WO2018228444A1 - 连接管理方法、终端及无线接入网设备 - Google Patents

连接管理方法、终端及无线接入网设备 Download PDF

Info

Publication number
WO2018228444A1
WO2018228444A1 PCT/CN2018/091110 CN2018091110W WO2018228444A1 WO 2018228444 A1 WO2018228444 A1 WO 2018228444A1 CN 2018091110 W CN2018091110 W CN 2018091110W WO 2018228444 A1 WO2018228444 A1 WO 2018228444A1
Authority
WO
WIPO (PCT)
Prior art keywords
connection management
security algorithm
management message
information
integrity protection
Prior art date
Application number
PCT/CN2018/091110
Other languages
English (en)
French (fr)
Inventor
李秉肇
权威
王学龙
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018228444A1 publication Critical patent/WO2018228444A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections

Definitions

  • the embodiments of the present invention relate to communications technologies, and in particular, to a connection management method, a terminal, and a radio access network device.
  • an inactive state is proposed, which is another state different from the Connected state and the Idle state.
  • the terminal is saved.
  • the own context information and the information connected to the core network also store the location management area information of the anchor radio access network (RAN) device configuration.
  • the location management area information corresponds to a location management area, and the terminal does not need to notify the anchor RAN device when moving in the location management area.
  • the anchor RAN device needs to be notified by a message.
  • the connection management request message may be sent to the serving RAN device, where the connection management request message includes the context identifier of the terminal, and the serving RAN device obtains the identifier from the anchor RAN device according to the context identifier of the terminal.
  • the context information of the terminal, the serving RAN device determines the security algorithm used by the terminal according to the context information of the terminal. If the security RAN does not support the security algorithm, the service RAN uses the connection management message sent by the security algorithm supported by the RAN, and cannot be correctly verified by the terminal. And decryption, which causes connection management to fail.
  • the embodiment of the present application provides a connection management method, a terminal, and a radio access network device, which can complete a connection management process.
  • an embodiment of the present application provides a connection management method, including:
  • the terminal performs a first integrity verification on the connection management message according to the first security algorithm and the integrity protection information;
  • the terminal performs a second integrity check according to the result of the first integrity check, and the terminal performs a connection management process according to the result of the second integrity check.
  • the terminal after receiving the connection management message and the integrity protection information sent by the RAN device, the terminal performs the first integrity verification on the received connection management message by using the first security algorithm saved by the terminal itself, and according to the first complete
  • the result of the sexual verification determines that the second security algorithm is used to perform the second integrity verification, thereby performing the connection management process, thereby achieving correct verification and decryption, ensuring the normal execution of the connection management, and completing the connection management process.
  • the terminal performing the second integrity check according to the result of the first integrity check may specifically include: when the first integrity The terminal obtains the configuration information of the second security algorithm included in the connection management message when the result of the verification is that the terminal fails; the terminal according to the configuration information of the second security algorithm and the integrity protection information The connection management message performs a second integrity check.
  • the terminal may learn that the security algorithm used by the RAN device is different from its own security algorithm, and the received connection management message is not encrypted, and the terminal acquires the connection management message.
  • the configuration information of the second security algorithm used by the RAN device carried in the second security algorithm is used to perform the second integrity verification, thereby implementing correct verification and completing the connection recovery process.
  • the terminal performs a connection management process according to the result of the second integrity verification, including: When the result of the second integrity check is passed, the connection management process is performed.
  • the performing the connection management when the result of the second integrity check is passed includes: when the result of the second integrity check is passed, and the connection management message does not carry the first type of configuration parameter information, performing a connection management process, where the first type of configuration parameter information is only encrypted The configuration information sent in the message.
  • the terminal may also check whether the connection management message carries the first type of configuration parameter information, and when it does not carry the first type configuration parameter information, perform the connection management process.
  • the connection management message may be determined to be an illegal message, and the connection management process may be terminated. This further enhances the security of connection management.
  • the method further includes: when the result of the first integrity check is passed And the terminal decrypts the connection recovery message by using the first security algorithm, and performs connection recovery according to the decrypted connection recovery message.
  • an embodiment of the present invention provides a connection management method, including:
  • the radio access network RAN device acquires configuration information of the first security algorithm used by the terminal;
  • the RAN device generates a connection management message and integrity protection information according to the determination result
  • the RAN device sends the connection management message and the integrity protection information.
  • the RAN device determines whether the RAN device supports the first security algorithm used by the terminal, and generates a connection management message and integrity protection information according to the determination result, and sends the connection management message and the integrity protection information to the terminal, thereby Ensure that the terminal can correctly verify and decrypt the received connection management message to complete the connection management process.
  • the RAN device generates a connection management message and integrity protection information according to the determination result, including: when the determining result is that the RAN device does not support the When the first security algorithm is described, the RAN device generates a connection management message, and generates the integrity protection information according to the connection management message by using a second security algorithm, where the second security algorithm is supported by the RAN device;
  • the connection management message includes configuration information of the second security algorithm.
  • the RAN device when the determining result is that the RAN device does not support the first security algorithm, the RAN device generates a connection management message, where the connection management message includes configuration information of a second security algorithm used by the RAN device, and according to The connection management message uses the second security algorithm to generate the integrity protection information, and sends the connection management message and the integrity protection information to the terminal, so as to obtain the second RAN device used by the terminal from the unencrypted connection management message.
  • the configuration information of the security algorithm completes the connection management process.
  • connection management message further includes a second type of configuration parameter information, where the second type configuration
  • the parameter information is configuration information that is allowed to be sent in encrypted and unencrypted messages.
  • the RAN device generates the connection management message and the integrity protection information according to the determination result, including: When the RAN device supports the first security algorithm, the RAN device uses the first security algorithm to encrypt the connection management message, and generates the integrity according to the connection management message using a first security algorithm. Protect information.
  • the connection management message carries the first type of configuration parameter information and the second type of configuration parameter information
  • the first type of configuration parameter information is configuration information that is allowed to be sent in an encrypted message
  • the second type of configuration parameter information is configuration information that is allowed to be sent in encrypted and unencrypted messages.
  • an embodiment of the present invention provides a connection management method, including:
  • the terminal receives the connection management message, the integrity protection information, and the configuration information of the security algorithm, where the connection management message is encrypted by using the security algorithm, and the integrity protection information is used according to the connection management message by using the security algorithm.
  • the generated configuration information of the security algorithm is not encrypted;
  • the terminal performs integrity verification on the connection management message according to configuration information of the security algorithm, and decrypts the connection management message based on configuration information of the security algorithm, and performs a connection management process according to the decryption result.
  • the terminal receives the connection management message, the integrity protection information, and the configuration information of the unencrypted security algorithm, and the terminal may learn the configuration information of the security algorithm used by the RAN device from the configuration information of the unencrypted security algorithm, so that the terminal correctly Connection management messages are decrypted to ensure proper execution of connection management.
  • connection management message, the integrity protection information, and the configuration information of the security algorithm are transmitted through a high-level data unit.
  • the configuration information of the security algorithm is in a header of a PDCP layer data unit, or in a PDCP layer data. After the integrity protection information for the unit.
  • an embodiment of the present invention provides a connection management method, including:
  • the radio access network RAN device uses a security algorithm to generate a connection management message, and uses the security algorithm to generate integrity protection information according to the connection management message;
  • the RAN device sends the connection management message, the integrity protection information, and configuration information of the security algorithm that is not encrypted.
  • the RAN device uses a security algorithm to generate a connection management message, and uses a security algorithm to generate integrity protection information according to the connection management message, and configures the encrypted connection management message, integrity protection information, and unencrypted security algorithm.
  • the information is sent to the terminal, so that the terminal can know the configuration information of the security algorithm used by the RAN device, so as to correctly decrypt the connection management message and ensure the normal execution of the connection management.
  • the configuration information of the security algorithm includes at least one of an identifier of a security algorithm, a key, and a key input parameter.
  • the RAN device sends the connection management message, the integrity protection information, and
  • the configuration information of the security algorithm that is encrypted includes: the RAN device sends the connection management message, the integrity protection information, and configuration information of the security algorithm that is not encrypted through a high-level data unit.
  • the RAN device uses a security algorithm to generate a connection management message, and uses a security algorithm to generate integrity protection information according to the connection management message, and configures the encrypted connection management message, integrity protection information, and unencrypted security algorithm.
  • the information is sent to the terminal through a high-level data unit, so that the terminal can learn the configuration information of the security algorithm used by the RAN, so as to correctly decrypt the connection management message and ensure the normal execution of the connection management.
  • the high-level data unit includes a PDCP layer data unit
  • the RAN device sends the connection management message, the integrity protection information, and the unencrypted configuration information of the security algorithm by using a high-level data unit, where the RAN device sends the connection management message of the RRC layer Data set as a PDCP layer data unit; the RAN device sets configuration information of the unencrypted security algorithm at a header of a PDCP layer data unit, or after the integrity protection information of a PDCP layer data unit.
  • an embodiment of the present invention provides a terminal, where the terminal has a function of implementing terminal behavior in the foregoing method embodiment.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • an embodiment of the present invention provides a terminal, including: a processor, a memory, and a communication interface; the memory is configured to store a computer execution instruction, and when the terminal is running, the processor executes the computer execution instruction stored in the memory.
  • the connection management method of any one of the above-mentioned first aspect or the third aspect is performed by the terminal.
  • an embodiment of the present invention provides a computer readable storage medium, configured to store computer software instructions used by the terminal, when executed on a computer, to enable the computer to perform any one of the foregoing first aspects. Or the connection management method of any one of the third aspects.
  • an embodiment of the present invention provides a computer program product including instructions, which, when run on a computer, enable the computer to perform the connection management method according to any one of the above first aspects or the third aspect .
  • an embodiment of the present invention provides a radio access network device, where the radio access network device has a function of implementing a behavior of a radio access network device in the foregoing method embodiment.
  • This function can be implemented in hardware or in hardware by executing the corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • an embodiment of the present invention provides a radio access network device, including: a processor, a memory, and a communication interface; the memory is configured to store a computer to execute an instruction, and when the radio access network device is in operation, the processor executes the The computer stored in the memory executes instructions to cause the wireless access network device to perform the connection management method of any one of the second aspect or the fourth aspect.
  • an embodiment of the present invention provides a computer readable storage medium, configured to store computer software instructions used by the wireless access network device, and when executed on a computer, enable the computer to execute the second The connection management method according to any one of the aspects or the fourth aspect.
  • an embodiment of the present invention provides a computer program product comprising instructions, which when executed on a computer, enable the computer to perform connection management according to any one of the above first aspects or any one of the third aspects method.
  • an embodiment of the present invention provides a chip for running an instruction, where the chip is configured to perform the following steps:
  • connection management message and the integrity protection information are from a radio access network device, and the integrity protection information is generated by the radio access network device according to the connection management message using a first security algorithm.
  • an embodiment of the present invention provides a chip for running an instruction, where the chip is configured to perform the following steps:
  • the protection information and the configuration information of the security algorithm are from the radio access network device, the connection management message is encrypted using the security algorithm, and the integrity protection information is used according to the connection management message by using the security algorithm.
  • the generated configuration information of the security algorithm is not encrypted.
  • connection management message referred to herein refers to a message for connection management between the network side and the terminal, which may specifically be a connection recovery message, a connection suspension message, a connection continuation message, a connection activation message, a connection reactivation message, a connection establishment message, Connection re-establishment message, connection reconfiguration message, etc.
  • the inactive state referred to herein specifically means that the terminal saves its own context information and can perform a cell-based reselection operation.
  • the connection information of the terminal is stored in the anchor RAN device, and the connection information of the terminal includes the context information of the terminal and the core network connection information.
  • a terminal in an inactive state performs cell reselection in the same manner as a terminal in an idle Idle state.
  • the terminal saves the location management area information configured by the anchor RAN device, and when the terminal moves out of the location management area corresponding to the location management area information, the anchor RAN device needs to be notified.
  • the connection management method, the terminal, and the radio access network device in the embodiment of the present application determine whether the RAN device supports the first security algorithm used by the terminal by using the RAN device, and generate a connection management message and integrity protection information according to the judgment result, and connect the connection.
  • the management message and the integrity protection information are sent to the terminal, and after receiving the connection management message and the integrity protection information sent by the RAN device, the terminal performs the first integrity of the received connection management message by using the first security algorithm saved by the terminal itself.
  • Validation, and according to the result of the first integrity verification, the second security algorithm is used to perform the second integrity verification, thereby performing the connection management process, thereby achieving correct verification and decryption, and ensuring the normal execution of the connection management.
  • the normal execution of the connection management of the terminal can be implemented even if the encryption algorithm used by the terminal and the RAN device is different.
  • FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present application
  • connection management method 2 is a flowchart of a connection management method according to an embodiment of the present application.
  • FIG. 3 is a flowchart of another connection management method according to an embodiment of the present application.
  • connection management method 4 is a flowchart of another connection management method according to an embodiment of the present application.
  • FIG. 5 is a flowchart of another connection management method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a PDCP data unit according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a radio access network RAN device according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another terminal according to an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of another radio access network RAN device according to an embodiment of the present application.
  • FIG. 11 is a schematic block diagram of a communication apparatus according to an embodiment of the present application.
  • FIG. 12 is another schematic block diagram of a communication apparatus according to an embodiment of the present application.
  • FIG. 13 is still another schematic block diagram of a communication apparatus according to an embodiment of the present application.
  • FIG. 14 is still another schematic block diagram of a communication device according to an embodiment of the present application.
  • FIG. 15 is still another schematic block diagram of a communication device according to an embodiment of the present application.
  • FIG. 16 is still another schematic block diagram of a communication apparatus according to an embodiment of the present application.
  • FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present disclosure.
  • an application scenario of the embodiment may include: a core network device, and an anchor radio access network (RAN) device 2.
  • the RAN device 3 and the terminal 4 are configured to be responsible for management of radio resources, establishment of a radio connection, quality of service (QoS) guarantee, and final resource release.
  • the core network device may be a Mobility Management Entity (MME), a Gateway (Gateway, GW for short), or a functional entity of the 5G Core network, such as access and mobile.
  • MME Mobility Management Entity
  • GW Gateway
  • the Core Access and Mobility Management Function (AMF), the Session Management Function (SMF), and the like may of course be other core network devices, which are merely illustrative.
  • the anchor RAN device 2 retains the context information of the terminal 4 and the core network interface information, and the terminal 4 can connect with the anchor RAN device 2 through the RAN device 3, and establish a communication connection with the core network side through the anchor RAN device 2 .
  • the anchor RAN device 2 may also be referred to as a source RAN device, and the RAN device 3 may also be referred to as a new RAN device, a serving RAN device, or the like.
  • the terminal 4 of the embodiment of the present application is in an inactive state, and when the terminal 4 in the inactive state needs to perform connection management, the connection management method of the terminal 4 can be implemented by the connection management method in the embodiment of the present application, and the RAN device 3 is not supported.
  • the security algorithm of the terminal 4 causes the connection management to fail.
  • connection management may include: establishing a connection for the idle terminal, restoring the connection for the inactive terminal, or updating the connection for the connected terminal.
  • the Radio Access Network (RAN) device involved in this document is a device that connects a terminal to a wireless network, and may be a Global System of Mobile communication (GSM) or Base Transceiver Station (BTS) in Code Division Multiple Access (CDMA), or base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA). It may be an evolved base station (Evolutional Node B, eNB or eNodeB) in a Long Term Evolution (LTE), or a relay station or an access point, or a base station in a future 5G network, and the like, which is not limited herein.
  • GSM Global System of Mobile communication
  • BTS Base Transceiver Station
  • CDMA Code Division Multiple Access
  • NodeB, NB base station
  • WCDMA Wideband Code Division Multiple Access
  • It may be an evolved base station (Evolutional Node B, eNB or eNodeB) in a Long Term Evolution (LTE), or a relay station or an access point, or a
  • a terminal referred to herein refers to a device that provides voice and/or data connectivity to a user, including a wireless terminal or a wired terminal.
  • the wireless terminal can be a handheld device with wireless connectivity, or other processing device connected to a wireless modem, and a mobile terminal that communicates with one or more core networks via a wireless access network.
  • the wireless terminal can be a mobile phone (or "cellular" phone) and a computer with a mobile terminal.
  • the wireless terminal can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device.
  • the wireless terminal can be part of a User Equipment (UE).
  • UE User Equipment
  • the security algorithms involved herein include encryption algorithms or integrity protection algorithms, and may also include encryption algorithms and integrity protection algorithms.
  • the encryption algorithm may include: EPS Encryption Algorithm 1 (EEA1), EEA2, EEA3, etc.
  • the integrity protection algorithm may include EPS Integrity Algorithm 1 (EIA1), EIA2, and the like.
  • EIA1 is based on the SNOW 3G algorithm.
  • the security algorithm includes an encryption algorithm and an integrity protection algorithm
  • the encryption algorithm and the integrity protection algorithm may have a corresponding relationship.
  • the encryption algorithm 1 corresponds to the integrity protection algorithm 1
  • the encryption algorithm 2 corresponds to the integrity protection algorithm 2.
  • Encryption using a security algorithm may include encrypting using an encryption algorithm in a security algorithm.
  • Using security algorithms for integrity protection can include integrity protection using an integrity protection algorithm in the security algorithm.
  • first security algorithm and second security algorithm are only used to distinguish different security algorithms. That is, the encryption algorithm and/or integrity protection algorithm used by the two are different.
  • integration check specifically refers to the terminal calculating the X-MAC according to the received message and the security algorithm configuration information, and comparing the X-MAC with the received integrity check information, if the same, the integrity Pass the test, otherwise, the integrity test will not pass.
  • a plurality refers to two or more. "and/or”, describing the association relationship of the associated objects, indicating that there may be three kinds of relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the character "/" generally indicates that the contextual object is an "or" relationship.
  • FIG. 2 is a flowchart of a connection management method according to an embodiment of the present application. As shown in FIG. 2, this embodiment relates to a RAN device and a terminal, and the RAN device may be specifically the RAN device 3 shown in FIG.
  • the methods can include:
  • Step 101 The RAN device acquires configuration information of a first security algorithm used by the terminal.
  • the terminal may send a connection management request message to the RAN device.
  • the connection recovery request message may be used to request the RAN device to manage the connection for the terminal.
  • the RAN device receives the connection management request message, where the connection management request message may include a context identifier of the terminal, and the RAN device acquires context information of the terminal from the anchor RAN device according to the context identifier of the terminal, and the RAN device obtains the context of the terminal.
  • the information of the first security algorithm used by the terminal is obtained from the information.
  • the context identifier of the terminal may include an identifier of the anchor RAN device and an identifier of the terminal, and the RAN device may determine, according to the identifier of the anchor RAN device, request the terminal from the anchor RAN device. Identifying the corresponding context information, the anchor RAN device sends the context information of the terminal to the RAN device, where the context information may include configuration information of the first security algorithm used by the terminal, and the RAN device obtains the context information of the terminal.
  • the configuration information of the first security algorithm may include at least one of an identifier of the first security algorithm, a key, and a key input parameter.
  • the configuration information of the first security algorithm may be configured by the anchor RAN device to the terminal.
  • Step 102 The RAN device determines, according to the configuration information, whether the RAN device supports the first security algorithm.
  • the RAN device may determine, according to the configuration information acquired in step 101, the first security algorithm corresponding to the configuration information, and further determine whether the first security algorithm is supported by itself.
  • the determining, by the RAN device, whether the first security algorithm is supported by the RAN device may include: determining whether the AAA device supports the encryption algorithm and/or the integrity protection algorithm included in the first security algorithm, that is, determining whether the encryption algorithm of the first security algorithm is supported, or It is determined whether the integrity protection algorithm of the first security algorithm is supported, or whether the encryption algorithm and the integrity protection algorithm of the first security algorithm are supported, and the specific implementation manner can be flexibly set according to requirements.
  • Step 103 The RAN device generates a connection management message and integrity protection information according to the determination result.
  • the integrity protection information is generated by integrity protection of the connection management message.
  • the judgment result of the above step 102 includes two types: support and no support.
  • the specific implementation of the step 103 may be that the RAN device generates a connection management message, the connection management message is not encrypted, and the connection management message carries configuration information of the second security algorithm, and the second security algorithm A security algorithm supported by the RAN device, and the RAN device generates integrity protection information using the second security algorithm for integrity protection according to the connection management message.
  • step 103 may be that the RAN device uses the first security algorithm to generate a connection management message, that is, the connection management message is an encrypted message, and uses the first security algorithm according to the connection management message. Perform integrity protection to generate integrity protection information.
  • Step 104 The RAN device sends the connection management message and the integrity protection information.
  • the RAN device sends the connection management message and the integrity protection information to the terminal, and the terminal receives the connection management message and the integrity protection information sent by the RAN device.
  • Step 105 The terminal performs a first integrity verification on the connection management message according to the first security algorithm and the integrity protection information.
  • the terminal After receiving the connection management message and the integrity protection information, the terminal uses the first security algorithm supported by the terminal to perform integrity verification on the connection management message, that is, according to the received integrity protection information.
  • a sexual protection algorithm to verify the integrity of the received connection management message.
  • Step 106 The terminal performs a second integrity check according to a result of the first integrity check.
  • the results of the first integrity check include pass and fail.
  • One of the implementations is that when the result of the first integrity check is passed, the second integrity check is skipped.
  • step 106 is performed, that is, the second integrity check is performed.
  • the terminal fails to pass the result of the first integrity check, and can learn that the security algorithm used by the RAN device is different from its own security algorithm, and then performs the second integrity check.
  • Step 107 The terminal performs a connection management process according to a result of the second integrity verification.
  • the terminal may determine, according to the result of the first integrity check, that the connection management message received by the terminal is encrypted, and decrypt the connection management message by using the first security algorithm, according to the decryption. Post connection management messages for connection management. If the result of the first integrity check is not passed, after step 106, step 107 is performed, and the terminal may determine, according to the result of the first integrity check, that the connection management message received by the terminal is not encrypted, and the RAN device and the terminal are used for security.
  • the terminal obtains the configuration information of the second security algorithm used by the RAN device from the unencrypted connection management message, and performs the second integrity verification on the connection management message according to the configuration information and the integrity protection information of the second security algorithm.
  • the connection management process is performed according to the connection management message.
  • the RAN device determines whether the RAN device supports the first security algorithm used by the terminal, and generates a connection management message and integrity protection information according to the determination result, and sends the connection management message and the integrity protection information to the terminal, where the terminal After receiving the connection management message and the integrity protection information sent by the RAN device, performing the first integrity verification on the received connection management message by using the first security algorithm saved by the terminal itself, and according to the result of the first integrity verification,
  • the second security algorithm is used to perform the second integrity verification, thereby performing the connection management process, thereby achieving correct verification and decryption, and ensuring the normal execution of the connection management.
  • the normal execution of the connection management of the terminal can be implemented even if the encryption algorithm used by the terminal and the RAN device is different.
  • FIG. 3 is a flowchart of another connection management method according to an embodiment of the present application. As shown in FIG. 3, the method in this embodiment may include:
  • Step 201 The anchor RAN device configures the first security algorithm used by the terminal to the terminal.
  • the anchor RAN device may send the configuration information of the first security algorithm to the terminal, so as to implement configuring the first security algorithm used by the terminal to the terminal.
  • the configuration information of the first security algorithm refer to the explanation of the embodiment shown in FIG. 2, and details are not described herein again.
  • the terminal uses the first security algorithm to perform integrity protection verification and encryption and decryption operations on the received or transmitted data or signaling messages.
  • Step 202 The anchor RAN device controls the terminal to enter an inactive state.
  • the anchor RAN device sends a status control command to the terminal to indicate that the terminal enters an inactive state.
  • the anchor RAN device sends the context information of the terminal to the terminal before or at the same time as step 202, and the context information of the terminal includes the context identifier of the terminal.
  • the context identifier of the terminal refer to the description of the embodiment shown in FIG. 2, and details are not described herein again.
  • Step 203 The terminal sends a connection management request message to the RAN device.
  • the RAN device receives a connection management request message sent by the terminal, where the connection management request message carries a context identifier of the terminal.
  • the terminal may send a connection management request message to the RAN device, so that the RAN device manages the connection for the terminal.
  • Step 204 The RAN device acquires the context information of the terminal from the anchor RAN device according to the context identifier of the terminal, and obtains configuration information of the first security algorithm used by the terminal from the context information of the terminal.
  • Step 205 The RAN device determines, according to the configuration information of the first security algorithm, whether the RAN device supports the first security algorithm. When the RAN device does not support the first security algorithm, step 206 is performed. When the RAN device supports the first security algorithm, the RAN device performs Step 206'.
  • Step 206 The RAN device generates a connection management message, and generates integrity protection information according to the connection management message by using a second security algorithm.
  • the second security algorithm is supported by the RAN device.
  • the connection management message generated in step 206 is not encrypted, and the connection management message carries configuration information of the second security algorithm used by the RAN device.
  • connection management message may further carry a second type of configuration parameter, where the second type of configuration parameter information is configuration information that is allowed to be sent in an encrypted or unencrypted message.
  • the second type of configuration parameter may specifically be physical resource configuration information.
  • Step 206' the RAN device encrypts the connection management message by using the first security algorithm, and generates the integrity protection information according to the connection management message by using the first security algorithm.
  • connection management message generated in step 206' is an encrypted message.
  • the connection management message may carry the first type of configuration parameter information and the second type of configuration parameter information, where the first type of configuration parameter information is configuration information that is allowed to be sent in the encrypted message, and the second type of configuration parameter Information is configuration information that is allowed to be sent in encrypted and unencrypted messages.
  • the first type of configuration parameter information is configuration information that is allowed to be sent in the encrypted message
  • the second type of configuration parameter Information is configuration information that is allowed to be sent in encrypted and unencrypted messages.
  • the configuration information of the first type may be the configuration information of the logical channel.
  • the configuration parameters carried in the connection management message are classified into two types, one is parameter information that needs to be encrypted, that is, the first type of configuration parameter information, and the other type can be sent without encryption.
  • Parameter information that is, the second type of configuration parameter information.
  • Step 207 The RAN device sends a connection management message and integrity protection information to the terminal.
  • connection management message and integrity protection information are generated in step 206 or step 206'.
  • the terminal receives the connection management message and the integrity protection information sent by the RAN device.
  • Step 208 The terminal performs a first integrity verification on the received connection management message according to the first security algorithm and the integrity protection information.
  • step 209 is performed, and when the first integrity check passes, step 210 is performed.
  • step 209 is performed, and when the result of the first integrity check is passed, step 210 is performed.
  • Step 209 The terminal acquires configuration information of the second security algorithm included in the connection management message, and performs second integrity verification on the connection management message according to the configuration information and the integrity protection information of the second security algorithm, where the terminal is configured according to the The result of the second integrity check performs the connection management process.
  • the terminal may determine, according to the result, that the received connection management message is not encrypted, and obtain configuration information of the second security algorithm included in the connection management message.
  • the second security algorithm is used to perform the second integrity check, and when the second integrity check passes, the connection management process is performed.
  • the connection management message is not encrypted, and carries the second type of configuration parameter information.
  • the RAN device may send another encrypted message to the terminal, and the terminal may use the connection management message to include The configuration information of the second security algorithm is decrypted to obtain the first type of parameter configuration information.
  • the terminal may further check whether the connection management message carries the first type of configuration parameter information, and when the first type configuration parameter information is not carried, the connection management process is performed.
  • the connection management message may be determined to be an illegal message, and the connection management process may be terminated. This further enhances the security of connection management.
  • Step 210 The terminal decrypts the connection management message by using the first security algorithm, and performs connection management according to the decrypted connection management message.
  • the RAN device determines whether the RAN device supports the first security algorithm used by the terminal, and generates a connection management message and integrity protection information according to the determination result, and sends the connection management message and the integrity protection information to the terminal, where the terminal After receiving the connection management message and the integrity protection information sent by the RAN device, performing the first integrity verification on the received connection management message by using the first security algorithm saved by the terminal itself, and when the result of the first integrity check is When passed, the second security algorithm is used to perform the second integrity verification, thereby performing the connection management process, thereby achieving correct verification and decryption, and ensuring the normal execution of the connection management.
  • the normal execution of the connection management of the terminal can be implemented even if the encryption algorithm used by the terminal and the RAN device is different.
  • the present application further provides another connection management method to achieve the same technical effects as the foregoing embodiments.
  • the present application further provides another connection management method to achieve the same technical effects as the foregoing embodiments.
  • FIG. 4 is a flowchart of another connection management method according to an embodiment of the present application. As shown in FIG. 4, the method in this embodiment may include:
  • Step 301 The RAN device uses a security algorithm to generate a connection management message, and uses a security algorithm to generate integrity protection information according to the connection management message.
  • Step 302 The RAN device sends connection management messages, integrity protection information, and configuration information of the unencrypted security algorithm.
  • the terminal receives the connection management message, the integrity protection information, and the configuration information of the unencrypted security algorithm sent by the RAN device.
  • Step 303 The terminal performs integrity verification on the connection management message according to the configuration information of the security algorithm, and decrypts the connection management message according to the configuration information of the security algorithm, and performs a connection management process according to the decryption result.
  • the configuration information of the security algorithm may include at least one of an identifier of a security algorithm, a key, and a key input parameter.
  • connection management message, integrity protection information, and configuration information of the security algorithm are transmitted through a high-level data unit.
  • the upper layer includes a layer other than the physical layer, and may include any one of the following: a Service Data Adaptation Protocol (SDAP) layer, a Packet Data Convergence Protocol (PDCP) layer, and a MAC layer. And the RLC layer.
  • SDAP Service Data Adaptation Protocol
  • PDCP Packet Data Convergence Protocol
  • RLC Radio Link Control
  • the configuration information of the foregoing security algorithm may be transmitted through a MAC layer header, a MAC layer control unit, or a MAC logical channel.
  • the configuration information of the foregoing security algorithm may be transmitted through a PDCP layer header, a PDCP layer control unit, or a PDCP layer tail.
  • connection management message is generated by the RAN device using the security algorithm encryption
  • security protection information is generated according to the connection management message by using the security algorithm
  • the encrypted connection management message, the integrity protection information, and the unencrypted security algorithm are used.
  • the configuration information is sent to the terminal, so that the terminal can learn the configuration information of the security algorithm used by the RAN, so as to correctly decrypt the connection management message and ensure the normal execution of the connection management.
  • the normal execution of the connection management of the terminal can be implemented even if the encryption algorithm used by the terminal and the RAN device is different.
  • FIG. 5 is a flowchart of another connection management method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a PDCP data unit according to an embodiment of the present application. As shown in FIG. 5, the method in this embodiment may include:
  • Step 401 The anchor RAN device configures, by the terminal, the first security algorithm used by the terminal.
  • Step 402 The anchor RAN device controls the terminal to enter an inactive state.
  • Step 403 The terminal sends a connection management request message to the RAN device.
  • Step 404 The RAN device acquires the context information of the terminal from the anchor RAN device according to the context identifier of the terminal, and obtains configuration information of the first security algorithm used by the terminal from the context information of the terminal.
  • steps 401 to 404 For the specific explanation of the foregoing steps 401 to 404, reference may be made to steps 201 to 204 of the embodiment shown in FIG. 3, and details are not described herein again.
  • Step 405 The RAN device determines, according to the configuration information of the first security algorithm, whether the RAN device supports the first security algorithm. When the RAN device does not support the first security algorithm, step 406 is performed. When the RAN device supports the first security algorithm, Step 406' is performed.
  • Step 406 The RAN device generates a connection management message by using a second security algorithm, and generates integrity protection information according to the connection management message by using the second security algorithm.
  • Step 407 The RAN device sends a connection management message, integrity protection information, and configuration information of the second security algorithm that is not encrypted.
  • the terminal receives the connection management message, the integrity protection information, and the configuration information of the unencrypted second security algorithm sent by the RAN device.
  • the RAN device determines that the configuration information of the security algorithm of the terminal needs to be updated, and the RRC layer of the RAN device generates a connection management message.
  • the connection management message is encapsulated in the payload of the PDCP layer, and a field carrying the configuration information of the second security algorithm is added after the integrity protection information of the PDCP layer.
  • the PDCP layer data unit may send, by using the PDCP layer data unit, connection management messages, integrity protection information, and configuration information of an unencrypted second security algorithm to the terminal.
  • Step 408 The terminal performs integrity verification on the connection management message according to the configuration information of the second security algorithm, and decrypts the connection management message based on the configuration information of the second security algorithm, and performs a connection management process according to the decryption result.
  • the PDCP layer data unit is taken as an example for further example.
  • the terminal After receiving the PDCP layer data unit, the terminal extracts the configuration information of the second security algorithm, and uses the second security algorithm to perform integrity verification on the connection management message. And decryption to perform the connection management process.
  • Step 406' the RAN device generates a connection management message by using a first security algorithm, and generates integrity protection information according to the connection management message using the first security algorithm.
  • Step 407' the RAN device sends a connection management message and integrity protection information.
  • the terminal receives the connection management message and the integrity protection information sent by the RAN device.
  • Step 408' the terminal performs integrity verification on the connection management message by using its own first security algorithm, and decrypts the connection management message based on the configuration information of the first security algorithm, and performs a connection management process according to the decryption result.
  • connection management message is generated by using the second security algorithm by the RAN device, and the integrity protection information is generated according to the connection management message by using the second security algorithm, and the encrypted connection management message, integrity protection information, and unencrypted are generated.
  • the configuration information of the second security algorithm is sent to the terminal, so that the terminal can learn the configuration information of the second security algorithm used by the RAN, so as to correctly decrypt the connection management message and ensure the normal execution of the connection management.
  • the normal execution of the connection management of the terminal can be implemented even if the encryption algorithm used by the terminal and the RAN device is different.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • the apparatus in this embodiment may include: a receiving module 11 and a processing module 12, where the receiving module 11 is configured to receive a connection management message and integrity.
  • the protection information is generated according to the connection management message by using a first security algorithm
  • the processing module 12 is configured to perform the connection management message according to the first security algorithm and the integrity protection information.
  • the first integrity check, the processing module 12 is further configured to perform a second integrity check according to the result of the first integrity check, and perform a connection management process according to the result of the second integrity check.
  • the processing module 12 is configured to perform the second integrity check according to the result of the first integrity check, where the method may include: acquiring, when the result of the first integrity check is not Determining configuration information of the second security algorithm included in the connection management message; performing second integrity verification on the connection management message according to the configuration information of the second security algorithm and the integrity protection information.
  • the processing module 12 is configured to perform a connection management process according to the result of the second integrity check.
  • the processing module 12 is configured to perform a connection management process according to the result of the second integrity check, and specifically includes: performing a connection management process when the result of the second integrity check is passed.
  • the processing module 12 is configured to: when the result of the second integrity check is a pass, perform a connection management process, where the method may include: when the result of the second integrity check is passed, The connection management message does not carry the first type of configuration parameter information, and performs a connection management process, where the first type of configuration parameter information is configuration information sent only in the encrypted message.
  • the processing module 12 is further configured to: when the result of the first integrity check is passed, decrypt the connection management message by using the first security algorithm, and according to the decrypted connection Manage messages for connection management.
  • the terminal in the embodiment of the present application may further include a storage module, where the storage module is configured to store program codes and data of the terminal.
  • the terminal in the embodiment of the present application may further include a sending module, where the sending module is configured to send a message, data, or the like.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 2 or FIG. 3, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 8 is a schematic structural diagram of a radio access network RAN device according to an embodiment of the present disclosure.
  • the apparatus in this embodiment may include: a processing module 21 and a sending module 22, where the processing module 21 is configured to determine a terminal.
  • the configuration information of the first security algorithm used by the processing module 21 is further configured to determine, according to the configuration information, whether the RAN device supports the first security algorithm, and the processing module 12 is further configured to generate a connection management message and complete according to the determination result.
  • the sexual protection information, the sending module 22 is configured to send the connection management message and the integrity protection information.
  • the processing module 21 is configured to generate, according to the determination result, the connection management message and the integrity protection information, where the method may include: when the determining result is that the RAN device does not support the first security algorithm, generating a connection Managing the message, and generating the integrity protection information according to the connection management message using a second security algorithm, the second security algorithm being supported by the RAN device; wherein the connection management message includes the second security The configuration information of the algorithm.
  • connection management message further includes a second type of configuration parameter information, where the second type of configuration parameter information is configuration information that is allowed to be sent in an encrypted or unencrypted message.
  • the processing module 21 is configured to generate, according to the determination result, the connection management message and the integrity protection information, where the method further includes: when the RAN device supports the first security algorithm, using the first security algorithm to encrypt Generating the connection management message and generating the integrity protection information using a first security algorithm according to the connection management message.
  • connection management message carries the first type of configuration parameter information and the second type of configuration parameter information, where the first type of configuration parameter information is configuration information that is allowed to be sent in the encrypted message, and the second type of configuration
  • the parameter information is configuration information that is allowed to be sent in an encrypted or unencrypted message.
  • the RAN device in the embodiment of the present application may further include a storage module, where the storage module is configured to store program codes and data of the terminal.
  • the RAN device in the embodiment of the present application may further include a receiving module, where the receiving module is configured to receive a message, data, and the like.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 2 or FIG. 3, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 9 is a schematic structural diagram of another terminal according to an embodiment of the present application.
  • the apparatus in this embodiment may include: a receiving module 31 and a processing module 32, where the receiving module 31 is configured to receive a connection management message and complete sexual protection information, and configuration information of the security algorithm, the connection management message is encrypted using the security algorithm, and the integrity protection information is generated according to the connection management message by using the security algorithm, the security algorithm
  • the configuration information is not encrypted
  • the processing module 32 is configured to perform integrity verification on the connection management message according to configuration information of the security algorithm, and decrypt the connection management message based on configuration information of the security algorithm, and The connection management process is performed based on the decrypted result.
  • connection management message, the integrity protection information, and the configuration information of the security algorithm are transmitted through a high-level data unit.
  • the configuration information of the security algorithm is in a header of a PDCP layer data unit, or after the integrity protection information of a PDCP layer data unit.
  • the terminal in the embodiment of the present application may further include a storage module, where the storage module is configured to store program codes and data of the terminal.
  • the terminal in the embodiment of the present application may further include a sending module, where the sending module is configured to send a message, data, or the like.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 4 or FIG. 5, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 10 is a schematic structural diagram of another radio access network RAN device according to an embodiment of the present application.
  • the apparatus in this embodiment may include: a processing module 41 and a sending module 42, where the processing module 41 is used.
  • the security algorithm encrypts a connection management message, and uses the security algorithm to generate integrity protection information according to the connection management message, where the sending module 42 is configured to send the connection management message, the integrity protection information, and the unencrypted Configuration information of the security algorithm.
  • the configuration information of the security algorithm includes at least one of an identifier of a security algorithm, a key, and a key input parameter.
  • the sending module is configured to send, by using a high-level data unit, the connection management message, the integrity protection information, and configuration information of the security algorithm that is not encrypted.
  • the high-level data unit includes a PDCP layer data unit, where the processing module 41 is further configured to set the connection management message of the RRC layer to data of a PDCP layer data unit, where the unencrypted security algorithm is The configuration information is set in the header of the PDCP layer data unit or after the integrity protection information of the PDCP layer data unit.
  • the RAN device in the embodiment of the present application may further include a storage module, where the storage module is configured to store program codes and data of the terminal.
  • the RAN device in the embodiment of the present application may further include a receiving module, where the receiving module is configured to receive a message, data, and the like.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 4 or FIG. 5, and the implementation principle and technical effects are similar, and details are not described herein again.
  • the receiving module 11 in the embodiment of the present application may correspond to the receiver of the terminal, and may also correspond to the transceiver of the terminal.
  • the terminal may further include a sending module, where the sending module may correspond to a transmitter of the terminal, or may correspond to a transceiver of the terminal.
  • the processing module 12 may correspond to the processor of the terminal, where the processor may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or complete the implementation of the embodiment of the present application.
  • One or more integrated circuits may further include a memory for storing the instruction code, and the processor calls the instruction code of the memory to control the receiving module 11 in the embodiment of the present application to perform the above operation.
  • the sending module 22 in the embodiment of the present application may correspond to the transmitter of the RAN device, and may also correspond to the transceiver of the RAN device.
  • the RAN device may further include a receiving module, and the receiving module may correspond to a receiver of the RAN device or may correspond to a transceiver of the RAN device.
  • the processing module 21 may correspond to a processor of the RAN device, where the processor may be a CPU, or an ASIC, or one or more integrated circuits implementing the embodiments of the present application.
  • the RAN device may further include a memory for storing the instruction code, the processor invoking the instruction code of the memory, and controlling the transmitting module 22 in the embodiment of the present application to perform the above operation.
  • the receiving module 31 in the embodiment of the present application may correspond to the receiver of the terminal, or may correspond to the transceiver of the terminal.
  • the terminal may further include a sending module, where the sending module may correspond to a transmitter of the terminal, or may correspond to a transceiver of the terminal.
  • the processing module 32 may correspond to the processor of the terminal, where the processor may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or complete the implementation of the embodiment of the present application. One or more integrated circuits.
  • the terminal may further include a memory for storing the instruction code, and the processor calls the instruction code of the memory to control the receiving module 31 in the embodiment of the present application to perform the above operation.
  • the sending module 42 in the embodiment of the present application may correspond to the transmitter of the RAN device, and may also correspond to the transceiver of the RAN device.
  • the RAN device may further include a receiving module, and the receiving module may correspond to a receiver of the RAN device or may correspond to a transceiver of the RAN device.
  • the processing module 41 may correspond to a processor of the RAN device, where the processor may be a CPU, or an ASIC, or one or more integrated circuits that implement the embodiments of the present application.
  • the RAN device may further include a memory for storing the instruction code, the processor invoking the instruction code of the memory, and controlling the transmitting module 42 in the embodiment of the present application to perform the above operation.
  • the embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium is used to store computer software instructions used by the terminal.
  • the computer can perform various possible connection management methods in the above method embodiments.
  • the processes or functions described in accordance with embodiments of the present invention may be generated in whole or in part.
  • the computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, such as cellular communication, infrared, short-range wireless, microwave Etc.) Transfer to another website site, computer, server, or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)).
  • the embodiment of the present invention further provides a computer readable storage medium, where the computer readable storage medium is used to store computer software instructions used by the RAN device.
  • the computer is enabled to perform various possible connection management methods in the above method embodiments.
  • the processes or functions described in accordance with embodiments of the present invention may be generated in whole or in part.
  • the computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, such as cellular communication, infrared, short-range wireless, microwave Etc.) Transfer to another website site, computer, server, or data center.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, an SSD) or the like.
  • an embodiment of the present invention further provides a computer program product, that is, a software product, which, when run on a computer, causes the computer to execute various possible connection management methods in the above method embodiments.
  • a computer program product that is, a software product, which, when run on a computer, causes the computer to execute various possible connection management methods in the above method embodiments.
  • the implementation principle and technical effect are similar, and will not be described here.
  • the embodiment of the present application further provides a communication device, which may be a terminal or a circuit.
  • the communication device can be used to perform the actions performed by the terminal in the above method embodiments.
  • FIG. 11 shows a schematic structural view of a simplified terminal. It is convenient for understanding and illustration.
  • the terminal uses a mobile phone as an example.
  • the terminal includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
  • the processor is mainly used for processing communication protocols and communication data, and controlling terminals, executing software programs, processing data of software programs, and the like.
  • Memory is primarily used to store software programs and data.
  • the RF circuit is mainly used for the conversion of the baseband signal and the RF signal and the processing of the RF signal.
  • the antenna is mainly used to transmit and receive RF signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, keyboards, etc., are primarily used to receive user input data and output data to the user. It should be noted that some types of terminals may not have input and output devices.
  • the processor When the data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal, and then sends the radio frequency signal to the outside through the antenna in the form of electromagnetic waves.
  • the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor, which converts the baseband signal into data and processes the data.
  • the memory may also be referred to as a storage medium or a storage device or the like.
  • the memory may be independent of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.
  • the antenna and the radio frequency circuit having the transceiving function can be regarded as the transceiving unit of the terminal, and the processor having the processing function can be regarded as the processing unit of the terminal.
  • the terminal includes a transceiver unit 1110 and a processing unit 1120.
  • the transceiver unit can also be referred to as a transceiver, a transceiver, a transceiver, and the like.
  • the processing unit may also be referred to as a processor, a processing board, a processing module, a processing device, and the like.
  • the device for implementing the receiving function in the transceiver unit 1110 can be regarded as a receiving unit, and the device for implementing the sending function in the transceiver unit 1110 is regarded as a sending unit, that is, the transceiver unit 1110 includes a receiving unit and a sending unit.
  • the transceiver unit may also be referred to as a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may also be referred to as a receiver, a receiver, or a receiving circuit or the like.
  • the transmitting unit may also be referred to as a transmitter, a transmitter, or a transmitting circuit, and the like.
  • transceiver unit 1110 is configured to perform the sending operation and the receiving operation on the terminal side in the foregoing method embodiment
  • the processing unit 1120 is configured to perform other operations on the terminal except the transmitting and receiving operations in the foregoing method embodiments.
  • the transceiver unit 1110 is configured to perform the receiving operation on the terminal side in the step 104 in FIG. 2, and/or the transceiver unit 1110 is further configured to perform other transmitting and receiving steps on the terminal side in the embodiment of the present application.
  • the processing unit 1120 is configured to perform step 105 to step 107 in FIG. 2, and/or the processing unit 1120 is further configured to perform other processing steps on the terminal side in the embodiment of the present application.
  • the transceiver unit 1110 is configured to perform the receiving operation on the terminal side in step 207 in FIG. 3, and/or the transceiver unit 1110 is further configured to perform other transmitting and receiving steps on the terminal side in the embodiment of the present application.
  • the processing unit 1120 is configured to perform step 207 to step 210 in FIG. 3, and/or the processing unit 1120 is further configured to perform other processing steps on the terminal side in the embodiment of the present application.
  • the transceiver unit 1110 is configured to perform the receiving operation on the terminal side in step 302 in FIG. 4, and/or the transceiver unit 1110 is further configured to perform other transmitting and receiving steps on the terminal side in the embodiment of the present application.
  • the processing unit 1120 is configured to perform step 303 in FIG. 4, and/or the processing unit 1120 is further configured to perform other processing steps on the terminal side in the embodiment of the present application.
  • the transceiver unit 1110 is configured to perform the receiving operation on the terminal side in step 407 or step 407 ′ in FIG. 5, and/or the transceiver unit 1110 is further configured to perform the terminal side in the embodiment of the present application.
  • the processing unit 1120 is configured to perform step 408 or step 408' in FIG. 5, and/or the processing unit 1120 is further configured to perform other processing steps on the terminal side in the embodiment of the present application.
  • the chip When the communication device is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit and a communication interface;
  • the processing unit is a processor or a microprocessor or an integrated circuit integrated on the chip.
  • the device shown in FIG. 12 can be referred to.
  • the device can perform functions similar to the processor of the above terminal.
  • the device includes a processor 1210, a transmit data processor 1220, and a receive data processor 1230.
  • the processing module 12 or the processing module 32 in the above embodiment may be the processor 1210 in FIG. 12 and perform the corresponding functions.
  • the receiving module 11 or the receiving module 31 in the above embodiment may be the receiving data processor 1230 in FIG. 12, and the transmitting module in the above embodiment may be the transmitting data processor 1220 in FIG.
  • a channel coder and a channel decoder are shown in FIG. 12, it is to be understood that these modules are not intended to be limiting, and are merely illustrative.
  • the processing device 1300 includes modules such as a modulation subsystem, a central processing subsystem, and a peripheral subsystem.
  • the communication device in this embodiment can be used as a modulation subsystem therein.
  • the modulation subsystem may include a processor 1303, an interface 1304.
  • the processor 1303 performs the functions of the processing module 12 or the processing module 32, and the interface 1304 performs the functions of the receiving module and the sending module of the terminal.
  • the modulation subsystem includes a memory 1306, a processor 1303, and a program stored on the memory 1306 and executable on the processor, and the processor 1303 executes the program to implement the terminal side in the above method embodiment. method.
  • the memory 1306 may be non-volatile or volatile, and its location may be located inside the modulation subsystem or in the processing device 1300 as long as the memory 1306 can be connected to the The processor 1303 is sufficient.
  • a computer readable storage medium having stored thereon an instruction for executing a method on a terminal side in the above method embodiment when the instruction is executed.
  • a computer program product comprising instructions which, when executed, perform the method on the terminal side of the above method embodiment.
  • the embodiment of the present application further provides a communication device, which may be a network device or a circuit.
  • the communication device can be used to perform the actions performed by the terminal in the above method embodiments.
  • the communication device in this embodiment is a network device
  • the processing module of the above RAN device may be the processor 1401 and perform the corresponding functions.
  • the transmitting module and/or the receiving module of the RAN device may be a wireless transceiver 1403 in the figure, which performs corresponding functions through an antenna.
  • the device shown in FIG. 15 can be referred to.
  • the device can perform functions similar to the processor of FIG.
  • the device includes a processor 1501, a transmit data processor 1503, and a receive data processor 1505.
  • the processing module of the above RAN device may be the processor 1501 and perform the corresponding functions.
  • the transmitting module 22 of the RAN device may be the transmitting data processor 1503 of FIG. 15, and the receiving module may be the receiving data processor 1505 of FIG.
  • a channel coder and a channel decoder are shown in the drawings, it is to be understood that these modules are not intended to be limiting, and are merely illustrative.
  • the processing device 1600 includes modules such as a modulation subsystem, a central processing subsystem, and a peripheral subsystem.
  • the communication device in this embodiment can be used as a modulation subsystem therein.
  • the modulation subsystem can include a processor 1603, an interface 1604.
  • the processor 1603 performs the functions of the processing module of the RAN device, and the interface 1604 performs the functions of the transmitting module and/or the receiving module of the RAN device.
  • the modulation subsystem includes a memory 1606, a processor 1603, and a program stored on the memory and executable on the processor, the processor implementing the program to implement the method of any of the above method embodiments .
  • the memory 1606 may be non-volatile or volatile, and its location may be internal to the modulation subsystem or may be located in the processing device 1600 as long as the memory 1606 can be connected to the The processor 1603 is sufficient.
  • a computer readable storage medium having stored thereon instructions for performing the method of the RAN device side in the above method embodiment when the instructions are executed.
  • a computer program product comprising instructions which, when executed, perform the method on the RAN device side of the above method embodiment.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种连接管理方法、终端及无线接入网设备。本申请连接管理方法，包括：终端接收连接管理消息及完整性保护信息，所述完整性保护信息是根据所述连接管理消息使用第一安全算法生成的；所述终端根据所述第一安全算法和所述完整性保护信息对所述连接管理消息进行第一完整性效验；所述终端根据第一完整性校验的结果，执行第二完整性校验；所述终端根据第二完整性效验的结果执行连接管理过程。本申请实施例可以实现正确效验与解密，确保连接管理的正常执行。

Description

连接管理方法、终端及无线接入网设备
本申请要求于2017年6月16日提交中国专利局、申请号为201710458181.6、申请名称为“连接管理方法、终端及无线接入网设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术，尤其涉及一种连接管理方法、终端及无线接入网设备。
背景技术
随着无线通信技术的不断发展，非激活态被提出，该非激活态是有别于连接(Connected)态和空闲(Idle)态的另一种状态，终端处于非激活态时，会保存终端自身的上下文信息和与核心网连接的信息，还会保存锚点无线接入网(RAN)设备配置的位置管理区域信息。该位置管理区域信息对应一个位置管理区，终端在该位置管理区内移动时无需通知锚点RAN设备，超出该位置管理区时需要通过消息通知锚点RAN设备。
处于非激活态的终端需要进行连接管理时，可以向服务RAN设备发送连接管理请求消息，该连接管理请求消息包括终端的上下文标识，服务RAN设备根据该终端的上下文标识从锚点RAN设备处获取终端的上下文信息，服务RAN设备根据该终端的上下文信息确定终端使用的安全算法，服务RAN若不支持该安全算法，则服务RAN采用自身支持的安全算法发送的连接管理消息，不能被终端正确效验和解密，从而导致连接管理失败。
发明内容
本申请实施例提供一种连接管理方法、终端及无线接入网设备，可以完成连接管理过程。
第一方面，本申请实施例提供一种连接管理方法，包括：
终端接收连接管理消息及完整性保护信息，所述完整性保护信息是根据所述连接管理消息使用第一安全算法生成的；
所述终端根据所述第一安全算法和所述完整性保护信息对所述连接管理消息进行第一完整性效验；
所述终端根据第一完整性校验的结果，执行第二完整性校验，所述终端根据第二完整性效验的结果执行连接管理过程。
本实现方式，终端在接收到RAN设备发送的连接管理消息和完整性保护信息后，使用终端自身保存的第一安全算法对接收到的连接管理消息进行第一完整性效验，并根据第一完整性效验的结果确定使用第二安全算法执行第二完整性效验，进而执行连 接管理过程，从而实现正确效验与解密，确保连接管理的正常执行，完成连接管理过程。
结合第一方面，在第一方面的一种可能的实现方式中，所述终端根据第一完整性校验的结果，执行第二完整性校验，具体可以包括：当所述第一完整性效验的结果为未通过时，所述终端获取所述连接管理消息中包括的第二安全算法的配置信息；所述终端根据所述第二安全算法的配置信息和所述完整性保护信息对所述连接管理消息进行第二完整性效验。
本实现方式，终端在第一完整性效验的结果为未通过时，可以获知RAN设备使用的安全算法与其自身的安全算法不同，且其接收到的连接管理消息未加密，终端获取该连接管理消息中携带的RAN设备使用的第二安全算法的配置信息，使用该第二安全算法配置信息进行第二完整性效验，从而实现正确效验，完成连接恢复过程。
结合第一方面或者第一方面的一种可能的实现方式，在第一方面的另一种可能的实现方式中，所述终端根据所述第二完整性效验的结果执行连接管理过程，包括：当所述第二完整性效验的结果为通过时，执行连接管理过程。
结合第一方面或者第一方面的任一种可能的实现方式，在第一方面的另一种可能的实现方式中，所述当所述第二完整性效验的结果为通过时，执行连接管理过程，包括：当所述第二完整性效验的结果为通过，且所述连接管理消息未携带第一类配置参数信息，执行连接管理过程，所述第一类配置参数信息为仅在加密的消息中发送的配置信息。
本实现方式，当第二完整性效验通过时，终端还可以检验连接管理消息中是否携带第一类配置参数信息，当其未携带第一类配置参数信息时，执行连接管理过程。当其携带第一类配置参数信息时，则可以确定该连接管理消息为非法消息，可以终止连接管理过程。从而可以进一步提升连接管理的安全性。
结合第一方面或者第一方面的任一种可能的实现方式，在第一方面的另一种可能的实现方式中，所述方法还包括：当所述第一次完整性效验的结果为通过时，所述终端使用所述第一安全算法对所述连接恢复消息进行解密，并根据解密后的连接恢复消息进行连接恢复。
第二方面，本发明实施例提供一种连接管理方法，包括：
无线接入网RAN设备获取终端使用的第一安全算法的配置信息；
所述RAN设备根据所述配置信息判断所述RAN设备是否支持所述第一安全算法；
所述RAN设备根据判断结果生成连接管理消息和完整性保护信息；
所述RAN设备发送所述连接管理消息和所述完整性保护信息。
本实现方式，RAN设备通过判断该RAN设备是否支持终端使用的第一安全算法，并根据判断结果生成连接管理消息和完整性保护信息，将该连接管理消息和完整性保护信息发送给终端，从而确保终端可以对接收到的连接管理消息进行正确效验与解密，完成连接管理过程。
结合第二方面，在第二方面的一种可能的实现方式中，所述RAN设备根据判断结果生成连接管理消息和完整性保护信息，包括：当所述判断结果为所述RAN设备不支持所述第一安全算法时，所述RAN设备生成连接管理消息，并根据所述连接管理消息 使用第二安全算法生成所述完整性保护信息，所述第二安全算法是所述RAN设备支持的；其中，所述连接管理消息包括所述第二安全算法的配置信息。
本实现方式，当所述判断结果为所述RAN设备不支持所述第一安全算法时，RAN设备生成连接管理消息，该连接管理消息包括RAN设备使用的第二安全算法的配置信息，并根据所述连接管理消息使用第二安全算法生成所述完整性保护信息，将该连接管理消息和完整性保护信息发送给终端，从而实现终端从未加密的连接管理消息中获取RAN设备使用的第二安全算法的配置信息，从而完成连接管理过程。
结合第二方面或者第二方面的一种可能的实现方式，在第二方面的另一种可能的实现方式中，所述连接管理消息还包括第二类配置参数信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。
结合第二方面或者第二方面的任一种可能的实现方式，在第二方面的另一种可能的实现方式中，所述RAN设备根据判断结果生成连接管理消息和完整性保护信息，包括：当所述RAN设备支持所述第一安全算法时，所述RAN设备使用所述第一安全算法加密生成所述连接管理消息，并根据所述连接管理消息使用第一安全算法生成所述完整性保护信息。
结合第二方面或者第二方面的任一种可能的实现方式，在第二方面的另一种可能的实现方式中，所述连接管理消息携带第一类配置参数信息和第二类配置参数信息，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。
第三方面，本发明实施例提供一种连接管理方法，包括：
终端接收连接管理消息、完整性保护信息、以及安全算法的配置信息，所述连接管理消息为使用所述安全算法加密的，所述完整性保护信息为使用所述安全算法根据所述连接管理消息生成的，所述安全算法的配置信息未加密；
所述终端根据所述安全算法的配置信息对所述连接管理消息进行完整性校验，并且基于所述安全算法的配置信息对所述连接管理消息进行解密，并根据解密结果执行连接管理过程。
本实现方式，终端接收连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息，终端可以从未加密的安全算法的配置信息获知RAN设备使用的安全算法的配置信息，从而正确对连接管理消息进行解密，确保连接管理的正常执行。
结合第三方面，在第三方面的一种可能的实现方式中，所述连接管理消息、完整性保护信息、以及安全算法的配置信息是通过一个高层数据单元传输的。
结合第三方面或第三方面的一种可能的实现方式，在第三方面的另一种可能的实现方式中，所述安全算法的配置信息在PDCP层数据单元的包头，或者在PDCP层数据单元的所述完整性保护信息之后。
第四方面，本发明实施例提供一种连接管理方法，包括：
无线接入网RAN设备使用安全算法加密生成连接管理消息，使用所述安全算法根据所述连接管理消息生成完整性保护信息；
所述RAN设备发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
本实现方式，RAN设备使用安全算法加密生成连接管理消息，使用安全算法根据所述连接管理消息生成完整性保护信息，将加密的连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息发送给终端，使得终端可以获知RAN设备使用的安全算法的配置信息，从而正确对连接管理消息进行解密，确保连接管理的正常执行。
结合第四方面，在第四方面的一种可能的实现方式中，所述安全算法的配置信息包括安全算法的标识、密钥和密钥输入参数中的至少一种。
结合第四方面或者第四方面的一种可能的实现方式，在第四方面的另一种可能的实现方式中，所述RAN设备发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息，包括：所述RAN设备通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
本实现方式，RAN设备使用安全算法加密生成连接管理消息，使用安全算法根据所述连接管理消息生成完整性保护信息，将加密的连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息通过一个高层数据单元发送给终端，使得终端可以获知RAN使用的安全算法的配置信息，从而正确对连接管理消息进行解密，确保连接管理的正常执行。
结合第四方面或者第四方面的任一种可能的实现方式，在第四方面的另一种可能的实现方式中，所述高层数据单元包括PDCP层数据单元；
所述RAN设备通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息，包括：所述RAN设备将RRC层的所述连接管理消息设置为PDCP层数据单元的数据；所述RAN设备将所述未加密的安全算法的配置信息设置在PDCP层数据单元的包头，或者设置在PDCP层数据单元的所述完整性保护信息之后。
第五方面，本发明实施例提供一种终端，该终端具有实现上述方法实施例中终端行为的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第六方面，本发明实施例提供一种终端，包括：处理器、存储器和通信接口；该存储器用于存储计算机执行指令，当该终端运行时，该处理器执行该存储器存储的该计算机执行指令，以使该终端执行如上述第一方面任意一项或者第三方面任意一项的连接管理方法。
第七方面，本发明实施例提供了一种计算机可读存储介质，用于储存为上述终端所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项或者第三方面任意一项的连接管理方法。
第八方面，本发明实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项或者第三方面任意一项的连接管理方法。
另外，第五方面至第八方面中任一种设计方式所带来的技术效果可参见第一方面或第三方面中不同设计方式所带来的技术效果，此处不再赘述。
第九方面，本发明实施例提供一种无线接入网设备，该无线接入网设备具有实现上述方法实施例中无线接入网设备行为的功能。该功能可以通过硬件实现，也可以通 过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的模块。
第十方面，本发明实施例提供一种无线接入网设备，包括：处理器、存储器和通信接口；该存储器用于存储计算机执行指令，当无线接入网设备运行时，该处理器执行该存储器存储的该计算机执行指令，以使该无线接入网设备执行如上述第二方面任意一项或者第四方面任意一项的连接管理方法。
第十一方面，本发明实施例提供了一种计算机可读存储介质，用于储存为上述无线接入网设备所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述第二方面中任意一项或者第四方面任意一项的连接管理方法。
第十二方面，本发明实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行上述第一方面中任意一项或者第三方面任意一项的连接管理方法。
另外，第九方面至第十三方面中任一种设计方式所带来的技术效果可参见第二方面或第四方面中不同设计方式所带来的技术效果，此处不再赘述。
第十三方面，本发明实施例提供了一种运行指令的芯片，该芯片用于执行以下步骤：
根据第一安全算法和完整性保护信息对连接管理消息进行第一完整性效验；根据第一完整性校验的结果，执行第二完整性校验，根据第二完整性效验的结果执行连接管理过程，其中，所述连接管理消息及所述完整性保护信息来自于无线接入网设备，所述完整性保护信息是无线接入网设备根据所述连接管理消息使用第一安全算法生成的。
其技术效果可以参见上述第一方面或第二方面中不同设计方式所带来的技术效果，此处不再赘述。
第十四方面，本发明实施例提供了一种运行指令的芯片，该芯片用于执行以下步骤：
根据安全算法的配置信息对连接管理消息进行完整性校验，并且基于所述安全算法的配置信息对所述连接管理消息进行解密，并根据解密结果执行连接管理过程，所述连接管理消息、完整性保护信息、以及安全算法的配置信息来自于无线接入网设备，所述连接管理消息为使用所述安全算法加密的，所述完整性保护信息为使用所述安全算法根据所述连接管理消息生成的，所述安全算法的配置信息未加密。
其技术效果可以参见上述第三方面或第四方面中不同设计方式所带来的技术效果，此处不再赘述。
本文所涉及的连接管理消息指网络侧和终端之间进行连接管理的消息，其具体可以是连接恢复消息，连接挂起消息，连接继续消息，连接激活消息，连接重激活消息，连接建立消息，连接重建立消息，连接重配置消息等。
本文所涉及的非激活态具体指，终端保存其自身的上下文信息，并且可以执行基于小区的重选操作。同时，终端的连接信息保存在锚点RAN设备，终端的连接信息包括终端的上下文信息以及核心网连接信息。
通常，非激活态的终端会和空闲Idle态的终端一样进行小区重选。当终端处于非激活态时，终端保存锚点RAN设备配置的位置管理区域信息，终端移动出该位置管理 区域信息对应的位置管理区域时，需要通知锚点RAN设备。
本申请实施例连接管理方法、终端及无线接入网设备，通过RAN设备判断该RAN设备是否支持终端使用的第一安全算法，并根据判断结果生成连接管理消息和完整性保护信息，将该连接管理消息和完整性保护信息发送给终端，终端在接收到RAN设备发送的连接管理消息和完整性保护信息后，使用终端自身保存的第一安全算法对接收到的连接管理消息进行第一完整性效验，并根据第一完整性效验的结果，使用第二安全算法执行第二完整性效验，进而执行连接管理过程，从而实现正确效验与解密，确保连接管理的正常执行。其中，即使终端和RAN设备使用的加密算法不同，也可以实现终端的连接管理的正常执行。
附图说明
图1为本申请实施例一种应用场景的示意图；
图2为本申请实施例的一种连接管理方法的流程图；
图3为本申请实施例的另一种连接管理方法的流程图；
图4为本申请实施例另一种连接管理方法的流程图；
图5为本申请实施例另一种连接管理方法的流程图；
图6为本申请实施例一种PDCP数据单元的示意图。
图7为本申请实施例一种终端的结构示意图；
图8为本申请实施例一种无线接入网RAN设备的结构示意图；
图9为本申请实施例另一种终端的结构示意图；
图10为本申请实施例另一种无线接入网RAN设备的结构示意图；
图11为本申请实施例提供的通信装置的示意性框图；
图12为本申请实施例提供的通信装置的另一示意性框图；
图13为本申请实施例提供的通信装置的再一示意性框图；
图14为本申请实施例提供的通信装置的再一示意性框图；
图15为本申请实施例提供的通信装置的再一示意性框图；
图16为本申请实施例提供的通信装置的再一示意性框图。
具体实施方式
图1为本申请实施例一种应用场景的示意图，如图1所示，本实施例的应用场景可以包括：核心网设备1、锚点无线接入网(Radio Access Network，RAN)设备2、RAN设备3以及终端4，其中，核心网设备用于负责无线资源的管理、无线连接的建立、业务服务质量(Quality of Service，简称QoS)保证和最终的资源释放等。该核心网设备可以为移动性管理实体(Mobility Management Entity，简称MME)、网关设备(Gateway，简称GW)等，也可以为5G核心网络侧(5G Core network)的功能实体，例如接入与移动性管理功能实体(Core Access and Mobility Management Function，AMF)、会话管理功能实体(Session Management Function，SMF)等，当然也可以是其他核心网设备，此处仅为示意性说明。上述锚点RAN设备2保留有终端4的上下文信息和核心网接口信息，终端4可以通过RAN设备3与锚点RAN设备2进行连接， 并通过该锚点RAN设备2与核心网侧建立通信连接。上述锚点RAN设备2也可以称之为源RAN设备，上述RAN设备3也可以称之为新的RAN设备、服务RAN设备等。本申请实施例的终端4处于非激活态，处于非激活态的终端4需要进行连接管理时，可以通过本申请实施例的连接管理方法，实现终端4的连接管理，避免由于RAN设备3不支持终端4的安全算法而导致连接管理失败。本申请实施例的连接管理方法的具体实现方式可以参见下述实施例的解释说明。
其中，连接管理具体可以包括：为空闲态终端建立连接，为非激活态终端恢复连接，或者为连接态终端更新连接使用等。当然可以理解的，还可以是其他具体操作，此处不一一举例说明。
需要说明的是，本文所涉及的无线接入网(Radio Access Network，RAN)设备，是一种将终端接入到无线网络的设备，可以是全球移动通讯(Global System of Mobile communication，GSM)或码分多址(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)中的基站(NodeB，NB)，还可以是长期演进(Long Term Evolution，LTE)中的演进型基站(Evolutional Node B，eNB或eNodeB)，或者中继站或接入点，或者未来5G网络中的基站等，在此并不限定。
本文所涉及的终端，指向用户提供语音和/或数据连通性的设备(device)，包括无线终端或有线终端。无线终端可以是具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备，经无线接入网与一个或多个核心网进行通信的移动终端。例如，无线终端可以是移动电话(或称为“蜂窝”电话)和具有移动终端的计算机。又如，无线终端也可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置。再如，无线终端可以为用户设备(User Equipment，简称UE)的一部分。
本文所涉及的安全算法包括加密算法或完整性保护算法，也可以包括加密算法和完整性保护算法。该加密算法可以包括：EPS Encryption Algorithm 1(EEA1)、EEA2、EEA3等，该完整性保护算法可以包括EPS Integrity Algorithm 1(EIA1)、EIA2等。其中，EIA1是基于SNOW 3G算法。当所述安全算法包括加密算法和完整性保护算法时，所述加密算法和完整性保护算法可以存在对应关系。例如加密算法1对应于完整性保护算法1；加密算法2对应于完整性保护算法2。使用安全算法进行加密可以包括：使用安全算法中的加密算法进行加密。使用安全算法进行完整性保护可以包括：使用安全算法中的完整性保护算法进行完整性保护。
本文所涉及的“第一安全算法”和“第二安全算法”仅用于区分不同的安全算法。即二者采用的加密算法和/或完整性保护算法不同。
本文所涉及的“完整性效验”具体指终端根据接收到的消息和安全算法配置信息计算出X-MAC，将该X-MAC与接收到的完整性效验信息进行比较，如果相同，则完整性效验通过，否则，完整性效验不通过。
本文所涉及的“第一完整性效验”和“第二完整性效验”仅用于区分使用不同的安全算法。
本文所涉及的“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A 和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
图2为本申请实施例的一种连接管理方法的流程图，如图2所示，本实施例涉及RAN设备和终端，该RAN设备具体可以是图1所示的RAN设备3，本实施例的方法可以包括：
步骤101、RAN设备获取终端使用的第一安全算法的配置信息。
其中，在步骤101之前，终端可以向RAN设备发送连接管理请求消息。所述连接恢复请求消息可以用于请求RAN设备为该终端管理连接。RAN设备接收该连接管理请求消息，该连接管理请求消息可以包括该终端的上下文标识，RAN设备根据该终端的上下文标识从锚点RAN设备处获取该终端的上下文信息，RAN设备从该终端的上下文信息中获取该终端使用的第一安全算法的配置信息。
具体的一种可实现方式，该终端的上下文标识可以包括锚点RAN设备的标识和该终端的标识，RAN设备可以根据该锚点RAN设备的标识，确定向该锚点RAN设备请求该终端的标识对应的上下文信息，该锚点RAN设备将该终端的上下文信息发送给RAN设备，其中，该上下文信息可以包括终端使用的第一安全算法的配置信息，RAN设备从该终端的上下文信息中获取第一安全算法的配置信息，该第一安全算法的配置信息可以包括第一安全算法的标识、密钥和密钥输入参数中的至少一种。该第一安全算法的配置信息可以是锚点RAN设备配置给终端的。
步骤102、所述RAN设备根据所述配置信息判断所述RAN设备是否支持所述第一安全算法。
具体的，RAN设备可以根据步骤101中获取的配置信息确定该配置信息对应的第一安全算法，进而判断其自身是否支持该第一安全算法。
其中，RAN设备判断是否支持第一安全算法具体可以包括：RAN设备判断是否支持第一安全算法所包括的加密算法和/或完整性保护算法，即判断是否支持第一安全算法的加密算法、或者判断是否支持第一安全算法的完整性保护算法、或者判断是否支持第一安全算法的加密算法和完整性保护算法，其具体实现方式可以根据需求进行灵活设置。
步骤103、所述RAN设备根据判断结果生成连接管理消息和完整性保护信息。
其中，完整性保护信息为对连接管理消息进行完整性保护生成的。
具体的，上述步骤102的判断结果包括两种：支持和不支持。
当判断结果为不支持时，步骤103的具体实现方式可以为，RAN设备生成连接管理消息，该连接管理消息未加密，且该连接管理消息携带第二安全算法的配置信息，该第二安全算法为RAN设备支持的安全算法，并且RAN设备根据该连接管理消息使用第二安全算法进行完整性保护生成完整性保护信息。
当判断结果为支持时，步骤103的具体实现方式可以为，RAN设备使用第一安全算法加密生成连接管理消息，即该连接管理消息为加密的消息，并根据该连接管理消息使用第一安全算法进行完整性保护生成完整性保护信息。
步骤104、所述RAN设备发送所述连接管理消息和所述完整性保护信息。
具体的，所述RAN设备向终端发送所述连接管理消息和所述完整性保护信息，终端接收RAN设备发送的所述连接管理消息和所述完整性保护信息。
步骤105、所述终端根据所述第一安全算法和所述完整性保护信息对所述连接管理消息进行第一完整性效验。
其中，终端在接收到所述连接管理消息和所述完整性保护信息后，使用其自身支持的第一安全算法对该连接管理消息进行完整性效验，即根据接收到的完整性保护信息使用完整性保护算法来效验接收到的连接管理消息的完整性。
步骤106、所述终端根据第一完整性校验的结果，执行第二完整性校验。
具体的，第一完整性效验的结果包括通过和不通过。其中一种可实现方式为，当第一完整性效验的结果为通过时，则跳过执行第二完整性效验。当第一完整性效验的结果为不通过时，执行步骤106，即执行第二完整性效验。其中终端根据第一完整性效验的结果为不通过，可以获知RAN设备使用的安全算法与其自身的安全算法不同，进而执行第二完整性效验。
步骤107、所述终端根据第二完整性效验的结果执行连接管理过程。
其中，第一完整性效验的结果为通过时，终端根据该第一完整性效验的结果可以确定终端接收到的连接管理消息加密，并使用第一安全算法对该连接管理消息进行解密，根据解密后的连接管理消息进行连接管理。第一完整性效验的结果为不通过时，步骤106后，执行步骤107，终端根据该第一完整性效验的结果可以确定终端接收到的连接管理消息未加密，且RAN设备与终端使用的安全算法不同，终端从未加密的连接管理消息中获取RAN设备使用的第二安全算法的配置信息，并根据该第二安全算法的配置信息和完整性保护信息对连接管理消息进行第二完整性效验，在第二完整性效验的结果为通过时，根据连接管理消息执行连接管理过程。
本实施例，通过RAN设备判断该RAN设备是否支持终端使用的第一安全算法，并根据判断结果生成连接管理消息和完整性保护信息，将该连接管理消息和完整性保护信息发送给终端，终端在接收到RAN设备发送的连接管理消息和完整性保护信息后，使用终端自身保存的第一安全算法对接收到的连接管理消息进行第一完整性效验，并根据第一完整性效验的结果，使用第二安全算法执行第二完整性效验，进而执行连接管理过程，从而实现正确效验与解密，确保连接管理的正常执行。其中，即使终端和RAN设备使用的加密算法不同，也可以实现终端的连接管理的正常执行。
下面采用一个具体的实施例，对图2所示方法实施例的技术方案进行详细说明。
图3为本申请实施例的另一种连接管理方法的流程图，如图3所示，本实施例的方法可以包括：
步骤201、锚点RAN设备向终端配置该终端使用的第一安全算法。
具体的，锚点RAN设备可以通过向终端发送第一安全算法的配置信息，从而实现向终端配置该终端使用的第一安全算法。其中，第一安全算法的配置信息的具体解释说明可以参见上述图2所示实施例的解释说明，此处不再赘述。终端使用给第一安全算法对接收或发送的数据或者信令消息进行完整性保护效验、加解密操作。
步骤202、锚点RAN设备控制终端进入非激活态。
具体的，锚点RAN设备向终端发送状态控制命令，以指示该终端进入非激活(Inactive)态。其中，锚点RAN设备在实施步骤202之前或者同时，向终端发送终端的上下文信息，该终端的上下文信息包括终端的上下文标识。该终端的上下文标识 的具体解释说明可以参见上述图2所示实施例的解说说明，此处不再赘述。
步骤203、终端向RAN设备发送连接管理请求消息。
RAN设备接收终端发送的连接管理请求消息，该连接管理请求消息携带该终端的上下文标识。
具体的，终端在有数据需要发送时，可以向RAN设备发送连接管理请求消息，以便RAN设备为该终端管理连接。
步骤204、RAN设备根据该终端的上下文标识从锚点RAN设备获取该终端的上下文信息，并从该终端的上下文信息中获取该终端使用的第一安全算法的配置信息。
步骤205、RAN设备根据第一安全算法的配置信息判断RAN设备是否支持第一安全算法，当RAN设备不支持第一安全算法时，执行步骤206，当RAN设备支持第一安全算法时，则执行步骤206’。
步骤206、RAN设备生成连接管理消息，并根据连接管理消息使用第二安全算法生成完整性保护信息。
其中，第二安全算法是RAN设备支持的。步骤206生成的连接管理消息未加密，且该连接管理消息携带RAN设备使用的第二安全算法的配置信息。
其中，该连接管理消息还可以携带第二类配置参数，所述第二类配置参数信息为被允许在加密或者未加密的消息中发送的配置信息。举例而言，该第二类配置参数具体可以是物理资源配置信息。
步骤206’、RAN设备使用第一安全算法加密生成连接管理消息，并根据连接管理消息使用第一安全算法生成完整性保护信息。
其中，步骤206’生成的连接管理消息为加密的消息。
其中，该连接管理消息可以携带第一类配置参数信息和第二类配置参数信息，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。其中，第二类配置参数信息的具体解释说明可以参见步骤206的解释，此处不再赘述，第一类配置参数信息具体可以是逻辑信道的配置信息。
由此可见，本申请实施例将连接管理消息中携带的配置参数分为两类，一类是需要加密才可以发送的参数信息，即第一类配置参数信息，另一类是可以不加密发送的参数信息，即第二类配置参数信息。
步骤207、RAN设备向终端发送连接管理消息和完整性保护信息。
其中，该连接管理消息和完整性保护信息是步骤206或者步骤206’生成的。
终端接收RAN设备发送的连接管理消息和完整性保护信息。
步骤208、终端根据第一安全算法和完整性保护信息对接收到的连接管理消息进行第一完整性效验。
当第一完整性效验未通过时，执行步骤209，当第一完整性效验通过时，执行步骤210。
具体的，第一完整性效验的结果为不通过时，则执行步骤209，第一完整性效验的结果为通过时，执行步骤210。
步骤209、终端获取连接管理消息中包括的第二安全算法的配置信息，根据第二 安全算法的配置信息和完整性保护信息对连接管理消息进行第二完整性效验，所述终端根据所述第二完整性效验的结果执行连接管理过程。
具体的，第一完整性效验的结果为不通过时，终端可以根据该结果确定接收到的连接管理消息未加密，则获取该连接管理消息中包括的第二安全算法的配置信息。使用该第二安全算法进行第二完整性效验，当第二完整性效验通过时，执行连接管理过程。其中，需要说明的是，连接管理消息未加密，其携带第二类配置参数信息，对于第一类参数配置信息，RAN设备可以使用另一条加密消息发送给终端，终端可以使用连接管理消息中包括的第二安全算法的配置信息解密获取第一类参数配置信息。
可选的，当第二完整性效验通过时，终端还可以检验连接管理消息中是否携带第一类配置参数信息，当其未携带第一类配置参数信息时，执行连接管理过程。当其携带第一类配置参数信息时，则可以确定该连接管理消息为非法消息，可以终止连接管理过程。从而可以进一步提升连接管理的安全性。
步骤210、所述终端使用所述第一安全算法对所述连接管理消息进行解密，并根据解密后的连接管理消息进行连接管理。
本实施例，通过RAN设备判断该RAN设备是否支持终端使用的第一安全算法，并根据判断结果生成连接管理消息和完整性保护信息，将该连接管理消息和完整性保护信息发送给终端，终端在接收到RAN设备发送的连接管理消息和完整性保护信息后，使用终端自身保存的第一安全算法对接收到的连接管理消息进行第一完整性效验，并当第一完整性效验的结果为通过时，使用第二安全算法执行第二完整性效验，进而执行连接管理过程，从而实现正确效验与解密，确保连接管理的正常执行。其中，即使终端和RAN设备使用的加密算法不同，也可以实现终端的连接管理的正常执行。
与上述实施例不同，本申请还提供另一种连接管理方法，以实现与上述实施例相同的技术效果，具体可以参见下述实施例的具体解释说明。
图4为本申请实施例另一种连接管理方法的流程图，如图4所示，本实施例的方法可以包括：
步骤301、RAN设备使用安全算法加密生成连接管理消息，使用安全算法根据连接管理消息生成完整性保护信息。
步骤302、RAN设备发送连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息。
终端接收RAN设备发送的连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息。
步骤303、终端根据安全算法的配置信息对连接管理消息进行完整性校验，并且基于安全算法的配置信息对连接管理消息进行解密，并根据解密结果执行连接管理过程。
上述安全算法的配置信息可以包括安全算法的标识、密钥和密钥输入参数中的至少一种。
可选的，上述连接管理消息、完整性保护信息、以及安全算法的配置信息是通过一个高层数据单元传输的。其中，高层包括物理层之外的层，例如可以包括以下任意一项：业务数据适配协议(Service Data Adaptation Protocol，SDAP)层、分组数据汇 聚协议(Packet Data Convergence Protocol，PDCP)层、MAC层以及RLC层。
可选的，高层数据单元为MAC层数据单元时，上述安全算法的配置信息可以通过MAC层包头、或者MAC层控制单元、或者MAC逻辑信道进行传输。
可选的，高层数据单元为PDCP层数据单元时，上述安全算法的配置信息可以通过PDCP层包头、或者PDCP层控制单元、或者PDCP层包尾传输。
本实施例，通过RAN设备使用安全算法加密生成连接管理消息，使用安全算法根据所述连接管理消息生成完整性保护信息，将加密的连接管理消息、完整性保护信息、以及未加密的安全算法的配置信息发送给终端，使得终端可以获知RAN使用的安全算法的配置信息，从而正确对连接管理消息进行解密，确保连接管理的正常执行。其中，即使终端和RAN设备使用的加密算法不同，也可以实现终端的连接管理的正常执行。
下面采用一个具体的实施例，对图4所示方法实施例的技术方案进行详细说明。
图5为本申请实施例另一种连接管理方法的流程图，图6为本申请实施例一种PDCP数据单元的示意图，如图5所示，本实施例的方法可以包括：
步骤401、锚点RAN设备向终端配置该终端使用的第一安全算法。
步骤402、锚点RAN设备控制终端进入非激活态。
步骤403、终端向RAN设备发送连接管理请求消息。
步骤404、RAN设备根据该终端的上下文标识从锚点RAN设备获取该终端的上下文信息，并从该终端的上下文信息中获取该终端使用的第一安全算法的配置信息。
上述步骤401至步骤404的具体解释说明可以参见图3所示实施例的步骤201至步骤204，此处不再赘述。
步骤405、RAN设备根据第一安全算法的配置信息判断RAN设备是否支持第一安全算法，当RAN设备不支持第一安全算法时，则执行步骤406，当RAN设备支持第一安全算法时，则执行步骤406’。
步骤406、RAN设备使用第二安全算法加密生成连接管理消息，使用第二安全算法根据连接管理消息生成完整性保护信息。
步骤407、RAN设备发送连接管理消息、完整性保护信息、以及未加密的第二安全算法的配置信息。
终端接收RAN设备发送的连接管理消息、完整性保护信息、以及未加密的第二安全算法的配置信息。
一种可实现方式，RAN设备在通过步骤405获知RAN设备不支持终端使用的第一安全算法时，该RAN设备确定需要更新终端的安全算法的配置信息，则RAN设备的RRC层生成连接管理消息，将该连接管理消息封装在PDCP层的负载中，并在PDCP层的完整性保护信息之后增加携带第二安全算法的配置信息的字段。该PDCP层数据单元具体可以如图6所示，通过该PDCP层数据单元向终端发送连接管理消息、完整性保护信息、以及未加密的第二安全算法的配置信息。
步骤408、终端根据第二安全算法的配置信息对连接管理消息进行完整性校验，并且基于第二安全算法的配置信息对连接管理消息进行解密，并根据解密结果执行连接管理过程。
具体的，以上述PDCP层数据单元为例做进一步举例说明，终端接收到PDCP层 数据单元后，提取其中的第二安全算法的配置信息，使用该第二安全算法对连接管理消息进行完整性效验和解密，进而执行连接管理过程。
步骤406’、RAN设备使用第一安全算法加密生成连接管理消息，并根据连接管理消息使用第一安全算法生成完整性保护信息。
步骤407’、RAN设备发送连接管理消息和完整性保护信息。
终端接收RAN设备发送的连接管理消息和完整性保护信息。
步骤408’、终端使用其自身的第一安全算法对连接管理消息进行完整性校验，并且基于第一安全算法的配置信息对连接管理消息进行解密，并根据解密结果执行连接管理过程。
本实施例，通过RAN设备使用第二安全算法加密生成连接管理消息，使用第二安全算法根据所述连接管理消息生成完整性保护信息，将加密的连接管理消息、完整性保护信息、以及未加密的第二安全算法的配置信息发送给终端，使得终端可以获知RAN使用的第二安全算法的配置信息，从而正确对连接管理消息进行解密，确保连接管理的正常执行。其中，即使终端和RAN设备使用的加密算法不同，也可以实现终端的连接管理的正常执行。
图7为本申请实施例一种终端的结构示意图，如图7所示，本实施例的装置可以包括：接收模块11和处理模块12，其中，接收模块11用于接收连接管理消息及完整性保护信息，所述完整性保护信息是根据所述连接管理消息使用第一安全算法生成的，处理模块12用于根据所述第一安全算法和所述完整性保护信息对所述连接管理消息进行第一完整性效验，处理模块12还用于根据第一完整性校验的结果，执行第二完整性校验，根据第二完整性效验的结果执行连接管理过程。
可选的，所述处理模块12用于根据第一完整性校验的结果，执行第二完整性校验，具体可以包括：当所述第一完整性效验的结果为未通过时，获取所述连接管理消息中包括的第二安全算法的配置信息；根据所述第二安全算法的配置信息和所述完整性保护信息对所述连接管理消息进行第二完整性效验。
可选的，所述处理模块12用于根据所述第二完整性效验的结果执行连接管理过程。
可选的，所述处理模块12用于根据所述第二完整性效验的结果执行连接管理过程，具体可以包括：当所述第二完整性效验的结果为通过时，执行连接管理过程。
可选的，所述处理模块12用于当所述第二完整性效验的结果为通过时，执行连接管理过程，具体可以包括：当所述第二完整性效验的结果为通过时，且所述连接管理消息未携带第一类配置参数信息，执行连接管理过程，所述第一类配置参数信息为仅在加密的消息中发送的配置信息。
可选的，所述处理模块12还用于：当所述第一次完整性效验的结果为通过时，使用所述第一安全算法对所述连接管理消息进行解密，并根据解密后的连接管理消息进行连接管理。
可选的，本申请实施例的终端还可以包括存储模块，该存储模块用于存储终端的程序代码和数据。
可选的，本申请实施例的终端还可以包括发送模块，该发送模块用于发送消息、数据等。
本实施例的装置，可以用于执行图2或图3所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图8为本申请实施例一种无线接入网RAN设备的结构示意图，如图8所示，本实施例的装置可以包括：处理模块21和发送模块22，其中，处理模块21用于确定终端使用的第一安全算法的配置信息，处理模块21还用于根据所述配置信息判断所述RAN设备是否支持所述第一安全算法，处理模块12还用于根据判断结果生成连接管理消息和完整性保护信息，发送模块22用于发送所述连接管理消息和所述完整性保护信息。
可选的，所述处理模块21用于根据判断结果生成连接管理消息和完整性保护信息，具体可以包括：当所述判断结果为所述RAN设备不支持所述第一安全算法时，生成连接管理消息，并根据所述连接管理消息使用第二安全算法生成所述完整性保护信息，所述第二安全算法是所述RAN设备支持的；其中，所述连接管理消息包括所述第二安全算法的配置信息。
可选的，所述连接管理消息还包括第二类配置参数信息，所述第二类配置参数信息为允许在加密或者未加密的消息中发送的配置信息。
可选的，所述处理模块21用于根据判断结果生成连接管理消息和完整性保护信息，具体可以包括：当所述RAN设备支持所述第一安全算法时，使用所述第一安全算法加密生成所述连接管理消息，并根据所述连接管理消息使用第一安全算法生成所述完整性保护信息。
可选的，所述连接管理消息携带第一类配置参数信息和第二类配置参数信息，所述第一类配置参数信息为允许在加密的消息中发送的配置信息，所述第二类配置参数信息为允许在加密或者未加密的消息中发送的配置信息。
可选的，本申请实施例的RAN设备还可以包括存储模块，该存储模块用于存储终端的程序代码和数据。
可选的，本申请实施例的RAN设备还可以包括接收模块，该接收模块用于接收消息、数据等。
本实施例的装置，可以用于执行图2或图3所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图9为本申请实施例另一种终端的结构示意图，如图9所示，本实施例的装置可以包括：接收模块31和处理模块32，其中，接收模块31用于接收连接管理消息、完整性保护信息、以及安全算法的配置信息，所述连接管理消息为使用所述安全算法加密的，所述完整性保护信息为使用所述安全算法根据所述连接管理消息生成的，所述安全算法的配置信息未加密，处理模块32用于根据所述安全算法的配置信息对所述连接管理消息进行完整性校验，并且基于所述安全算法的配置信息对所述连接管理消息进行解密，并根据解密结果执行连接管理过程。
可选的，所述连接管理消息、完整性保护信息、以及安全算法的配置信息是通过一个高层数据单元传输的。
可选的，所述安全算法的配置信息在PDCP层数据单元的包头，或者在PDCP层数据单元的所述完整性保护信息之后。
可选的，本申请实施例的终端还可以包括存储模块，该存储模块用于存储终端的 程序代码和数据。
可选的，本申请实施例的终端还可以包括发送模块，该发送模块用于发送消息、数据等。
本实施例的装置，可以用于执行图4或图5所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图10为本申请实施例另一种无线接入网RAN设备的结构示意图，如图10所示，本实施例的装置可以包括：处理模块41和发送模块42，其中，处理模块41用于使用安全算法加密生成连接管理消息，使用所述安全算法根据所述连接管理消息生成完整性保护信息，发送模块42用于发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
可选的，所述安全算法的配置信息包括安全算法的标识、密钥和密钥输入参数中的至少一种。
可选的，所述发送模块用于通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
可选的，所述高层数据单元包括PDCP层数据单元；所述处理模块41还用于将RRC层的所述连接管理消息设置为PDCP层数据单元的数据；将所述未加密的安全算法的配置信息设置在PDCP层数据单元的包头，或者设置在PDCP层数据单元的所述完整性保护信息之后。
可选的，本申请实施例的RAN设备还可以包括存储模块，该存储模块用于存储终端的程序代码和数据。
可选的，本申请实施例的RAN设备还可以包括接收模块，该接收模块用于接收消息、数据等。
本实施例的装置，可以用于执行图4或图5所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
需要说明的是，本申请实施例中的接收模块11可以与终端的接收器对应，也可以对应终端的收发器。该终端还可以包括发送模块，发送模块可以与终端的发送器对应，也可以对应终端的收发器。处理模块12可以与终端的处理器对应，这里处理器可以是一个中央处理器(Central Processing Unit，CPU)，或者是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者完成实施本申请实施例的一个或多个集成电路。终端还可以包括存储器，存储器用于存储指令代码，处理器调用存储器的指令代码，控制本申请实施例中的接收模块11执行上述操作。
需要说明的是，本申请实施例中的发送模块22可以与RAN设备的发送器对应，也可以对应RAN设备的收发器。该RAN设备还可以包括接收模块，接收模块可以与RAN设备的接收器对应，也可以对应RAN设备的收发器。处理模块21可以与RAN设备的处理器对应，这里处理器可以是一个CPU，或者是ASIC，或者完成实施本申请实施例的一个或多个集成电路。RAN设备还可以包括存储器，存储器用于存储指令代码，处理器调用存储器的指令代码，控制本申请实施例中的发送模块22执行上述操作。
需要说明的是，本申请实施例中的接收模块31可以与终端的接收器对应，也可以 对应终端的收发器。该终端还可以包括发送模块，发送模块可以与终端的发送器对应，也可以对应终端的收发器。处理模块32可以与终端的处理器对应，这里处理器可以是一个中央处理器(Central Processing Unit，CPU)，或者是特定集成电路(Application Specific Integrated Circuit，ASIC)，或者完成实施本申请实施例的一个或多个集成电路。终端还可以包括存储器，存储器用于存储指令代码，处理器调用存储器的指令代码，控制本申请实施例中的接收模块31执行上述操作。
需要说明的是，本申请实施例中的发送模块42可以与RAN设备的发送器对应，也可以对应RAN设备的收发器。该RAN设备还可以包括接收模块，接收模块可以与RAN设备的接收器对应，也可以对应RAN设备的收发器。处理模块41可以与RAN设备的处理器对应，这里处理器可以是一个CPU，或者是ASIC，或者完成实施本申请实施例的一个或多个集成电路。RAN设备还可以包括存储器，存储器用于存储指令代码，处理器调用存储器的指令代码，控制本申请实施例中的发送模块42执行上述操作。
当本发明实施例的连接管理方法的至少一部分功能通过软件实现时，本发明实施例还提供一种计算机可读存储介质，计算机可读存储介质用于储存为上述终端所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述方法实施例中各种可能的连接管理方法。在计算机上加载和执行所述计算机执行指令时，可全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，所述传输可以通过无线(例如蜂窝通信、红外、短距离无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
当本发明实施例的连接管理方法的至少一部分功能通过软件实现时，本发明实施例还提供一种计算机可读存储介质，计算机可读存储介质用于储存为上述RAN设备所用的计算机软件指令，当其在计算机上运行时，使得计算机可以执行上述方法实施例中各种可能的连接管理方法。在计算机上加载和执行所述计算机执行指令时，可全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，所述传输可以通过无线(例如蜂窝通信、红外、短距离无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如SSD)等。
此外，本发明实施例还提供一种包含指令的计算机程序产品，即软件产品，当其在计算机上运行时，使得计算机执行上述方法实施例中各种可能的连接管理方法。其实现原理和技术效果类似，此处不再赘述。
本申请实施例还提供一种通信装置，该通信装置可以是终端也可以是电路。该通 信装置可以用于执行上述方法实施例中由终端所执行的动作。
当该通信装置为终端时，图11示出了一种简化的终端的结构示意图。便于理解和图示方便，图11中，终端以手机作为例子。如图11所示，终端包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对终端进行控制，执行软件程序，处理软件程序的数据等。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端可以不具有输入输出装置。
当需要发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。为便于说明，图11中仅示出了一个存储器和处理器。在实际的终端产品中，可以存在一个或多个处理器和一个或多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
在本申请实施例中，可以将具有收发功能的天线和射频电路视为终端的收发单元，将具有处理功能的处理器视为终端的处理单元。如图11所示，终端包括收发单元1110和处理单元1120。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1110中用于实现接收功能的器件视为接收单元，将收发单元1110中用于实现发送功能的器件视为发送单元，即收发单元1110包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
应理解，收发单元1110用于执行上述方法实施例中终端侧的发送操作和接收操作，处理单元1120用于执行上述方法实施例中终端上除了收发操作之外的其他操作。
例如，在一种实现方式中，收发单元1110用于执行图2中的步骤104中终端侧的接收操作，和/或收发单元1110还用于执行本申请实施例中终端侧的其他收发步骤。处理单元1120，用于执行图2中的步骤105至步骤107，和/或处理单元1120还用于执行本申请实施例中终端侧的其他处理步骤。
再例如，在另一种实现方式中，收发单元1110用于执行图3中步骤207中终端侧的接收操作，和/或收发单元1110还用于执行本申请实施例中终端侧的其他收发步骤。处理单元1120用于执行图3中的步骤207至步骤210，和/或处理单元1120还用于执行本申请实施例中终端侧的其他处理步骤。
又例如，在再一种实现方式中，收发单元1110用于执行图4中步骤302中终端侧的接收操作，和/或收发单元1110还用于执行本申请实施例中终端侧的其他收发步骤。处理单元1120，用于执行图4中的步骤303，和/或处理单元1120还用于执行本申请实施例中终端侧的其他处理步骤。
又例如，在再一种实现方式中，收发单元1110用于执行图5中步骤407或步骤407’中终端侧的接收操作，和/或收发单元1110还用于执行本申请实施例中终端侧的其他收发步骤。处理单元1120，用于执行图5中的步骤408或步骤408’，和/或处理单元1120还用于执行本申请实施例中终端侧的其他处理步骤。
当该通信装置为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路、通信接口；处理单元为该芯片上集成的处理器或者微处理器或者集成电路。
本实施例中的通信装置为终端时，可以参照图12所示的设备。作为一个例子，该设备可以完成类似于上述终端的处理器的功能。在图12中，该设备包括处理器1210，发送数据处理器1220，接收数据处理器1230。上述实施例中的处理模块12或处理模块32可以是图12中的该处理器1210，并完成相应的功能。上述实施例中的接收模块11或接收模块31可以是图12中的接收数据处理器1230，上述实施例中的发送模块可以是图12中的发送数据处理器1220。虽然图12中示出了信道编码器、信道解码器，但是可以理解这些模块并不对本实施例构成限制性说明，仅是示意性的。
图13示出本实施例的另一种形式。处理装置1300中包括调制子系统、中央处理子系统、周边子系统等模块。本实施例中的通信装置可以作为其中的调制子系统。具体的，该调制子系统可以包括处理器1303，接口1304。其中处理器1303完成上述处理模块12或处理模块32的功能，接口1304完成上述终端的接收模块和发送模块的功能。作为另一种变形，该调制子系统包括存储器1306、处理器1303及存储在存储器1306上并可在处理器上运行的程序，该处理器1303执行该程序时实现上述方法实施例中终端侧的方法。需要注意的是，所述存储器1306可以是非易失性的，也可以是易失性的，其位置可以位于调制子系统内部，也可以位于处理装置1300中，只要该存储器1306可以连接到所述处理器1303即可。
作为本实施例的另一种形式，提供一种计算机可读存储介质，其上存储有指令，该指令被执行时执行上述方法实施例中终端侧的方法。
作为本实施例的另一种形式，提供一种包含指令的计算机程序产品，该指令被执行时执行上述方法实施例中终端侧的方法。
本申请实施例还提供一种通信装置，该通信装置可以是网络设备也可以是电路。该通信装置可以用于执行上述方法实施例中由终端所执行的动作。
本实施例中的通信装置为网络设备时，可以参照图14所示的设备，该设备包括处理器1401，应用处理器，存储器，用户接口，以及其他一些元件(包括未示出的电源等设备)。在图14中，上述RAN设备的处理模块可以是所述处理器1401，并完成相应的功能。所述RAN设备的发送模块和/或接收模块，可以是图中的无线收发器1403，其通过天线完成相应的功能。可以理解图中所示的各个元件只是示意性的，并不是完成本实施例必须的元件。
本实施例中的通信装置为网络设备时，可以参照图15所示的设备。作为一个例子，该设备可以完成类似于图14的处理器的功能。在图15中，该设备包括处理器1501，发送数据处理器1503，接收数据处理器1505。在图15中，上述RAN设备的处理模块可以是所述处理器1501，并完成相应的功能。所述RAN设备的发送模块22可以是图 15中发送数据处理器1503，所述接收模块可以是图15中接收数据处理器1505。虽然图中示出了信道编码器、信道解码器，但是可以理解这些模块并不对本实施例构成限制性说明，仅是示意性的。
图16示出本实施例的另一种形式。处理装置1600中包括调制子系统、中央处理子系统、周边子系统等模块。本实施例中的通信装置可以作为其中的调制子系统。具体的，该调制子系统可以包括处理器1603，接口1604。其中处理器1603完成上述RAN设备的处理模块的功能，接口1604完成上述RAN设备的发送模块和/或接收模块的功能。作为另一种变形，该调制子系统包括存储器1606、处理器1603及存储在存储器上并可在处理器上运行的程序，所述处理器执行所述程序时实现上述任一方法实施例的方法。需要注意的是，所述存储器1606可以是非易失性的，也可以是易失性的，其位置可以位于调制子系统内部，也可以位于处理装置1600中，只要该存储器1606可以连接到所述处理器1603即可。
作为本实施例的另一种形式，提供一种计算机可读存储介质，其上存储有指令，该指令被执行时执行上述方法实施例中RAN设备侧的方法。
作为本实施例的另一种形式，提供一种包含指令的计算机程序产品，该指令被执行时执行上述方法实施例中RAN设备侧的方法。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述各实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (40)

  1. 一种连接管理方法，其特征在于，包括：
    通信设备接收连接管理消息及完整性保护信息，所述完整性保护信息是根据所述连接管理消息使用第一安全算法生成的；
    所述通信设备根据所述第一安全算法和所述完整性保护信息对所述连接管理消息进行第一完整性效验；
    所述通信设备根据第一完整性校验的结果，执行第二完整性校验，所述通信设备根据第二完整性效验的结果执行连接管理过程。
  2. 根据权利要求1所述的方法，其特征在于，所述通信设备根据第一完整性校验的结果，执行第二完整性校验，包括：
    当所述第一完整性效验的结果为未通过时，所述通信设备获取所述连接管理消息中包括的第二安全算法的配置信息；
    所述通信设备根据所述第二安全算法的配置信息和所述完整性保护信息对所述连接管理消息进行第二完整性效验。
  3. 根据权利要求2所述的方法，其特征在于，所述通信设备根据所述第二完整性效验的结果执行连接管理过程，包括：
    当所述第二完整性效验的结果为通过时，执行连接管理过程。
  4. 根据权利要求3所述的方法，其特征在于，所述当所述第二完整性效验的结果为通过时，执行连接管理过程，包括：
    当所述第二完整性效验的结果为通过，且所述连接管理消息未携带第一类配置参数信息，执行连接管理过程，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息。
  5. 一种连接管理方法，其特征在于，包括：
    网络设备获取通信设备使用的第一安全算法的配置信息；
    所述网络设备根据所述配置信息判断所述网络设备是否支持所述第一安全算法；
    所述网络设备根据判断结果生成连接管理消息和完整性保护信息；
    所述网络设备发送所述连接管理消息和所述完整性保护信息。
  6. 根据权利要求5所述的方法，其特征在于，所述网络设备根据判断结果生成连接管理消息和完整性保护信息，包括：
    当所述判断结果为所述网络设备不支持所述第一安全算法时，所述网络设备生成连接管理消息，并根据所述连接管理消息使用第二安全算法生成所述完整性保护信息，所述第二安全算法是所述网络设备支持的；
    其中，所述连接管理消息包括所述第二安全算法的配置信息。
  7. 根据权利要求6所述的方法，其特征在于，所述连接管理消息还包括第二类配置参数信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。
  8. 根据权利要求5所述的方法，其特征在于，所述网络设备根据判断结果生成连接管理消息和完整性保护信息，包括：
    当所述网络设备支持所述第一安全算法时，所述网络设备使用所述第一安全算法 加密生成所述连接管理消息，并根据所述连接管理消息使用第一安全算法生成所述完整性保护信息。
  9. 根据权利要求8所述的方法，其特征在于，所述连接管理消息携带第一类配置参数信息和第二类配置参数信息，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。
  10. 一种连接管理方法，其特征在于，包括：
    通信设备接收连接管理消息、完整性保护信息、以及安全算法的配置信息，所述连接管理消息为使用所述安全算法加密的，所述完整性保护信息为使用所述安全算法根据所述连接管理消息生成的，所述安全算法的配置信息未加密；
    所述通信设备根据所述安全算法的配置信息对所述连接管理消息进行完整性校验，并且基于所述安全算法的配置信息对所述连接管理消息进行解密，并根据解密结果执行连接管理过程。
  11. 根据权利要求10所述的方法，其特征在于，所述连接管理消息、完整性保护信息、以及安全算法的配置信息是通过一个高层数据单元传输的。
  12. 根据权利要求11所述的方法，其特征在于，所述安全算法的配置信息在PDCP层数据单元的包头，或者在PDCP层数据单元的所述完整性保护信息之后。
  13. 一种连接管理方法，其特征在于，包括：
    网络设备使用安全算法加密生成连接管理消息，使用所述安全算法根据所述连接管理消息生成完整性保护信息；
    所述网络设备发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
  14. 根据权利要求13所述的方法，其特征在于，所述安全算法的配置信息包括安全算法的标识、密钥和密钥输入参数中的至少一种。
  15. 根据权利要求13或14所述的方法，其特征在于，所述网络设备发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息，包括：
    所述网络设备通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
  16. 根据权利要求15所述的方法，其特征在于，所述高层数据单元包括PDCP层数据单元；
    所述网络设备通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息，包括：
    所述网络设备将RRC层的所述连接管理消息设置为PDCP层数据单元的数据；
    所述网络设备将所述未加密的安全算法的配置信息设置在PDCP层数据单元的包头，或者设置在PDCP层数据单元的所述完整性保护信息之后。
  17. 一种通信设备，其特征在于，包括：
    接收模块，用于接收连接管理消息及完整性保护信息，所述完整性保护信息是根据所述连接管理消息使用第一安全算法生成的；
    处理模块，用于根据所述第一安全算法和所述完整性保护信息对所述连接管理消 息进行第一完整性效验；
    所述处理模块，还用于根据第一完整性校验的结果，执行第二完整性校验，并根据第二完整性效验的结果执行连接管理过程。
  18. 根据权利要求17所述的通信设备，其特征在于，所述处理模块用于根据第一完整性校验的结果，执行第二完整性校验，包括：
    当所述第一完整性效验的结果为未通过时，获取所述连接管理消息中包括的第二安全算法的配置信息；
    根据所述第二安全算法的配置信息和所述完整性保护信息对所述连接管理消息进行第二完整性效验。
  19. 根据权利要求18所述的通信设备，其特征在于，所述处理模块用于根据所述第二完整性效验的结果执行连接管理过程，包括：
    当所述第二完整性效验的结果为通过时，执行连接管理过程。
  20. 根据权利要求19所述的通信设备，其特征在于，所述处理模块用于当所述第二完整性效验的结果为通过时，执行连接管理过程，包括：
    当所述第二完整性效验的结果为通过，且所述连接管理消息未携带第一类配置参数信息，执行连接管理过程，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息。
  21. 一种网络设备，其特征在于，包括：
    处理模块，用于确定通信设备使用的第一安全算法的配置信息；
    所述处理模块，还用于根据所述配置信息判断所述网络设备是否支持所述第一安全算法；
    所述处理模块，还用于根据判断结果生成连接管理消息和完整性保护信息；
    发送模块，用于发送所述连接管理消息和所述完整性保护信息。
  22. 根据权利要求21所述的网络设备，其特征在于，所述处理模块用于根据判断结果生成连接管理消息和完整性保护信息，包括：
    当所述判断结果为所述网络设备不支持所述第一安全算法时，生成连接管理消息，并根据所述连接管理消息使用第二安全算法生成所述完整性保护信息，所述第二安全算法是所述网络设备支持的；
    其中，所述连接管理消息包括所述第二安全算法的配置信息。
  23. 根据权利要求22所述的网络设备，其特征在于，所述连接管理消息还包括第二类配置参数信息，所述第二类配置参数信息为被允许在加密和未加密的消息中发送的配置信息。
  24. 根据权利要求21所述的网络设备，其特征在于，所述处理模块用于根据判断结果生成连接管理消息和完整性保护信息，包括：
    当所述网络设备支持所述第一安全算法时，使用所述第一安全算法加密生成所述连接管理消息，并根据所述连接管理消息使用第一安全算法生成所述完整性保护信息。
  25. 根据权利要求24所述的网络设备，其特征在于，所述连接管理消息携带第一类配置参数信息和第二类配置参数信息，所述第一类配置参数信息为被允许在加密的消息中发送的配置信息，所述第二类配置参数信息为被允许在加密和未加密的消息中 发送的配置信息。
  26. 一种通信设备，其特征在于，包括：
    接收模块，用于接收连接管理消息、完整性保护信息、以及安全算法的配置信息，所述连接管理消息为使用所述安全算法加密的，所述完整性保护信息为使用所述安全算法根据所述连接管理消息生成的，所述安全算法的配置信息未加密；
    处理模块，用于根据所述安全算法的配置信息对所述连接管理消息进行完整性校验，并且基于所述安全算法的配置信息对所述连接管理消息进行解密，并根据解密结果执行连接管理过程。
  27. 根据权利要求26所述的通信设备，其特征在于，所述连接管理消息、完整性保护信息、以及安全算法的配置信息是通过一个高层数据单元传输的。
  28. 根据权利要求27所述的通信设备，其特征在于，所述安全算法的配置信息在PDCP层数据单元的包头，或者在PDCP层数据单元的所述完整性保护信息之后。
  29. 一种网络设备，其特征在于，包括：
    处理模块，用于使用安全算法加密生成连接管理消息，使用所述安全算法根据所述连接管理消息生成完整性保护信息；
    发送模块，用于发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
  30. 根据权利要求29所述的网络设备，其特征在于，所述安全算法的配置信息包括安全算法的标识、密钥和密钥输入参数中的至少一种。
  31. 根据权利要求29或30所述的网络设备，其特征在于，所述发送模块用于通过一个高层数据单元发送所述连接管理消息、所述完整性保护信息、以及未加密的所述安全算法的配置信息。
  32. 根据权利要求31所述的网络设备，其特征在于，所述高层数据单元包括PDCP层数据单元；
    所述处理模块还用于将RRC层的所述连接管理消息设置为PDCP层数据单元的数据；将所述未加密的安全算法的配置信息设置在PDCP层数据单元的包头，或者设置在PDCP层数据单元的所述完整性保护信息之后。
  33. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述程序被处理器执行时实现如权利要求1至4中任一项所述的连接管理方法。
  34. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述程序被处理器执行时实现如权利要求5至9中任一项所述的连接管理方法。
  35. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述程序被处理器执行时实现如权利要求10至12中任一项所述的连接管理方法。
  36. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述程序被处理器执行时实现如权利要求13至16中任一项所述的连接管理方法。
  37. 一种通信装置，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序，其特征在于，所述处理器执行所述程序时实现权利要求1至4中任一项所述的连接管理方法。
  38. 一种通信装置，包括存储器、处理器及存储在所述存储器上并可在所述处理 器上运行的程序，其特征在于，所述处理器执行所述程序时实现权利要求5至9中任一项所述的连接管理方法。
  39. 一种通信装置，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序，其特征在于，所述处理器执行所述程序时实现权利要求10至12中任一项所述的连接管理方法。
  40. 一种通信装置，包括存储器、处理器及存储在所述存储器上并可在所述处理器上运行的程序，其特征在于，所述处理器执行所述程序时实现权利要求13至16中任一项所述的连接管理方法。
PCT/CN2018/091110 2017-06-16 2018-06-13 连接管理方法、终端及无线接入网设备 WO2018228444A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710458181.6 2017-06-16
CN201710458181.6A CN109246692A (zh) 2017-06-16 2017-06-16 连接管理方法、终端及无线接入网设备

Publications (1)

Publication Number Publication Date
WO2018228444A1 true WO2018228444A1 (zh) 2018-12-20

Family

ID=64659862

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/091110 WO2018228444A1 (zh) 2017-06-16 2018-06-13 连接管理方法、终端及无线接入网设备

Country Status (2)

Country Link
CN (1) CN109246692A (zh)
WO (1) WO2018228444A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024086995A1 (zh) * 2022-10-24 2024-05-02 华为技术有限公司 广播消息保护方法及相关装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102137400A (zh) * 2010-01-23 2011-07-27 中兴通讯股份有限公司 一种rrc连接重建立时的安全处理方法和系统
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及系统
CN105429750A (zh) * 2007-02-02 2016-03-23 诺基亚公司 在切换期间改变无线电接入网安全算法

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102223632B (zh) * 2010-04-15 2015-12-16 中兴通讯股份有限公司 一种接入层安全算法同步方法和系统
US9237483B2 (en) * 2010-12-30 2016-01-12 Motorola Solutions, Inc. Methods for managing resource utilization in a long term evolution communication system
CN104349312B (zh) * 2013-08-02 2019-01-29 上海诺基亚贝尔股份有限公司 用于支持双连接的安全处理的方法
CN103476028B (zh) * 2013-08-30 2017-04-05 大唐移动通信设备有限公司 Nas count翻转时nas消息的处理方法及装置
CN104936171B (zh) * 2014-03-21 2019-07-16 中兴通讯股份有限公司 安全算法的确定方法及装置
CN106358195B (zh) * 2015-07-24 2019-08-20 苏州简约纳电子有限公司 适用于lte接入层的安全激活优化方法
CN106102105B (zh) * 2016-06-15 2019-09-17 京信通信系统（中国）有限公司 一种小区内切换的方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105429750A (zh) * 2007-02-02 2016-03-23 诺基亚公司 在切换期间改变无线电接入网安全算法
CN102137400A (zh) * 2010-01-23 2011-07-27 中兴通讯股份有限公司 一种rrc连接重建立时的安全处理方法和系统
CN102487507A (zh) * 2010-12-01 2012-06-06 中兴通讯股份有限公司 一种实现完整性保护的方法及系统

Also Published As

Publication number Publication date
CN109246692A (zh) 2019-01-18

Similar Documents

Publication Publication Date Title
US11310266B2 (en) Mobile communication method, apparatus, and device
WO2018171703A1 (zh) 通信方法与设备
WO2019153994A1 (zh) 安全协商方法及装置
US10798082B2 (en) Network authentication triggering method and related device
JP2020536424A (ja) セキュリティ保護方法、装置及びシステム
CN109729524B (zh) 一种rrc连接恢复方法及装置
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
CN111448813B (zh) 与配置的安全保护进行通信的系统和方法
KR20130054317A (ko) 보안 구성들의 동기화를 용이하게 하는 방법들 및 장치들
US11445365B2 (en) Communication method and communications apparatus
CN114145032B (zh) 获取安全上下文的方法、装置和通信系统
WO2020220888A1 (zh) 切换的处理方法和装置
WO2018166338A1 (zh) 一种秘钥更新方法及装置
RU2748314C1 (ru) Конфигурирование радиоресурсов
WO2018227638A1 (zh) 通信方法和装置
WO2017132962A1 (zh) 一种安全参数传输方法及相关设备
US20230092744A1 (en) Ckey obtaining method and apparatus
WO2018228444A1 (zh) 连接管理方法、终端及无线接入网设备
CN112654046A (zh) 用于注册的方法和装置
WO2022252867A1 (zh) 通信方法及通信装置
WO2019213925A1 (zh) 密钥更新方法、设备和存储介质
WO2023213191A1 (zh) 安全保护方法及通信装置
WO2021057456A1 (zh) 用于注册的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18818428

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18818428

Country of ref document: EP

Kind code of ref document: A1