encryption, but the AN supports AES encryption as the first priority, then the AN selects the encryption algorithm AES, and the integrity protection algorithm is Empty algorithm.
  • the session protection mechanism is encryption/integrity protection
  • the session protection mechanism directly specifies a security protection algorithm, including specifying an encryption algorithm and an integrity protection algorithm
  • the AN may be from the session protection mechanism. Get the security protection algorithm directly.
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID, flow ID),
  • KDF K_SMF, UP algorithm ID, session ID
  • KDF K_SMF, UP algorithm ID, DRB ID
  • the AMF After the K_AN is successfully authenticated, the AMF sends the K_AN to the AN based on the authenticated base key or the key derived after the authentication, and the AMF sends the K_AN to the AN;
  • the UP algorithm ID can be the encryption algorithm ID. It can also be the maintenance algorithm ID;
  • the DRB ID can be the DRB identifier assigned by the AN for this service.
  • the AN sends a session ID, a QoS flow ID, a security protection algorithm, and a session protection mechanism to the UE.
  • the session protection mechanism may be carried in the Qos rule and sent to the UE.
  • the session protection mechanism is optional.
  • the UE determines the protection key.
  • the UE acquires a session ID, a QFI, a user plane security algorithm, a session protection mechanism, and a K_AN, and generates a user plane protection key accordingly;
  • the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the second air interface user plane protection key KDF (K_SMF, UP algorithm ID, flow ID),
  • the second air interface user plane protection key KDF (K_SMF, UP algorithm ID, session ID),
  • the second air interface user plane protection key KDF (K_SMF, UP algorithm ID, DRB ID);
  • KDF is a Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (eg HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC And VMAC and HASH algorithms and so on.
  • HMAC Key Derivation Function
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • the difference between the embodiment of FIG. 13 and the embodiment of FIG. 11 is that the UE-AN performs policy negotiation based on the PDU session transmission channel granularity.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation based on the granularity of the PDU session transmission channel, and the PCF needs the security requirements according to the user equipment side (including The security requirements of different services and the security requirements preset on the network side determine the user plane protection mechanism.
  • the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the user plane data is based on the uplink transmission process of the session key configuration method.
  • the UE determines the session ID according to the user data, and further confirms that the session ID corresponds to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm; therefore, the UE is based on the encryption algorithm and integrity protection.
  • the algorithm uses the corresponding protection key to perform security protection of user plane data.
  • the AN confirms the QoS flow ID according to the DRB ID, and then confirms the session ID, and finally determines the session ID pair.
  • the security protection mechanism may perform security protection of the user plane data by using the corresponding key based on the encryption algorithm and the integrity protection algorithm after the AN obtains the user plane data uploaded by the UE.
  • the session ID is directly determined according to the DRB ID; or the AN determines the QFI according to the QFI of the protocol stack or according to the marking in the protocol stack.
  • the user plane data is based on the downlink transmission process of the session key configuration method.
  • the AN On the AN side, when the AN needs to transmit the user plane data in the downlink, the AN confirms the session ID according to the QFI, and then confirms the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, based on the encryption algorithm. And the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • the session ID is directly determined according to the DRB ID; or, according to the session ID in the protocol stack, the security protection mechanism (session protection mechanism) is confirmed.
  • the UE confirms the QoS flow ID according to the DRB ID, and then confirms the session ID, and finally determines the session ID corresponding to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, which may be based on an encryption algorithm. And the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • a security protection algorithm including an encryption algorithm and an integrity protection algorithm, which may be based on an encryption algorithm.
  • the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • a flow-based key configuration method is described below based on the UE-CN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the session request is used to request that a session be established between the UE and the SMF. For example, if the session is established through a session establishment protocol, then the session request is session establishment request signaling.
  • the SMF sends a policy request to the PCF.
  • step 5 of the embodiment of FIG. 11 Reference may be made to the description of step 5 of the embodiment of FIG. 11 , and details are not described herein again.
  • the PCF determines the user plane protection mechanism.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF. Accordingly, the SMF obtains the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF determines the QoS flow protection mechanism (QFISP) based on the User Plane Protection Mechanism (SDFSP).
  • step 8 of the embodiment of FIG. 11 Reference may be made to the description of step 8 of the embodiment of FIG. 11 , and details are not described herein again.
  • the SMF determines a security protection algorithm and determines a user plane protection key.
  • the SMF determines the security protection algorithm according to the UE security capability, the algorithm priority list supported by the UPF, and the QFISP.
  • the algorithm priority list supported by the UPF may be preset in the SMF, or may be preset in the UPF, and the SMF obtains the algorithm priority list supported by the UPF from the UPF. For example, when the user plane protection mechanism is “requires encryption+requires integrity protection”, the SMF determines that the encryption algorithm is AES according to the UE security capability, the algorithm priority list supported by the UPF, and the algorithm supported by the UE, and the integrity protection algorithm is AES. If encryption is not required, the encryption algorithm is empty. If integrity protection is not required, the integrity protection algorithm is empty.
  • the SMF can directly obtain security from QFISP. Protection algorithm.
  • the PCF may obtain an algorithm priority list supported by the UPF, where the algorithm priority list supported by the UPF may be preset in the AMF or may be preset in the UPF.
  • the AMF obtains an algorithm priority list supported by the UPF from the UPF.
  • the PCF determines the air interface protection algorithm based on the UE security capability, the algorithm priority list supported by the UPF, and the QFISP.
  • the PCF further determines that the encryption algorithm is AES, and the integrity protection algorithm is AES, and carries the above security protection algorithm in QFISP.
  • the User Face Protection Mechanism directly specifies the encryption algorithm and the integrity protection algorithm
  • the SMF directly determines the encryption algorithm and the integrity protection algorithm.
  • the SMF may generate a user plane protection key based on the security protection algorithm. Specifically, the SMF calculates a key for cryptographic protection based on the determined encryption algorithm to obtain an air interface user plane encryption key; or, the SMF calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID, flow ID);
  • the second air interface user plane protection key KDF (K_SMF, UP algorithm ID, DRBID);
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID, session ID);
  • the AMF After the K_SMF is successfully authenticated, the AMF sends the K_SMF to the SMF based on the authenticated base key or the key derived after the authentication, and the AMF sends the K_SMF to the SMF.
  • the AUSF sends the K_SMF to the SMF based on the base key after authentication or the key derived again after authentication.
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID; the encryption algorithm ID is used to indicate a corresponding encryption algorithm, and the integrity protection algorithm ID is used to indicate a corresponding integrity protection algorithm.
  • the SMF sends a security protection algorithm or a user plane protection key to the UPF.
  • the UPF receives the security protection algorithm or the user plane protection key.
  • the user plane protection key is used as the user plane protection key of the UPF.
  • the UPF may obtain the user plane protection key based on the security protection algorithm and the K_SMF calculation (refer to the related description above),
  • the user plane protection key is the user plane protection key of the UPF.
  • the AMF derives the key according to the key obtained after the authentication or the key derived after the authentication, and specifically, the AMF sends the K_SMF to the UPF; or, after the authentication succeeds, the AUSF
  • the AUSF sends the K_SMF to the UPF based on the key after the authentication or the key derived after the authentication, and the derived key.
  • the SMF sends a sending session ID, QoS flow ID, security protection algorithm, and QoS flow protection mechanism (QFISP) to the AN through the AMF.
  • QFISP QoS flow protection mechanism
  • the QFISP may be carried in the Qos rule and sent to the UE.
  • the QoS flow protection mechanism is optional.
  • the AN sends a sending session ID, a QoS flow ID, a security protection algorithm, and a QoS flow protection mechanism (QFISP) to the UE.
  • QFISP QoS flow protection mechanism
  • the UE determines the user plane protection key.
  • step 12 in the embodiment of FIG. 11 , and details are not described herein again.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the contents of steps 7 and 8 may be replaced by: the PCF directly determines the QoS flow protection mechanism, and sends the QoS flow protection mechanism to the SMF.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • step 9 and step 13 can also implement security protection in the following ways:
  • the SMF sends the session ID, QFI and first K_UP to UPF.
  • the SMF sends the session ID, QFI and QFISP to the AN via the AMF.
  • the AN sends the session ID, QFI and QFISP to the UE;
  • the UE generates a second K_UP based on the K_SMF. After the K_SMF is successfully authenticated, the UE derives the key based on the authenticated key or the key derived after authentication.
  • the UPF re-negotiates the security protection algorithm with the UE, and then generates a user plane protection key of the UPF and a user plane protection key of the UE based on the first K_UP and the second K_UP, respectively.
  • FIG. 14 may refer to the related description of the embodiment of FIG. 11.
  • FIG. 14 embodiment is only an example and should not be construed as limiting the present invention.
  • the UE-CN uses the flow transmission channel granularity for policy negotiation, in which the AN does not need security settings.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation based on the granularity of the flow transmission channel.
  • the UE and the CN respectively determine the user plane. Protect the key to secure the user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • the UE determines the session ID according to the user data, and then confirms the QFI, and then determines the corresponding security protection mechanism (QFISP) to obtain a security protection algorithm, including an encryption algorithm and an integrity protection algorithm; therefore, the UE is based on the encryption algorithm and integrity protection.
  • the algorithm uses the corresponding protection key to perform security protection of user plane data.
  • the UPF determines the QFI corresponding security protection mechanism (QFISP) according to the QoS flow ID, the UPF obtains the security protection algorithm, including the encryption algorithm and the integrity protection algorithm. After the UPF obtains the user plane data uploaded by the UE, The security protection of the user plane data is performed by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • QFISP QFI corresponding security protection mechanism
  • the UPF obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, based on the QFI-based method for confirming the security protection mechanism (QFISP) according to the method shown in FIG.
  • the encryption algorithm and the integrity protection algorithm use the corresponding key to perform security protection of the user plane data.
  • the UE confirms the QoS flow ID according to the DRB ID, finally determines the QFI corresponding security protection mechanism, and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, and can execute the user by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • a security protection algorithm including an encryption algorithm and an integrity protection algorithm
  • a session-based key configuration method is described below based on the UE-CN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the attach request includes at least a user equipment identifier (UE ID).
  • the attach request may further include a service ID, a UE service ID, or a DNN.
  • the attach request may further include an indication of a security requirement.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the SMF sends a policy request to the PCF.
  • the PCF determines the user plane protection mechanism.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF. Accordingly, the SMF obtains the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF determines the session protection mechanism.
  • the SMF determines the security protection algorithm and the user plane protection key.
  • the SMF is based on the UE security capability, the algorithm priority list supported by the UPF, and the session protection.
  • the mechanism determines a security protection algorithm, wherein the algorithm priority list supported by the UPF may be preset in the SMF, or may be preset in the UPF, and the SMF obtains an algorithm priority list supported by the UPF from the UPF.
  • the SMF determines that the encryption algorithm is AES according to the UE security capability, the algorithm priority list supported by the UPF, and the algorithm supported by the UE, and the integrity protection algorithm is AES. If encryption is not required, the encryption algorithm is empty. If integrity protection is not required, the integrity protection algorithm is empty.
  • the SMF may be from the session protection mechanism. Get the security protection algorithm directly.
  • the SMF may generate a user plane protection key based on the security protection algorithm. Specifically, the SMF calculates a key for cryptographic protection based on the determined encryption algorithm to obtain an air interface user plane encryption key; or, the SMF calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain air interface user face integrity protection Key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID, flow ID);
  • the second air interface user plane protection key KDF (K_SMF, UP algorithm ID, DRBID);
  • the first air interface user plane protection key KDF (K_SMF, UP algorithm ID, session ID);
  • the AMF After the K_SMF is successfully authenticated, the AMF sends the K_SMF to the SMF based on the authenticated base key or the key derived after the authentication, and the AMF sends the K_SMF to the SMF.
  • the AUSF sends the K_SMF to the SMF based on the base key after authentication or the key derived again after authentication.
  • the UP algorithm ID may be an encryption algorithm ID or an integrity protection algorithm ID; the encryption algorithm ID is used to indicate a corresponding encryption algorithm, and the integrity protection algorithm ID is used to indicate a corresponding integrity protection algorithm.
  • the SMF sends a user plane protection key or a security protection algorithm to the UPF; correspondingly, the UPF receives the user plane protection key or a security protection algorithm.
  • the SMF sends a session ID, QoS flow ID, security protection algorithm, QFISP, and session protection mechanism to the AN through the AMF.
  • the AN sends a session ID, a QoS flow ID, a security protection algorithm, a QFISP, and a session protection mechanism to the UE.
  • the UE determines the user plane protection key.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the contents of steps 7 and 8 may be replaced by: the PCF directly determines the session protection mechanism and sends the session protection mechanism to the SMF.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • the SMF may also send a session protection mechanism to the UPF, and the UPF acquires a security protection algorithm in the session protection mechanism.
  • step 9 and step 13 can also implement security protection in the following ways:
  • the SMF sends the session ID, QFI and first K_UP to UPF.
  • the SMF sends the session ID, QFI, session protection mechanism and QFISP to the AN through the AMF.
  • the AN sends a session ID, QFI, session protection mechanism and QFISP to the UE;
  • the UE generates a second K_UP based on the K_SMF. After the K_SMF is successfully authenticated, the UE derives the key based on the authenticated key or the key derived after authentication.
  • the UPF re-negotiates the security protection algorithm with the UE, and then based on the first K_UP and the second K_UP respectively.
  • the UE-CN uses the session transmission channel granularity for policy negotiation, in which the AN does not need security settings.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation based on the session transmission channel granularity.
  • the user plane protection mechanism is determined by the PCF, the UE and the CN respectively determine the user plane. Protect the key to secure the user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • the user plane data is based on the uplink transmission process of the session key configuration method.
  • the UE determines the session ID according to the user data, and then confirms the session ID corresponding to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm; Therefore, the UE performs security protection of the user plane data by using the corresponding protection key based on the encryption algorithm and the integrity protection algorithm.
  • the security protection mechanism session protection mechanism
  • the UPF confirms the session ID according to the QFI, and finally determines the session ID corresponding to the security protection mechanism (session protection mechanism), obtains the security protection algorithm, including the encryption algorithm and the integrity protection algorithm, and obtains the user plane data uploaded by the UE in the UPF. After that, the security protection of the user plane data can be performed by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • the security protection mechanism session protection mechanism
  • the user plane data is based on the downlink transmission process of the session key configuration method.
  • the UPF confirms the security protection mechanism (session protection mechanism) according to the session ID, and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, based on the encryption algorithm and the integrity protection algorithm. Use the corresponding key to perform security protection of user plane data.
  • the security protection mechanism session protection mechanism
  • a security protection algorithm including an encryption algorithm and an integrity protection algorithm, based on the encryption algorithm and the integrity protection algorithm.
  • the UE confirms the QoS flow ID according to the DRB ID, and then confirms the session ID, and finally determines the session ID corresponding to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, which may be based on an encryption algorithm. And the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • the session ID may be directly determined according to the DRB ID; or, optionally, the UE determines the session ID according to the data format.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the attach request includes at least a user equipment identifier (UE ID).
  • UE ID user equipment identifier
  • the UE sends a session request to the AMF, where the session request includes a session ID, a Request type, and a DNN.
  • the Request type parameter includes two possibilities.
  • the Request type indicates the use of an existing PDU session (expressed as "existing PDU session") or indicates the initial session initiation (if expressed as "Initial request").
  • the session request may further include at least one of a service ID, a UE service ID, and an APP ID.
  • the session request may further include an indication of a security requirement.
  • the AMF sends the UE ID, session ID, Request type, DNN to SMF.
  • the UE ID may be the UE ID obtained by the AMF in the above authentication, and the AMF determines the UE ID according to the transmission protocol between the UE and the AMF, that is, determining the UE according to the AMF UE N2-AP ID between the UE and the AMF. ID; may also have a UE ID in the session request sent by the UE, or the session request sent by the UE carries a temporary ID, and the AMF corresponds to the UE ID.
  • the SMF determines the existing user plane protection mechanism corresponding to the session ID according to the session ID, and uses the user plane protection corresponding to the session ID. The mechanism acts as a user plane protection mechanism for this session.
  • the SMF continues to execute.
  • the SMF sends the UE ID and DNN to the UDM and receives the subscription security protection mechanism from the UDM. It is also possible that the UDN does not store the subscription security protection mechanism corresponding to the UE ID and the DNN.
  • the UDM sends the default security protection mechanism stored in the UDM as a subscription security protection mechanism to the SMF, or the UDM sends an empty security protection mechanism identifier to SMF.
  • the default security mechanism stored in the UDM can be either cryptographic protection only, or only integrity protection, or both encryption and integrity protection.
  • the default user plane protection mechanism indicates which security algorithm is used for protection, such as encryption protection using only the AES algorithm, or integrity protection using only the Snow 3G security algorithm, or both AES algorithm encryption and Snow 3G security algorithm integrity protection.
  • the SMF determines if a dynamic policy control mechanism has been deployed.
  • the SMF adopts the contract security protection mechanism as the security protection mechanism of the session and skips to step 10. It is also possible that the SMF does not store or obtain the subscription security protection mechanism. At this time, the SMF adopts the default user plane protection mechanism and skips to step 10 for execution. It is also possible that the SMF does not store or obtain the subscription security protection mechanism. At this time, the SMF adopts the user plane protection mechanism indicated by the indicator, and jumps to step 10 for execution.
  • the default user plane protection mechanism can be to use only encryption protection, or just use integrity protection, or both encryption and integrity protection. Alternatively, the default user plane protection mechanism indicates which security algorithm is used for protection, such as encryption protection using only the AES algorithm, or integrity protection using only the Snow 3G security algorithm, or both AES algorithm encryption and Snow 3G security algorithm integrity protection.
  • the SMF sends the UE ID and DNN to the PCF.
  • the SMF may also receive at least one of a service ID, a UE service ID, and an APP ID from the UE or the AMF.
  • the SMF sends the UE ID and the DNN to the PCF, and may also simultaneously send the service ID, the UE service ID, and the APP. At least one of the IDs to the PCF.
  • the PCF determines the dynamic user plane protection mechanism.
  • the method for determining a dynamic user plane protection mechanism by the PCF includes determining whether a corresponding protection mechanism is stored according to at least one of a DNN, a service ID, a UE service ID, and an APP ID. If the corresponding protection mechanism is stored, it is used as a dynamic user plane protection mechanism.
  • the protection mechanism stored in the PCF is sent to the PCF by the DNN, the service ID, the UE service ID, or the APP corresponding server. Otherwise, the PCF sends a request to the DNN, the Service ID, the UE Service ID, or the APP corresponding server, the request including the UE ID; and receives the security protection requirement from the server.
  • Security protection requirements are used as a dynamic user plane protection mechanism.
  • the security protection requirement may be to use only encryption protection, or only use integrity protection, or both encryption and integrity protection, or further specify which security algorithms are used, so-called encryption protection algorithm and integrity protection algorithm. It is also possible that if it is not stored in the PCF, Or if the security protection requirements are not obtained from the server, the PCF uses the default security protection mechanism stored in the PCF to use only encryption protection, or only integrity protection, or both encryption and integrity protection.
  • the default user plane protection mechanism indicates which security algorithm is used for protection, such as encryption protection using only the AES algorithm, or integrity protection using only the Snow 3G security algorithm, or both AES algorithm encryption and Snow 3G security algorithm integrity protection.
  • the PCF sends a dynamic user plane protection mechanism to the SMF. Accordingly, the SMF obtains the dynamic user plane protection mechanism and uses it as an end user plane protection mechanism.
  • the SMF sends the user plane protection mechanism to the AMF, and simultaneously sends the session ID or flow ID.
  • the AMF sends the user plane protection mechanism to the AN, and simultaneously sends the session ID or flow ID. It is also possible that the SMF directly sends the user plane protection mechanism to the AN while sending the session ID or flow ID.
  • the AN determines the security protection algorithm and the user plane protection key.
  • the AN if the user plane protection mechanism is encryption/integrity protection, and the user plane protection mechanism does not directly specify the security protection algorithm, then the AN according to the UE security capability, the AN supports the algorithm priority list and The user plane protection mechanism determines the security protection algorithm. For example, the user plane protection mechanism requires encryption, but does not require integrity protection.
  • the UE security capability supports AES encryption/ZUC encryption, but the AN supports AES encryption as the first priority, and the AN selects the encryption algorithm AES, the integrity protection algorithm. Empty algorithm.
  • the AN may be from the user.
  • the security protection algorithm is directly obtained from the surface protection mechanism.
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • KDF K_AN, UP algorithm ID, session ID
  • KDF K_AN, UP algorithm ID, DRB ID
  • KDF K_AN, UP algorithm ID, slice ID
  • KDF is a Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (eg HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC And VMAC and HASH algorithms, etc.
  • HMAC Key Derivation Function
  • the AN sends a session ID, a flow ID, a security protection algorithm, and a user plane protection mechanism to the UE.
  • the user plane protection mechanism may be carried in the Qos rule and sent to the UE.
  • the user plane protection mechanism is optional.
  • the UE determines the protection key.
  • the UE acquires a session ID, a user plane security algorithm, a user plane protection mechanism, and a K_AN, and generates a user plane protection key accordingly;
  • the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, DRB ID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, slice ID);
  • the K_AN is the base station key that is derived by the UE based on the authenticated base key or the key derived after the authentication.
  • the UP algorithm ID may be an encryption algorithm ID or a security algorithm ID;
  • the DRB ID may be a DRB identifier allocated by the AN for the service.
  • KDF is a Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (eg HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC And VMAC and HASH algorithms and so on.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • Step 6 is optional.
  • the SMF does not use the request type to determine whether to use the old user plane security mechanism. Every time the session is established, the SMF needs to renegotiate the user plane security mechanism.
  • Steps 1-9 can be implemented separately as an embodiment of the user plane security mechanism.
  • the user plane security mechanism may be used for security protection between a UE and an AN in the future, or security protection between a UE and a CN.
  • Steps 10-13 can be used as an embodiment of establishing a secure channel between the UE and the AN.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation based on the granularity of the PDU session transmission channel, and the PCF needs the security requirements according to the user equipment side (including The security requirements of different services and the security requirements preset on the network side determine the user plane protection mechanism.
  • the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • Steps 1-9 can be referred to FIG. 16.
  • the SMF obtains the user plane security mechanism, determines the security protection algorithm, and determines the user plane protection key.
  • the SMF determines whether the user plane protection mechanism between the UE and the CN needs to be encrypted, and whether integrity protection is required. Then, the SMF determines the security protection algorithm according to the received UE security capability and the algorithm priority list supported by the UPF.
  • the algorithm priority list supported by the UPF may be preset in the SMF, or may be preset in the UPF, SMF.
  • the list of algorithm priorities supported by the UPF is obtained from the UPF.
  • the SMF determines that the encryption algorithm is AES according to the UE security capability, the algorithm priority list supported by the UPF, and the algorithm supported by the UE, and the integrity protection algorithm is AES.
  • the user plane protection mechanism directly specifies a security protection algorithm
  • the SMF can directly obtain the security protection algorithm from the user plane protection mechanism.
  • the SMF may determine the air interface protection algorithm based on the algorithm priority list supported by the UPF, the UE supported algorithm, and the user equipment security capability, where the UPF supported algorithm priority list may be preset in the SMF. It may also be preset in the UPF, and the SMF obtains an algorithm priority list supported by the UPF from the UPF.
  • the SMF further determines that the encryption algorithm is AES, the integrity protection algorithm is AES, and carries the above security protection algorithm in the user plane protection mechanism.
  • the user plane protection mechanism directly specifies the encryption algorithm and the integrity protection algorithm
  • the encryption algorithm and the integrity protection algorithm can be directly obtained from the user plane protection mechanism.
  • the SMF may further determine the user plane protection key, specifically:
  • KDF KDF (K_SMF, UP algorithm ID, flow ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, session ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, DRB ID);
  • KDF KDF (K_SMF, UP algorithm ID, slice ID);
  • the AMF/SEAF derives the key based on the authenticated key or the key derived after the authentication. Specifically, the AMF/SEAF sends the K_SMF to the SMF; or, after the K_SMF is successfully authenticated, the AUSF sends the K_SMF to the SMF according to the key after the authentication or the key derived after the authentication, and the AUSF sends the K_SMF.
  • the SMF sends a security protection algorithm or a user plane protection key to the UPF.
  • the UPF receives the security protection algorithm or the user plane protection key.
  • the UPF may obtain the user plane protection key based on the security protection algorithm and the K_SMF calculation (refer to the related description above),
  • the user plane protection key is the user plane protection key of the UPF.
  • the AMF/SEAF derives the key according to the key after the authentication or the key derived after the authentication. Specifically, the AMF/SEAF sends the K_SMF to the UPF through the SMF; or, K_SMF After the authentication succeeds, the AUSF sends the K_SMF to the UPF based on the key obtained after the authentication key or the key derived after the authentication.
  • the security protection algorithm may be a security protection algorithm determined by the UPF according to the algorithm priority list of the UPF and the algorithm list of the UE. Here the UE's algorithm list can be sent by SMF. Send to UPF.
  • the user plane protection key is used as the user plane protection key of the UPF.
  • the SMF sends a security protection algorithm and a user plane protection mechanism to the AMF, wherein the user plane protection mechanism is optional.
  • the SMF sends a security protection algorithm to the AMF.
  • the SMF sends a security protection algorithm to the AMF, where the SMF sends a session response to the AMF, where the session response carries a security protection algorithm.
  • the security protection algorithm is that the AMF can be determined based on the algorithm priority list supported by the UPF, the algorithm supported by the UE, and the security capability of the user equipment, the SMF does not need to send a security protection algorithm to the AMF.
  • the AMF sends a security protection algorithm and a user plane protection mechanism to the AN, wherein the user plane protection mechanism is optional.
  • the AN sends a security protection algorithm and a user plane protection mechanism to the UE, where the user plane protection mechanism is optional.
  • the UE generates a user plane protection key according to the user plane security algorithm, the user plane protection mechanism, and the K_SMF. Or the UE generates a user plane protection key according to the user plane security algorithm and K_SMF.
  • the UE may further determine a user plane protection key, where the user plane protection key is a user plane protection key of the UE, specifically:
  • KDF KDF (K_SMF, UP algorithm ID, flow ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, session ID),
  • the user plane protection key KDF (K_SMF, UP algorithm ID, DRB ID);
  • KDF KDF (K_SMF, UP algorithm ID, slice ID);
  • Possibility 1 If the AMF does not require the information of the indicator during the process of determining the user plane protection mechanism, the UE may not send the indicator to the network side (or the attachment may not include the indicator).
  • step 8 and step 9 may be performed simultaneously, and step 8 may also be placed before or after step 9.
  • the session establishment procedure may also be initiated by the UE, that is, the UE sends a session request to the SMF through the AMF.
  • Possibility 4 If the user plane protection mechanism includes a specific security protection algorithm, the AMF can also send the user plane protection mechanism to the UPF through the SMF, and the UPF obtains the security protection algorithm in the user plane protection mechanism.
  • the SMF sends the session ID, QFI and user plane protection mechanisms to the AMF.
  • AMF sends session ID, QFI and user plane protection mechanism to AN;
  • the AN sends the session ID, QFI and user plane protection mechanism to the UE;
  • the UE generates a second K_UP based on the K_SMF. After the K_SMF is successfully authenticated, the UE derives the key based on the authenticated key or the key derived after authentication.
  • the UPF and the UE negotiate a security protection algorithm based on the session ID, the QFI, and the user plane protection mechanism, and then generate the user plane protection key of the UPF and the user plane protection key of the UE based on the first K_UP and the second K_UP, respectively.
  • Step 6 is optional.
  • the SMF does not use the request type to determine whether to use the old user plane security mechanism. Every time the session is established, the SMF needs to renegotiate the user plane security mechanism.
  • the SMF needs security according to the needs of the user equipment side in the related process of session establishment (including the security of different services).
  • the user requirements protection mechanism is determined by the security requirements preset on the network side.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-CN completes the policy negotiation.
  • the UE and the CN respectively determine the user plane protection key, thereby implementing Security protection of user plane data.
  • the embodiments of the present invention can implement network security protection between the UE and the core network, avoid the disadvantages of the hop-by-hop segment protection mode, and improve the security of user plane data transmission.
  • a session-based key configuration method is described in the following manner based on the UE-AN.
  • the key configuration method provided by the embodiment of the present invention includes the following steps:
  • the UE sends an attach request to the AUSF through the AN and the AMF.
  • the AUSF performs authentication with the UE based on the UE ID, and determines that the UE is a legitimate user.
  • the attach request includes at least a user equipment identifier (UE ID).
  • the attach request may further include a service ID, a UE service ID, or a DNN.
  • the attach request may further include an indication of a security requirement.
  • the UE sends a session request to the SMF through the AMF, and correspondingly, the SMF receives the session request.
  • the SMF sends a policy request to the PCF.
  • the PCF determines the user plane protection mechanism.
  • the PCF sends a User Plane Protection Mechanism (SDFSP) to the SMF. Accordingly, the SMF obtains the User Plane Protection Mechanism (SDFSP).
  • SDFSP User Plane Protection Mechanism
  • the SMF determines the session protection mechanism.
  • the security protection mechanism in the data transmission may also be implemented based on the session.
  • the SMF can determine the session protection mechanism based on the SDFSP in different PCC rules. Or the SMF receives the session protection mechanism directly from the PCF.
  • the SMF sends QFISP, session protection mechanism, and QoS flow ID to the AN through the AMF.
  • the SMF directly sends the session ID, the session protection mechanism, and the QoS flow ID to the AN through the AMF.
  • the SMF sends a QoS rule, a QoS profile, and a QoS flow ID to the AN through the AMF.
  • the QoS rule includes a session protection mechanism, and the QoS rule is used to provide the session protection mechanism corresponding to the user plane data to the UE.
  • the QoS profile includes the session protection mechanism, and the QoS profile is used to provide the session protection mechanism corresponding to the user plane data to the AN.
  • the SMF may also send a session ID to the AN through the AMF.
  • the AN determines the security protection algorithm and the user plane protection key.
  • the AN supports the algorithm priority list and the user plane supported by the AN according to the UE security capability.
  • the protection mechanism determines the security protection algorithm. For example, the session protection mechanism requires encryption, but does not require integrity protection.
  • the UE security capability supports AES encryption/ZUC encryption, but the AN supports AES encryption as the first priority, then the AN selects the encryption algorithm AES, and the integrity protection algorithm is Empty algorithm.
  • the session protection mechanism is encryption/integrity protection
  • the session protection mechanism directly specifies a security protection algorithm, including specifying an encryption algorithm and an integrity protection algorithm
  • the AN may be from the session protection mechanism. Get the security protection algorithm directly.
  • the AN may generate a user plane protection key based on a security protection algorithm. Specifically, the AN calculates a key for cryptographic protection based on the determined encryption algorithm, and obtains an air interface user plane encryption key; or, the AN calculates a key for integrity protection based on the determined integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a first air interface user plane protection key.
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the first air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • KDF K_AN, UP algorithm ID, session ID
  • KDF K_AN, UP algorithm ID, DRB ID
  • KDF K_AN, UP algorithm ID, slice ID
  • the AMF After the K_AN is successfully authenticated, the AMF sends the K_AN to the AN based on the authenticated base key or the key derived after the authentication, and the AMF sends the K_AN to the AN;
  • the UP algorithm ID can be the encryption algorithm ID. It can also be the maintenance algorithm ID;
  • the DRB ID can be the DRB identifier assigned by the AN for this service.
  • the AN sends a session ID, a QoS flow ID, a security protection algorithm, and a session protection mechanism to the UE.
  • the session protection mechanism may be carried in the Qos rule and sent to the UE.
  • the session protection mechanism is optional.
  • the UE determines the protection key.
  • the UE acquires a session ID, a QFI, a user plane security algorithm, a session protection mechanism, and a K_AN, and generates a user plane protection key accordingly;
  • the UE calculates a key for cryptographic protection based on the received encryption algorithm, and obtains an air interface user plane encryption key; or the UE calculates a key for integrity protection based on the received integrity protection algorithm. , obtain the air interface user plane integrity protection key.
  • the air interface user plane encryption key and the air interface user plane integrity protection key may be collectively referred to as a second air interface user plane protection key.
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, flow ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, session ID),
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, DRB ID);
  • the second air interface user plane protection key KDF (K_AN, UP algorithm ID, slice ID);
  • the K_AN is the base station key that is deduced by the UE according to the base key after authentication or the key derived after authentication.
  • the UP algorithm ID may be an encryption algorithm ID or a security algorithm ID;
  • the DRB ID may be a DRB identifier allocated by the AN for the service.
  • KDF is a Key Derivation Function (KDF), including but not limited to the following cryptographic derivation functions: HMAC (eg HMAC-SHA256, HMAC-SHA1), NMAC, CMAC, OMAC, CBC-MAC, PMAC, UMAC And VMAC and HASH algorithms and so on.
  • the session establishment process may also be initiated by the AMF, that is, the AMF sends a session request to the SMF.
  • the user equipment identifier UE ID
  • the user equipment security capability the indicator
  • the DNN the service ID, the UE service ID, and the like in the session request
  • the attach request carries the above information.
  • the flow ID and session ID may be generated before the SMF sends a policy request.
  • the difference between the embodiment of FIG. 18 and the embodiment of FIG. 11 is that the UE-AN performs policy negotiation based on the PDU session transmission channel granularity.
  • the implementation of the embodiment of the present invention can implement a communication architecture based on the future 5G.
  • the UE-AN completes the policy negotiation based on the granularity of the PDU session transmission channel, and the PCF needs the security requirements according to the user equipment side (including The security requirements of different services and the security requirements preset on the network side determine the user plane protection mechanism.
  • the UE and the AN respectively determine the security protection algorithm and the key, thereby realizing the security protection of the user plane data.
  • the user plane data is based on the uplink transmission process of the session key configuration method.
  • the UE determines the session ID according to the user data, and further confirms that the session ID corresponds to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm; therefore, the UE is based on the encryption algorithm and integrity protection.
  • the algorithm uses the corresponding protection key to perform security protection of user plane data.
  • the AN confirms the QoS flow ID according to the DRB ID, and then confirms the session ID. Finally, the session ID corresponds to the security protection mechanism (session protection mechanism).
  • the AN can be based on the encryption algorithm and complete. The sexual protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • the session ID is directly determined according to the DRB ID; or the AN determines the QFI according to the QFI of the protocol stack or according to the marking in the protocol stack.
  • the user plane data is based on the downlink transmission process of the session key configuration method.
  • the AN On the AN side, when the AN needs to transmit the user plane data in the downlink, the AN confirms the session ID according to the QFI, and then confirms
  • the security protection mechanism obtains the security protection algorithm, including the encryption algorithm and the integrity protection algorithm, and performs security protection of the user plane data by using the corresponding key based on the encryption algorithm and the integrity protection algorithm.
  • the session ID is directly determined according to the DRB ID; or, according to the session ID in the protocol stack, the security protection mechanism (session protection mechanism) is confirmed.
  • the UE confirms the QoS flow ID according to the DRB ID, and then confirms the session ID, and finally determines the session ID corresponding to the security protection mechanism (session protection mechanism), and obtains a security protection algorithm, including an encryption algorithm and an integrity protection algorithm, which may be based on an encryption algorithm. And the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • a security protection algorithm including an encryption algorithm and an integrity protection algorithm, which may be based on an encryption algorithm.
  • the integrity protection algorithm uses the corresponding key to perform security protection of the user plane data.
  • secondary authentication may be an optional step. If the secondary authentication is performed, the SMF or the AMF may determine whether to authorize the UE to access the session according to the result of the secondary authentication. The authentication succeeds, and the UE is allowed to access the session, thereby performing the determination of the user plane security mechanism. It is also possible that the SMF or the AMF can determine whether to perform the determination of the user plane security mechanism based on the result of the secondary authentication.
  • the ID and parameters used by the UE, AN or UPF in the user plane protection key derivation may pass through the core network element (for example, AMF, SMF). , SEAF, etc.) is sent to the UE, AN or UPF so that the UE, AN or UPF can correctly derive the user plane protection key.
  • the ID and parameters used in the UE may also be sent to the UE through the AN or the UPF.
  • the user plane security mechanism may be a priority list of the algorithm.
  • the user plane security algorithm can be determined according to the user plane security mechanism, the UE security capability, and the security algorithm supported by the AN/UPF. For example, the algorithm with the highest priority among the user plane security mechanisms is selected, and the security algorithm supported by the UE and the AN/UPF is used as the user plane security algorithm.
  • the SMF first determines whether the PCF needs to be requested according to the registration information of the UE (or whether a dynamic user plane security mechanism is required), thereby obtaining a user plane security mechanism for the PCF response.
  • the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the UE registration information. Or the SMF obtains the subscription service data from the UDM by sending the DNN, or the service ID, or the DNN and the service ID to the UDM, and the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the subscription service data.
  • the SMF sends a policy request to obtain a user plane security mechanism from the PCF. This method is the same as the procedure for requesting the PCF in the above embodiment.
  • the AMF first determines whether the PCF needs to be requested (or whether a dynamic user plane security mechanism is required) according to the registration information of the UE, thereby obtaining a user plane security mechanism for the PCF response.
  • the AMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the UE registration information. Or the AMF obtains the subscription service data from the UDM by sending the DNN, or the service ID, or the DNN and the service ID to the UDM, and the AMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the subscription service data.
  • the AMF sends a policy request to obtain a user plane security mechanism from the PCF. This method is the same as the procedure for requesting the PCF in the above embodiment.
  • the SMF receives the Request type parameter, and the parameter may send the Request type to the AMF for the UE, the AMF sends the Request type to the SMF, or the UE directly sends the Request type to the SMF.
  • the Request type parameter includes two possibilities. If the Request type indicates that an existing PDU session is used, such as an "existing PDU session", the SMF determines the existing user plane security mechanism corresponding to the session ID according to the session ID, and uses the existing user plane security mechanism as the session. User plane security mechanism. If the Request type indicates to establish a new PDU session (eg, "Initial Request"), the user plane security mechanism is determined according to the flow of the above embodiment.
  • the SMF determines whether a new user plane security mechanism needs to be determined based on obtaining parameter 1 from the UDM or AMF.
  • parameter 1 may be obtained by the SMF sending a request to the UDM; or the SMF is received from the AMF, at which time parameter 1 may be obtained from the AMF to the UDM request.
  • the SMF first determines whether it is necessary to request a PCF (or whether a dynamic user plane security mechanism is required) according to whether a dynamic policy configuration is required, thereby obtaining a user plane security mechanism for the PCF response.
  • the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the UE registration information. Or the SMF obtains the subscription service data from the UDM by sending the DNN, or the service ID, or the DNN and the service ID to the UDM, and the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the subscription service data. Alternatively, the SMF uses a preset default user plane security mechanism as the user plane security protection mechanism.
  • the SMF sends a policy request to obtain a user plane security mechanism from the PCF. This method is the same as the procedure for requesting the PCF in the above embodiment.
  • the SMF receives the Request type parameter, and the parameter may send the Request type to the AMF for the UE, the AMF sends the Request type to the SMF, or the UE directly sends the Request type to the SMF.
  • the Request type parameter includes two possibilities. If the Request type indicates that an existing PDU session is used, such as an "existing PDU session", the SMF determines the existing user plane security mechanism corresponding to the session ID according to the session ID, and uses the existing user plane security mechanism as the session. User plane security mechanism. If the Request type indicates to establish a new PDU session (for example, "Initial request”), if the Request type indicates "Initial request", the execution continues.
  • the SMF first determines whether it is necessary to request a PCF (or whether a dynamic user plane security mechanism is required) according to whether a dynamic policy configuration is required, thereby obtaining a user plane security mechanism for the PCF response.
  • the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the UE registration information. Or the SMF obtains the subscription service data from the UDM by sending the DNN, or the service ID, or the DNN and the service ID to the UDM, and the SMF determines the user plane protection mechanism of the UE according to the user plane security mechanism preset in the subscription service data. Alternatively, the SMF uses a preset default user plane security mechanism as the user plane security protection mechanism.
  • the SMF sends a policy request to obtain a user plane security mechanism from the PCF. This method is the same as the procedure for requesting the PCF in the above embodiment.
  • the SMF can determine the user plane security protection mechanism by itself, and does not need to send a policy request message to the PCF.
  • the method by which the SMF determines the user plane security protection mechanism may be based on the method of the FIG. 7 embodiment.
  • the PCF determines the user plane security protection mechanism based on the default security configuration.
  • K_UP KDF (K_SMF, session ID)
  • K_UP KDF (K_UP, UP algorithm ID); wherein K_UP may also be
  • K_UP KDF(K_SMF, flow ID)
  • K_UP KDF (K_SMF, slice ID).
  • each of the foregoing embodiments may be two independent schemes: the scheme 1 is a user plane protection mechanism, or the user plane security mechanism or the security policy negotiation method; and the scheme 2 is an air interface. Security algorithm and security key generation method.
  • the AN only supports the mechanism for determining the security algorithm, does not perform the derivation of the air interface key, and sends the security algorithm or the user plane security mechanism to the UE. If the UE receives the user plane security mechanism, the UE determines the security algorithm in the same way as the AN.
  • the AN only transmitting the received user plane security mechanism to the UE.
  • the UE and the AN have negotiated to determine the confidentiality protection algorithm and the integrity protection algorithm.
  • the AN determines the security protection algorithm based on the received user plane security mechanism and the determined confidentiality protection algorithm and integrity protection algorithm, wherein the user plane security mechanism indicates whether to encrypt (or whether integrity protection, or whether to encrypt and simultaneously Integrity protection). For example, if the user plane security mechanism indicates encryption protection, the AN uses the determined confidentiality protection algorithm to protect data between the UE and the AN. If the user plane security mechanism indicates integrity protection, the AN uses the determined integrity protection algorithm to protect the data between the UE and the AN.
  • the AN uses the determined confidentiality protection algorithm to protect the data between the UE and the AN.
  • the AN then sends the user plane security mechanism to the UE.
  • the UE determines the security protection algorithm in the same way as the AN according to the user plane security mechanism and the determined algorithm. It is also possible that the AN sends the determined security protection algorithm to the UE. It is also possible that the AN first sends the user plane security mechanism, and then the UE and the AN determine the confidentiality protection algorithm and the integrity protection algorithm, and finally determine the security protection according to the user plane security mechanism and the determined confidentiality protection algorithm and integrity protection algorithm. algorithm.
  • FIG. 19 is a schematic structural diagram of a policy function network element according to an embodiment of the present invention.
  • the policy function network element may include a receiving module 110, a policy module 120, and a sending module 130. Said as follows:
  • the receiving module 110 is configured to receive a request for communication between the user equipment and the network device, where the request includes the session identifier, the user equipment identifier, and the indication information of the security requirement, where the indication information of the security requirement is used to indicate the security of the user equipment.
  • the request includes the session identifier, the user equipment identifier, and the indication information of the security requirement, where the indication information of the security requirement is used to indicate the security of the user equipment.
  • the policy module 120 is configured to determine, according to the request, at least one of UE registration information fed back by the unified data management network element UDM, subscription service data fed back by the UDM, and service security requirements fed back by the application function network element AF.
  • User plane protection mechanism the user plane protection mechanism is used to indicate whether user plane data transmitted between the user equipment and the network equipment needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time .
  • the sending module 130 is configured to: when the network device is an access network AN device, send the user plane protection mechanism to the AN device; wherein the AN device is configured to determine, according to the user plane protection mechanism a security protection algorithm, based on the security protection algorithm, generating a first user plane protection key; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment is based on the security protection The algorithm generates a second user plane protection key;
  • the sending module 130 is further configured to: when the network device is a core network CN device, send the user plane protection mechanism to an algorithm network element, where the algorithm network element is used to determine according to the user plane protection mechanism a security protection algorithm, configured to generate a first user plane protection key based on the security protection algorithm, and send the first user plane protection key to the CN device; the algorithm network element is further configured to use the security protection An algorithm is sent to the user equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the request further includes at least one of a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the request is an attach request;
  • the attach request is initiated by the user equipment to an authentication server network element AUSF;
  • the attach request is used for mutual authentication between the network device and the AUSF, and
  • the request is a session request; the session request is initiated by the user equipment to the session management network element SMF, or is initiated to the SMF by the access and mobility management network element AMF; the session request is used for Establishing a session between the network device and the SMF, and is further configured to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a policy request; the policy request is initiated by the SMF to the policy function network element, and the policy request is used to trigger the policy function network element to determine a user plane protection mechanism.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device. .
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • the CN device is a user plane node UPF
  • the algorithm network element includes at least one of the PCF, the AUSF, the AMF, the SMF, and the AN device.
  • each module unit may also correspond to the phase of the method embodiment shown in FIG. 3 to FIG. 5. It should be described, and will not be described here.
  • the policy function network element includes a processor 210, a memory 220, and a transmitter 230, and a receiver 240.
  • the processor 210, the memory 220, and the transmitter 230 are provided.
  • the receivers 240 are connected (eg, connected to each other through a bus).
  • the memory 220 includes, but is not limited to, a random access memory (English: Random Access Memory, RAM for short), a read-only memory (English: Read-Only Memory, ROM for short), and an erasable programmable read-only memory (English: Erasable Programmable Read Only Memory (EPROM), or Portable Read-Only Memory (CD-ROM), which is used for related commands and data.
  • the transceiver 1303 is configured to receive and transmit data.
  • Transmitter 230 is used to transmit data or signaling
  • receiver 240 is used to receive data or signaling.
  • the processor 210 may be one or more central processing units (English: Central Processing Unit, CPU for short). In the case where the processor 210 is a CPU, the CPU may be a single core CPU or a multi-core CPU.
  • CPU Central Processing Unit
  • the processor 210 is configured to read the program code stored in the memory 220 and perform the following operations:
  • the receiver 240 Receiving, by the receiver 240, a request for communication between the user equipment and the network device; the request includes the session identifier, the user equipment identifier, and the indication information of the security requirement, where the indication information of the security requirement is used to indicate the security requirement of the user equipment and/or Or business security needs;
  • the processor 210 determines the user plane protection mechanism based on the request, and at least one of the UE registration information fed back by the unified data management network element UDM, the subscription service data fed back by the UDM, and the service security requirement fed back by the application function network element AF.
  • the user plane protection mechanism is configured to indicate whether user plane data transmitted between the user equipment and the network device needs to be encrypted, or whether integrity protection is required, or whether encryption and integrity protection are required at the same time.
  • the user plane protection mechanism is sent to the AN device by using a transmitter 230, where the AN device is configured to determine a security protection algorithm based on the user plane protection mechanism, Generating a first user plane protection key based on the security protection algorithm; the AN device is further configured to send the security protection algorithm to the user equipment, so that the user equipment generates a second manner based on the security protection algorithm User plane protection key;
  • the user plane protection mechanism is sent by the transmitter 230 to the algorithm network element when the network device is the core network CN device, where the algorithm network element is used to determine a security protection algorithm based on the user plane protection mechanism, based on The security protection algorithm generates a first user plane protection key, and sends the first user plane protection key to the CN device; the algorithm network element is further configured to send the security protection algorithm to the User equipment, so that the user equipment generates a second user plane protection key based on the security protection algorithm.
  • the request further includes at least one of a service identifier, a user equipment service identifier, a data network identifier DNN, and a user equipment security capability.
  • the request is an attach request;
  • the attach request is initiated by the user equipment to an authentication server network element AUSF;
  • the attach request is used for mutual authentication between the network device and the AUSF, and
  • the request is a session request; the session request is initiated by the user equipment to the session management network element SMF, or is initiated to the SMF by the access and mobility management network element AMF; the session request is used for Establishing a session between the network device and the SMF, and is further configured to trigger the policy function network element to determine a user plane protection mechanism;
  • the request is a policy request; the policy request is initiated by the SMF to the policy function network element, and the policy request is used to trigger the policy function network element to determine a user plane protection mechanism.
  • the user plane protection mechanism is further configured to: at least one of a security protection algorithm, a key length, and a key update period that are required to be used to indicate user plane data transmitted between the user equipment and the network device. .
  • the user plane protection mechanism is further configured to indicate a priority security protection algorithm list that can be adopted by the user plane data transmitted between the user equipment and the network device.
  • the policy function network element includes one of a policy control node PCF, an authentication server network element AUSF, an access and mobility management function network element AMF, a session management network element SMF, and an AN device.
  • the CN device is a user plane node UPF; the algorithm network element includes at least one of the PCF, the AUSF, the AMF, the SMF, and the AN device.
  • the optional AN device is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and an algorithm priority list supported by the AN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • the optional algorithm network element is configured to determine a security protection algorithm based on the user plane protection mechanism, including:
  • the security protection algorithm is determined based on at least one of the user plane protection mechanism, the user equipment security capability, and the algorithm priority list supported by the CN device.
  • the security protection algorithm in the user plane protection mechanism is directly obtained.
  • generating the first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_AN, UP algorithm ID), wherein after the authentication is successful, the AMF is derived based on the authenticated base key or the key derived after authentication again. a base station key, the AN device obtains the K_AN from the AMF;
  • generating a first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_ algorithm network element, UP algorithm ID), wherein after the K_ algorithm network element is successfully authenticated, the AMF or the AUSF is based on the verified basic key or Deriving the obtained key again after the authentication, and deriving the base station key, and the algorithm network element obtains the K_ algorithm network element from the AMF or the AUSF;
  • the UP algorithm ID is an identifier of the encryption algorithm, or an identifier of the integrity protection algorithm; and the KDF is a key derivation function.
  • the user plane data is carried by a QoS flow Qos flow transmission channel
  • the QoS flow transmission is selected.
  • the channel transmits user plane data; otherwise, a new Qos flow transmission channel is created, and a QoS flow ID corresponding to the QoS flow transmission channel is generated;
  • the Qos flow transmission channel is selected to transmit the user plane data; otherwise, the new Qos flow is created. Transmitting a channel and generating a QoS flow ID corresponding to the QoS flow transmission channel;
  • the Qos requirement is a requirement for a quality of service parameter in a communication network.
  • the user plane data is carried by a data radio bearer DRB transmission channel;
  • the DRB transmission channel is selected to transmit the user data; Otherwise, a new DRB transmission channel is created, and a DRB ID corresponding to the DRB transmission channel is generated;
  • the DRB transmission channel is selected to transmit the user data; otherwise, the DRB transmission channel is newly created, and the DRB transmission channel is generated. DRB ID.
  • the DRB ID has a mapping relationship with the user plane protection mechanism.
  • the user plane data is carried by a session session transmission channel
  • the session transmission channel is selected to transmit the user data; otherwise, Create a new session transport channel and generate a session ID corresponding to the session transport channel.
  • the session transmission channel is selected to transmit user data; otherwise, the session transmission channel is newly created, and a session corresponding to the session transmission channel is generated. Session ID.
  • the session ID has a mapping relationship with the user plane protection mechanism.
  • mapping between the session ID and the QoS flow ID to the DRB ID is established, and QoS flows with the same user plane protection mechanism are mapped to the same DRB.
  • the network device is an AN device
  • generating the first user plane protection key based on the security protection algorithm including:
  • the first user plane protection key KDF (K_AN, UP algorithm ID); or,
  • the first user plane protection key KDF (K_AN, UP algorithm ID, flow ID); or
  • the first user plane protection key KDF (K_AN, UP algorithm ID, session ID); or,

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明本发明实施例公开了一种密钥配置方法、装置与系统，该方法包括：策略功能网元接收用户设备与网络设备之间通信的请求；基于所述请求，以及UE注册信息、签约业务数据、业务安全需求确定用户面保护机制；当网络设备为CN设备时，策略功能网元向算法网元发送用户面保护机制；算法网元基于用户面保护机制确定安全保护算法，基于安全保护算法生成第一用户面保护密钥，将第一用户面保护密钥发送至CN设备，将安全保护算法发送至用户设备，用户设备基于安全保护算法生成第二用户面保护密钥。实施本发明实施例能够实现在5G通信中用户设备与网络设备分别完成用户面保护密钥的配置，提高用户面数据传输的安全性，实现网络安全保护。

Description

密钥配置方法、装置以及系统 技术领域
本发明涉及通信领域，尤其涉及密钥配置方法、装置以及系统。
背景技术
在现有的网络安全架构中，数据的安全性保护采用的是hop-by-hop方式，即分段进行安全性保护。以数据从终端设备—基站—服务网关—PDN网关的传输链路为例，终端设备-基站之间执行一次安全性保护，基站—服务网关之间执行一次安全性保护，服务网关—PDN网关之间执行一次安全性保护在数据传输的过程中，如果中间节点出现了问题，则可能会导致数据的泄露。
此外，在现有的网络安全架构中，终端设备和基站之间采用PDCD空口保护机制。PDCD空口保护机制仅支持一套用户数据保护机制，也就是说，即使终端设备与基站之间传输多种类型的业务数据，这些多种类型的业务数据也只能采用同一种加密算法和完整性保护算法进行安全保护。可以看到，现有技术不支持差异化的安全保护，在基站侧所有的业务数据均需进行统一的安全保护。
另外，在未来的5G规划中，要求5G网络中的网元支持基于业务的安全策略协商，而目前LTE中的安全算法协商仅用于用户面或者控制面的安全算法协商。不支持基于业务的安全策略协商，所以，现有的LTE的协商机制不能够直接应用于未来5G通信中。
发明内容
本发明实施例公开了一种密钥配置方法、装置以及系统，能够实现在5G通信中用户设备与网络设备分别完成用户面保护密钥的配置，提高用户面数据传输的安全性，实现网络安全保护。
第一方面，本发明实施例提供了一种密钥配置方法，应用于通信系统的策略功能网元侧，该方法包括：
策略功能网元接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，和/或，是否需要完整性保护。
当所述网络设备为接入网AN设备时，所述策略功能网元向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，所述策略功能网元向算法网元发送所述用户面保 护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
其中，当所述第一用户面保护密钥用于对用户面数据进行安全性保护时，所述第二用户面保护密钥用于对用户面数据进行还原；当所述第二用户面保护密钥用于对用户面数据进行安全性保护时，所述第一用户面保护密钥用于对用户面数据进行还原；其中，所述安全性保护为所述用户面保护机制所指示是否加密，和/或，是否完整性保护。
结合第一方面，在可能的实施方式中，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制；
结合第一方面，在可能的实施方式中，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
其中，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、CN设备中的一个。
其中，所述CN设备为用户面节点UPF；所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
结合第一方面，在可能的实施方式中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
结合第一方面，在可能的实施方式中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
结合第一方面，在可能的实施方式中，当所述网络设备为接AN设备时，基于所述安全 保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述算法网元从所述AMF或所述AUSF获得所述K_算法网元；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
结合第一方面，在可能的实施方式中，所述用户面数据通过服务质量流Qos flow传输通道承载；
在确定用户面保护机制之前，包括：确定所述Qos flow传输通道对应的服务质量流标识QoS flow ID；
确定用户面保护机制，包括：确定所述QoS flow ID对应的用户面保护机制；其中，所述QoS flow ID与所述用户面保护机制具有映射关系。
结合第一方面，在可能的实施方式中，确定所述Qos flow传输通道对应的QoS flow ID，包括：
基于安全需求，和/或，Qos需求，选择预设的Qos flow传输通道对应的QoS flow ID；
或者，基于安全需求，和/或Qos需求，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID。
其中，所述安全需求为所述指示信息、所述UE注册信息、所述签约业务数据、所述AF反馈的业务安全需求中的至少一个所指示的安全需求；所述Qos需求为对通信网络中服务质量参数的需求。
结合第一方面，在可能的实施方式中，所述用户面数据通过数据无线承载DRB传输通道承载；
在确定用户面保护机制之前，包括：确定所述DRB传输通道对应的数据无线承载标识DRB ID；
确定用户面保护机制，包括：确定所述DRB ID对应的用户面保护机制；其中，所述DRB ID与所述用户面保护机制具有映射关系。
结合第一方面，在可能的实施方式中，确定所述DRB传输通道对应的DRB ID，包括：
基于所述安全需求，和/或，所述Qos需求，选择预设的DRB传输通道对应的DRB ID；
或者，基于所述安全需求，和/或，所述Qos需求，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID。
其中，所述安全需求为所述指示信息、所述UE注册信息、所述签约业务数据、所述AF反馈的业务安全需求中的至少一个所指示的安全需求；所述Qos需求为对通信网络中服务质量参数的需求。
结合第一方面，在可能的实施方式中，所述用户面数据通过会话session传输通道承 载；
在确定用户面保护机制之前，包括：确定所述session传输通道对应的会话标识session ID；
确定用户面保护机制，包括：确定所述session ID对应的用户面保护机制；其中，所述session ID与所述用户面保护机制具有映射关系。
在可能的实施例中，确定用户面保护机制，还包括：
建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
结合第一方面，在可能的实施方式中，当所述网络设备为接AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)；
当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)；
结合第一方面，在可能的实施方式中，确定用户面保护机制之前，还包括：
基于所述会话请求，所述用户设备与数据网络DN进行二次认证，并将认证结果反馈至所述策略功能网元，以便于所述策略功能网元参考所述认证结果来确定用户面保护机制。
第二方面，本发明实施例提供了一种策略功能网元，用于实现第一方面所述的方法，策略功能网元包括：接收模块、策略模块和发送模块，其中：
所述接收模块用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述策略模块用于基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
所述发送模块用于，当所述网络设备为接入网AN设备时，向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
所述发送模块还用于，当所述网络设备为核心网CN设备时，向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述 CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
第三方面，本发明实施例提供了又一种策略功能网元，该策略功能网元包括处理器、存储器和发射器以及接收器，所述处理器、存储器和发射器以及接收器相连接(如通过总线相互连接)。该处理器用于读取所述存储器中存储的程序代码，执行以下步骤：
通过接收器接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
处理器基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
当所述网络设备为接入网AN设备时，利用发射器向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，利用发射器向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
结合第三方面，在可能的实施例中，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
结合第三方面，在可能的实施例中，所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
结合第三方面，在可能的实施例中，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
结合第三方面，在可能的实施例中，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
结合第三方面，在可能的实施例中，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
结合第三方面，在可能的实施例中，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
结合第三方面，在可能的实施例中，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
其中，所述CN设备为用户面节点UPF；所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
结合第三方面，在可能的实施例中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
结合第三方面，在可能的实施例中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
结合第三方面，在可能的实施例中，当所述网络设备为接AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述算法网元从所述AMF或所述AUSF获得所述K_算法网元；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
结合第三方面，在可能的实施例中，所述用户面数据通过服务质量流Qos flow传输通道承载；
若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
其中，所述Qos需求为对通信网络中服务质量参数的需求。
结合第三方面，在可能的实施例中，所述用户面数据通过数据无线承载DRB传输通道 承载；
若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID。
其中，所述DRB ID与所述用户面保护机制具有映射关系。
可选的所述用户面数据通过会话session传输通道承载；
若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
其中，所述session ID与所述用户面保护机制具有映射关系。
结合第三方面，在可能的实施例中，建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
结合第三方面，在可能的实施例中，当所述网络设备为AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)。
结合第三方面，在可能的实施例中，当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)。
第四方面，本发明实施例提供了一种通信系统，该通信系统包括：用户设备、策略功能网元、网络设备、统一数据管理网元UDM、应用功能网元AF、算法网元，所述策略功能网元与所述用户设备、所述网络设备连接，所述策略功能网元还与所述UDM、所述AF连接，所述算法网元与所述策略功能网元、网络设备连接，其中：
所述策略功能网元用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述策略功能网元还用于基于所述请求，以及所述UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、所述AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
当所述网络设备为接入网AN设备时，所述策略功能网元还用于向所述AN设备发送所述用户面保护机制；所述AN设备用于基于所述用户面保护机制确定安全保护算法；所述AN设备还用于基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，所述策略功能网元用于向算法网元发送所述用户面保护机制；所述算法网元还用于基于所述用户面保护机制确定安全保护算法；所述算法网元还用于基于所述安全保护算法生成第一用户面保护密钥；所述算法网元还用于将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥。
第五方面，本发明实施例提供了一种密钥配置方法，包括：
用户设备发送请求，所述请求中包括所述用户设备的标识；
所述用户设备接收响应，所述响应中携带安全保护算法，所述安全保护算法由用户面保护机制确定，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示所述用户设备与网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
所述用户设备基于所述安全保护算法确定用户面保护密钥，所述用户面保护密钥用于对所述用户设备与所述网络设备之间传输的用户面数据进行安全性保护。
可选的，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
可选的，所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
可选的，根据权利要求40至42任一项所述的方法，其特征在于，
所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，根据权利要求40至43任一项所述的方法，其特征在于，
所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
可选的，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
可选的，根据权利要求40至45任一项所述的方法，其特征在于，
所述用户设备基于所述安全保护算法确定用户面保护密钥，包括：
用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述用户设备根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
可选的，所述网络设备为接入网AN设备或者用户面节点UPF。
第六方面，本发明实施例提供了一种密钥配置方法，包括：
用户面节点接收响应，所述响应中携带安全保护算法，所述安全保护算法由用户面保护机制确定，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示用户设备与所述用户面节点之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
所述用户面节点基于所述安全保护算法确定用户面保护密钥，所述用户面保护密钥用于对用户设备与所述用户面节点之间传输的用户面数据进行安全性保护。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
可选的，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
第七方面，本发明实施例提供了一种密钥配置方法，包括：
接入网设备接收用户面保护机制，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示所述用户设备与网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
所述接入网设备基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；
所述接入网设备将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
可选的，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
可选的，所述接入网设备用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、接入网设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
可选的，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述接入网设备从所述AMF获得所述K_AN；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数
第八方面，本发明实施例提供了一种一种密钥配置方法，包括：
会话管理网元接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述会话管理网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
当所述网络设备为接入网AN设备时，所述会话管理网元向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，所述会话管理网元向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
可选的，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备 安全能力中的至少一项。
可选的，所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
可选的，所述会话管理网元确定所述用户面数据通过服务质量流Qos flow传输通道承载；
若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
其中，所述Qos需求为对通信网络中服务质量参数的需求。
可选的，所述会话管理网元确定所述用户面数据通过数据无线承载DRB传输通道承载；
若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID。
其中，所述DRB ID与所述用户面保护机制具有映射关系。
可选的，所述会话管理网元确定所述用户面数据通过会话session传输通道承载；
若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
或者，若已存在session传输通道对应的session ID，所述session ID对应session 满足用户面保护机制，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
其中，所述session ID与所述用户面保护机制具有映射关系。
第九方面，本发明实施例提供了一种存储计算机指令的可读非易失性存储介质，包括计算机指令，所述计算机指令被执行以实现上述第一方面描述的方法。
第十方面，本发明实施例提供了一种存储计算机指令的可读非易失性存储介质，包括计算机指令，所述计算机指令被执行以实现上述第五方面描述的方法。
第十一方面，本发明实施例提供了一种存储计算机指令的可读非易失性存储介质，包括计算机指令，所述计算机指令被执行以实现上述第六方面描述的方法。
第十二方面，本发明实施例提供了一种存储计算机指令的可读非易失性存储介质，包括计算机指令，所述计算机指令被执行以实现上述第七方面描述的方法。
第十三方面，本发明实施例提供了一种存储计算机指令的可读非易失性存储介质，包括计算机指令，所述计算机指令被执行以实现上述第八方面描述的方法。
第十四方面，本发明实施例提供了一种计算机程序产品，当计算机程序产品运行于计算机时，被执行以实现上述第一方面、或第五方面、或第六方面、或第七方面、或第八方面描述的方法。
通过实施本发明实施例，可实现基于未来5G的通信架构，在用户设备与网络设备(接入网设备或者核心网设备)的通信中，需要传输用户面数据时，用户设备与网络设备完成策略协商，确定用户面保护机制后，用户设备与网络设备分别完成用户面保护密钥的配置，从而实现对用户面数据的安全保护。实施本发明实施例可实现基于Qos flow、DRB、session粒度的网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
附图说明
下面将对背景技术或者实施例所需要使用的附图作简单地介绍。
图1是本发明实施例提供的一种移动通信网络架构示意图；
图2是本发明实施例提供的一种数据传输通道示意图；
图3-图18是本发明实施例提供的密钥配置方法的流程示意图；
图19是本发明实施例提供的一种策略功能网元结构示意图；
图20是本发明实施例提供的又一种策略功能网元结构示意图。
具体实施方式
下面将结合本发明实施例中的附图对本发明实施例中的技术方案进行描述。
为便于方案理解，首先结合相关附图来举例介绍本申请实施例的方案可能应用到的网络架构。图1为未来的移动通信的网络架构，该网络架构包括用户设备和运营商网络，运营商网络又包括核心网和数据网，用户设备通过接入网节点接入运营商网络。具体如下：
用户设备(User Equipment，UE)，UE为逻辑实体，具体的，UE可以是终端设备(Terminal Equipment)、通信设备(Communication Device)、物联网(Internet of Things，IoT)设备中的任意一种。其中，终端设备可以是智能手机(smart phone)、智能手表(smart watch)，智能平板(smart tab let)等等。通信设备可以是服务器、网关(Gateway，GW)、控制器 等等。物联网设备可以是传感器，电表以及水表等等。
接入网(access network，AN，)，AN负责用户设备的接入，AN可以是无线接入点，例如：基站、无线保真(Wireless Fidelity，Wi-Fi)接入点、以及蓝牙接入点等等，也可以是有线接入点，例如：网关，调制解调器，光纤接入，I P接入等等。
数据网络(Data network，DN)，数据网络可以为运营商外部网络，也可以为运营商控制的网络，用于向用户提供业务服务。
核心网(core network，CN)，CN作为承载网络提供到DN的接口，为UE提供通信连接、认证、管理、策略控制以及对数据业务完成承载等。其中，CN又包括：接入和移动管理网元、会话管理网元，认证服务器网元、策略控制节点、应用功能网元、用户面节点等，相关描述具体如下：
接入与移动管理网元(Access and Mobility Management Function，AMF)，用于管理UE的接入和移动性。
会话管理网元(Session Management Function，SMF)，用于进行会话管理，执行会话(session)、流(flow)或者承载(bearer)的建立和管理。.
认证服务器网元(Authentication Server Function，AUSF)，UE与运营商网络执行双向认证的节点。AUSF可以作为一个独立的逻辑功能实体单独部署，也可以集合在AMF/SMF等设备中。
统一数据管理网元(Unified Data Manager，UDM)，用于存储UE注册信息，也可能存储签约业务数据。
策略控制节点(Policy control Function，PCF)，所述PCF部署有策略控制的功能，所述策略控制的功能是指根据安全需求完成用户面保护机制的协商，确定网络中的用户面保护机制的功能。需要说明的是，PCF可以作为一个独立的逻辑功能实体，也可以集合在其他的网元中。也就是说，在具体的实现上，可以将策略控制的功能部署在PCF中，也可以部署在其他网元中，例如部署在移动性管理(Mobility Management，MM)网元、会话管理网元(Session Management，SM)、认证服务器节点(Authentication Server Function，AUSF)、策略和计费规则功能(Policy charging and rules function，PCRF)、移动性管理实体(Mobility Management Entity，MME)、归属签约用户服务器(Home Subscriber Server，HSS)、鉴权中心(AUthentication Center，AuC)、认证信任状存储和处理功能网元(Authentication Credential Repository and Processing Function，ARPF)、安全上下文管理网元(Security Context Management Function(SCMF)、接入与移动管理功能网元(Access and Mobility management Function，AMF)、会话管理网元(Session Management Function，SMF)、接入网节点(Access network，AN)、用户面节点(User plane function，UPF)等网元中。本发明实施例中，部署策略控制的功能的网元(如PCF)可能会与DN的AAA server(外部的AAA server)，APP server，或者service server交互获得DN侧的安全需求。
应用功能网元(Application Function，AF)：用于存储业务安全需求，为PCF提供策略判定的信息。
用户面节点(User Plane Function，UPF):UPF可以是网关、服务器、控制器、用户 面功能网元等。UPF可以设置在运营网内部，也可以设置在运营网外部。
还需要说明的是，图1中体现的是各个网元之间的逻辑关系，在实际中，有些网元可以单独部署，也可以两两或多个网元集成部署在一个实体中。例如，AMF和SMF可部署在一个实体中；或者AMF和SMF也可分别部署在不同的实体中。
基于上述移动通信的网络架构，下面分析在通信过程中所涉及的数据传输通道。
从纵向角度来看，当用户设备需要与运营商网络进行通信时，至少包括两个方面的通信：(1)用户设备与接入网的通信，简称UE-AN通信，UE-AN通信属于直接的通信，UE通过空中接口与AN进行通信连接。为了实现UE-AN通信的安全，需要在UE与AN间建立用户面保护机制。(2)用户设备与核心网的通信，简称UE-CN通信。UE-CN通信属于间接的通信，UE通过接入网与CN进行通信连接，在这个过程中，接入网起着透传或转发的作用。为了实现UE-CN通信的安全，需要在UE与CN间建立用户面保护机制。
从横向角度来看，通信网络中的硬件基础设施可切分出多个虚拟的端到端网络，称为网络切片，每个网络切片从用户设备到接入网到核心网的过程在逻辑上隔离，以适配各种类型服务的不同需求。其中，1个网络切片可包括1个或多个会话。数据传输过程中，不同类型服务可能会采用不同的承载，在用户设备与接入网或核心网进行通信连接时，在同一个通信连接里可以同时存在多个承载，所述承载为UE-AN之间或UE-CN之间提供一条逻辑的传输通道，每一个承载关联到描述这个传输通道属性的服务质量(Quality of Service，QoS)参数集,例如比特率、时延、差错率等等。所述传输通道包括会话(如PDU session)，无线承载(如Data Radio Bearer)和流(如QoS flow)等。为方便表述，下文将采用PDU session，Data Radio Bearer，和QoS flow为例进行描述。
参见图2，图2是本发明实施例提供的一种数据传输通道的简单示意图。如图2所示，UE可与AN进行通信连接，UE也可与处于核心网的UPF进行通信连接。所述通信连接中的网络切片具有多种传输通道，包括逻辑设置于UE与UPF之间的一个PDU session和一个或多个QoS flow，逻辑设置于UE与AN之间的一个或多个Radio Bearer，逻辑设置于AN与UPF之间的一个N3隧道，具体描述如下：
PDU session为UE与UPF之间粗粒度的数据传输通道，PDU session又包括无线承载(Radio Bearer)段和N3隧道段，在PDU session内还包括更细粒度的QoS flow。在图2中，PUD session包括N3隧道，多个Radio Bearer(Radio Bearer1，Radio Bearer2)，多个QoS flow(QoS flow1，QoS flow2，QoS flow3)。
Radio Bearer为UE与AN之间的承载通道，Radio Bearer支持信令无线承载和数据无线承载(Data radio bearer，DRB)，并且不同的Radio Bearer可包括不同的QoS flow，图2中，Radio Bearer1包括QoS flow1和QoS flow2，Radio Bearer2只包括QoS flow3。
N3隧道为AN与UPF之间的数据传输通道，可用于传输用户设备的QoS flow数据，图2中，N3隧道包括QoS flow1，QoS flow2和QoS flow3。
QoS flow为贯穿UE与UPF之间细粒度的数据传输通道，QoS flow具有统一的QoS需求，不同的QoS flow具有不同的Qos flow标识(QFI ID)。
为了解决现有技术的缺陷，基于图1所示的网络架构和图2所示的数据传输通道架构，本发明实施例提供一种密钥配置方法，该方法简要描述如下：
1、策略功能网元接收用户设备与网络设备之间通信的请求；
其中，所述策略功能网元为策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、CN设备中的一个。
其中，所述请求为附着请求；或者，所述请求为会话请求；或者，所述为策略请求；
其中，所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；所述请求还可以包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
2、所述策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；
其中，所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，和/或，是否需要完整性保护。所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
3、当所述网络设备为接入网AN设备时，所述策略功能网元向所述AN设备发送所述用户面保护机制；
所述AN设备基于所述用户面保护机制确定安全保护算法；
所述AN设备基于所述安全保护算法生成第一用户面保护密钥；
所述AN设备将所述安全保护算法发送至所述用户设备；
所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
4、当所述网络设备为核心网CN设备(比如为用户面节点UPF)时，所述策略功能网元向算法网元发送所述用户面保护机制；
其中，所述算法网元为所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的一个。
所述算法网元基于所述用户面保护机制确定安全保护算法；
所述算法网元基于所述安全保护算法生成第一用户面保护密钥；
所述算法网元将所述第一用户面保护密钥发送至所述CN设备；
所述算法网元将所述安全保护算法发送至所述用户设备；
所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
可以理解的，在完成上述策略协商以及密钥配置流程后，当用户面数据需要上行传输时，所述用户设备使用所述第二用户面保护密钥对所述用户面数据的安全性保护，而得到受保护用户面数据，然后向网络设备发送受保护用户面数据；所述网络设备可根据所述第一用户面保护密钥对所述受保护用户面数据进行还原，以获得所述用户面数据。
当用户面数据需要下行传输时，所述网络设备使用所述第一用户面保护密钥对所述用户面数据的安全性保护，而得到受保护用户面数据，然后向用户设备发送受保护用户面数据，所述用户设备根据所述第二用户面保护密钥对所述受保护用户面数据进行还原，以获 得所述用户面数据。
下面，本发明实施例将根据图1的网络架构，分别基于UE-AN和UE-CN，从不区分粒度的角度和区分粒度的角度描述本发明实施例提供的密钥配置方法。
首先，基于UE-AN，从不区分粒度的角度描述本发明实施例提供的一种密钥配置方法，如图3所示，本发明实施例提供的密钥配置方法包括如下步骤：
1、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)、用户设备安全能力、安全需求的指示信息(indicator)，所述安全需求的指示信息用于指示所述设备安全需求和/或业务安全需求；此外，所述附着请求还可以包括业务ID和UE业务ID。所述附着请求可能还包括数据网络标识(Data Network Name，DNN)，所述DNN代表UE希望接入的数据网络标识。其中：
具体的，用户设备标识(UE ID)用于表征发出附着请求的用户设备的身份。例如：UE ID可以是媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、临时移动用户标识符(Temporary Mobile Subscriber Identity，TMSI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等中的一项或多项。
具体的，用户设备安全能力用于表征用户设备可以支持的安全保护算法、可以支持的密钥长度、可以支持的密钥更新周期等。可以理解的是，不同用户设备的存储容量，运算速度各不相同，所以，不同用户设备支持的安全保护算法、支持的密钥长度以及支持的密钥更新周期各不相同。例如，物联网(Internet of Things，IoT)设备的存储容量不大，运算速度也不高，不能支持复杂度较高的安全保护算法；智能手机的存储容量大，运算速度也比较高，可以支持复杂度较高的安全保护算法。故此，用户设备需要将所述用户设备安全能力告知AMF，以便于AMF结合用户设备安全能力确定用户面保护机制。
其中，在本发明实施例中，安全保护算法包括加密算法和完整性保护算法，举例来说，安全保护算法可以是null、AES、Snow 3G、ZUC等等算法中的任意一种，其中null代表空算法。密钥长度可以是64位、96位、128位、192位、和256位等等长度中的任意一种。密钥更新时间可以是6小时、12小时、24小时和48小时等等时间中的任意一种。上述安全算法、密钥长度以及密钥更新时间只是作为一种举例说明，不应构成对本申请的限定。
具体的，设备安全需求用于指示所述用户设备侧的安全需求，也就是说，所述设备安全需求用于向AMF指示UE需要怎么样的用户面保护机制。在本发明实施例中，所述用户面保护机制用于指示用户面数据传输的保护方式，例如指示UE是否需要对用户面数据进行加密和/或完整性保护。用户面保护机制可以为“需要加密+不需要完整性保护”；或者为“需要加密+不需要完整性保护”；或者为“需要加密+需要完整性保护”。其中，所述加密是指 用户面数据通过加密算法处理之后，成为不可阅读的密文，达到避免数据被非法窃取、阅读的目的。所述完整性保护是指用户面数据通过完整性保护算法处理之后，数据在传输过程中没有被非法添加、删除、替换等。另外，本发明可能的实施例中，所述用户面保护机制还可用于指示安全保护算法、UE可接受的密钥长度、UE可接受的密钥更新周期等。
举例来说，所述用户面保护机制还可用于指示安全保护算法，包括指示加密算法和指示完整性保护算法，指示加密算法具体为：规定采用包括但不限于null(空算法，表示不进行加密)、AES、Snow 3G或ZUC中的哪种加密算法对用户面数据进行加密保护；指示完整性保护算法具体为：规定采用包括但不限于null(空算法，指不进行完整性保护)、AES、Snow 3G、ZUC、HMAC、CMAC中的哪种完整性保护算法对用户面数据进行完整性保护。可能一个安全需求中安全保护的算法包括多个加密算法和/或多个完整性保护算法；在此情况下，安全需求中，还包含算法的优先级排序，即指明优先使用哪一个算法。
又举例来说，所述用户面保护机制指示的UE可接受的密钥长度包括64、128、256，或者512比特等。又举例来说，所述用户面保护机制指示的UE可接受的密钥更新周期可以是6小时、12小时、24小时和48小时等等。
具体的，业务安全需求用于表征业务可接受的安全性算法、可接受的密钥长度和可接受的密钥更新周期中至少一项。可以理解的是，不同业务对于安全性算法、密钥长度以及密钥更新周期的要求是不相同的。例如，金融业务对于安全性算法的要求比较高，而视频下载业务对于安全性算法的要求比较低。故此，第一设备需要将业务安全需求告知AMF，以便于AMF结合业务安全需求生成用户面保护机制。
具体的，业务ID用于表征UE支持的业务，例如所述业务为微信，则所述业务ID为微信标识(微信ID)。
具体的，UE业务ID用于表征在UE支持的业务中，UE具体所需要传输的业务的标识，例如所述业务为微信，则所述UE业务ID为微信用户标识(微信用户ID)。
在通信架构中，UE在进行实际的业务传输之前，首先需要附着(attach)到签约网络，获得签约网络上的授权。在具体的应用场景中，UE可以在开机时触发附着过程，向AN发送附着请求；UE也可以在完全离开网络一段时间后，在需要连接到网络时，重新触发附着过程，向AN发送附着请求。AN接收到所述附着请求后，将附着请求转发至AMF。
2、AMF发送UE ID至AUSF。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID。
3、UE与AUSF双向认证。
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、AMF确定用户面保护机制。
在本发明实施例中，策略控制的功能部署在AMF中，AMF可以通过多种方式确定用户面保护机制：
方式一，AMF可根据indicator确定用户面保护机制。包括：(1)AMF基于indicator获得用户设备侧的安全需求(即用户设备安全需求)，那么，AMF可根据用户设备安全需求 确定用户面保护机制。(2)AMF基于indicator获得业务的安全需求(即业务安全需求)，那么，AMF可根据业务安全需求确定用户面保护机制。
方式二，AMF可根据UE注册信息确定用户面保护机制。其中，UE注册信息是AMF从UDM获得的。具体的，AMF接收到UE的附着请求后，发送UE ID至UDM，进而从UDM获得的UE注册信息，或者，通过AUSF从UDM获得的UE注册信息。所述注册信息预置于于UDM中，所述UE注册信息包括预置的UE安全需求。所述UE安全需求用于表示UE是否需要加密，或者UE是否需要进行完整性保护，或者UE是否同时需要加密和完整性保护。
方式三，AMF可根据签约业务数据确定用户面保护机制。具体的，AMF发送业务ID至UDM，或者发送数据网络标识(DNN)至UDM；UDM基于业务ID或DNN确认其中预置的签约业务数据，并将相关的签约业务数据发送至AMF，其中，所述签约业务数据包括预置的业务安全需求，所述预置的业务安全需求用于指示业务需要什么样的用户面保护机制，例如指示业务是否需要加密，或者业务是否需要进行完整性保护，或者业务是否同时需要加密和完整性保护。
方式四，AMF可根据AF反馈的业务安全需求确定用户面保护机制。具体的，PCF向AF发送请求，AF基于请求向PCF反馈业务安全需求，其中，所述请求可包括UE ID，业务ID，业务UE ID，或DNN的至少一项，PCF将所述业务安全需求发送给AMF，进而，AMF获得业务安全需求。所述业务安全需求用于指示业务需要什么样的用户面保护机制，例如指示业务是否需要加密，或者是否需要进行完整性保护，或者是否同时需要加密和完整性保护。
在本发明具体实施例中，AMF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，AMF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或者或者业务的安全需求综合确定用户面保护机制。
5、AMF发送用户面保护机制至AN，相应的，AN接收用户面保护机制。
6、AN确定安全保护算法以及确定用户面保护密钥。
在一种具体实施例中，AN获取用户面保护机制后，确定UE-AN之间的用户面保护机制为是否需要加密、是否需要完整性保护；然后，AN根据UE安全能力，AN支持的算法优先级列表确定安全保护算法，例如，当用户面保护机制为“需要加密+需要完整性保护”时，AN根据UE安全能力，AN支持的算法优先级列表确定加密算法为AES，完整性保护算法为AES。
在另一种具体实施例中，用户面保护机制直接制定了指定了安全保护算法，则AN可从用户面保护机制直接获取安全保护算法。在步骤5中，在确定了用户面保护机制后，AMF可获取AN支持的算法优先级列表，并基于AN支持的算法优先级列表以及UE支持的算法和用户设备安全能力确定空口保护算法，例如，在“需要加密+需要完整性保护”的用户面保护机制下,AMF进一步确定加密算法为AES，完整性保护算法为AES，并在用户面保护机制中携带上述安全保护算法。在这种情况下，由于用户面保护机制直接指定了加密算法和完整性保护算法，所以AN获得用户面保护机制后，可从用户面保护机制直接获取加密算法和完整性保护算法。
另外，在具体应用场景实施用户面保护机制过程中，当用户面保护机制包括“需要加 密+需要完整性保护”时，采用相同的安全保护算法、相同的密钥长度以及相同的密钥更新时间对用户面数据进行加密和完整性保护，也可以采用不同的安全保护算法、采用不同的密钥长度和采用不同的密钥更新时间对用户面数据进行加密和完整性保护。例如，在一具体的实施例中，当对会话的加密性和完整性进行保护时，对于加密性，采用的安全保护算法为Snow 3G算法，密钥长度为64位，密钥更新时间为6小时；对于完整性，采用的安全保护算法为Snow 3G算法，密钥长度为64位，密钥更新时间为6小时。在另一具体的实施例中，当对会话的加密性和完整性进行保护时，对于加密性，采用的安全保护算法为Snow 3G算法，密钥长度为64位，密钥更新时间为6小时；对于完整性，AN/UE采用的安全保护算法为ZUC算法，密钥长度为128位，密钥更新时间为12小时。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥(K_AN又可称为中间密钥)，所述K_AN是AMF发送直接发送至AN的，或者所述K_AN是携带于用户面保护机制中由AMF发送至AN的；UP算法ID可以为加密算法的标识，也可以为完整性保护算法的标识；KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。另外，由于用户面保护机制所针对的安全需求不同，例如，用户面保护机制1要求保护密钥长度为256bit；而用户面保护机制2要求保护密钥长度要求为128bit；此时第一设备可以采用不同的密钥推衍算法，来满足不同用户面保护机制对于不同保护密钥长度的需求(例如，采用HMAC-SHA1来生成128bit的保护密钥，采用HMAC-SHA256生成256bit保护密钥)。
7、AN发送安全保护算法至UE，相应的，UE接收用户面安全保护算法。
在一具体实施例中，AN在步骤6中确定了安全保护算法，那么此时AN直接发送所述安全保护算法至UE。
在另一具体实施例中，可能用户面保护机制本身就包括安全保护算法，那么此时AN可发送用户面保护机制至UE，UE接收用户面保护机制后，获取用户面保护机制中的安全保护算法。
8、UE根据用户面安全算法和K_AN生成用户面保护密钥。
在本发明实施例中，UE可基于安全保护算法生成用户面保护密钥。具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)，其中，K_AN为UE根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；UP算法ID可以为加密算法的标识，也可以为完整性保护算法的标识；KDF为密钥推衍函数(Key  Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
可以理解的，在具体应用场景实施用户面保护机制过程中，所述第一空口用户面保护密钥和第二空口用户面保护密钥可以是相同的密钥。在上行传输中，UE可基于第二空口用户面保护密钥对用户面数据进行加密性保护和/或进行完整性保护，AN接收到UE发送的上述用户面数据后，基于第一空口用户面保护密钥对用户面数据解密和/或完整性检验。在下行传输中，AN基于第一空口用户面保护密钥对用户面数据进行加密性保护和/或进行完整性保护，UE接收到AN发送的上述用户面数据后，基于第二空口用户面保护密钥对用户面数据解密和/或完整性检验。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，AMF可以在双向认证之前确定用户面保护机制(即步骤4可以放在步骤3之前)。
还需要说明的是，上述图3实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，实施本发明实施例，可实现基于未来5G的通信架构，在附着网络过程中，UE-AN完成策略协商，通过AMF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-AN，从不区分粒度的角度描述本发明实施例提供的又一种密钥配置方法，如图4所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。关于UE ID、用户设备安全能力、indicator、业务ID、UE业务ID、DNN的详细内容可参考图3实施例中的相关描述，这里不再赘述。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
另外，在可能的实施例中，根据AUSF的需要，AMF可将用户设备安全能力、安全需求的指示信息(indicator)、业务ID、UE业务ID和DNN发送至AUSF；或者，AMF直接将附着请求的内容进一步转发至AUSF。
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、AUSF确定用户面保护机制。
在本发明具体实施例中，AUSF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护 机制。也就是说，AUSF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。关于AUSF确定用户面保护机制的详细内容可类似地参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
5、AUSF发送用户面保护机制至AMF，AMF再发送用户面保护机制至AN，相应的，AN接收用户面保护机制。
6、AN确定安全保护算法以及确定用户面保护密钥。
详细情况可参考图3实施例中步骤6的描述，这里不再赘述。
7、AN发送安全保护算法至UE，相应的，UE接收用户面安全保护算法。
8、UE根据用户面安全算法和K_AN生成用户面保护密钥。
详细情况可参考图3实施例中步骤8的描述，这里不再赘述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AUSF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，AUSF可以在双向认证之前确定用户面保护机制。
还需要说明的是，图4实施例中没有详细描述的地方可参考图3实施例的相关描述，上述图4实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图4实施例与图3实施例的主要区别在于，AUSF在附着网络过程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在附着网络过程中，UE-AN完成策略协商，通过AUSF确定用户面保护机制后，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-AN，从不区分粒度的角度描述本发明实施例提供的又一种密钥配置方法，如图5所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于AMF和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
所述会话请求至少包括会话标识(会话ID)。
5、SMF将SMF响应信息发送至AMF，AMF再将SMF响应信息发送至AN，相应的，AN接收所述SMF响应信息。
其中，所述SMF响应信息可以包括网络侧预设置的安全需求，例如，包括UDM反馈的UE注册信息、或者UDM反馈的签约业务数据，或者AF反馈的业务安全需求等等，此外，所述SMF响应信息还可以包括UE与数据网络DN二次认证的认证结果，例如，基于所述会话请求，所述UE通过SMF与数据网络DN进行二次认证后，SMF将认证结果写入所述SMF响应信息中，再将SMF响应信息发送至AN，AN获知认证结果后，如果发现认证结果为正确(即通过认证)，那么将执行后面的确定用户面保护机制流程；如果发现认证结果为错误(即通过认证)，那么将不执行后面的确定用户面保护机制流程。
6、AN确定用户面保护机制。
在本发明具体实施例中，AN可根据ind icator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，AN可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。关于AN确定用户面保护机制的详细内容可类似地参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
7、AN确定安全保护算法以及确定用户面保护密钥。
详细情况可参考图3实施例中步骤6的描述，这里不再赘述。
8、AN发送安全保护算法至UE，相应的，UE接收用户面安全保护算法。
9、UE根据用户面安全算法和K_AN生成用户面保护密钥。
详细情况可参考图3实施例中步骤8的描述，这里不再赘述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AN在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，AN可以在步骤4(AMF向SMF发送会话请求)之前确定用户面保护机制。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
还需要说明的是，图5实施例中没有详细描述的地方可参考图3实施例的相关描述，上述图5实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图5实施例与图3实施例的主要区别在于，AN在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，基于未来5G的通信架构，在会话建立流程中，UE-AN完成策略协商，通过AN确定用户面保护机制后，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-AN，从不区分粒度的角度描述本发明实施例提供的又一种密钥配置方法，如图6所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于AMF和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
所述会话请求至少包括会话标识(会话ID)。
5、UE与DN进行二次认证。
具体的，基于所述会话请求，UE通过SMF与DN进行二次认证，如认证通过，则认证结果为正确，若认证不通过，则认证结果为错误，SMF可获得所述认证结果。
需要说明的是，本步骤为可选的步骤。
6、SMF将SMF响应信息发送至AMF。
具体的，SMF生成SMF响应信息。
其中，所述SMF响应信息可以包括网络侧预设置的安全需求，例如，包括UDM反馈的UE注册信息、或者UDM反馈的签约业务数据，或者AF反馈的业务安全需求等等，以便AMF获得所述SMF响应信息后可进一步根据SMF响应信息中的安全需求确定用户面保护机制。
此外，所述SMF响应信息还可以包括UE与数据网络DN二次认证的认证结果，例如，基于所述会话请求，所述UE通过SMF与数据网络DN进行二次认证后，SMF将认证结果写入所述SMF响应信息中，再将SMF响应信息发送至AMF，AMF获知认证结果后，如果发现认证结果为正确(即通过认证)，那么将执行后面的确定用户面保护机制流程；如果发现认证结果为错误(即通过认证)，那么将不执行后面的确定用户面保护机制流程。
7、AMF确定用户面保护机制。
在本发明具体实施例中，AMF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，AMF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。另外，AMF也可能根据SMF响应信息(包括认证结果)，确定是否可以根据相关的安全需求(如AF反馈的业务安全)确定用户面保护机制，确定是否执行确定用户面保护机制的步骤等等。关于本实施例AMF确定用户面保护机制的详细内容还可参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
8、AMF将用户面保护机制发送至AN。
9、AN确定安全保护算法以及确定用户面保护密钥。
详细情况可参考图3实施例中步骤6的描述，这里不再赘述。
10、AN发送安全保护算法至UE，相应的，UE接收用户面安全保护算法。
11、UE根据用户面安全算法和K_AN生成用户面保护密钥。
详细情况可参考图3实施例中步骤8的描述，这里不再赘述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，AMF可以在步骤4之前确定用户面保护机制。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
还需要说明的是，图6实施例中没有详细描述的地方可参考图3实施例的相关描述，上述图4实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图6实施例与图3实施例的主要区别在于，AMF在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-AN完成策略协商，通过AMF确定用户面保护机制后，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-AN，从不区分粒度的角度描述本发明实施例提供的又一种密钥配置方法，如图7所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、UE通过AN、AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于UE和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
所述会话请求至少包括会话标识(会话ID)，可选的，所述会话请求还可能还包括用户设备标识(UE ID)、安全需求的指示信息(indicator)，或者DNN、业务ID、UE业务ID等。其中，所述用户设备标识(UE ID)，安全需求的指示信息(indicator)，或者DNN、 业务ID，UE业务ID可以是UE建立会话时被携带于会话请求中的。
5、可选的，UE与DN进行二次认证。
6、SMF确定用户面保护机制。
在本发明具体实施例中，SMF可根据ind icator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的一项，或者两项，或者三项，或者全部信息确定用户面保护机制。也就是说，SMF可根据用户设备侧所需要的安全需求、网络侧所预置的安全需求或者业务的安全需求综合确定用户面保护机制。具体的，SMF可以通过向UDM发送UE ID，业务ID，业务UE ID，或DNN的至少一项，从UDM获得UE注册信息。SMF可以通过向UDM发送UE ID，业务ID，业务UE ID，或DNN的至少一项，从UDM获得签约业务数据。SMF向PCF发送请求，PCF向AF发送请求，AF基于请求向PCF反馈业务安全需求，其中，所述请求可包括UE ID，业务ID，业务UE ID，或DNN的至少一项，PCF将所述业务安全需求发送给SMF，进而，SMF获得业务安全需求。所述业务安全需求用于指示业务需要什么样的用户面保护机制，例如指示业务是否需要加密，或者是否需要进行完整性保护，或者是否同时需要加密和完整性保护。
7、SMF将用户面保护机制发送至AMF，AMF将用户面保护机制发送至AN，相应的，AN接收所述用户面保护机制。
8、AN确定安全保护算法以及确定用户面保护密钥。
详细情况可参考图3实施例中步骤6的描述，这里不再赘述。
9、AN发送安全保护算法至UE，相应的，UE接收用户面安全保护算法。
10、UE根据用户面安全算法和K_AN生成用户面保护密钥。
详细情况可参考图3实施例中步骤8的描述，这里不再赘述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若SMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，SMF可以在步骤5之前确定用户面保护机制。
可能性3：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求至少包括会话标识(会话ID)，可选的，所述会话请求还可能还包括用户设备标识(UE ID)、安全需求的指示信息(indicator)，或者DNN、业务ID，UE业务ID等。所述用户设备标识(UE ID)、安全需求的指示信息(indicator)，或者DNN、业务ID，UE业务ID可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性4：SMF确定用户面保护机制的方法，可以参考图3实施例中AMF确定用户面保护机制的方法。
可能性5：AN和UE推衍用户面保护密钥的方法，也可以基于图12的方法，包括基于session ID，切片ID，flow ID，或者DRB ID的方法。其中DRB ID为AN选择后，发送给UE。
还需要说明的是，图7实施例中没有详细描述的地方可参考图3实施例的相关描述，上 述图7实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图7实施例与图3实施例的主要区别在于，SMF在会话建立流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-AN完成策略协商，通过SMF确定用户面保护机制后，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-CN，从不区分粒度的角度描述本发明实施例提供的一种密钥配置方法，如图8所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于附着请求中的UE ID执行与UE的认证，确定UE为合法用户。
4、AMF确定用户面保护机制。
在本发明具体实施例中，AMF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，AMF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。关于本实施例AMF确定用户面保护机制的详细内容可参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
5、AMF向SMF发送会话请求、用户面保护机制，相应的，SMF接收所述会话请求、用户面保护机制。
会话请求用于请求在于AMF和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。所述会话请求至少包括会话标识(会话ID)。
具体实现上，在一实施例中，所述用户面保护机制被携带于所述会话请求中，也就是说，AMF将会话请求发送至SMF，所述会话请求包括用户面保护机制。
在另一实施例中，AMF分别向SMF发送会话请求和用户面保护机制。
6、UE与DN进行二次认证。
7、SMF确定安全保护算法以及确定用户面保护密钥。
在一种具体实施例中，若用户面保护机制中仅包含是否加密/是否完整性保护的描述，则SMF确定UE-CN之间的用户面保护机制为是否需要加密、是否需要完整性保护，然后，SMF根据接收到的UE安全能力、UPF支持的算法优先级列表确定安全保护算法，其中，所 述UPF支持的算法优先级列表可以预置于SMF，也可以是预置于UPF中，SMF从UPF获取所述UPF支持的算法优先级列表。例如，当用户面保护机制为“需要加密+需要完整性保护”时，SMF根据UE安全能力、UPF支持的算法优先级列表、UE支持的算法确定加密算法为AES，完整性保护算法为AES。
在另一种具体实施例中，用户面保护机制直接制定了指定了安全保护算法，则SMF可从用户面保护机制直接获取安全保护算法。在步骤4中，在确定了用户面保护机制后，AMF可基于UPF支持的算法优先级列表、UE支持的算法和用户设备安全能力确定空口保护算法，其中，所述UPF支持的算法优先级列表可以预置于AMF，也可以是预置于UPF中，AMF从UPF获取所述UPF支持的算法优先级列表。例如，在“需要加密+需要完整性保护”的用户面保护机制下,AMF进一步确定加密算法为AES，完整性保护算法为AES，并在用户面保护机制中携带上述安全保护算法。在这种情况下，由于用户面保护机制直接指定了加密算法和完整性保护算法，所以SMF获得用户面保护机制后，可从用户面保护机制直接获取加密算法和完整性保护算法。
在可能的实施例中，在确定安全保护算法后，SMF可进一步确定用户面保护密钥，具体的：
用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,DRB ID)；
其中K_SMF为认证成功后，AMF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥。具体的，AMF发送K_SMF至SMF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至SMF。UP算法ID可以为加密算法ID，也可以为完整性保护算法ID。
8、SMF向UPF发送安全保护算法或用户面保护密钥，相应的，UPF接收安全保护算法或用户面保护密钥。
在可能的实施例中，如果UPF仅接收到安全保护算法，没有收到用户面保护密钥，则UPF可基于安全保护算法和K_SMF计算获得用户面保护密钥(可参考上述相关描述)，该用户面保护密钥即为UPF的用户面保护密钥。其中，K_SMF为认证成功后，AMF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，具体的，AMF发送K_SMF至UPF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UPF。
在可能的实施例中，如果UPF接收到用户面保护密钥，则将用户面保护密钥作为UPF的用户面保护密钥。
9、SMF向AMF发送安全保护算法。
需要说明的是，如果所述安全保护算法是SMF根据接收到的UE安全能力、UPF支持的算法优先级列表等确定的，那么SMF将向AMF发送安全保护算法；
可选的，SMF向AMF发送安全保护算法，具体为：SMF向AMF发送会话响应，所述会话响应中携带有安全保护算法。
需要说明的是，如果安全保护算法是AMF可基于UPF支持的算法优先级列表、UE支持的算法和用户设备安全能力等确定的，那么SMF就不需要向AMF发送安全保护算法。
10、AMF向AN发送安全保护算法、用户面保护机制，其中，用户面保护机制为可选。
11、AN向UE发送安全保护算法、用户面保护机制，其中，用户面保护机制为可选。
12、UE根据用户面安全算法、用户面保护机制和K_SMF生成用户面保护密钥。或者UE根据用户面安全算法和K_SMF生成用户面保护密钥。
在可能的实施例中，在收到安全保护算法后，UE可进一步确定用户面保护密钥，该用户面保护密钥即为UE的用户面保护密钥，具体的：
用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,DRB ID)；
或者在上述推衍函数输入中添加用户面保护机制参数。其中，K_SMF为认证成功后，UE根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，具体的，AMF发送K_SMF至UE；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UE。UP算法ID可以为加密算法ID，也可以为完整性保护算法ID。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，步骤8和步骤9可以同时进行，步骤8也可以放在步骤9之前或者之后。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
可能性4：若用户面保护机制包括具体安全保护算法，那么AMF也可以通过SMF发送用户面保护机制至UPF，UPF获取用户面保护机制中的安全保护算法。
可能性5：若用户面保护机制中未包含安全保护算法，那么步骤7-步骤12还可以通过以下方式实现安全保护：
(替换步骤7、8)SMF计算第一K_UP，K_UP＝KDF(K_SMF,会话ID)；或者K_UP＝KDF(K_SMF,QoS flow ID)；
(替换步骤9)SMF发送会话ID，QFI和用户面保护机制至AMF。
(替换步骤10)AMF发送会话ID，QFI和用户面保护机制至AN；
(替换步骤11)AN发送会话ID，QFI和用户面保护机制至UE；
(替换步骤12)UE基于K_SMF生成第二K_UP。K_SMF为认证成功后，UE根据认证后密钥，或认证后再次推衍得到的密钥，推衍出的密钥。
(增加步骤13)UPF与UE基于会话ID，QFI和用户面保护机制协商安全保护算法，再分别基于第一K_UP和第二K_UP生成UPF的用户面保护密钥和UE的用户面保护密钥。
还需要说明的是，图8实施例中没有详细描述的地方可参考图3实施例的相关描述， 上述图8实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图8实施例与图3实施例的主要区别在于，在UE-CN的应用场景中，AMF在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成策略协商，通过AMF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
下面基于UE-CN，从不区分粒度的角度描述本发明实施例提供的一种密钥配置方法，如图9所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于附着请求中的UE ID执行与UE的认证，确定UE为合法用户。
4、AUSF确定用户面保护机制。
在本发明具体实施例中，AUSF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，AUSF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。关于本实施例AUSF确定用户面保护机制的详细内容可参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
5、AUSF向SMF发送用户面保护机制，相应的，SMF接收所述用户面保护机制。
6、AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于AMF和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。所述会话请求至少包括会话标识(会话ID)。
7、可选的，UE与DN进行二次认证。
8、SMF确定安全保护算法以及确定用户面保护密钥。
详细内容可参考图8实施例步骤7的相关描述。
9、SMF向UPF发送安全保护算法、用户面保护密钥，相应的，UPF接收安全保护算法、用户面保护密钥。其中，安全保护算法为可选。
10、SMF向AMF发送安全保护算法、用户面保护机制。其中，用户面保护机制为可选。
11、AMF向AN发送安全保护算法、用户面保护机制。其中，用户面保护机制为可选。
12、AN向UE发送安全保护算法、用户面保护机制。其中，用户面保护机制为可选。
13、UE根据用户面安全算法、用户面保护机制和K_SMF生成用户面保护密钥。或者，UE根据用户面安全算法和K_SMF生成用户面保护密钥。
本实施例中没有详细描述的地方可参考图8实施例的相关描述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，步骤9和步骤10可以同时进行，步骤8也可以放在步骤9之前或者之后。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
可能性4：若用户面保护机制包括具体安全保护算法，那么AUSF也可通过SMF发送用户面保护机制至UPF，UPF获取用户面保护机制中的安全保护算法。
可能性5：若用户面保护机制中未包含安全保护算法，那么步骤7-步骤12还可以通过以下方式实现安全保护：
(替换步骤8和9)SMF发送会话ID，QFI，以及用户面保护密钥至UPF；此外，UPF还获取第一K_SMF，其中，其中第一K_SMF为认证成功后，AMF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥。具体的，AMF发送K_SMF至UPF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UPF。
(替换步骤10)SMF发送会话ID，QFI和用户面保护机制至AMF；
(替换步骤11)AMF发送会话ID，QFI和用户面保护机制至AN；
(替换步骤12)AN发送会话ID，QFI和用户面保护机制至UE；
(替换步骤13)UPF与UE基于会话ID，QFI和用户面保护机制协商安全保护算法，再分别基于第一K_SMF和第二K_SMF生成UPF的用户面保护密钥和UE的用户面保护密钥。其中，其中第二K_SMF为认证成功后，AMF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥。具体的，AMF发送K_SMF至UE；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UE。
还需要说明的是，图8实施例中没有详细描述的地方可参考图3实施例的相关描述，上述图8实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图9实施例与图8实施例的主要区别在于，AUSF在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成策略协商，通过AUSF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
下面基于UE-CN，从不区分粒度的角度描述本发明实施例提供的一种密钥配置方法，如图10所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE发送附着请求(attach request)至AN，AN再发送所述附着请求至AMF，AMF再发送UE ID至AUSF。
本发明实施例中，其中，所述附着请求包括用户设备标识(UE ID)，用户设备安全能力，安全需求的指示信息(indicator)；此外，所述附着请求还可以包括业务ID、UE业务ID和DNN。
在一具体的实施例中，AMF识别出附着请求中的UE ID，并将UE ID发送至AUSF；在另一具体实施例中，AMF将认证请求直接发送至AUSF，所述AUSF接收到认证请求后识别所述认证请求中的UE ID，其中，所述认证请求包括UE ID。
AUSF基于附着请求中的UE ID执行与UE的认证，确定UE为合法用户。
4、AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于UE和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
所述会话请求至少包括会话标识(会话ID)，可选的，所述会话请求还可能还包括用户设备标识(UE ID)、安全需求的指示信息(indicator)，或者DNN、业务ID、UE业务ID等。其中，所述用户设备标识(UE ID)，安全需求的指示信息(indicator)，或者DNN、业务ID，UE业务ID可以是UE建立会话时被携带于会话请求中的。
5、可选的，UE与DN进行二次认证。
6、SMF确定用户面保护机制。
在本发明具体实施例中，SMF可根据indicator(用户设备安全需求和/或业务安全需求)、UE注册信息、签约业务数据和AF反馈的业务安全需求中的至少一项确定用户面保护机制。也就是说，SMF可根据用户设备侧所需要的安全需求和网络侧所预置的安全需求或业务安全需求综合确定用户面保护机制。关于SMF确定用户面保护机制的详细内容可类似地参考图3实施例中AMF确定用户面保护机制的相关内容描述，这里不再赘述。
7、SMF确定安全保护算法以及确定用户面保护密钥。
详细内容可参考图8实施例步骤7的描述。
8、SMF向UPF发送安全保护算法或用户面保护密钥，相应的，UPF接收安全保护算法或用户面保护密钥。
9、SMF向AMF发送安全保护算法。
10、AMF向AN发送安全保护算法、用户面保护机制。其中用户面保护机制可选。
11、A N向UE发送安全保护算法、用户面保护机制。其中用户面保护机制可选。
12、UE根据用户面安全算法、用户面保护机制和K_SMF生成用户面保护密钥。或者，UE根据用户面安全算法和K_SMF生成用户面保护密钥。
需要说明的是，本实施例中没有详细描述的地方可参考图8实施例的相关描述.
还需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若SMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，SMF可以在步骤5之前确定用户面保护机制。例如，步骤8和步骤9可以同时进行，步骤8也可以放在步骤9之前或者之后。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
可能性4：若用户面保护机制包括具体安全保护算法，那么SMF也可以发送用户面保护机制至UPF，进而，UPF获取用户面保护机制中的安全保护算法。
图10实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图10实施例与图8实施例的主要区别在于，SMF在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成策略协商，通过SMF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
下面基于UE-AN，从区分粒度的角度描述本发明实施例提供的一种基于flow的密钥配置方法，如图11所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于UE和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
5、SMF向PCF发送策略请求。
在本发明实施例中，策略控制的功能部署在PCF中，SMF向PCF发送策略请求，以便于PCF根据策略请求确定相应的用户面保护机制。具体的，所述策略请求至少包括会话标识(会话ID)，可能还包括用户设备标识(UE ID)、安全需求的指示信息(indicator)、用户设备安全能力、业务ID、UE业务ID、DNN。其中，所述安全需求的指示信息(indicator)用于指示所述设备安全需求和/或业务安全需求；其中，所述会话ID、UE ID、indicator、用户设备安全能力、业务ID、UE业务ID、DNN可以是SMF从所接收到的会话请求中获取到的；其中：
具体的，会话标识(会话ID)用于识别会话的身份，会话具有唯一的会话标识。可选的，会话标识可以是UE、AN、AMF、SMF中的任意一种生成的。其中，当会话标识是UE生成时，会话标识在UE准备新建会话时生成；当会话标识是AN、AMF、SMF中的任意一种生成时，会话标识在AN、AMF、SMF中任意一种接收到其他网元发送的请求时生成。例如，SMF接收到从AN发送过来的会话请求时，基于会话请求生成会话ID。
另外，会话标识可以是新建的标识，也可以复用其他的标识，例如，已有的会话标识、空口标识、无线承载标识、切片标识、空口资源标识、设备永久标识、设备临时标识、用 户永久标识、用户临时标识等等中的任意一种。
具体的，用户设备标识(UE ID)用于表征发出会话请求的用户设备的身份。例如：UEID可以是媒体访问控制(Media Access Control，MAC)地址、网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、临时移动用户标识符(Temporary Mobile Subscriber Identity，TMSI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等中的一项或多项。
具体的，用户设备安全能力用于表征用户设备可以支持的安全保护算法、可以支持的密钥长度、可以支持的密钥更新周期等。可以理解的是，不同用户设备的存储容量，运算速度各不相同，所以，不同用户设备支持的安全保护算法、支持的密钥长度以及支持的密钥更新周期各不相同。例如，物联网(Internet of Things，IoT)设备的存储容量不大，运算速度也不高，不能支持复杂度较高的安全保护算法；智能手机的存储容量大，运算速度也比较高，可以支持复杂度较高的安全保护算法。故此，用户设备需要将所述用户设备安全能力告知PCF，以便于PCF结合用户设备安全能力确定用户面保护机制。
具体的，设备安全需求用于指示所述用户设备的所需要的安全需求，也就是说，所述设备安全需求用于向PCF指示UE需要怎么样的用户面保护机制，例如，指示“需要加密+不需要完整性保护”；或者“需要加密+不需要完整性保护”；或者“需要加密+需要完整性保护”等等，还可以指示UE所需要的安全保护算法、UE可接受的密钥长度、UE可接受的密钥更新周期等。
具体的，业务安全需求用于表征业务可接受的安全性算法、可接受的密钥长度和可接受的密钥更新周期中至少一项。可以理解的是，不同业务对于安全性算法、密钥长度以及密钥更新周期的要求是不相同的。例如，金融业务对于安全性算法的要求比较高，而视频下载业务对于安全性算法的要求比较低。故此，第一设备需要将业务安全需求告知PCF，以便于PCF结合业务安全需求生成用户面保护机制。
6、PCF确定用户面保护机制。
在本发明具体实施例中，PCF可通过多种方式确定用户面保护机制。具体的，PCF可根据策略请求、UE注册信息、签约业务数据、AF反馈的业务安全需求中的至少一项确定用户面保护机制，即，PCF可根据indicator、业务安全需求、UE注册信息、签约业务数据、AF反馈的业务安全需求中的至少一项确定用户面保护机制。
其中，所述注册信息预置于UDM中，PCF从UDM获得所述UE注册信息。例如，PCF发送策略请求中的UE ID至UDM，进而从UDM获得的UE注册信息。所述UE注册信息包括预置的UE安全需求。所述UE安全需求用于表示UE是否需要加密，或者UE是否需要进行完整性保护，或者UE是否同时需要加密和完整性保护。SMF也可以将UE注册信息发送至PCF，此时SMF通过向UDM发送UE ID，进而获得UE注册信息。
其中，所述签约业务数据预置于UDM中，PCF从UDM获得所述签约业务数。例如，PC发送策略请求中的业务ID至UDM，或者发送策略请求中的DNN至UDM；UDM基于业务ID或 DNN确认其中预置的签约业务数据，并将相关的签约业务数据发送至PCF。或者PCF发送策略请求中的UEID和业务ID至UDM，或者发送策略请求中的UE ID和DNN至UDM；UDM基于UE ID和业务ID，或UE ID和DNN确认其中预置的签约业务数据，并将相关的签约业务数据发送至PCF。也可能，在上述基础上，PCF将业务UE ID发送至UDM，以使UDM进行判断。其中，所述签约业务数据包括预置的业务安全需求，所述预置的业务安全需求用于指示业务需要什么样的用户面保护机制，例如指示业务是否需要加密，或者业务是否需要进行完整性保护，或者业务是否同时需要加密和完整性保护。
其中，所述AF反馈的业务安全需求预置于AF中，具体的，PCF向AF发送请求，AF基于请求向PCF反馈业务安全需求，其中，所述请求可包括UE ID，业务ID，业务UE ID，或DNN的至少一项。所述AF反馈的业务安全需求用于指示业务需要什么样的用户面保护机制，例如指示业务是否需要加密，或者是否需要进行完整性保护，或者是否同时需要加密和完整性保护。
在本发明实施例中，所述用户面保护机制用于指示用户面数据传输的保护方式，例如指示UE是否需要对用户面数据进行加密和/或完整性保护。用户面保护机制可以为“需要加密+不需要完整性保护”；或者为“需要加密+不需要完整性保护”；或者为“需要加密+需要完整性保护”。另外，本发明具体实施例中，所述用户面保护机制还可用于指示安全保护算法、UE可接受的密钥长度、UE可接受的密钥更新周期等。
具体的，在本发明实施例的具体实现中，用户面保护机制可以是服务数据流安全机制(Service Data Flow Security Protection，SDFSP。以下将以用户面保护机制为SDFSP为例进行阐述。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制(SDFSP)。
在一具体实施例中，PCF直接向SMF发送SDFSP。
在另一具体实施例中，PCF将SDFSP封装在特定参数中，并将特定参数发送至SMF。例如，PCF将SDFSP封装在PCC rule中，PCF向SMF发送PCC rule，相应的，SMF获取所述PCC rule后，从PCC rule中获取SDFSP。
8、SMF基于用户面保护机制(SDFSP)确定QoS flow保护机制。
本发明实施例中，当用户面数据需要采用QoS flow传输通道进行数据传输时，为了获得基于QoS flow的安全机制(细粒度)，SMF需要确定该用户面数据对应的QoS flow(QFI)，进而需要确定该QoS flow对应的安全机制，后文将此QoS flow对应的安全机制称为QFI安全机制(QFI security protection)，简称为QFISP，其中QFI为QoS flow ID。
可选的，SMF可根据SDFSP需求和PCC rule中QoS需求确定QoS flow，其中，所述SDFSP需求为用户面保护机制所涉及的安全需求，所述QoS需求为对通信网络中时延、带宽、差错率等服务质量参数的需求。
可选的，SMF可根据SDFSP需求确定QoS flow，其中，所述SDFSP需求为用户面保护机制所涉及的安全需求。
在具体的实现中，在通信架构中预设有QoS flow通道，例如预设的QoS flow通道对应的标识为QoS flow ID1，QoS flow ID2，QoS flow ID3，QoS flow ID4。那么，(1)SMF 可能根据SDFSP需求和PCC rule中QoS需求确定已有的QoS flow来传输用户面数据，例如选择QoS flow ID2；(2)SMF也可能根据SDFSP需求和PCC rule中QoS需求发现不能采用QoS flow ID1或QoS flow ID2或QoS flow ID3或QoS flow ID4来传输用户面数据，故需要新建一个QoS flow通道，例如生成QoS flow ID5来传输用户面数据。仅根据SDFSP选择QoS flow的方式与上述类似。
需要说明的是，对于用户面数据为服务数据流(Service Data Flow，SDF)，如果不同的SDF具有相同的安全需求，那么可对具有相同的安全需求的SDF采用同一套QFISP进行安全保护。例如QoS flow包括SDF1和SDF2，SDF1对应的SDFSP1和SDF2对应的SDFSP2都是仅支持加密/不需要完整性保护。此时QoS flow的数据可以采用一套QFISP进行保护。此时QFISP与SDFSP相同。
可以理解的，SDFSP可以包括多种QFISP。例如，对于通信系统中四种服务数据流SDF1、SDF2、SDF3、SDF4，具有相同安全需求的SDF1、SDF2采用QFISP1(对应QoS flow ID1)作为安全机制，具有相同安全需求的SDF3、SDF4采用QFISP2(对应QoS flow ID2)作为安全机制。
还可以理解的，当所有的服务数据流都具有相同安全需求时(例如SDF1、SDF2、SDF3、SDF4具有相同安全需求时)，这些服务数据流对应的QFISP等同于SDFSP。
可选的，SMF可仅根据SDFSP需求进行QoS flow的选择，确定QoS flow，若存在满足SDFSP需求的QoS flow ID，则使用此QoS flow ID对应的QoS flow；否则重新生成QoS flow。
在具体的实施例中，在确定与用户面数据对应的QFISP后，SMF生成QoS rule，所述QoS rule中包括该QFISP。其中，QoS rule是一种参数，该参数用于向UE提供用户面数据对应的QFISP。
在具体的实施例中，在确定与用户面数据对应的QFISP后，SMF生成QoS profile，所述QoS profile中包括该QFISP。其中，QoS profile是一种参数，该参数用于向AN提供用户面数据对应的QFISP。
9、SMF通过AMF向AN发送QoS flow保护机制(QFISP)、QoS flow ID。
其中，在一具体实施例中，SMF通过AMF向AN直接发送QFISP、QoS flow ID。
在另一具体实施例中，SMF通过AMF向AN发送QoS rule、QoS profile和QoS flow ID。
其中QoS profile中包含QFISP。
可选的，SMF还可通过AMF向AN发送会话ID。
10、AN确定安全保护算法以及保护密钥。
具体的，AN根据QoS profile，建立会话ID和QoS flow ID至DRB的映射。AN在选择DRB时，可将具有相同的安全保护需求的QoS flow映射到同一个DRB。那么，AN可以通过确定DRB ID，确定此DRB内数据(即具有相同DRB ID的数据)的用户面保护机制相同。可选的，AN在确定用户面保护机制后，就可以采用密钥对用户面数据进行加密或者完整性保护。
在一种具体实施例中，若QFISP为是否加密/是否完整性保护，且QFISP不直接指定安全保护算法，那么，AN根据UE安全能力，AN支持的算法优先级列表和用户面保护机制确定安全保护算法，例如，当用户面保护机制为“需要加密+需要完整性保护”时，AN根据 UE安全能力，AN支持的算法优先级列表确定加密算法为AES，完整性保护算法为AES。
又例如，若不需要加密，则加密算法为空。若不需要完整性保护，则完整性保护算法为空。
在另一种具体实施例中，若QFISP为是否加密/是否完整性保护，且QFISP直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则AN可从QFISP中直接获取安全保护算法。例如在步骤6中，在确定了用户面保护机制后，PCF可获取AN支持的算法优先级列表，并基于AN支持的算法优先级列表以及UE支持的算法和用户设备安全能力确定空口保护算法，例如，在“需要加密+需要完整性保护”的用户面保护机制下,PCF进一步确定加密算法为AES，完整性保护算法为AES，并在用户面保护机制中携带上述安全保护算法。在这种情况下，由于用户面保护机制(QFISP)直接指定了加密算法和完整性保护算法，所以AN获得QFISP后，可从QFISP直接获取加密算法和完整性保护算法。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRBID)；
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，flow ID)；
其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥(K_AN又可称为中间密钥)，AMF发送K_AN至AN；UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；所述加密算法ID用于指示对应的加密算法，所述完整性保护算法ID用于指示对应的完整性保护算法。
11、AN向UE发送会话ID，QoS flow ID，安全保护算法，QoS flow保护机制(QFISP)。
其中，所述QFISP可以是携带于Qos rule中发送至UE的。
另外，QoS flow保护机制为可选。
12、UE确定用户面保护密钥。
具体的，UE获取会话ID，QFI，用户面安全算法和K_AN，并相应生成用户面保护密钥，其中，K_AN为认证成功后，UE根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥。
具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRBID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，flow ID)；
其中，UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；KDF为密钥推衍 函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
可以理解的，在具体应用场景实施用户面保护机制过程中，所述第一空口用户面保护密钥和第二空口用户面保护密钥可以是相同的密钥。在上行传输中，UE可基于第二空口用户面保护密钥对用户面数据进行加密性保护和/或进行完整性保护，AN接收到UE发送的上述用户面数据后，基于第一空口用户面保护密钥对用户面数据解密和/或完整性检验。在下行传输中，AN基于第一空口用户面保护密钥对用户面数据进行加密性保护和/或进行完整性保护，UE接收到AN发送的上述用户面数据后，基于第二空口用户面保护密钥对用户面数据解密和/或完整性检验。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：在可能的实施例中，步骤7和步骤8的内容可以替换为：PCF直接确定QoS flow保护机制，将QoS flow保护机制发送至SMF。
可能性3：flow ID和session ID可能是在SMF发送策略请求前生成的。
还需要说明的是，上述图11实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，实施本发明实施例，可实现基于未来5G的通信架构，在会话建立的相关流程中，UE-AN完成基于flow传输通道粒度的策略协商，通过PCF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
为了便于理解本发明实施例的方案，下面基于UE-AN，举例说明用户面数据在上行传输和下行传输过程中，应用上述图11基于flow的密钥配置方法的一些操作流程，具体描述如下：
(1)用户面数据基于flow的密钥配置方法的上行传输过程。
在UE侧，当用户面数据需要进行上行传输时，UE根据用户数据确定会话ID，进而确认QoS flow ID。例如，UE确定上行用户数据(IP packet)采用会话ID1(PDU session1)，进而确认QFI为QoS flow ID1，那么，通过UE-AN基于图11所示方法流程的协商，UE确定QoS flow ID1所对应安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法；所以，UE基于加密算法和完整性保护算法采用相应保护密钥执行用户面数据的安全保护。
在AN侧，AN根据空口标识RB ID1(或DRB ID1)确认QoS flow ID1，那么，通过UE-AN基于图11所示方法流程的协商，UE确定QoS flow ID1所对应安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法，在AN获取到UE上传的用户面数据后， 可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。需要说明的是，AN可以直接根据协议栈中QFI确定安全保护机制，或者UE根据空口协议栈中marking确定QFI，再确定安全机制。
(2)用户面数据基于flow的密钥配置方法的下行传输过程。
在AN侧，AN需要将用户面数据进行下行传输时，AN可根据QFI基于图11所示方法流程确认安全保护机制，例如确定QFI为QoS flow ID3，确定QoS flow ID3对应空口标识RB ID3(DRB ID3)，进而确定QoS flow ID3对应的安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
在UE侧，UE根据DRB ID3确认QFI为QoS flow ID3，AN可根据QFI基于图11所示方法流程确认QoS flow ID3对应的安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。需要说明的是，UE也可以直接根据协议栈中QFI确定安全保护机制，或者UE根据空口协议栈中marking确定QFI，再确定安全机制。
下面基于UE-AN，从区分粒度的角度描述本发明实施例提供的一种基于DRB的密钥配置方法，如图12所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
本发明实施例中，其中，所述附着请求至少包括用户设备标识(UE ID)。此外，可选的，所述附着请求还可以包括业务ID，UE业务ID，或者DNN，可选的，所述附着请求还可以包括安全需求的指示信息(indicator)。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
5、SMF向PCF发送策略请求。
6、PCF确定用户面保护机制。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制(SDFSP)。
8、SMF基于用户面保护机制(SDFSP)确定QoS flow保护机制。
9、SMF通过AMF向AN发送QoS flow保护机制(QFISP)、QoS flow ID。
其中，在一具体实施例中，SMF通过AMF向AN直接发送QFISP；
在另一具体实施例中，SMF通过AMF向AN发送QoS rule和QoS profile。所述QoS rule中包括该QFISP，QoS rule用于向UE提供用户面数据对应的QFISP。所述QoS profile中包括该QFISP，QoS profile用于向AN提供用户面数据对应的QFISP。
可选的，SMF还可通过AMF向AN发送会话ID。
10、AN确定DRB，以及确定DRB保护机制。
本发明实施例中，用户面数据可以基于DRB实现数据传输中的安全保护机制。
具体的，为了获得基于DRB的安全保护机制(细粒度)，AN需要确定QoS flow对应的DRB，建立会话ID和QoS flow ID至DRB ID的映射，进而需要确定该DRB ID对应的安全 机制，后文将DRB ID对应的安全机制称为DRB安全机制(DRB security protection)，简称为DRBSP。
可选的，AN可根据QFISP需求和QoS的需求确定DRB ID，所述DRB ID既需满足QoS profile中对于QoS的需求，同时满足QFISP需求。其中，所述QFISP需求为QoS flow所涉及的安全需求(例如，仅加密，不需要完整性保护)，所述QoS的需求为对通信网络中时延、带宽、差错率等服务质量参数的需求。
可选的，AN可根据QFISP需求确定DRB ID，所述DRB ID需满足QFISP需求。
在具体的实现中，在通信架构中预设有DRB通道，例如预设的DRB通道对应的标识为DRB ID1，DRB ID2，DRB ID3，DRB ID4。那么，(1)SMF可能根据QFISP需求和profile中对于QoS的需求确定已有的DRB来承载QoS flow或用户面数据，例如选择DRB ID1；(2)SMF也可能根据QFISP需求和profile中对于QoS的需求发现不能采用DRB ID1或DRB ID2或DRB ID3或DRB ID4来承载QoS flow或用户面数据，故需要新建一个DRB通道，例如生成DRB ID5来承载QoS flow或用户面数据。
需要说明的是，如果不同QoS flow(或不同的SDF)具有相同的安全需求，那么可对具有相同的安全需求的QoS flow采用同一套DRBSP进行安全保护。例如DRB包括QoS flow1和QoS flow2，QoS flow1对应的QFISP1和QoS flow2对应的QFISP2都是仅支持加密/不需要完整性保护。此时DRB承载的数据可以采用一套DRBSP进行保护。
可以理解的，不同的DRB可具有不同的DRBSP。例如，对于通信系统中四种服务数据流QoS flow1、QoS flow2、QoS flow3、QoS flow4，具有相同安全需求的QoS flow1、QoS flow2采用DRBSP1(对应DRB ID1)作为安全机制，具有相同安全需求的QoS flow3、QoS flow4采用DRBSP2(对应DRB ID2)作为安全机制。
可选的，AN可仅根据QFISP需求进行DRB ID的选择，确定DRB，若存在满足QFISP需求的DRB ID，则使用此DRB ID对应的DRB；否则重新生成DRB。
11、AN确定安全保护算法以及用户面保护密钥。
在一种具体实施例中，若DRBSP为是否加密/是否完整性保护，且DRBSP不直接指定安全保护算法，那么，AN根据UE安全能力，AN支持的算法优先级列表和用户面保护机制确定安全保护算法例如，DRBSP要求加密，但不要求完整性保护，另外，UE安全能力支持AES加密/ZUC加密，但AN支持AES加密为第一优先级，则AN选择加密算法AES，完整性保护算法为空算法。
在另一种具体实施例中，若DRBSP为是否加密/是否完整性保护，且DRBSP直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则AN可从DRBSP中直接获取安全保护算法。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，flow ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，DRB ID)，
其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF发送K_AN至AN；UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；所述加密算法ID用于指示对应的加密算法，所述完整性保护算法ID用于指示对应的完整性保护算法。
12、AN向UE发送会话ID，QoS flow ID，安全保护算法，QoS flow保护机制(QFISP)，DRB保护机制(DRBSP)。
其中，所述QFISP和/或DRBSP可以是携带于Qos rule中发送至UE的。
其中，QFISP为可选。
其中，DRBSP为可选。
13、UE确定用户面保护密钥。
UE获取会话ID，QFI，用户面安全算法，QFISP，DRBSP和K_AN，并相应生成用户面保护密钥；
或者UE获取会话ID，QFI和用户面安全算法。UE根据获取的会话ID，QFI，用户面安全算法和K_AN生成用户面保护密钥。
具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，flow ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID，DRB ID)。
其中，K_AN为认证成功后，UE根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
需要说明的是，对于图13实施例中没有详细描述的步骤，可以参考图11实施例中的相关描述。上述图12实施例仅作为一种示例，不应视为对本发明的限制。
还需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：在可能的实施例中，步骤7和步骤8的内容可以替换为：PCF直接确定QoS flow保护机制，将QoS flow保护机制发送至SMF。
可能性3：flow ID和session ID可能是在SMF发送策略请求前生成的。
可以看出，图12实施例和图11实施例区别在于，UE-AN之间采用基于DRB传输通道粒度进行策略协商。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立的相关流程中，UE-AN完成基于DRB传输通道粒度的策略协商，通过PCF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-AN，举例简单说明用户面数据在上行传输和下行传输过程中，应用上述图12基于DRB的密钥配置方法的一些操作流程，描述如下：
(1)用户面数据基于DRB的密钥配置方法的上行传输过程。
在UE侧，UE根据用户数据确定会话ID，进而确认QFI，以及DRB ID，根据DRB ID进一步确定安全保护机制(DRBSP)，在确定了加密算法和完整性保护算法后，采用相应的用户面保护密钥执行用户面数据的安全性保护。
在AN侧，AN根据DRB ID确认，确定对应的安全保护机制(DRBSP)，)，获得安全保护算法，包括加密算法和完整性保护算法，在AN获取到UE上传的用户面数据后，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
(2)用户面数据基于DRB的密钥配置方法的下行传输过程。
在AN侧，AN需要将用户面数据进行下行传输时，AN根据QFI确认DRB，之后确定DRB对应安全保护机制(DRBSP)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
在UE侧，UE根据DRB ID确认，对应安全保护机制(DRBSP)，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
下面基于UE-AN，从区分粒度的角度描述本发明实施例提供的一种基于session的密钥配置方法，如图13所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
本发明实施例中，其中，所述附着请求至少包括用户设备标识(UE ID)。此外，可选的，所述附着请求还可以包括业务ID，UE业务ID，或者DNN，可选的，所述附着请求还可以包括安全需求的指示信息(indicator)。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
5、SMF向PCF发送策略请求。
6、PCF确定用户面保护机制。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制 (SDFSP)。
8、SMF确定会话保护机制。
本发明实施例中，当用户面数据需要采用session传输通道或者DRB传输通道或者QoSflow传输通道进行数据传输时，还可以基于session实现数据传输中的安全保护机制。
具体的，SMF可基于不同PCC rule中SDFSP确定会话保护机制。或者SMF直接从PCF处接收到会话保护机制。
9、SMF通过AMF向AN发送QFISP、会话保护机制、QoS flow ID。
其中，在一具体实施例中，SMF通过AMF向AN直接发送会话ID，会话保护机制、QoS flow ID；
在另一具体实施例中，SMF通过AMF向AN发送QoS rule、QoS profile、QoS flow ID。所述QoS rule中包括会话保护机制，QoS rule用于向UE提供用户面数据对应的会话保护机制。所述QoS profile中包括该会话保护机制，QoS profile用于向AN提供用户面数据对应的会话保护机制。
可选的，SMF还可通过AMF向AN发送会话ID。
10、AN确定确定安全保护算法以及用户面保护密钥。
在一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制不直接指定安全保护算法，那么，AN根据UE安全能力，AN支持的算法优先级列表和用户面保护机制确定安全保护算法。例如，会话保护机制要求加密，但不要求完整性保护，另外，UE安全能力支持AES加密/ZUC加密，但AN支持AES加密为第一优先级，则AN选择加密算法AES，完整性保护算法为空算法。
在另一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则AN可从会话保护机制中直接获取安全保护算法。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，KDF(K_SMF,UP算法ID,session ID)，
或者，KDF(K_SMF,UP算法ID,DRB ID)；
其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF发送K_AN至AN；UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。
11、AN向UE发送会话ID，QoS flow ID，安全保护算法，会话保护机制。
其中，所述会话保护机制可以是携带于Qos rule中发送至UE的。
另外，会话保护机制为可选。
12、UE确定保护密钥。
UE获取会话ID，QFI，用户面安全算法，会话保护机制和K_AN，并相应生成用户面保护密钥；
具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第二空口用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，第二空口用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)，
或者，第二空口用户面保护密钥＝KDF(K_SMF,UP算法ID,DRB ID)；
其中，其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，UE发送K_AN至UE。；UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
需要说明的是，对于图13实施例中没有详细描述的步骤，可以参考图11实施例中的相关描述。上述图13实施例仅作为一种示例，不应视为对本发明的限制。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：flow ID和session ID可能是在SMF发送策略请求前生成的。
可以看出，图13实施例和图11实施例区别在于，UE-AN之间采用基于PDU session传输通道粒度进行策略协商。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立的相关流程中，UE-AN完成基于PDU session传输通道粒度的策略协商，通过PCF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
为了便于理解本发明实施例的方案，下面基于UE-AN，举例说明用户面数据在上行传输和下行传输过程中，应用上述图13基于session的密钥配置方法的一些操作流程，具体描述如下：
(1)用户面数据基于session的密钥配置方法的上行传输过程。
在UE侧，UE根据用户数据确定会话ID，进而确认会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法；所以，UE基于加密算法和完整性保护算法采用相应保护密钥执行用户面数据的安全保护。
在AN侧，AN根据DRB ID确认QoS flow ID，进而确认会话ID，最终确定会话ID对 应安全保护机制(会话保护机制)，在AN获取到UE上传的用户面数据后，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。或者，根据DRB ID直接确定会话ID；或者AN根据协议栈的QFI，或者根据协议栈中marking确定QFI。
(2)用户面数据基于session的密钥配置方法的下行传输过程。
在AN侧，AN需要将用户面数据进行下行传输时，AN根据QFI确认会话ID，进而确认安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。或者，根据DRB ID直接确定会话ID；或者，根据协议栈中会话ID，确认安全保护机制(会话保护机制)。在UE侧，UE根据DRB ID确认QoS flow ID，进而确认会话ID，最终确定会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
下面基于UE-CN，从区分粒度的角度描述本发明实施例提供的一种基于flow的密钥配置方法，如图14所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
会话请求用于请求在于UE和SMF之间建立会话。例如，如果会话是通过会话建立协议建立的，那么，所述会话请求即为会话建立请求信令。
5、SMF向PCF发送策略请求。
可参考图11实施例步骤5的描述，这里不再赘述。
6、PCF确定用户面保护机制。
可参考图11实施例步骤6的描述，这里不再赘述。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制(SDFSP)。
可参考图11实施例步骤7的描述，这里不再赘述。
8、SMF基于用户面保护机制(SDFSP)确定QoS flow保护机制(QFISP)。
可参考图11实施例步骤8的描述，这里不再赘述。
9、所述SMF确定安全保护算法，确定用户面保护密钥。
在一种具体实施例中，若QFISP为是否加密/是否完整性保护，且QFISP不直接指定安全保护算法，那么，SMF根据UE安全能力、UPF支持的算法优先级列表、QFISP确定安全保护算法，其中，所述UPF支持的算法优先级列表可以预置于SMF，也可以是预置于UPF中，SMF从UPF获取所述UPF支持的算法优先级列表。例如，当用户面保护机制为“需要加密+需要完整性保护”时，SMF根据UE安全能力、UPF支持的算法优先级列表、UE支持的算法确定加密算法为AES，完整性保护算法为AES。若不需要加密，则加密算法为空。若不需要完整性保护，则完整性保护算法为空。
在另一种具体实施例中，若QFISP为是否加密/是否完整性保护，且QFISP直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则SMF可从QFISP中直接获取安全 保护算法。例如在步骤6中，在确定了用户面保护机制后，PCF可获取UPF支持的算法优先级列表，其中，所述UPF支持的算法优先级列表可以预置于AMF，也可以是预置于UPF中，AMF从UPF获取所述UPF支持的算法优先级列表。PCF基于UE安全能力、UPF支持的算法优先级列表、QFISP确定空口保护算法，例如，在“需要加密+需要完整性保护”的用QFISP下,PCF进一步确定加密算法为AES，完整性保护算法为AES，并在QFISP中携带上述安全保护算法。在这种情况下，用户面保护机制(QFISP)直接指定了加密算法和完整性保护算法，SMF直接确定加密算法和完整性保护算法。
在本发明实施例中，SMF可基于安全保护算法生成用户面保护密钥。具体的，SMF基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，SMF基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)；
或者，第二空口用户面保护密钥＝KDF(K_SMF,UP算法ID,DRBID)；
或者，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)；
其中，K_SMF为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF发送K_SMF至SMF；也可能，K_SMF为认证成功后，AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AUSF发送K_SMF至SMF。UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；所述加密算法ID用于指示对应的加密算法，所述完整性保护算法ID用于指示对应的完整性保护算法。
10、所述SMF向UPF发送安全保护算法、或用户面保护密钥。相应的，UPF接收安全保护算法或用户面保护密钥。
在可能的实施例中，如果UPF接收到用户面保护密钥，则将用户面保护密钥作为UPF的用户面保护密钥。
在可能的实施例中，如果UPF仅接收到安全保护算法，没有收到用户面保护密钥，则UPF可基于安全保护算法和K_SMF计算获得用户面保护密钥(可参考上述相关描述)，该用户面保护密钥即为UPF的用户面保护密钥。其中，K_SMF为认证成功后，AMF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，具体的，AMF发送K_SMF至UPF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UPF。
11、SMF通过AMF向AN发送发送会话ID，QoS flow ID，安全保护算法，QoS flow保护机制(QFISP)。
其中，所述QFISP可以是携带于Qos rule中发送至UE的。
另外，QoS flow保护机制为可选。
12、AN向UE发送发送会话ID，QoS flow ID，安全保护算法，QoS flow保护机制(QFISP)。
13、UE确定用户面保护密钥。
可参考图11实施例步骤12的描述，这里不再赘述。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：在可能的实施例中，步骤7和步骤8的内容可以替换为：PCF直接确定QoS flow保护机制，将QoS flow保护机制发送至SMF。
可能性3：flow ID和session ID可能是在SMF发送策略请求前生成的。
可能性4：若QFISP包括具体安全保护算法，那么SMF也可发送QFISP至UPF，UPF获取QFISP中的安全保护算法。
可能性5：若QFISP中未包含安全保护算法，那么步骤9步骤13还可以通过以下方式实现安全保护：
(替换步骤9)SMF计算第一K_UP，K_UP＝KDF(K_SMF,会话ID)；或者K_UP＝KDF(K_SMF,QoS flow ID)；
(替换步骤10)SMF发送会话ID，QFI和第一K_UP至UPF。
(替换步骤11)SMF通过AMF向AN发送会话ID，QFI和QFISP。
(替换步骤12)AN发送会话ID，QFI和QFISP至UE；
(替换步骤13)UE基于K_SMF生成第二K_UP。K_SMF为认证成功后，UE根据认证后密钥，或认证后再次推衍得到的密钥，推衍出的密钥。
(增加步骤14)UPF与UE再协商安全保护算法，再分别基于第一K_UP和第二K_UP生成UPF的用户面保护密钥和UE的用户面保护密钥。
还需要说明的是，图14实施例中没有详细描述的地方可参考图11实施例的相关描述，上述图14实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图14实施例与图11实施例的主要区别在于，UE-CN之间采用基于flow传输通道粒度进行策略协商，这个过程中AN不需要安全设置。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成基于flow传输通道粒度的策略协商，通过PCF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
为了便于理解本发明实施例的方案，下面基于UE-CN，举例说明用户面数据在上行传输和下行传输过程中，应用上述图14基于flow的密钥配置方法的一些操作流程，具体描述如下：
(1)用户面数据基于flow的密钥配置方法的上行传输过程。
在UE侧，UE根据用户数据确定会话ID，进而确认QFI，再确定对应安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法；所以，UE基于加密算法和完整性保护算法采用相应保护密钥执行用户面数据的安全保护。
在UPF侧，UPF在根据QoS flow ID，确定QFI对应安全保护机制(QFISP)后，UPF获得安全保护算法，包括加密算法和完整性保护算法，在UPF获取到UE上传的用户面数据后，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
(2)用户面数据基于flow的密钥配置方法的下行传输过程。
在UPF侧，在需要将用户面数据进行下行传输时，UPF根据可根据QFI基于图14所示方法流程确认安全保护机制(QFISP)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
在UE侧，UE根据DRB ID确认QoS flow ID，最终确定QFI对应安全保护机制，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
下面基于UE-CN，从区分粒度的角度描述本发明实施例提供的一种基于session的密钥配置方法，如图15所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
本发明实施例中，其中，所述附着请求至少包括用户设备标识(UE ID)。此外，可选的，所述附着请求还可以包括业务ID，UE业务ID，或者DNN，可选的，所述附着请求还可以包括安全需求的指示信息(indicator)。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
5、SMF向PCF发送策略请求。
6、PCF确定用户面保护机制。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制(SDFSP)。
8、SMF确定会话保护机制。
9、SMF确定安全保护算法以及用户面保护密钥。
在一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制不直接指定安全保护算法，那么，SMF根据UE安全能力、UPF支持的算法优先级列表、会话保护机制确定安全保护算法，其中，所述UPF支持的算法优先级列表可以预置于SMF，也可以是预置于UPF中，SMF从UPF获取所述UPF支持的算法优先级列表。例如，当用户面保护机制为“需要加密+需要完整性保护”时，SMF根据UE安全能力、UPF支持的算法优先级列表、UE支持的算法确定加密算法为AES，完整性保护算法为AES。若不需要加密，则加密算法为空。若不需要完整性保护，则完整性保护算法为空。
在另一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则SMF可从会话保护机制中直接获取安全保护算法。
在本发明实施例中，SMF可基于安全保护算法生成用户面保护密钥。具体的，SMF基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，SMF基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护 密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)；
或者，第二空口用户面保护密钥＝KDF(K_SMF,UP算法ID,DRBID)；
或者，第一空口用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)；
其中，K_SMF为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF发送K_SMF至SMF；也可能，K_SMF为认证成功后，AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AUSF发送K_SMF至SMF。UP算法ID可以为加密算法ID，也可以为完整性保护算法ID；所述加密算法ID用于指示对应的加密算法，所述完整性保护算法ID用于指示对应的完整性保护算法。
10、SMF向UPF发送用户面保护密钥，或安全保护算法；相应的，UPF接收用户面保护密钥，或安全保护算法。
11、SMF通过AMF向AN发送会话ID，QoS flow ID，安全保护算法，QFISP，会话保护机制。
12、AN向UE发送会话ID，QoS flow ID，安全保护算法，QFISP，会话保护机制。
13、UE确定用户面保护密钥。
需要说明的是，本实施例没有详细描述的部分，可以参考图13实施例的相关描述。
还需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：在可能的实施例中，步骤7和步骤8的内容可以替换为：PCF直接确定会话保护机制，将会话保护机制发送至SMF。
可能性3：flow ID和session ID可能是在SMF发送策略请求前生成的。
可能性4：若会话保护机制包括具体安全保护算法，那么SMF也可发送会话保护机制至UPF，UPF获取会话保护机制中的安全保护算法。
可能性5：若QFISP中未包含安全保护算法，那么步骤9步骤13还可以通过以下方式实现安全保护：
(替换步骤9)SMF计算第一K_UP，K_UP＝KDF(K_SMF,会话ID)；或者K_UP＝KDF(K_SMF,QoS flow ID)；
(替换步骤10)SMF发送会话ID，QFI和第一K_UP至UPF。
(替换步骤11)SMF通过AMF向AN发送会话ID，QFI，会话保护机制和QFISP。
(替换步骤12)AN发送会话ID，QFI，会话保护机制和QFISP至UE；
(替换步骤13)UE基于K_SMF生成第二K_UP。K_SMF为认证成功后，UE根据认证后密钥，或认证后再次推衍得到的密钥，推衍出的密钥。
(增加步骤14)UPF与UE再协商安全保护算法，再分别基于第一K_UP和第二K_UP生 成UPF的用户面保护密钥和UE的用户面保护密钥。
可以看出，图15实施例与图11实施例的主要区别在于，UE-CN之间采用基于session传输通道粒度进行策略协商，这个过程中AN不需要安全设置。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成基于session传输通道粒度的策略协商，通过PCF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
为了便于理解本发明实施例的方案，下面基于UE-CN，举例说明用户面数据在上行传输和下行传输过程中，应用上述图15基于session的密钥配置方法的一些操作流程，具体描述如下：
(1)用户面数据基于session的密钥配置方法的上行传输过程。
在UE侧，当用户面数据需要进行上行传输时，UE根据用户数据确定会话ID，进而确认会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法；所以，UE基于加密算法和完整性保护算法采用相应保护密钥执行用户面数据的安全保护。
在UPF侧，UPF根据QFI确认确认会话ID，最终确定会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，在UPF获取到UE上传的用户面数据后，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
(2)用户面数据基于session的密钥配置方法的下行传输过程。
在UPF侧，需要将用户面数据进行下行传输时，UPF根据会话ID确认安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
在UE侧，UE根据DRB ID确认QoS flow ID，进而确认会话ID，最终确定会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。其中，可选的，可以根据DRB ID直接确定会话ID；或者，可选的，UE根据数据格式确定会话ID。
下面基于UE-AN，提供的一种密钥配置方法，如图16所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
本发明实施例中，其中，所述附着请求至少包括用户设备标识(UE ID)。
4、UE发送会话请求至AMF，所述会话请求包括会话ID，Request type，DNN。其中Request type参数包括两种可能性。Request type指示使用已有PDU session(如表示为，“existing PDU session”)，或者指示初始会话发起(如表示为，“Initial request”)。此外，可选 的，所述会话请求还可以包括业务ID，UE业务ID，APP ID的至少一项，可选的，所述会话请求还可以包括安全需求的指示信息(indicator)。
5、AMF发送UE ID，会话ID，Request type，DNN至SMF。所述UE ID可以为上述认证中AMF获得的UE ID，AMF根据UE与AMF之间的传输协议，确定UE ID，即根据UE与AMF之间信令的AMF UE N2-AP ID来确定找到UE ID；也可能为UE发送的会话请求中带有UE ID，或者UE发送的会话请求中带有临时ID，AMF将其对应为UE ID。
6、若Request type指示使用已有PDU session(如“existing PDU session”)，此时SMF根据会话ID确定所述会话ID对应的已有用户面保护机制，采用所述会话ID对应的用户面保护机制作为本次会话的用户面保护机制。
若Request type指示建立新的PDU session(如，“Initial request”)，则SMF继续执行。
若SMF未存储DNN相关的注册信息，SMF发送UE ID和DNN至UDM，并从UDM接收签约安全保护机制。也可能，UDN未存储有UE ID和DNN对应的签约安全保护机制，此时UDM将UDM内存储的默认的安全保护机制作为签约安全保护机制发送至SMF，或者UDM发送空的安全保护机制标识至SMF。UDM内存储的默认的安全保护机制可以为仅使用加密保护，或者仅使用完整性保护，或者同时使用加密和完整性保护。或者，默认用户面保护机制指示采用哪个安全算法进行保护，例如仅使用AES算法加密保护，或者仅使用Snow 3G安全算法做完整性保护，或者同时使用AES算法加密和Snow 3G安全算法完整性保护。
7、SMF判断是否已部署动态的策略控制机制。
若未部署动态的策略控制机制，则SMF采用签约安全保护机制，作为本次会话的安全保护机制，并跳到步骤10执行。也可能，SMF未存储或未获得签约安全保护机制，此时SMF采用默认的用户面保护机制，并跳到步骤10执行。也可能，SMF未存储或未获得签约安全保护机制，此时SMF采用indicator所指示的用户面保护机制，并跳到步骤10执行。默认用户面保护机制可以为仅使用加密保护，或者仅使用完整性保护，或者同时使用加密和完整性保护。或者，默认用户面保护机制指示采用哪个安全算法进行保护，例如仅使用AES算法加密保护，或者仅使用Snow 3G安全算法做完整性保护，或者同时使用AES算法加密和Snow 3G安全算法完整性保护。
若网络已部署动态的策略控制机制，则SMF发送UE ID和DNN至PCF。另外，SMF也可能从UE或者AMF处接收业务ID，UE业务ID和APP ID的至少一项，此时SMF发送UE ID和DNN所述至PCF，也可能同时发送业务ID，UE业务ID和APP ID的至少一项至PCF。
8、PCF确定动态用户面保护机制。PCF确定动态用户面保护机制的方法，包括根据DNN，业务ID，UE业务ID和APP ID的至少一项确定是否存储有对应的保护机制。若存储有相应的保护机制，则将其作为动态用户面保护机制。所述PCF内存储的保护机制，为之前所述DNN，业务ID，UE业务ID，或者APP对应服务器向PCF发送的。否则，PCF向DNN，业务ID，UE业务ID，或者APP对应服务器发送请求，所述请求包含UE ID；并从所述服务器接收安全保护需求。将安全保护需求作为动态用户面保护机制。所述安全保护需求，可以为仅使用加密保护，或者仅使用完整性保护，或者同时使用加密和完整性保护，或者进一步的指定采用哪些安全算法所谓加密保护算法和完整性保护算法。还可能，若PCF内未存储， 或者未从服务器获得安全保护需求，则PCF采用PCF内存储的默认的安全保护机制可以为仅使用加密保护，或者仅使用完整性保护，或者同时使用加密和完整性保护。或者，默认用户面保护机制指示采用哪个安全算法进行保护，例如仅使用AES算法加密保护，或者仅使用Snow 3G安全算法做完整性保护，或者同时使用AES算法加密和Snow 3G安全算法完整性保护。
9、PCF向SMF发送动态用户面保护机制，相应的，SMF获取所述动态用户面保护机制，并将其作为最终用户面保护机制。
10、SMF发送用户面保护机制至AMF，同时发送会话ID或flow ID。
11、AMF发送用户面保护机制至AN，同时发送会话ID或flow ID。也可能SMF直接发送用户面保护机制至AN，同时发送会话ID或flow ID。
12、AN确定安全保护算法以及用户面保护密钥。
在一种具体实施例中，若用户面保护机制为是否加密/是否完整性保护，且用户面保护机制不直接指定安全保护算法，那么，AN根据UE安全能力，AN支持的算法优先级列表和用户面保护机制确定安全保护算法。例如，用户面保护机制要求加密，但不要求完整性保护，另外，UE安全能力支持AES加密/ZUC加密，但AN支持AES加密为第一优先级，则AN选择加密算法AES，完整性保护算法为空算法。
在另一种具体实施例中，若用户面保护机制为是否加密/是否完整性保护，且用户面保护机制直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则AN可从用户面保护机制中直接获取安全保护算法。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，KDF(K_AN,UP算法ID,session ID)，
或者，KDF(K_AN,UP算法ID,DRB ID)；
或者，KDF(K_AN,UP算法ID,切片ID)；
其中，K_AN为认证成功后，AMF或者SEAF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF或者SEAF发送K_AN至AN；UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等
13、AN向UE发送会话ID，flow ID，安全保护算法，用户面保护机制。
其中，所述用户面保护机制可以是携带于Qos rule中发送至UE的。
另外，用户面保护机制为可选。
14、UE确定保护密钥。
UE获取会话ID，用户面安全算法，用户面保护机制和K_AN，并相应生成用户面保护密钥；
具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,切片ID)；
其中，其中，K_AN为认证成功后，UE根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥。UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：flow ID和session ID可能是在SMF发送策略请求前生成的。
可能性3：步骤6可选，SMF不使用request type做是否采用旧用户面安全机制的判断。每次会话的建立，SMF都需要重新协商用户面安全机制。
可能性4：步骤1-9可以单独作为用户面安全机制确定的实施例。所述用户面安全机制可以用于未来UE与AN之间的安全保护，或者用户UE与CN之间的安全保护。
可能性5：步骤10-13可以单独作为UE与AN建立安全通道的实施例。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立的相关流程中，UE-AN完成基于PDU session传输通道粒度的策略协商，通过PCF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
下面基于UE-CN，提供的一种密钥配置方法，如图17所示，本发明实施例与图16所述实施例的不同点在于，用户面安全机制最终用于UE与UPF之间的安全保护。本发明实施例提供的密钥配置方法包括如下步骤：
步骤1-9可以参考图16所示。
10、SMF得到用户面安全机制，确定安全保护算法以及确定用户面保护密钥。
在一种具体实施例中，若用户面保护机制中仅包含是否加密/是否完整性保护的描述，则SMF确定UE-CN之间的用户面保护机制为是否需要加密、是否需要完整性保护，然后，SMF根据接收到的UE安全能力、UPF支持的算法优先级列表确定安全保护算法，其中，所述UPF支持的算法优先级列表可以预置于SMF，也可以是预置于UPF中，SMF从UPF获取所述UPF支持的算法优先级列表。例如，当用户面保护机制为“需要加密+需要完整性保护”时，SMF根据UE安全能力、UPF支持的算法优先级列表、UE支持的算法确定加密算法为AES，完整性保护算法为AES。
在另一种具体实施例中，用户面保护机制直接制定了指定了安全保护算法，则SMF可从用户面保护机制直接获取安全保护算法。在确定了用户面保护机制后，SMF可基于UPF支持的算法优先级列表、UE支持的算法和用户设备安全能力确定空口保护算法，其中，所述UPF支持的算法优先级列表可以预置于SMF，也可以是预置于UPF中，SMF从UPF获取所述UPF支持的算法优先级列表。例如，在“需要加密+需要完整性保护”的用户面保护机制下,SMF进一步确定加密算法为AES，完整性保护算法为AES，并在用户面保护机制中携带上述安全保护算法。在这种情况下，由于用户面保护机制直接指定了加密算法和完整性保护算法，所以SMF获得用户面保护机制后，可从用户面保护机制直接获取加密算法和完整性保护算法。
在可能的实施例中，在确定安全保护算法后，SMF可进一步确定用户面保护密钥，具体的：
用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,DRB ID)；
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,切片ID)；
其中K_SMF为认证成功后，AMF/SEAF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥。具体的，AMF/SEAF发送K_SMF至SMF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至SMF。UP算法ID可以为加密算法ID，也可以为完整性保护算法ID。也可能用户面保护密钥的密钥基于K_SMF推衍后的密钥计算得到，例如，K_UP＝KDF(K_SMF,session ID),用户面保护密钥＝KDF(K_UP,UP算法ID)。
11、SMF向UPF发送安全保护算法或用户面保护密钥，相应的，UPF接收安全保护算法或用户面保护密钥。
在可能的实施例中，如果UPF仅接收到安全保护算法，没有收到用户面保护密钥，则UPF可基于安全保护算法和K_SMF计算获得用户面保护密钥(可参考上述相关描述)，该用户面保护密钥即为UPF的用户面保护密钥。其中，K_SMF为认证成功后，AMF/SEAF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，具体的，AMF/SEAF通过SMF发送K_SMF至UPF；或者，K_SMF为认证成功后，AUSF根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，AUSF发送K_SMF至UPF。其中安全保护算法可以为UPF根据UPF的算法优先级列表和UE的算法列表确定的安全保护算法。这里UE的算法列表可以有SMF发 送至UPF。
在可能的实施例中，如果UPF接收到用户面保护密钥，则将用户面保护密钥作为UPF的用户面保护密钥。
12、SMF向AMF发送安全保护算法、用户面保护机制，其中，用户面保护机制为可选。
需要说明的是，如果所述安全保护算法是SMF根据接收到的UE安全能力、UPF支持的算法优先级列表等确定的，那么SMF将向AMF发送安全保护算法；
可选的，SMF向AMF发送安全保护算法，具体为：SMF向AMF发送会话响应，所述会话响应中携带有安全保护算法。
需要说明的是，如果安全保护算法是AMF可基于UPF支持的算法优先级列表、UE支持的算法和用户设备安全能力等确定的，那么SMF就不需要向AMF发送安全保护算法。
13、AMF向AN发送安全保护算法、用户面保护机制，其中，用户面保护机制为可选。
14、AN向UE发送安全保护算法、用户面保护机制，其中，用户面保护机制为可选。
15、UE根据用户面安全算法、用户面保护机制和K_SMF生成用户面保护密钥。或者UE根据用户面安全算法和K_SMF生成用户面保护密钥。
在可能的实施例中，在收到安全保护算法后，UE可进一步确定用户面保护密钥，该用户面保护密钥即为UE的用户面保护密钥，具体的：
用户面保护密钥＝KDF(K_SMF,UP算法ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,flow ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,session ID)，
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,DRB ID)；
或者，用户面保护密钥＝KDF(K_SMF,UP算法ID,切片ID)；
或者在上述推衍函数输入中添加用户面保护机制参数。其中，K_SMF为认证成功后，UE根据认证后密钥或认证后再次推衍得到的密钥，推衍出的密钥，UP算法ID可以为加密算法ID，也可以为完整性保护算法ID。也可能用户面保护密钥的密钥基于K_SMF推衍后的密钥计算得到，例如，K_UP＝KDF(K_SMF,session ID),用户面保护密钥＝KDF(K_UP,UP算法ID)。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：若AMF在确定用户面保护机制过程中不需要indicator的信息，那么UE可以不发送indicator至网络侧(或者附着请求中可以不包括indicator)。
可能性2：本实施例对上述流程步骤的先后顺序不做限定，例如，步骤8和步骤9可以同时进行，步骤8也可以放在步骤9之前或者之后。
可能性3：步骤4中，会话建立流程也可能是由UE发起的，即UE通过AMF向SMF发送会话请求。
可能性4：若用户面保护机制包括具体安全保护算法，那么AMF也可以通过SMF发送用户面保护机制至UPF，UPF获取用户面保护机制中的安全保护算法。
可能性5：若用户面保护机制中未包含安全保护算法，那么步骤7-步骤12还可以通过以下方式实现安全保护：
(替换步骤7、8)SMF计算第一K_UP，K_UP＝KDF(K_SMF,会话ID)；或者K_UP＝KDF(K_SMF, QoS flow ID)；
(替换步骤9)SMF发送会话ID，QFI和用户面保护机制至AMF。
(替换步骤10)AMF发送会话ID，QFI和用户面保护机制至AN；
(替换步骤11)AN发送会话ID，QFI和用户面保护机制至UE；
(替换步骤12)UE基于K_SMF生成第二K_UP。K_SMF为认证成功后，UE根据认证后密钥，或认证后再次推衍得到的密钥，推衍出的密钥。
(增加步骤13)UPF与UE基于会话ID，QFI和用户面保护机制协商安全保护算法，再分别基于第一K_UP和第二K_UP生成UPF的用户面保护密钥和UE的用户面保护密钥。
可能性6：步骤6可选，SMF不使用request type做是否采用旧用户面安全机制的判断。每次会话的建立，SMF都需要重新协商用户面安全机制。
还需要说明的是，图17实施例中没有详细描述的地方可参考图3实施例的相关描述，上述图17实施例仅作为一种示例，不应视为对本发明的限制。
可以看出，图17实施例与图3实施例的主要区别在于，在UE-CN的应用场景中，SMF在会话建立的相关流程中根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立流程中，UE-CN完成策略协商，通过AMF确定用户面保护机制后，UE和CN分别确定用户面保护密钥，从而实现对用户面数据的安全保护。实施本发明实施例可实现UE与核心网之间网络安全保护，避免hop-by-hop分段保护方式的弊端，提高用户面数据传输的安全性。
下面基于UE-AN，从区分粒度的角度描述本发明实施例提供的一种基于session的密钥配置方法，如图18所示，本发明实施例提供的密钥配置方法包括如下步骤：
1-3、在附着网络的过程中，UE通过AN、AMF将附着请求发送至AUSF，
AUSF基于UE ID执行与UE的认证，确定UE为合法用户。
本发明实施例中，其中，所述附着请求至少包括用户设备标识(UE ID)。此外，可选的，所述附着请求还可以包括业务ID，UE业务ID，或者DNN，可选的，所述附着请求还可以包括安全需求的指示信息(indicator)。
4、UE通过AMF向SMF发送会话请求，相应的，SMF接收所述会话请求。
5、SMF向PCF发送策略请求。
6、PCF确定用户面保护机制。
7、PCF向SMF发送用户面保护机制(SDFSP)，相应的，SMF获取所述用户面保护机制(SDFSP)。
8、SMF确定会话保护机制。
本发明实施例中，当用户面数据需要采用session传输通道或者DRB传输通道或者QoS flow传输通道进行数据传输时，还可以基于session实现数据传输中的安全保护机制。
具体的，SMF可基于不同PCC rule中SDFSP确定会话保护机制。或者SMF直接从PCF处接收到会话保护机制。
9、SMF通过AMF向AN发送QFISP、会话保护机制、QoS flow ID。
其中，在一具体实施例中，SMF通过AMF向AN直接发送会话ID，会话保护机制、QoS flow ID；
在另一具体实施例中，SMF通过AMF向AN发送QoS rule、QoS profile、QoS flow ID。所述QoS rule中包括会话保护机制，QoS rule用于向UE提供用户面数据对应的会话保护机制。所述QoS profile中包括该会话保护机制，QoS profile用于向AN提供用户面数据对应的会话保护机制。
可选的，SMF还可通过AMF向AN发送会话ID。
10、AN确定确定安全保护算法以及用户面保护密钥。
在一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制不直接指定安全保护算法，那么，AN根据UE安全能力，AN支持的算法优先级列表和用户面保护机制确定安全保护算法。例如，会话保护机制要求加密，但不要求完整性保护，另外，UE安全能力支持AES加密/ZUC加密，但AN支持AES加密为第一优先级，则AN选择加密算法AES，完整性保护算法为空算法。
在另一种具体实施例中，若会话保护机制为是否加密/是否完整性保护，且会话保护机制直接指定安全保护算法，包括指定了加密算法和完整性保护算法，则AN可从会话保护机制中直接获取安全保护算法。
在本发明实施例中，AN可基于安全保护算法生成用户面保护密钥。具体的，AN基于所确定的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，AN基于所确定的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第一空口用户面保护密钥。
在具体的实现中，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第一空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，KDF(K_AN,UP算法ID,session ID)，
或者，KDF(K_AN,UP算法ID,DRB ID)；
或者，KDF(K_AN,UP算法ID,切片ID)；
其中，K_AN为认证成功后，AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，AMF发送K_AN至AN；UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。
11、AN向UE发送会话ID，QoS flow ID，安全保护算法，会话保护机制。
其中，所述会话保护机制可以是携带于Qos rule中发送至UE的。
另外，会话保护机制为可选。
12、UE确定保护密钥。
UE获取会话ID，QFI，用户面安全算法，会话保护机制和K_AN，并相应生成用户面保护密钥；
具体的，UE基于所接收的加密算法计算出用于加密性保护的密钥，获得空口用户面加密密钥；或者，UE基于所接收的完整性保护算法计算出用于完整性保护的密钥，获得空口用户面完整性保护密钥。上述空口用户面加密密钥和空口用户面完整性保护密钥可统称为第二空口用户面保护密钥。
在具体的实现中，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)，
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)；
或者，第二空口用户面保护密钥＝KDF(K_AN,UP算法ID,切片ID)；
其中，K_AN为认证成功后，UE根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥。UP算法ID可以为加密算法ID，也可以为完保算法ID；DRB ID可以为AN为此项业务分配的DRB标识。KDF为密钥推衍函数(Key Derivation Function，KDF)，包括但不限于以下密码推衍函数：HMAC(如HMAC-SHA256，HMAC-SHA1)，NMAC，CMAC，OMAC，CBC-MAC，PMAC，UMAC和VMAC以及HASH算法等等。
需要说明的是，对于图18实施例中没有详细描述的步骤，可以参考图11实施例中的相关描述。上述图18实施例仅作为一种示例，不应视为对本发明的限制。
需要说明的是，在本实施例上述方法流程中，可能存在以下实施方式：
可能性1：步骤4中，会话建立流程也可能是由AMF发起的，即AMF向SMF发送会话请求。这种情况下，所述会话请求中的用户设备标识(UE ID)、用户设备安全能力、indicator，或者DNN、业务ID、UE业务ID等等可以是AMF从接收到的附着请求中获取的，所述附着请求携带上述信息。
可能性2：flow ID和session ID可能是在SMF发送策略请求前生成的。
可以看出，图18实施例和图11实施例区别在于，UE-AN之间采用基于PDU session传输通道粒度进行策略协商。
实施本发明实施例，可实现基于未来5G的通信架构，在会话建立的相关流程中，UE-AN完成基于PDU session传输通道粒度的策略协商，通过PCF根据用户设备侧所需要的安全需求(包括不同业务的安全需求)和网络侧所预置的安全需求确定用户面保护机制，UE和AN分别确定安全保护算法与密钥，从而实现对用户面数据的安全保护。
为了便于理解本发明实施例的方案，下面基于UE-AN，举例说明用户面数据在上行传输和下行传输过程中，应用上述图13基于session的密钥配置方法的一些操作流程，具体描述如下：
(1)用户面数据基于session的密钥配置方法的上行传输过程。
在UE侧，UE根据用户数据确定会话ID，进而确认会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法；所以，UE基于加密算法和完整性保护算法采用相应保护密钥执行用户面数据的安全保护。
在AN侧，AN根据DRB ID确认QoS flow ID，进而确认会话ID，最终确定会话ID对应安全保护机制(会话保护机制)，在AN获取到UE上传的用户面数据后，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。或者，根据DRB ID直接确定会话ID；或者AN根据协议栈的QFI，或者根据协议栈中marking确定QFI。
(2)用户面数据基于session的密钥配置方法的下行传输过程。
在AN侧，AN需要将用户面数据进行下行传输时，AN根据QFI确认会话ID，进而确认 安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。或者，根据DRB ID直接确定会话ID；或者，根据协议栈中会话ID，确认安全保护机制(会话保护机制)。在UE侧，UE根据DRB ID确认QoS flow ID，进而确认会话ID，最终确定会话ID对应安全保护机制(会话保护机制)，获得安全保护算法，包括加密算法和完整性保护算法，可基于加密算法和完整性保护算法采用相应密钥执行用户面数据的安全保护。
在本文上述实施例中，需要说明的是：二次认证可以为可选步骤。若二次认证执行了，SMF或者AMF可以根据二次认证的结果，确定是否授权UE接入此会话。认证成功，代表允许UE接入此会话，进而执行用户面安全机制的判定。也可能SMF或者AMF可以根据二次认证的结果，确定是否执行用户面安全机制的判定。
在本文上述实施例中，还需要说明的是：UE，AN或者UPF在用户面保护密钥推衍中用到的ID和参数，部分ID和需求可以通过核心网网元(例如，AMF，SMF，SEAF等)发送至UE，AN或者UPF，以使UE，AN或者UPF可以正确的推衍用户面保护密钥。另外，UE中用到的ID和参数，也可以通过AN或者UPF发送至UE。
在本文上述实施例中，还需要说明的是，用户面安全机制可以为算法的优先级列表。此时AN或UPF之后，可以根据用户面安全机制，UE安全能力和AN/UPF支持的安全算法，确定用户面安全算法。例如，选择用户面安全机制中优先级最高的算法，同时UE和AN/UPF同时支持的安全算法作为用户面安全算法。
在本文上述实施例中，还需要说明的是：
(1)针对采用SMF确定用户面安全机制的实施例，需要支持以下可能性：
SMF首先根据UE的注册信息判断是否需要请求PCF(或者是否需要动态的用户面安全机制)，进而获得PCF响应的用户面安全机制。
若不需要请求PCF(或者不需要动态的用户面安全机制)，此时SMF根据UE注册信息中预置的用户面安全机制确定UE的用户面保护机制。或者SMF通过向UDM发送DNN，或业务ID，或DNN和业务ID，从UDM获得签约业务数据，SMF根据签约业务数据中预置的用户面安全机制确定UE的用户面保护机制。
若需要请求PCF(或者需要动态的用户面安全机制)，SMF则发送策略请求，进而从PCF获得用户面安全机制。此方式与上述实施例中请求PCF的流程相同。
(2)针对采用AMF确定用户面安全机制的实施例，需要支持以下可能性：
AMF首先根据UE的注册信息判断是否需要请求PCF(或者是否需要动态的用户面安全机制)，进而获得PCF响应的用户面安全机制。
若不需要请求PCF(或者不需要动态的用户面安全机制)，此时AMF根据UE注册信息中预置的用户面安全机制确定UE的用户面保护机制。或者AMF通过向UDM发送DNN，或业务ID，或DNN和业务ID，从UDM获得签约业务数据，AMF根据签约业务数据中预置的用户面安全机制确定UE的用户面保护机制。
若需要请求PCF(或者需要动态的用户面安全机制)，AMF则发送策略请求，进而从PCF获得用户面安全机制。此方式与上述实施例中请求PCF的流程相同。
(3)针对SMF确定用户面安全机制的实施例，需要支持以下可能性：
SMF接收Request type参数，所述参数可以为UE发送Request type至AMF，AMF再发送Request type至SMF，也可能UE直接发送Request type至SMF。
Request type参数包括两种可能性。若Request type指示使用已有PDU session(如“existing PDU session”)，此时SMF根据会话ID确定所述会话ID对应的已有用户面安全机制，采用已有用户面安全机制作为本次会话的用户面安全机制。若Request type指示建立新的PDU session(如，“Initial request”)，则按照上述实施例的流程确定用户面安全机制。
也可能SMF根据从UDM或AMF获得参数1确定是否需要确定新的用户面安全机制。具体地，参数1可以为SMF向UDM发送请求获得；或者SMF从AMF处接收到，此时参数1可以为AMF向UDM请求中获得。参数1，指示是否需要新的用户面安全机制。
(4)针对采用SMF确定用户面安全机制的实施例，需要支持以下可能性：
SMF首先根据是否需要动态的策略配置，判断是否需要请求PCF(或者是否需要动态的用户面安全机制)，进而获得PCF响应的用户面安全机制。
若不需要请求PCF(或者不需要动态的用户面安全机制)，此时SMF根据UE注册信息中预置的用户面安全机制确定UE的用户面保护机制。或者SMF通过向UDM发送DNN，或业务ID，或DNN和业务ID，从UDM获得签约业务数据，SMF根据签约业务数据中预置的用户面安全机制确定UE的用户面保护机制。或者，SMF采用预置的默认用户面安全机制，作为本次用户面安全保护机制。
若需要请求PCF(或者需要动态的用户面安全机制)，SMF则发送策略请求，进而从PCF获得用户面安全机制。此方式与上述实施例中请求PCF的流程相同。
(5)针对采用SMF确定用户面安全机制的实施例，需要支持以下可能性：
SMF接收Request type参数，所述参数可以为UE发送Request type至AMF，AMF再发送Request type至SMF，也可能UE直接发送Request type至SMF。
Request type参数包括两种可能性。若Request type指示使用已有PDU session(如“existing PDU session”)，此时SMF根据会话ID确定所述会话ID对应的已有用户面安全机制，采用已有用户面安全机制作为本次会话的用户面安全机制。若Request type指示建立新的PDU session(如，“Initial request”)，若Request type指示“Initial request”，则继续执行。
SMF首先根据是否需要动态的策略配置，判断是否需要请求PCF(或者是否需要动态的用户面安全机制)，进而获得PCF响应的用户面安全机制。
若不需要请求PCF(或者不需要动态的用户面安全机制)，此时SMF根据UE注册信息中预置的用户面安全机制确定UE的用户面保护机制。或者SMF通过向UDM发送DNN，或业务ID，或DNN和业务ID，从UDM获得签约业务数据，SMF根据签约业务数据中预置的用户面安全机制确定UE的用户面保护机制。或者，SMF采用预置的默认用户面安全机制，作为本次用户面安全保护机制。
若需要请求PCF(或者需要动态的用户面安全机制)，SMF则发送策略请求，进而从PCF获得用户面安全机制。此方式与上述实施例中请求PCF的流程相同。
(6)针对采用SMF确定用户面安全机制的实施例，需要支持以下可能性：
图11,12,13,14,15,16,17,18对应实施例中，SMF可以自己确定用户面安全保护机制，不需要向PCF发送策略请求消息。例如，SMF确定用户面安全保护机制的方法可以基于图7实施例的方法。
(7)针对采用PCF确定用户面安全机制的实施例，需要支持以下可能性：
PCF根据默认的安全配置，确定用户面安全保护机制。
(8)针对上述实施例中，基于K_SMF生成用户面保护密钥的方法，需要考虑支持以下可能性：
用户面保护密钥的密钥基于K_SMF推衍后的密钥计算得到，例如，K_UP＝KDF(K_SMF,session ID),用户面保护密钥＝KDF(K_UP,UP算法ID)；其中K_UP还可能有如下生成方式K_UP＝KDF(K_SMF,flow ID)，或者K_UP＝KDF(K_SMF,切片ID)。
(8)针对上述实施例中，用户面保护密钥的生成方式还需要考虑以下可能性：
用户面保护密钥＝KDF(K_SMF,UP算法ID，切片ID)，或者用户面保护密钥＝KDF(K_UP,UP算法ID，切片ID)，或者用户面保护密钥＝KDF(K_AN,UP算法ID，切片ID)。
(9)针对上述实施例，还包括以下可能性，上述每个实施例可独立为两个方案：方案1为用户面保护机制，或者用户面安全机制或者安全策略的协商方法；方案2为空口安全算法和安全密钥生成方法。
(10)针对上述实施例，还包括以下可能性，AN仅支持确定安全算法的机制，不做空口密钥的推衍，并将安全算法或用户面安全机制发送至UE。若UE接收到用户面安全机制，此时UE采用与AN相同的方法确定安全算法。
(11)针对上述实施例，还包括以下可能性，AN仅将接收到的用户面安全机制发送至UE。
(12)针对上述实施例，还包括以下可能性，UE与AN已协商确定机密性保护算法和完整性保护算法。之后AN根据接收到的用户面安全机制，以及已确定的机密性保护算法和完整性保护算法，确定安全保护算法，其中用户面安全机制指示是否加密(或者是否完整性保护，或者是否同时加密和完整性保护)。例如，若用户面安全机制指示加密保护，AN采用已确定的机密性保护算法保护UE与AN之间的数据。若用户面安全机制指示完整性保护，AN采用已确定的完整性保护算法保护UE与AN之间的数据。若用户面安全机制指示同时加密和完整性保护，AN采用已确定的机密性保护算法保护UE与AN之间的数据。之后AN将用户面安全机制发送至UE。UE根据用户面安全机制和已确定的算法，采用与AN相同的方法确定安全保护算法。也可能，AN将确定后的安全保护算法发送至UE。也可能，AN先发送用户面安全机制，之后UE和AN再确定机密性保护算法和完整性保护算法，最后根据用户面安全机制和已确定的机密性保护算法和完整性保护算法，确定安全保护算法。
上述详细阐述了本发明实施例的方法，为了便于更好地实施本发明实施例的上述方案，相应地，下面提供了本发明实施例的其中一些装置。
请参见图19，图19是本发明实施例提供的一种策略功能网元的结构示意图，该策略功能网元可以包括接收模块110、策略模块120以及发送模块130，其中，各个单元的详细描 述如下：
所述接收模块110用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述策略模块120用于基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
所述发送模块130用于，当所述网络设备为接入网AN设备时，向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
所述发送模块130还用于，当所述网络设备为核心网CN设备时，向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
可选的，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
可选的，所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
具体的，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
具体的，所述CN设备为用户面节点UPF；
其中，具体的，所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
需要说明的是，各个模块单元的实现还可以对应参照图3-图5所示的方法实施例的相 应描述，这里不再赘述。
参见图20，本发明实施例提供又一种策略功能网元，该策略功能网元包括处理器210、存储器220和发射器230以及接收器240，所述处理器210、存储器220和发射器230以及接收器240相连接(如通过总线相互连接)。
存储器220包括但不限于是随机存储记忆体(英文：Random Access Memory，简称：RAM)、只读存储器(英文：Read-Only Memory，简称：ROM)、可擦除可编程只读存储器(英文：Erasable Programmable Read Only Memory，简称：EPROM)、或便携式只读存储器(英文：Compact Disc Read-Only Memory，简称：CD-ROM)，该存储器1302用于相关指令及数据。收发器1303用于接收和发送数据。
发射器230用于发射数据或信令，接收器240用于接收数据或信令。
处理器210可以是一个或多个中央处理器(英文：Central Processing Unit，简称：CPU)，在处理器210是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
该处理器210用于读取所述存储器220中存储的程序代码，执行以下操作：
通过接收器240接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
处理器210基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
当所述网络设备为接入网AN设备时，利用发射器230向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，利用发射器230向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
可选的，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
可选的，所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
具体的，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
其中，所述CN设备为用户面节点UPF；所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
可选的所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
可选的所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
可选的，当所述网络设备为接AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述算法网元从所述AMF或所述AUSF获得所述K_算法网元；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
可选的，所述用户面数据通过服务质量流Qos flow传输通道承载；
若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow 传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
其中，所述Qos需求为对通信网络中服务质量参数的需求。
可选的，所述用户面数据通过数据无线承载DRB传输通道承载；
若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID。
其中，所述DRB ID与所述用户面保护机制具有映射关系。
可选的所述用户面数据通过会话session传输通道承载；
若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
其中，所述session ID与所述用户面保护机制具有映射关系。
可选的，建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
具体的，当所述网络设备为AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)。
具体的，当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)。
另外，本发明实施例还提供了一种通信系统，该通信系统包括：用户设备、策略功能网元、网络设备、统一数据管理网元UDM、应用功能网元AF、算法网元，所述策略功能网元与所述用户设备、所述网络设备连接，所述策略功能网元还与所述UDM、所述AF连接，所述算法网元与所述策略功能网元、网络设备连接，其中：
所述策略功能网元用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
所述策略功能网元还用于基于所述请求，以及所述UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、所述AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护。
当所述网络设备为接入网AN设备时，所述策略功能网元还用于向所述AN设备发送所述用户面保护机制；所述AN设备用于基于所述用户面保护机制确定安全保护算法；所述AN设备还用于基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥；
当所述网络设备为核心网CN设备时，所述策略功能网元用于向算法网元发送所述用户面保护机制；所述算法网元还用于基于所述用户面保护机制确定安全保护算法；所述算法网元还用于基于所述安全保护算法生成第一用户面保护密钥；所述算法网元还用于将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥。
其中，所述UDM用于存储UE的注册信息，还用于存储签约业务数据；所述AF用于存储业务安全需求。
可选的，所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
可选的，所述系统还包括认证服务器网元AUSF、会话管理网元SMF、接入与移动管理网元AMF中的一个或多个；
可选的，所述请求为附着请求；所述附着请求为所述用户设备向所述AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为会话请求；所述会话请求为所述用户设备向所述SMF发起的，或者为所述AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
可选的，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
具体的，所述策略功能网元为策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
具体的，所述CN设备为用户面节点UPF；所述算法网元包括所述PCF、所述AUSF、所 述AMF、所述SMF、所述AN设备中的至少一个。
可选的，所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则所述AN设备用于基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则所述AN设备用于直接获取所述用户面保护机制中的安全保护算法。
可选的，所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
如果用户面保护机制不包括安全保护算法，则所述算法网元用于基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法。
如果用户面保护机制包括安全保护算法，则所述算法网元用于直接获取所述用户面保护机制中的安全保护算法。
具体的，当所述网络设备为AN设备时，所述AN设备用于基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；所述AN设备用于从所述AMF获得所述K_AN；
当所述网络设备为CN设备时，所述算法网元用于基于所述安全保护算法生成第一用户面保护密钥，包括：
第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；所述算法网元用于从所述AMF或所述AUSF获得所述K_算法网元；
其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
可选的：所述SMF还用于确定用户面数据通过服务质量流Qos flow传输通道承载；
若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该Qos flow传输通道传输用户面数据；否则，所述SMF用于新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则所述SMF用于选择该Qos flow传输通道传输用户面数据；否则，所述SMF用于新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
其中，所述Qos需求为对通信网络中服务质量参数的需求。
可选的：所述SMF还用于确定所述用户面数据通过数据无线承载DRB传输通道承载；
若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该DRB传输通道传输用户数据；否则，所述SMF用于新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则所述SMF用于选择该DRB传输通道传输用户数据；否则，所述SMF用于新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID。
其中，所述DRB ID与所述用户面保护机制具有映射关系。
可选的：所述SMF用于确定所述用户面数据通过会话session传输通道承载；
若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该session传输通道传输用户数据；否则，所述SMF用于新建session传输通道，并生成与该session传输通道对应的session ID。
或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则所述SMF用于选择该session传输通道传输用户数据；否则，所述SMF用于新建session传输通道，并生成与该session传输通道对应的session ID。
其中，所述session ID与所述用户面保护机制具有映射关系。
可选的，确定用户面保护机制，还包括：
建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
具体的，当所述网络设备为AN设备时，所述AN设备用于基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)。
具体的，当所述网络设备为CN设备时，所述算法网元用于基于所述安全保护算法生成第一用户面保护密钥，包括：
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)。
需要说明的是，所述通信系统中各个网元的实现方式可参考图3-图15方法实施例的描述，这里不再赘述。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储程序代码的介质。

Claims (67)

  1. 一种密钥配置方法，其特征在于，包括：
    策略功能网元接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
    所述策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    当所述网络设备为接入网AN设备时，所述策略功能网元向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
    当所述网络设备为核心网CN设备时，所述策略功能网元向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
  2. 根据权利要求1所述的方法，其特征在于，
    所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
  3. 根据权利要求1或2所述的方法，其特征在于，
    所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述用户面保护机制还用于 指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，
    所述CN设备为用户面节点UPF；
    所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，
    所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
    如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法；
    如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
  9. 根据权利要求1至7任一项所述的方法，其特征在于，
    所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
    如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法；
    如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
  10. 根据权利要求3至9任一项所述的方法，其特征在于，
    当所述网络设备为接AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
    第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
    当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
    第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述算法网元从所述AMF或所述AUSF获得所述K_算法网元；
    其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
  11. 根据权利要求1至9任一项所述的方法，其特征在于，包括：所述用户面数据通过服务质量流Qos flow传输通道承载；
    若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    其中，所述Qos需求为对通信网络中服务质量参数的需求。
  12. 根据权利要求1至9任一项所述的方法，其特征在于，包括：所述用户面数据通过数据无线承载DRB传输通道承载；
    若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    其中，所述DRB ID与所述用户面保护机制具有映射关系。
  13. 根据权利要求1至9任一项所述的方法，其特征在于，包括：所述用户面数据通过会话session传输通道承载；
    若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID；
    或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID；
    其中，所述session ID与所述用户面保护机制具有映射关系。
  14. 根据权利要求11至13任一项所述的方法，其特征在于，确定用户面保护机制，还包括：
    建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
  15. 根据权利要求11至14任一项所述的方法，其特征在于，当所述网络设备为AN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)。
  16. 根据权利要求11至14任一项所述的方法，其特征在于，当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)。
  17. 一种策略功能网元，其特征在于，包括：接收模块、策略模块和发送模块，其中：
    所述接收模块用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
    所述策略模块用于基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    所述发送模块用于，当所述网络设备为接入网AN设备时，向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
    所述发送模块还用于，当所述网络设备为核心网CN设备时，向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
  18. 根据权利要求17所述的策略功能网元，其特征在于，
    所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
  19. 根据权利要求17或18所述的策略功能网元，其特征在于，
    所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的； 所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
  20. 根据权利要求17至19任一项所述的策略功能网元，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  21. 根据权利要求17至20任一项所述的策略功能网元，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  22. 根据权利要求17至21任一项所述的策略功能网元，其特征在于，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  23. 根据权利要求17至22任一项所述的策略功能网元，其特征在于，
    所述CN设备为用户面节点UPF；
    所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
  24. 一种通信系统，包括：用户设备、策略功能网元、网络设备、统一数据管理网元UDM、应用功能网元AF、算法网元，所述策略功能网元与所述用户设备、所述网络设备连接，所述策略功能网元还与所述UDM、所述AF连接，所述算法网元与所述策略功能网元、网络设备连接，其中：
    所述策略功能网元用于接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
    所述策略功能网元还用于基于所述请求，以及所述UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、所述AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    当所述网络设备为接入网AN设备时，所述策略功能网元还用于向所述AN设备发送所述用户面保护机制；所述AN设备用于基于所述用户面保护机制确定安全保护算法；所述 AN设备还用于基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥；
    当所述网络设备为核心网CN设备时，所述策略功能网元用于向算法网元发送所述用户面保护机制；所述算法网元还用于基于所述用户面保护机制确定安全保护算法；所述算法网元还用于基于所述安全保护算法生成第一用户面保护密钥；所述算法网元还用于将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备；所述用户设备用于基于所述安全保护算法生成第二用户面保护密钥；
    其中，所述UDM用于存储UE的注册信息，还用于存储签约业务数据；所述AF用于存储业务安全需求。
  25. 根据权利要求24所述的系统，其特征在于，
    所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
  26. 根据权利要求24或25所述的系统，其特征在于，所述系统还包括认证服务器网元AUSF、会话管理网元SMF、接入与移动管理网元AMF中的一个或多个；
    所述请求为附着请求；所述附着请求为所述用户设备向所述AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为会话请求；所述会话请求为所述用户设备向所述SMF发起的，或者为所述AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
  27. 根据权利要求24至26任一项所述的系统，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  28. 根据权利要求24至27任一项所述的系统，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  29. 根据权利要求24至28任一项所述的系统，其特征在于，所述策略功能网元为策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  30. 根据权利要求24至29任一项所述的系统，其特征在于，
    所述CN设备为用户面节点UPF；
    所述算法网元包括所述PCF、所述AUSF、所述AMF、所述SMF、所述AN设备中的至少一个。
  31. 根据权利要求24至30任一项所述的系统，其特征在于，
    所述AN设备用于基于所述用户面保护机制确定安全保护算法，包括：
    如果用户面保护机制不包括安全保护算法，则所述AN设备用于基于所述用户面保护机制、所述用户设备安全能力、所述AN设备支持的算法优先级列表中的至少一项确定安全保护算法；
    如果用户面保护机制包括安全保护算法，则所述AN设备用于直接获取所述用户面保护机制中的安全保护算法。
  32. 根据权利要求24至30任一项所述的系统，其特征在于，
    所述算法网元用于基于所述用户面保护机制确定安全保护算法，包括：
    如果用户面保护机制不包括安全保护算法，则所述算法网元用于基于所述用户面保护机制、所述用户设备安全能力、所述CN设备支持的算法优先级列表中的至少一项确定安全保护算法；
    如果用户面保护机制包括安全保护算法，则所述算法网元用于直接获取所述用户面保护机制中的安全保护算法。
  33. 根据权利要求26至32任一项所述的系统，其特征在于，
    当所述网络设备为AN设备时，所述AN设备用于基于所述安全保护算法生成第一用户面保护密钥，包括：
    第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；所述AN设备用于从所述AMF获得所述K_AN；
    当所述网络设备为CN设备时，所述算法网元用于基于所述安全保护算法生成第一用户面保护密钥，包括：
    第一用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述AMF或所述AUSF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；所述算法网元用于从所述AMF或所述AUSF获得所述K_算法网元；
    其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
  34. 根据权利要求24至32所述的系统，其特征在于，包括：所述SMF还用于确定用户面数据通过服务质量流Qos flow传输通道承载；
    若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID 对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该Qos flow传输通道传输用户面数据；否则，所述SMF用于新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则所述SMF用于选择该Qos flow传输通道传输用户面数据；否则，所述SMF用于新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    其中，所述Qos需求为对通信网络中服务质量参数的需求。
  35. 根据权利要求24至32任一项所述的系统，其特征在于，包括：所述SMF还用于确定所述用户面数据通过数据无线承载DRB传输通道承载；
    若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该DRB传输通道传输用户数据；否则，所述SMF用于新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则所述SMF用于选择该DRB传输通道传输用户数据；否则，所述SMF用于新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    其中，所述DRB ID与所述用户面保护机制具有映射关系。
  36. 根据权利要求24至32任一项所述的系统，其特征在于，包括：所述SMF用于确定所述用户面数据通过会话session传输通道承载；
    若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则所述SMF用于选择该session传输通道传输用户数据；否则，所述SMF用于新建session传输通道，并生成与该session传输通道对应的session ID；
    或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则所述SMF用于选择该session传输通道传输用户数据；否则，所述SMF用于新建session传输通道，并生成与该session传输通道对应的session ID；
    其中，所述session ID与所述用户面保护机制具有映射关系。
  37. 根据权利要求34至36任一项所述的系统，其特征在于，确定用户面保护机制，还包括：
    建立所述session ID和所述QoS flow ID至所述DRB ID的映射，将具有相同的用户面保护机制的QoS flow映射到同一个DRB。
  38. 根据权利要求34至37任一项所述的系统，其特征在于，当所述网络设备为AN设备时，所述AN设备用于基于所述安全保护算法生成第一用户面保护密钥，包括：
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,flow ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,session ID)；或者，
    所述第一用户面保护密钥＝KDF(K_AN,UP算法ID,DRB ID)。
  39. 根据权利要求34至37任一项所述的系统，其特征在于，当所述网络设备为CN设备时，所述算法网元用于基于所述安全保护算法生成第一用户面保护密钥，包括：
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID)；或者，
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,flow ID)；或者，
    所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,session ID)；或者，所述第一用户面保护密钥＝KDF(K_算法网元,UP算法ID,DRB ID)。
  40. 一种密钥配置方法，其特征在于，包括：
    用户设备发送请求，所述请求中包括所述用户设备的标识；
    所述用户设备接收响应，所述响应中携带安全保护算法，所述安全保护算法由用户面保护机制确定，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示所述用户设备与网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    所述用户设备基于所述安全保护算法确定用户面保护密钥，所述用户面保护密钥用于对所述用户设备与所述网络设备之间传输的用户面数据进行安全性保护。
  41. 根据权利要求40所述的方法，其特征在于，
    所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
  42. 根据权利要求40或41所述的方法，其特征在于，
    所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
  43. 根据权利要求40至42任一项所述的方法，其特征在于，
    所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据 需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  44. 根据权利要求40至43任一项所述的方法，其特征在于，
    所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  45. 根据权利要求40至44任一项所述的方法，其特征在于，
    所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  46. 根据权利要求40至45任一项所述的方法，其特征在于，
    所述用户设备基于所述安全保护算法确定用户面保护密钥，包括：
    用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述AN设备从所述AMF获得所述K_AN；
    当所述网络设备为CN设备时，基于所述安全保护算法生成第一用户面保护密钥，包括：
    用户面保护密钥＝KDF(K_算法网元，UP算法ID)，其中，所述K_算法网元为认证成功后，所述用户设备根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥；
    其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
  47. 根据权利要求40至46任一项所述的方法，其特征在于，
    所述网络设备为接入网AN设备或者用户面节点UPF。
  48. 一种密钥配置方法，其特征在于，包括：
    用户面节点接收响应，所述响应中携带安全保护算法，所述安全保护算法由用户面保护机制确定，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示用户设备与所述用户面节点之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    所述用户面节点基于所述安全保护算法确定用户面保护密钥，所述用户面保护密钥用于对用户设备与所述用户面节点之间传输的用户面数据进行安全性保护。
  49. 根据权利要求48所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  50. 根据权利要求48或49所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  51. 根据权利要求48至50任一项所述的方法，其特征在于，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  52. 一种密钥配置方法，其特征在于，包括：
    接入网设备接收用户面保护机制，所述用户面保护机制由策略功能网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一种所确定；其中，所述用户面保护机制用于指示所述用户设备与网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    所述接入网设备基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；
    所述接入网设备将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
  53. 根据权利要求52所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  54. 根据权利要求52或53所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  55. 根据权利要求52至54任一项所述的方法，其特征在于，所述策略功能网元包括策略控制节点PCF、认证服务器网元AUSF、接入与移动管理功能网元AMF、会话管理网元SMF、AN设备中的一个。
  56. 根据权利要求52至55任一项所述的方法，其特征在于，
    所述接入网设备用于基于所述用户面保护机制确定安全保护算法，包括：
    如果用户面保护机制不包括安全保护算法，则基于所述用户面保护机制、接入网设备支持的算法优先级列表中的至少一项确定安全保护算法；
    如果用户面保护机制包括安全保护算法，则直接获取所述用户面保护机制中的安全保护算法。
  57. 根据权利要求52至56任一项所述的方法，其特征在于，
    基于所述安全保护算法生成第一用户面保护密钥，包括：
    第一用户面保护密钥＝KDF(K_AN，UP算法ID)，其中，K_AN为认证成功后，所述AMF根据认证后的基础密钥或认证后再次推衍得到的密钥，推衍出的基站密钥，所述接入网设备从所述AMF获得所述K_AN；
    其中，所述UP算法ID为加密算法的标识，或者为完整性保护算法的标识；所述KDF为密钥推衍函数。
  58. 一种密钥配置方法，其特征在于，包括：
    会话管理网元接收用户设备与网络设备之间通信的请求；所述请求包括会话标识、用户设备标识、以及安全需求的指示信息，所述安全需求的指示信息用于指示用户设备安全需求和/或业务安全需求；
    所述会话管理网元基于所述请求，以及统一数据管理网元UDM反馈的UE注册信息、所述UDM反馈的签约业务数据、应用功能网元AF反馈的业务安全需求中的至少一个，确定用户面保护机制；所述用户面保护机制用于指示所述用户设备与所述网络设备之间传输的用户面数据是否需要加密，或是否需要完整性保护，或是否同时需要加密和完整性保护；
    当所述网络设备为接入网AN设备时，所述会话管理网元向所述AN设备发送所述用户面保护机制；其中，所述AN设备用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥；所述AN设备还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥；
    当所述网络设备为核心网CN设备时，所述会话管理网元向算法网元发送所述用户面保护机制；其中，所述算法网元用于基于所述用户面保护机制确定安全保护算法，基于所述安全保护算法生成第一用户面保护密钥，以及将所述第一用户面保护密钥发送至所述CN设备；所述算法网元还用于将所述安全保护算法发送至所述用户设备，以便于所述用户设备基于所述安全保护算法生成第二用户面保护密钥。
  59. 根据权利要求58所述的方法，其特征在于，
    所述请求还包括业务标识、用户设备业务标识、数据网络标识DNN、用户设备安全能力中的至少一项。
  60. 根据权利要求58或59所述的方法，其特征在于，
    所述请求为附着请求；所述附着请求为所述用户设备向认证服务器网元AUSF发起的；所述附着请求用于所述网络设备与所述AUSF之间进行双向认证，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为会话请求；所述会话请求为所述用户设备向会话管理网元SMF发起的，或者为接入与移动管理网元AMF向所述SMF发起的；所述会话请求用于网络设备和所述SMF之间建立会话，还用于触发所述策略功能网元确定用户面保护机制；
    或者，所述请求为策略请求；所述策略请求为所述SMF向所述策略功能网元发起的，所述策略请求用于触发所述策略功能网元确定用户面保护机制。
  61. 根据权利要求58至60任一项所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据需要采用的安全保护算法、密钥长度、密钥更新周期中的至少一项。
  62. 根据权利要求58至61任一项所述的方法，其特征在于，所述用户面保护机制还用于指示所述用户设备与所述网络设备之间传输的用户面数据可以采用的具有优先级的安全保护算法列表。
  63. 根据权利要求58至62任一项所述的方法，其特征在于，包括：所述会话管理网元确定所述用户面数据通过服务质量流Qos flow传输通道承载；
    若已存在Qos flow传输通道对应的服务质量流标识QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    若已存在Qos flow传输通道对应的QoS flow ID，所述QoS flow ID对应QoS flow满足用户面保护机制，则选择该Qos flow传输通道传输用户面数据；否则，新建Qos flow传输通道，并生成与该Qos flow传输通道对应的QoS flow ID；
    其中，所述Qos需求为对通信网络中服务质量参数的需求。
  64. 根据权利要求58至62任一项所述的方法，其特征在于，包括：所述会话管理网元确定所述用户面数据通过数据无线承载DRB传输通道承载；
    若已存在DRB传输通道对应的数据无线承载标识DRB ID，所述DRB ID对应DRB满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    或者，若已存在DRB传输通道对应的DRB ID，所述DRB ID对应DRB满足用户面保护机制，则选择该DRB传输通道传输用户数据；否则，新建DRB传输通道，并生成与该DRB传输通道对应的DRB ID；
    其中，所述DRB ID与所述用户面保护机制具有映射关系。
  65. 根据权利要求58至62任一项所述的方法，其特征在于，包括：所述会话管理网元确定所述用户面数据通过会话session传输通道承载；
    若已存在session传输通道对应的会话标识session ID，所述session ID对应session满足用户面保护机制，或Qos需求，或用户面保护机制和QoS需求，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID。
    或者，若已存在session传输通道对应的session ID，所述session ID对应session满足用户面保护机制，则选择该session传输通道传输用户数据；否则，新建session传输通道，并生成与该session传输通道对应的session ID；
    其中，所述session ID与所述用户面保护机制具有映射关系。
  66. 一种存储计算机指令的可读非易失性存储介质，其特征在于，包括计算机指令，所述计算机指令被执行以实现权利要求1-16任一项描述的方法。
  67. 一种计算机程序产品，其特征在于，当计算机程序产品运行于计算机时，被执行以实现权利要求1-16任一项描述的方法。
PCT/CN2017/095301 2017-05-06 2017-07-31 密钥配置方法、装置以及系统 WO2018205427A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
BR112019023236A BR112019023236A2 (pt) 2017-05-06 2017-07-31 método, aparelho e sistema de configuração de chave
EP17909068.3A EP3611949A4 (en) 2017-05-06 2017-07-31 KEY CONFIGURATION METHOD, DEVICE AND SYSTEM
CN201780090099.0A CN110574406B (zh) 2017-05-06 2017-07-31 密钥配置方法、装置以及系统
US16/674,697 US20200084631A1 (en) 2017-05-06 2019-11-05 Key Configuration Method, Apparatus, and System

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201710314224.3 2017-05-06
CN201710314224.3A CN108810884B (zh) 2017-05-06 2017-05-06 密钥配置方法、装置以及系统
PCT/CN2017/091511 WO2018205394A1 (zh) 2017-05-06 2017-07-03 密钥配置方法、装置以及系统
CNPCT/CN2017/091511 2017-07-03

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/674,697 Continuation US20200084631A1 (en) 2017-05-06 2019-11-05 Key Configuration Method, Apparatus, and System

Publications (1)

Publication Number Publication Date
WO2018205427A1 true WO2018205427A1 (zh) 2018-11-15

Family

ID=64054643

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2017/091511 WO2018205394A1 (zh) 2017-05-06 2017-07-03 密钥配置方法、装置以及系统
PCT/CN2017/095301 WO2018205427A1 (zh) 2017-05-06 2017-07-31 密钥配置方法、装置以及系统

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/091511 WO2018205394A1 (zh) 2017-05-06 2017-07-03 密钥配置方法、装置以及系统

Country Status (5)

Country Link
US (1) US20200084631A1 (zh)
EP (1) EP3611949A4 (zh)
CN (3) CN108810884B (zh)
BR (1) BR112019023236A2 (zh)
WO (2) WO2018205394A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020159654A1 (en) * 2019-01-29 2020-08-06 Google Llc Integrity protection with message authentication codes having different lengths

Families Citing this family (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108810884B (zh) * 2017-05-06 2020-05-08 华为技术有限公司 密钥配置方法、装置以及系统
US10440159B2 (en) * 2017-08-03 2019-10-08 T-Mobile Usa, Inc. Header modification for supplementary services
WO2019223005A1 (en) * 2018-05-25 2019-11-28 Qualcomm Incorporated Mixed mode multicast architecture
CN110856175A (zh) * 2018-08-21 2020-02-28 华为技术有限公司 一种用户面安全的授权方法及装置
CN112956253B (zh) * 2018-11-06 2022-10-04 中兴通讯股份有限公司 用于将用户设备附着到网络切片的方法和装置
CN111436077B (zh) * 2019-01-14 2023-05-12 大唐移动通信设备有限公司 一种业务建立方法、实体及装置、介质
CN111491394B (zh) * 2019-01-27 2022-06-14 华为技术有限公司 用户面安全保护的方法和装置
CN111641947B (zh) * 2019-03-01 2021-12-03 华为技术有限公司 密钥配置的方法、装置和终端
CN111756555B (zh) 2019-03-28 2022-04-05 华为技术有限公司 计费规则绑定的方法、设备及系统
CN111757389B (zh) * 2019-03-29 2022-03-25 大唐移动通信设备有限公司 一种通信装置和方法
CN111865872B (zh) * 2019-04-26 2021-08-27 大唐移动通信设备有限公司 一种网络切片内终端安全策略实现方法及设备
CN112492584B (zh) * 2019-08-23 2022-07-22 华为技术有限公司 终端设备和用户面网元之间的安全通信方法、装置及系统
CN112788593A (zh) * 2019-11-04 2021-05-11 阿里巴巴集团控股有限公司 安全策略的更新方法及装置、系统
WO2021109151A1 (zh) * 2019-12-06 2021-06-10 华为技术有限公司 一种事件上报的方法、装置及系统
CN113543127B (zh) * 2020-03-31 2023-02-17 大唐移动通信设备有限公司 一种密钥生成方法、装置、设备及计算机可读存储介质
CN113676907B (zh) * 2020-04-30 2023-08-04 华为技术有限公司 一种确定服务质量流的方法，装置，设备及计算机可读存储介质
TWI754950B (zh) * 2020-06-02 2022-02-11 鴻海精密工業股份有限公司 物聯網設備、伺服器及軟體更新方法
CN112788594B (zh) * 2020-06-03 2023-06-27 中兴通讯股份有限公司 数据传输方法、装置和系统、电子设备、存储介质
CN112838925B (zh) * 2020-06-03 2023-04-18 中兴通讯股份有限公司 数据传输方法、装置和系统、电子设备、存储介质
CN112738800A (zh) * 2020-12-25 2021-04-30 中盈优创资讯科技有限公司 一种网络切片的数据安全传输实现方法
CN112738799A (zh) * 2020-12-29 2021-04-30 中盈优创资讯科技有限公司 一种基于策略的数据安全传输的实现方法
WO2022160314A1 (zh) * 2021-01-30 2022-08-04 华为技术有限公司 一种安全参数的获取方法、装置及系统
CN113316138B (zh) * 2021-04-27 2023-04-07 中盈优创资讯科技有限公司 一种应用层加密实现方法及其实现装置
CN113872752B (zh) * 2021-09-07 2023-10-13 哲库科技(北京)有限公司 安全引擎模组、安全引擎装置和通信设备
CN117527280A (zh) * 2022-07-29 2024-02-06 中兴通讯股份有限公司 用户终端接入网络的安全认证方法、装置及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101128061A (zh) * 2007-09-27 2008-02-20 中兴通讯股份有限公司 移动管理单元、演进基站、确定用户面是否加密的方法和系统
CN101242629A (zh) * 2007-02-05 2008-08-13 华为技术有限公司 选择用户面算法的方法、系统和设备
CN101335675A (zh) * 2008-01-09 2008-12-31 中兴通讯股份有限公司 一种策略控制方法
WO2016069638A2 (en) * 2014-10-29 2016-05-06 Qualcomm Incorporated User-plane security for next generation cellular networks

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7233671B2 (en) * 2003-02-13 2007-06-19 Innovative Sonic Limited Method for storing a security start value in a wireless communications system
CN1941695B (zh) * 2005-09-29 2011-12-21 华为技术有限公司 初始接入网络过程的密钥生成和分发的方法及系统
CN101188492B (zh) * 2006-11-17 2010-08-18 中兴通讯股份有限公司 实现安全业务的系统和方法
CN101488847B (zh) * 2008-01-18 2011-09-14 华为技术有限公司 一种数据加密的方法、装置和系统
CN101499959B (zh) * 2008-01-31 2012-08-08 华为技术有限公司 配置密钥的方法、装置及系统
CN101262337B (zh) * 2008-02-05 2012-06-06 中兴通讯股份有限公司 安全功能控制方法和系统
CN102045210B (zh) * 2009-10-10 2014-05-28 中兴通讯股份有限公司 一种支持合法监听的端到端会话密钥协商方法和系统
CN102149088A (zh) * 2010-02-09 2011-08-10 工业和信息化部电信传输研究所 一种保护移动用户数据完整性的方法
US8699708B2 (en) * 2010-06-29 2014-04-15 Alcatel Lucent Light-weight security solution for host-based mobility and multihoming protocols
US9386045B2 (en) * 2012-12-19 2016-07-05 Visa International Service Association Device communication based on device trustworthiness
GB2509937A (en) * 2013-01-17 2014-07-23 Nec Corp Providing security information to a mobile device in which user plane data and control plane signalling are communicated via different base stations
CN104955040B (zh) * 2014-03-27 2019-12-24 西安西电捷通无线网络通信股份有限公司 一种网络鉴权认证的方法及设备
WO2016082147A1 (zh) * 2014-11-27 2016-06-02 华为技术有限公司 寻呼方法、基站及寻呼系统
CN106487501B (zh) * 2015-08-27 2020-12-08 华为技术有限公司 密钥分发和接收方法、密钥管理中心、第一和第二网元
US11659382B2 (en) * 2017-03-17 2023-05-23 Telefonaktiebolaget Lm Ericsson (Publ) Security solution for switching on and off security for up data between UE and RAN in 5G
WO2018201506A1 (zh) * 2017-05-05 2018-11-08 华为技术有限公司 一种通信方法及相关装置
CN108810884B (zh) * 2017-05-06 2020-05-08 华为技术有限公司 密钥配置方法、装置以及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101242629A (zh) * 2007-02-05 2008-08-13 华为技术有限公司 选择用户面算法的方法、系统和设备
CN101128061A (zh) * 2007-09-27 2008-02-20 中兴通讯股份有限公司 移动管理单元、演进基站、确定用户面是否加密的方法和系统
CN101335675A (zh) * 2008-01-09 2008-12-31 中兴通讯股份有限公司 一种策略控制方法
WO2016069638A2 (en) * 2014-10-29 2016-05-06 Qualcomm Incorporated User-plane security for next generation cellular networks

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020159654A1 (en) * 2019-01-29 2020-08-06 Google Llc Integrity protection with message authentication codes having different lengths
US11917410B2 (en) 2019-01-29 2024-02-27 Google Llc Integrity protection with message authentication codes having different lengths

Also Published As

Publication number Publication date
CN110574406B (zh) 2021-04-20
BR112019023236A2 (pt) 2020-05-19
EP3611949A4 (en) 2020-04-22
CN108810884A (zh) 2018-11-13
CN110493774B (zh) 2023-09-26
EP3611949A1 (en) 2020-02-19
US20200084631A1 (en) 2020-03-12
WO2018205394A1 (zh) 2018-11-15
CN110493774A (zh) 2019-11-22
CN108810884B (zh) 2020-05-08
CN110574406A (zh) 2019-12-13

Similar Documents

Publication Publication Date Title
WO2018205427A1 (zh) 密钥配置方法、装置以及系统
US11695742B2 (en) Security implementation method, device, and system
CN109314638B (zh) 密钥配置及安全策略确定方法、装置
US20220132313A1 (en) Methods and apparatus for wireless communication using a security model to support multiple connectivity and service contexts
WO2019004929A2 (zh) 网络切片分配方法、设备及系统
WO2018000936A1 (zh) 密钥配置及安全策略确定方法、装置
CN113518315B (zh) 一种配置无线承载的方法、装置及系统
CN113766497B (zh) 密钥分发方法、装置、计算机可读存储介质及基站
WO2024001524A1 (zh) 一种通信方法及装置
NZ755869B2 (en) Security implementation method, device and system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17909068

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112019023236

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 2017909068

Country of ref document: EP

Effective date: 20191115

ENP Entry into the national phase

Ref document number: 112019023236

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20191105