WO2019033905A1

WO2019033905A1 - Security control method and device for data stream transmission

Info

Publication number: WO2019033905A1
Application number: PCT/CN2018/096889
Authority: WO
Inventors: 杨立
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-08-17
Filing date: 2018-07-24
Publication date: 2019-02-21
Also published as: CN109413005A

Abstract

Provided are a security control method and device for data stream transmission. The method comprises: a user plane (UP) entity independently configuring, according to a predetermined manner, security control information for each data radio bearer (DRB), wherein the predetermined manner comprises the UP entity independently configuring the security control information by combining a parameter transmitted by a control plane (CP) entity, and wherein the security control information comprises at least one of the following: a security algorithm, and a security configuration parameter; and the UP entity transmitting the security control information to a user equipment (UE) unit by means of the CP entity, such that the UE unit performs a security control operation on uplink/downlink data transmission.

Description

Data stream transmission security control method and device

Cross-reference to related applications

The present application is based on a Chinese patent application filed on Jan. 17, 2017, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present application relates to the field of communications, and in particular, to a data stream transmission security control method and apparatus.

Background technique

With the entry into the fifth generation (Fifth Generation for short) 5G mobile communication era, massive connection and higher data transmission rate requirements of users, baseband processing unit (Baseband Unit) in Long Term Evolution (LTE) system The transmission capacity of the Common Public Radio Interface (CPRI), which is referred to as the BBU and the Remote Radio Unit (RRU), poses a great challenge. The CPRI interface transmits the IQ signal processed by the physical layer code modulation, and the corresponding digital bit string rate is huge. Therefore, the CPRI interface has large requirements on the transmission delay and the working bandwidth, otherwise the BBU and the RRU cannot work. If the air interface rate of the 5G base station gNB is increased to tens of Gbps, the transmission traffic demand of the CPRI interface will rise to at least the Tbps level, which puts tremendous pressure on the deployment cost and difficulty of the front-end network interface (Fronthaul). Therefore, in the new 5G NR system, it is necessary to redefine the division of the pre-transmission network interface in the base station gNB. In the division mode, it is necessary to consider the transmission capacity, the transmission delay, and the convenient deployment. For example, considering the non-ideal forward transmission, the network function with delay-insensitive is placed in the first network element, for example, a centralized processing unit. In the Centralized Unit (CU), the delay-sensitive network function is placed in the second network element, for example, a distributed processing unit (DU). The overall architecture is shown in Figure 1.

A centralized deployment gNB can include a gNB-CU and multiple gNB-DUs under its jurisdiction, which are connected by a forward link logical interface F1. A gNB-DU can only be connected to and controlled by a gNB-CU. There is no direct interface between the gNB-DU and the adjacent gNB-DU. From the outside, the NG and Xn interfaces are terminated on the gNB-CU unit, and the gNB-DU is not visible to the outside. To ensure reliability, a gNB-DU may also be connected to multiple gNB-CUs from the perspective of actual deployment. From the perspective of 5GC, other neighboring gNBs or terminal UEs, both gNB-CU and gNB-DU exist as a whole large gNB, so the NG, Xn, Uu interface and "integral flat" gNB between them The deployment is the same.

The 5G user service and the unbalanced user service physical distribution required by different Quality of Service (QOS) services have different requirements for network deployment and data transmission performance of 5G networks. These different types of data services are often different. Interlaced coexistence, or hotspots in local areas, thus making the current relatively closed network architecture unable to support various 5G communication scenarios more efficiently. Therefore, on the basis of CU and DU partitioning, combined with the comprehensive considerations of transmission delay, load balancing, multi-vendor equipment interoperability and deployment cost, it is necessary to further control plane entities in the CU entity (Control plane) (referred to as CP) and user plane entity (User plane, abbreviated as UP) for physical segmentation (Note: CP and UP function set, which has been divided by logic level in the past, but physically integrated in a single base station network element), CPs and UPs can be deployed in different geographical locations, independently configured, resource-expanded, and functionally upgraded, so that they can be deployed more flexibly and efficiently to meet the various business requirements of 5G. The architecture of CP/UP physical separation is shown in Figure 2.

From the deployment location, the CP entity can be deployed in the network center computer room, such as the CU entity, and manage multiple UP entities in the jurisdiction to efficiently coordinate the service load resources between multiple UP entities to achieve load balancing. CP also It can be deployed at the edge of the network close to the DU entity according to the requirements. Similarly, the UP entity can be deployed in the network database center, such as the CU entity or the core network UPF entity, and is controlled to be connected to multiple CP entities to implement the UP entity. Shared multiplexing of the internal baseband resource pool; UP can also be deployed at the edge of the network near the DU entity according to requirements. The above flexible deployment modes can enable the baseband resources in the CP/UP entity to be utilized efficiently, and can greatly reduce the interaction delay between the RRC control plane signaling and the user service data and the DU entity. Meet the QOS requirements of low latency services such as URLLC.

From the perspective of operators, the separation of CP and UP can construct a more flexible and efficient network deployment mode, which can further reduce the deployment cost while enhancing network performance and meeting various service requirements. At the same time, the physical separation of CP/UP and the standardization of related interfaces greatly enhance the interoperability between CP and UP physical devices, making it possible for CP entities and UP entities to adopt devices of different vendors, and it is also beneficial for operators to further reduce 5G. The cost of infrastructure investment purchases.

From the perspective of the air interface user plane, the CP entity includes an RRC and Packet Data Convergence Protocol (PDCP-C) layer (PDCP processing for control plane signaling), and the UP entity includes service data adaptation. Protocol (Service Data Adaptation Protocol, SDAP for short), PDCP-U layer (for PDCP processing of user plane data). A many-to-many mapping connection mode can be adopted between the CP entity and the UP entity. The CP can manage multiple UPs at the same time, and the resources provided by the UP can also be shared by multiple CPs.

As the CP/UP is physically separated, the UP entity can independently process the user service data stream to and from the core user plane (User Plane Function, UPF for short) on the premise that the UP entity is successfully configured. For the following behaviors, the UP entity needs to encrypt the downstream user service data stream (Cipher or Encryption) and integrity protection (Integrity Protection) according to the requirements of objective security. Otherwise, the downlink user service data stream will face multiple times when it is transmitted in the air interface. Risk; for the uplink, the UE also encrypts the upstream user service data stream (Cipher or Encryption) and integrity protection (Integrity Protection). For the UP entity, it is required to decrypt and integrity protect the data stream. Test.

In the related art, in the scenario where the network side CP/UP network element entities are physically separated, how to perform security management and control processing of user service data stream transmission between the CP/UP has not yet proposed an effective solution.

Summary of the invention

The embodiment of the present application provides a data stream transmission security control method and apparatus, to at least solve the problem of how to perform user service data flow between CP/UPs in a scenario where the network side CP/UP network element entities are physically separated in the related art. The problem of security management and handling of transmission.

According to an embodiment of the present application, a data stream transmission security control method is provided, including: a user plane UP entity independently configuring security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: The security entity independently configures the security control information, and the UP entity combines the parameters sent by the control plane CP entity to configure the security control information; the security control information includes at least one of the following: a security algorithm and a security configuration parameter; The UP entity sends the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.

Optionally, the security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm; the security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and each DRB The subkey derives the auxiliary value DSKF.

Optionally, the method further includes: the UP entity deriving a corresponding algorithm subkey for each DRB according to a security configuration parameter configured by itself; wherein the algorithm subkey includes a first algorithm subkey and a second algorithm subkey, the first algorithm subkey is used to perform an encryption operation on a downlink data packet on each DRB or a decryption operation on an uplink data packet on each DRB, and the second algorithm The key is used to perform integrity protection operations on downlink data packets on each DRB or integrity protection check operations on uplink data packets on each DRB.

Optionally, the method further includes: the UP entity receives a security configuration parameter that is sent by the control plane CP entity through the E1 logical interface; and the UP entity derives a corresponding algorithm for each DRB according to the security configuration parameter. a subkey, wherein the algorithm subkey includes at least a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used to encrypt a downlink data packet on each DRB Or performing a decryption operation on the uplink data packet on each DRB, where the second algorithm subkey is used to perform integrity protection operation on the downlink data packet on each DRB or complete the uplink data packet on each DRB. Sex protection check operation.

Optionally, the sending, by the UP entity, the security control information to the user equipment by using the CP entity, the sending, by the UP entity, sending the security control information to the CP entity by using a flow message of the first specified interface So that the CP entity sends the security control information to the UE through a second designated interface.

Optionally, the first designated interface is an E1 logical interface between the CP entity and the UP entity network element, and the second designated interface is an air interface Uu.

Optionally, the method further includes: updating and reconfiguring the security control information if the DRB meets a preset condition.

According to another embodiment of the present application, a data stream transmission security control method is provided, including: the user equipment UE receives security control information sent by a user plane UP entity through a control plane CP entity; wherein the security control information is The UP entity is configured to independently configure the information of the DRB for each data radio according to a predetermined manner. The predetermined manner includes: the UP entity independently configures the security control information, and the UP entity combines parameters sent by the control plane CP entity. And configuring the security control information; the security control information includes at least one of the following: a security algorithm, a security configuration parameter; and the UE performs independent security control processing on each DRB data flow according to the security control information.

Optionally, the performing, by the UE, the independent security control process on each of the DRB data flows according to the security control information includes: the UE adopts a first algorithm subkey and a second algorithm subkey corresponding to each DRB respectively. The generated uplink encrypted stream and the integrity protection bit string are independently encrypted for each data stream on the DRB; or the data integrity protection is independently performed on the data stream on each DRB; wherein the first algorithm is dense The key and the second algorithm sub-key are: the algorithm sub-key derived by the UP entity according to the security configuration parameter configured by itself, or the security configuration sent by the UP entity according to the CP entity The parameter is the algorithm subkey derived for each DRB.

According to another embodiment of the present application, a data stream transmission security control apparatus is provided, which is applied to a user plane UP entity, and includes: a configuration module configured to independently configure security control information for each data radio bearer DRB according to a predetermined manner, The predetermined manner includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least the following A security algorithm, a security configuration parameter, and a sending module, configured to send the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.

Optionally, the device further includes: a first derivation module, configured to derive a corresponding algorithm subkey for each DRB according to the security configuration parameter configured by itself; wherein the algorithm subkey includes the first algorithm a key and a second algorithm subkey, the first algorithm subkey is used to perform an encryption operation on a downlink data packet on each DRB or a decryption operation on an uplink data packet on each DRB, the second The algorithm subkey is used to perform integrity protection operations on downlink data packets on each DRB or integrity protection check operations on uplink data packets on each DRB.

Optionally, the device further includes: a receiving module configured to receive a security configuration parameter sent by the control plane CP entity through the E1 logical interface; and a second derivation module configured to derive each DRB according to the security configuration parameter Corresponding algorithm subkey, wherein the algorithm subkey includes at least a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used for a downlink packet on each DRB Performing an encryption operation or performing a decryption operation on an uplink packet on each DRB, the second algorithm subkey being used for performing integrity protection operations on downlink data packets on each DRB or uplink data on each DRB The package performs an integrity protection check operation.

Optionally, the sending module is further configured to send the security control information to the CP entity by using a flow message of the first designated interface, so that the CP entity sends the security control information by using a second designated interface. To the UE.

Optionally, the device further includes: an update module, configured to update and reconfigure the security control information if the DRB meets a preset condition.

According to another embodiment of the present application, a data stream transmission security control apparatus is provided, which is applied to a user equipment UE, and includes: a receiving module, configured to receive security control information sent by a user plane UP entity through a control plane CP entity; The security control information is information that the UP entity independently configures for each data radio bearer DRB according to a predetermined manner. The predetermined manner includes: the UP entity independently configures the security control information, and the UP entity combines Controlling the security control information by the parameters sent by the CP entity; the security control information includes at least one of the following: a security algorithm, a security configuration parameter, and a processing module configured to each of the DRB data according to the security control information The flow performs independent security control processing.

Optionally, the processing module includes: a first processing unit configured to generate an uplink encrypted stream and an integrity protection bit string respectively by using a first algorithm subkey and a second algorithm subkey corresponding to each DRB, The data stream on each DRB is independently encrypted; or the second processing unit is configured to perform data integrity protection independently on the data stream on each DRB; wherein the first algorithm subkey and the second The algorithm subkey is an algorithm subkey derived by the UP entity according to the security configuration parameter configured by itself, or the UP entity derives the security configuration parameter sent by the CP entity for each DRB. Algorithm subkey.

According to still another embodiment of the present application, there is also provided a storage medium comprising a stored program, wherein the program is executed to perform the method of any of the above.

According to still another embodiment of the present application, there is also provided a processor for running a program, wherein the program is executed to perform the method of any of the above.

In this application, the user plane UP entity configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is combined with the control plane CP entity configuration. The security control information includes at least one of the following: a security algorithm and a security configuration parameter; the UP entity sends the security control information to the user equipment UE by using the CP entity. That is to say, the UP entity is used as the master control, and the CP entity plays a supporting role. In the scenario where the physical separation between the network side CP/UP network element entities in the related art is solved, how is the CP/UP performed? The problem of security management and control processing of user service data stream transmission achieves the technical effect of effectively performing security management and control of user service data stream transmission.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the present application, and are intended to be a part of this application. In the drawing:

1 is a schematic diagram of a 5G NR CU-DU split deployment (gNB centralized deployment) architecture in the related art;

2 is a schematic structural diagram of physical separation of CP/UP in the related art;

3 is a flowchart of a data stream transmission security control method according to an embodiment of the present application;

4 is a flowchart (1) of a data stream transmission security control method according to an alternative embodiment of the present application;

5 is a flowchart (2) of a data stream transmission security control method according to an alternative embodiment of the present application;

6 is a flowchart (3) of a data stream transmission security control method according to an alternative embodiment of the present application;

7 is a flowchart (4) of a data stream transmission security control method according to an alternative embodiment of the present application;

8 is a flowchart (5) of a data stream transmission security control method according to an alternative embodiment of the present application;

9 is a structural block diagram of a data stream transmission security control apparatus according to an embodiment of the present application;

FIG. 10 is a structural block diagram (1) of a data stream transmission security control apparatus according to an embodiment of the present application; FIG.

11 is a structural block diagram (2) of a data stream transmission security control apparatus according to an embodiment of the present application;

FIG. 12 is a structural block diagram (3) of a data stream transmission security control apparatus according to an embodiment of the present application; FIG.

FIG. 13 is a flowchart of another data stream transmission security control method according to an embodiment of the present application; FIG.

FIG. 14 is a structural block diagram of another data stream transmission security control apparatus according to an embodiment of the present application; FIG.

FIG. 15 is a structural block diagram (1) of another data stream transmission security control apparatus according to an embodiment of the present application.

Detailed ways

The present application will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or order.

Example 1

In this embodiment, a data stream transmission security control method is provided. FIG. 3 is a flowchart of a data stream transmission security control method according to an embodiment of the present application. As shown in FIG. 3, the process includes the following steps:

Step S302: The user plane UP entity independently configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is sent in conjunction with the control plane CP entity. And configuring the security control information; the security control information includes at least one of the following: a security algorithm, a security configuration parameter;

It should be noted that the security algorithm includes at least one of the following: an encryption algorithm and an integrity protection algorithm; the security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a sub-DRB sub- The key derives the auxiliary value DSKF.

Step S304: The UP entity sends the security control information to the user equipment UE through the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.

Optionally, the execution order of step S302 and step S304 is interchangeable, that is, step S304 may be performed first, and then S302 is performed.

Optionally, the application scenario of the foregoing data stream transmission security control method includes, but is not limited to, a scenario in which a network side CP/UP network element entity is physically separated in a 5G NR or other equal-bit system. In this scenario, the user plane UP entity configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is combined with the control plane CP entity configuration. The security control information includes at least one of the following: a security algorithm and a security configuration parameter; the UP entity sends the security control information to the user equipment UE by using the CP entity. That is to say, the UP entity is used as the master control, and the CP entity plays a supporting role. In the scenario where the physical separation between the network side CP/UP network element entities in the related art is solved, how is the CP/UP performed? The problem of security management and control processing of user service data stream transmission achieves the technical effect of effectively performing security management and control of user service data stream transmission.

The present embodiment will be exemplified below with reference to specific examples.

Optionally, in this example, the logical interface between the CP/UP network element entities is referred to as an E1 interface, and for a specific served UE object, it may be configured with one or more data radio bearers DRB: Data Radio Bearer, Used to transport user traffic data streams.

The network side UP entity is configured for security configuration and related encryption and decryption and integrity protection and verification operations for each user service data flow in the UP entity.

The UP entity preferentially configures an independent security algorithm for each DRB, including at least: an encryption algorithm, and optionally an integrity protection algorithm; in the special case, the UP entity selects a common security algorithm for all DRBs. After the UP entity completes the configuration of the security algorithm, the result of the selected configuration needs to be notified to the CP entity through the E1 interface process message. If the UP entity does not configure any security algorithm for the DRB itself, the accepting CP entity selects an independent security algorithm for each DRB. In the special case, the CP entity configures the same common security algorithm for all DRBs. The CP entity tells the UP entity to select the configured security algorithm through the E1 interface flow message.

The UP entity itself preferentially generates a public root key KgNB and a mobile next hop parameter next hopping (referred to as NH) and preferentially generates a Per DRB related sub-key derivation auxiliary value (DRB Specific Key Factor, referred to as DSKF). If the UP entity does not preferentially generate the above security configuration parameters, it accepts the KgNB, NH, and DSKF security parameters configured by the CP entity. The CP entity sends the above security parameters configured by the UP entity through the E1 interface flow message.

The PDCP-U protocol entity in the UP entity (each PDCP-U serves a DRB), and based on the above-mentioned security configuration parameters generated by itself, derives the independent algorithm subkey KUPenc for each DRB (for adding Decrypted) and KUPint (for integrity protection); if unsuccessful, secondly based on the above security configuration parameters sent by the CP entity through the E1 interface, derive respective independent algorithm subkeys KUPenc and KUPint for each DRB, derivation The methods and processes are defined and selected by the PDCP-U protocol entity.

The UP entity configures an independent security algorithm for each DRB, and KUPenc and KUPint corresponding to each DRB are sent to the CP entity through the E1 interface process message.

The CP entity sends the security algorithm corresponding to each DRB and KUPenc and KUPint to the UE through the air interface Uu. For the downlink, the UE decrypts the encrypted service data stream on each DRB through the downlink decryption stream and the integrity protection check bit string respectively generated by KUPenc and KUPint corresponding to each DRB, and/or for each DRB. Perform data integrity protection check operations.

The foregoing security processing mode is applicable to both the downlink user service data flow and the uplink user service data flow. For the uplink, the UE performs an encryption operation on the original service data stream on each DRB by using the uplink encrypted stream and the integrity protection bit string MAC-I respectively generated by each of the KUPenc and KUPint corresponding to each DRB, and or each pair. The DRB performs data integrity protection operations; accordingly, the decryption and integrity protection check operations of each DRB data stream are performed in the UP entity.

In an optional implementation manner, the method further includes: the UP entity deriving a corresponding algorithm subkey for each DRB according to the configured security configuration parameter; or, in an optional implementation manner, the foregoing method further The method includes: the UP entity receives a security configuration parameter sent by the control plane CP entity through the E1 logical interface; and the UP entity derives a corresponding algorithm subkey for each DRB according to the security configuration parameter.

It should be noted that the foregoing algorithm subkey includes a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used to perform encryption operation on each downlink packet on each DRB or The uplink data packet on the DRB performs a decryption operation, and the second algorithm subkey is used to perform an integrity protection operation on the downlink data packet on each DRB or perform an integrity protection verification operation on the uplink data packet on each DRB. .

Optionally, the sending, by the UP entity, the security control information to the user equipment by using the CP entity, the method: the UP entity sends the security control information to the CP entity by using a flow message of the first specified interface, so that the CP entity passes the The second designated interface sends the security control information to the UE.

The first designated interface is an E1 logical interface between the CP entity and the UP entity network element, and the second designated interface is an air interface Uu.

In an optional implementation manner, the method further includes: updating and reconfiguring the security control information if the DRB meets a preset condition.

It should be noted that the above update and reconfiguration process includes but is not limited to: each DRB independent update and reconfiguration, DRB joint update and reconfiguration.

The following technical effects can be achieved by this embodiment:

1: Each DRB has independent algorithm subkeys KUPenc and KUPint. Therefore, when KUPenc and KUPint each require Key Refresh update and reconfiguration, it is not required to change the public root key KgNB, and only need to do the key corresponding to its own DRB. Update and reconfigure it without affecting the transmission of business data on other DRBs.

2: Introduce the Per DRB-related subkey to derive the auxiliary value DSKF. This new parameter can be used to distinguish the KUPenc and KUPint derivation results corresponding to each DRB to achieve security isolation between DRBs.

3: In the security management of the user service data stream transmission, the UP entity takes precedence over the CP entity, provides KUPenc and KUPint corresponding auxiliary parameters for each DRB, and the UP entity itself derives the specific KUPenc and KUPint results and returns to the CP entity. This ensures that the UP entity device manufacturer can adopt independent security parameter generation configuration and different key derivation mode processes; otherwise, the UP entity can only passively accept the security parameter configuration and key derivation mode and process determined by the CP entity.

4: When the UP entity itself cannot provide certain security parameters, such as: Per DRB configured security algorithm, KgNB, NH, Per DRB related subkey derivation auxiliary value DSKF, the CP entity can assist in generation and configuration, which also The protection of the CP entity to the security management of the UP entity is enhanced.

Alternative embodiment 1

At a certain time, UE1 is configured with two DRBs: DRB1 and DRB2, which are used to carry services for transmitting voice and image data. The network side CP entity and the UP entity have four integrity protection algorithms to choose from: {EIA1, EIA2, EIA3, EIA4}, don't consider the encryption protection of DRB. In this embodiment, the UP entity has strong autonomous security management rights, and all the security parameters of the present application can be configured. As shown in Figure 4, the following steps are included:

Step S401: The network side UP entity preferentially selects and configures the same integrity protection algorithm EIA1 for DRB1/2. The UP entity independently generates the public root key KgNB and NH according to the configuration before the core network AMF, and the UP entity also preferentially generates the DSKF parameters related to each of the DRB1/2.

Step S402: The PDCP-U protocol entity in the UP entity derives the independent integrity protection algorithm subkeys KUPint1 and KUPint2 for the DRB1/2 based on the security configuration parameters generated by the priority.

Step S403: The UP entity sends the KUPint1 and KUPint2 corresponding to the DRB1/2 generated by the UP entity to the CP entity through the E1 interface: Security Configuration Update.

Step S404: The CP entity sends the KUPint1 and KUPint2 corresponding to the DRB1/2 to the UE1 through the air interface Uu flow message RRC Connection Reconfiguration, and the EIA1 integrity protection algorithm identifier preferentially selected by the UP entity.

Step S405: The UE1 completes the integrity-protected service data stream on the DRB1/2 by using the integrity protection check bit sequences MAC-I1 and MAC-I2 generated by KUPint1 and KUPint2 respectively based on the EIA1 integrity protection algorithm. Sex protection check operation. For the uplink, UE1 performs integrity protection operations on the original service data stream on DRB1/2 through the integrity protection bit strings MAC-I1 and MAC-I2 respectively generated by KUPint1 and KUPint2 based on the EIA1 integrity protection algorithm.

Alternative embodiment 2

At a certain moment, UE2 is configured with two DRBs: DRB3 and DRB4, which are used to carry services for transmitting files and video data respectively. The network side CP entity and the UP entity have four integrity protection algorithms to choose from: {EIA1, EIA2, EIA3, EIA4}, don't consider the encryption protection of DRB. In this embodiment, the UP entity does not have full autonomous security management rights, and cannot configure all the security parameters of the present application. The CP entity needs to assist in configuring the KgNB and NH security parameters. As shown in Figure 5, the following steps are included:

Step S501: The network side UP entity still preferentially configures the integrity protection algorithm EIA2 and the respective related DSKF parameters for the DRB3/4, but cannot generate the KgNB and NH parameters. The CP entity generates a common root key KgNB and NH parameters according to the configuration of the core network AMF.

Step S502: The CP entity sends only the public root key KgNB and the NH value configured for DRB3/4 to the UP entity through the E1 interface flow message E1AP: Security Configuration Assisting.

Step S503: The PDCP-U protocol entity in the UP entity derives the independent integrity protection subkeys KUPint3 and KUPint4 for the DRB3/4 based on the partial security configuration parameters sent by the CP entity.

Step S504: The UP entity sends the KUPint3 and KUPint4 corresponding to the DRB3/4 generated by the UP entity to the CP entity through the E1 interface: Security Configuration Update.

Step S505: The CP entity sends the KUPint3 and KUPint4 corresponding to the DRB3/4 to the UE2 through the air interface Uu flow message Security Mode Command, and the integrity protection algorithm EIA2 identifier selected by the UP entity.

Step S506: The UE2 completes the integrity-protected service data stream on the DRB3/4 by using the integrity protection check bit sequences MAC-I3 and MAC-I4 generated by KUPint3 and KUPint4 respectively based on the EIA2 integrity protection algorithm. Sex protection check operation. For the uplink, UE2 performs integrity protection operations on the original service data streams on DRB3/4, respectively, based on the EIA2 integrity protection algorithm, through the integrity protection bit strings MAC-I3 and MAC-I4 generated by KUPint3 and KUPint4, respectively.

Alternative embodiment 3

At a certain time, UE3 is configured with two DRBs: DRB5 and DRB6, which are used to carry services for transmitting web browsing and audio data. The network side CP entity and UP entity have three encryption algorithms to choose from: {AES, SNOW3G, ZUC} , do not consider the integrity protection of DRB. In this embodiment, the UP entity does not have full autonomous security management rights, and cannot configure all the security parameters of the present application. The CP entity needs to assist in configuring the KgNB and NH security parameters. As shown in FIG. 6, the following steps are included:

Step S601: The network side UP entity still preferentially configures the encryption algorithm AES and the respective related DSKF parameters for the DRB 5/6, but cannot generate the KgNB and NH parameters. The CP entity generates a common root key KgNB and NH parameters according to the configuration of the core network AMF.

Step S602: The CP entity sends the public root key KgNB and the NH value configured for the DRB 5/6 to the UP entity together through the E1 interface process message E1AP: Security Configuration Assisting.

Step S603: The PDCP-U protocol entity in the UP entity derives the independent encryption algorithm subkeys KUPenc5 and KUPenc6 for the DRB5/6 based on the partial security configuration parameters sent by the CP entity.

Step S604: The UP entity sends the KUPenc5 and KUPenc6 corresponding to the DRB5/6 generated by the UP entity to the CP entity through the E1 interface: Security Configuration Update.

Step S605: The CP entity sends the KUPenc5 and KUPenc6 corresponding to the DRB5/6 to the UE3 through the air interface Uu flow message Security Mode Command, and the AES encryption algorithm identifier selected by the UP entity.

Step S606: The UE3 decrypts the encrypted service data stream on the DRB 5/6 by using the decrypted stream generated by each of KUPenc5 and KUPenc6 based on the AES encryption algorithm. For the uplink, UE3 encrypts the original service data stream on DRB5/6 by the encrypted stream generated by KUPenc5 and KUPenc6 respectively based on the AES encryption algorithm.

Alternative embodiment 4

At a certain moment, UE4 is configured with two DRBs: DRB7 and DRB8, which are respectively used to carry services for transmitting audio and image data. Through the initial security configuration process in the foregoing various embodiments, the network has selected EIA3 as the integrity protection algorithm, and the UP entity has derived its independent integrity protection subkeys KUPint7 and KUPint8 for DRB7/8, based on As a result of the foregoing security configuration, each service data stream has been transmitted between the network and the UE. After a while, the SN sequence number of the DRB7 reaches the maximum value, and the PDCP Count value is reversed. Therefore, the integrity protection subkey KUPint7 corresponding to the DRB7 needs to update and reconfigure the Key Refresh. As shown in Figure 7, the following steps are included:

Step S701: The service data stream on the DRB 7/8 is being transmitted between the network and the UE 4. At this time, the DRB 7/8 corresponds to the integrity protection subkeys KUPint7 and KUPint8, respectively. The UP entity now holds all previous security configuration parameters and status contexts.

Step S702: At a certain moment, the PDCP SN sequence number corresponding to the DRB7 reaches the maximum value, and the Count value is reversed. Therefore, the DRB7 needs to update and reconfigure its integrity protection subkey KUPint7 to re-protect the future data stream. operating.

Step S703: The PDCP-U protocol entity in the UP entity re-derives the new integrity protection subkey KUPint7 for the DRB7 based on the previously saved security configuration parameters and context, and the update and reconfiguration DSKF values generated by the Key Refresh requirement. New). Since DRB8 does not need to update and reconfigure the integrity protection subkey, KUPint8 continues to be used and the data on DRB8 continues to be transmitted.

Step S704: The UP entity sends the new integrity protection subkey KUPint7(new) corresponding to the DRB7 generated by the UP entity to the CP entity through the E1 interface process message.

Step S705: The CP entity sends the new integrity protection subkey KUPint7(new) corresponding to the DRB7 to the UE4 through the air interface Uu flow message RRC Connection Reconfiguration, and the EIA3 integrity protection algorithm identifier currently being used.

Step S706: The UE4 generates a new integrity protection check bit string MAC-I7 by using the new integrity protection subkey KUPint7(new) based on the EIA3 integrity protection algorithm to complete the service data flow of the future new integrity protection on the DRB7. Sex protection check operation. For the uplink, UE4 performs an integrity protection operation on the future original service data stream on DRB7 based on the EIA3 integrity protection algorithm through the new integrity protection bit string MAC-I7 generated by KUPint7(new). During the entire DRB7Key Refresh process, the service data transmission in DRB8 is not affected.

Alternative embodiment 5

At a certain time, UE5 is configured with two DRBs: DRB9 and DRBa, which are respectively used to carry services for transmitting video and file data. Through the initial security configuration process in the foregoing various embodiments, the network has selected to configure the EIA4 integrity protection algorithm, and the UP entity has derived respective independent integrity protection subkeys KUPint9 and KUPintA for DRB9/a, based on the above As a result of the security configuration, various service data streams have been transmitted between the network and the UE. After a while, the SN sequence number of the DRB9 reaches the maximum value, and the PDCP Count value is reversed. Therefore, the integrity protection subkey KUPint9 corresponding to the DRB9 needs to update and reconfigure the Key Refresh. As shown in Figure 8.

Step S801: The service data stream on the DRB9/a is being transmitted between the network and the UE 5. At this time, the DRB9/a corresponds to the integrity protection subkeys KUPint9 and KUPintA, respectively. The UP entity now holds all previous security configuration parameters and status contexts.

Step S802: At a certain moment, the PDCP SN sequence number corresponding to the DRB9 reaches the maximum value, and the Count value is reversed. Therefore, the DRB9 needs to update and reconfigure its integrity protection subkey to perform the integrity protection operation on the future data stream. . At this point, the UP entity also decides to update and reconfigure its integrity protection subkey for the DRBa at the same time, although the DR value has not yet occurred.

Step S803: The PDCP-U protocol entity in the UP entity re-derives the new integrity protection subkey KUPint9 for the DRB9 based on the previously saved security configuration parameters and context, and the update and reconfiguration DSKF values generated by the Key Refresh requirement. New), at the same time re-introducing the new algorithm subkey KUPintA(new) for DRBa. At this time, the data transmission on DRB9 and DRBa is interrupted.

Step S804: The UP entity sends the new integrity protection subkeys KUPint9(new) and KUPintA(new) corresponding to the DRB9 and the DRBa generated by the UP entity to the CP entity through the E1 interface: Security Configuration Update.

Step S805: The CP entity sends the new integrity protection subkeys KUPint9(new) and KUPintA(new) corresponding to DRB9 and DRBa to the UE5 through the air interface Uu flow message RRC Connection Reconfiguration, and the EIA4 integrity protection currently in use. Algorithm identification.

Step S806: The UE5 generates a new integrity protection check bit string MAC-I9 and MAC-IA through the new integrity protection subkeys KUPint9(new) and KUPintA(new) based on the EIA4 integrity protection algorithm, on the DRB9 and the DRBa. In the future, the integrity-protected service data stream performs an integrity protection check operation. For uplink, UE5 generates new integrity protection bit strings MAC-I9 and MAC-IA based on EIA4 integrity protection algorithm through KUPint9(new) and KUPintA(new) to perform integrity on future original service data streams on DRB9 and DRBa. Protection operation.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present application, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present application.

Example 2

In this embodiment, a data stream transmission security control device is also provided, which is used to implement the foregoing embodiments and preferred embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

FIG. 9 is a structural block diagram of a data stream transmission security control apparatus according to an embodiment of the present application, applied to a user plane UP entity, as shown in FIG. 9, the apparatus includes:

1) The configuration module 92 is configured to independently configure security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is combined with the control plane CP entity. The security control information is configured by the parameter: the security control information includes at least one of the following: a security algorithm, and a security configuration parameter;

Optionally, the security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm; the security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a sub-density of each DRB. The key derives the auxiliary value DSKF.

2) The sending module 94 is configured to send the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.

Optionally, the application scenario of the foregoing data stream transmission security control device includes, but is not limited to, in a scenario where the network side CP/UP network element entity is physically separated in a 5G NR or other equal-bit system. The device shown in FIG. 9 solves the problem of how to perform security management and control processing of user service data stream transmission between CP/UP in a scenario where the network side CP/UP network element entities are physically separated in the related art, and the problem is effectively achieved. The technical effect of security management of user service data stream transmission.

In an alternative embodiment, FIG. 10 is a structural block diagram (1) of a data stream transmission security control apparatus according to an embodiment of the present application. As shown in FIG. 10, the apparatus includes all the modules shown in FIG. Also includes:

1) The first derivation module 102 is configured to derive a corresponding algorithm subkey for each DRB according to the security configuration parameter configured by itself;

The algorithm subkey includes a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used to encrypt the downlink data packet on each DRB or on each DRB. The uplink data packet performs a decryption operation, and the second algorithm subkey is used to perform an integrity protection operation on the downlink data packet on each DRB or an integrity protection verification operation on the uplink data packet on each DRB.

In an alternative embodiment, FIG. 11 is a structural block diagram (2) of a data stream transmission security control apparatus according to an embodiment of the present application. As shown in FIG. 11, the apparatus includes all the modules shown in FIG. Also includes:

1) The receiving module 112 is configured to receive a security configuration parameter sent by the control plane CP entity through the E1 logical interface;

2) The second derivation module 114 is configured to derive a corresponding algorithm subkey for each DRB according to the security configuration parameter, where the algorithm subkey includes at least a first algorithm subkey and a second algorithm subkey The first algorithm subkey is used to perform an encryption operation on a downlink data packet on each DRB or a decryption operation on an uplink data packet on each DRB, and the second algorithm subkey is used on each DRB. The downlink packets perform integrity protection operations or perform integrity protection check operations on the upstream packets on each DRB.

In an optional implementation manner, the sending module 94 is further configured to send the security control information to the CP entity by using a flow message of the first specified interface, so that the CP entity sends the security control information through the second designated interface. Sent to the UE.

It should be noted that the first designated interface is an E1 logical interface between a CP entity and a UP entity network element, and the second designated interface is an air interface Uu.

In an alternative embodiment, FIG. 12 is a structural block diagram (3) of a data stream transmission security control apparatus according to an embodiment of the present application. As shown in FIG. 12, the apparatus includes all the modules shown in FIG. Also includes:

1) The update module 122 is configured to update and reconfigure the security control information if the DRB meets a preset condition.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

Example 3

In this embodiment, a data stream transmission security control method is further provided. FIG. 13 is a flowchart of another data stream transmission security control method according to an embodiment of the present application. As shown in FIG. 13, the process includes the following steps:

The step is 1302, the user equipment UE receives the security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The predetermined manner includes: the UP entity independently configures the security control information, and the UP entity combines the parameters sent by the control plane CP entity to configure the security control information; the security control information includes at least one of the following: a security algorithm and a security configuration parameter;

It should be noted that the foregoing security algorithm includes at least one of the following: an encryption algorithm and an integrity protection algorithm; the foregoing security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a sub-DRB sub- The key derives the auxiliary value DSKF.

The step is 1304, and the UE performs independent security control processing on each DRB data stream according to the security control information.

Optionally, the application scenario of the foregoing data stream transmission security control method includes, but is not limited to, a scenario in which a network side CP/UP network element entity is physically separated in a 5G NR or other equal-bit system. In this scenario, the user equipment UE receives the security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The predetermined manner includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least one of the following: a security algorithm, a security configuration parameter The UE performs independent security control processing on each DRB data stream according to the security control information, and solves the problem of how to perform user services between the CP/UP in the scenario where the network side CP/UP network element entities are physically separated in the related art. The problem of security management and control of data stream transmission achieves the technical effect of effectively performing security management and control of user service data stream transmission.

In an optional implementation manner, the UE performs independent security control processing on each DRB data stream according to the security control information, where the UE separately uses the first algorithm subkey and the second algorithm subkey corresponding to each DRB. The generated upstream encrypted stream and the integrity protection bit string are independently encrypted for each data stream on the DRB; or the data integrity protection is independently performed on the data stream on each DRB.

It should be noted that, the foregoing first algorithm subkey and the second algorithm subkey are: an algorithm subkey derived by the UP entity according to a security configuration parameter configured by itself, or the UP entity according to the The security configuration parameters sent by the CP entity are the algorithm subkeys derived for each DRB.

Example 4

FIG. 14 is a structural block diagram of another data stream transmission security control apparatus according to an embodiment of the present application, which is applied to a user equipment UE. As shown in FIG. 14, the apparatus includes:

a receiving module 1402, configured to receive security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The predetermined manner includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least one of the following: a security algorithm, a security configuration parameter ;

2) The processing module 1404 is configured to perform independent security control processing on each DRB data stream according to the security control information.

Optionally, the application scenario of the foregoing data stream transmission security control method includes, but is not limited to, a scenario in which a network side CP/UP network element entity is physically separated in a 5G NR or other equal-bit system. In this scenario, how to perform security management and control of user service data stream transmission between CP/UP in the scenario where the network side CP/UP network element entity is physically separated in the related art is solved by the device shown in FIG. The problem has reached the technical effect of effectively controlling the security of user traffic data transmission.

In an alternative embodiment, FIG. 15 is a structural block diagram (1) of another data stream transmission security control apparatus according to an embodiment of the present application. As shown in FIG. 15, the processing module 1404 includes:

1) The first processing unit 1502 is configured to process the data stream on each DRB by using an uplink encrypted stream and an integrity protection bit string respectively generated by the first algorithm subkey and the second algorithm subkey corresponding to each DRB. Encrypted independently; or,

2) The second processing unit 1504 is configured to perform data integrity protection independently on the data stream on each DRB;

The first algorithm subkey and the second algorithm subkey are algorithm subkeys derived by the UP entity according to the security configuration parameter configured by the UP entity, or the UP entity is sent according to the CP entity. The security configuration parameters are the algorithm subkeys derived for each DRB.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. In the form of separate processors

Example 5

The embodiment of the present application further provides a storage medium including a stored program, wherein the program runs to perform the method described in any of the above.

Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1, the user plane UP entity independently configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity combines with the control plane CP. The security control information is configured by the parameter sent by the entity, where the security control information includes at least one of the following: a security algorithm and a security configuration parameter;

S2: The UP entity sends the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.

Optionally, the storage medium is further arranged to store program code for performing the following steps:

S1, the user equipment UE receives the security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The predetermined manner includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least one of the following: Algorithm, security configuration parameters;

S2. The UE performs independent security control processing on each DRB data stream according to the security control information.

Optionally, in the embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM). A variety of media that can store program code, such as a hard disk, a disk, or an optical disk.

Embodiments of the present application also provide a processor for running a program, wherein the program executes the steps of any of the above methods when executed.

Optionally, in this embodiment, the foregoing program is used to perform the following steps:

Optionally, the processor is further arranged to store program code for performing the following steps:

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, which can be concentrated on a single computing device or distributed in a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the application is not limited to any particular combination of hardware and software.

The above description is only the preferred embodiment of the present application, and is not intended to limit the present application, and various changes and modifications may be made to the present application. Any modifications, equivalent substitutions, improvements, etc. made within the principles of this application are intended to be included within the scope of the present application.

Industrial applicability

In this embodiment, the user plane UP entity configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity combines with the control plane CP. The security control information is configured by the entity: the security control information includes at least one of the following: a security algorithm, a security configuration parameter, and the UP entity sends the security control information to the user equipment UE by using the CP entity. That is to say, the UP entity is used as the master control, and the CP entity plays a supporting role. In the scenario where the physical separation between the network side CP/UP network element entities in the related art is solved, how is the CP/UP performed? The problem of security management and control processing of user service data stream transmission achieves the technical effect of effectively performing security management and control of user service data stream transmission.

Claims

A data stream transmission security control method includes:

The user plane UP entity independently configures security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is combined with the control plane CP entity. And the security control information is configured by the at least one of the following: the security algorithm and the security configuration parameter;

The UP entity sends the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.
The method of claim 1 wherein

The security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm;

The security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a subkey derivation assistance value DSKF of each DRB.
The method of claim 1 wherein the method further comprises:

The UP entity derives a corresponding algorithm subkey for each DRB according to the security configuration parameter configured by itself;

The algorithm subkey includes a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used to encrypt the downlink data packet on each DRB or for each DRB. The upper uplink data packet performs a decryption operation, and the second algorithm subkey is used to perform an integrity protection operation on the downlink data packet on each DRB or perform an integrity protection verification operation on the uplink data packet on each DRB. .
The method of claim 1 wherein the method further comprises:

Receiving, by the UP entity, a security configuration parameter sent by the control plane CP entity through the E1 logical interface;

Deriving, by the UP entity, a corresponding algorithm subkey for each DRB according to the security configuration parameter, where the algorithm subkey includes at least a first algorithm subkey and a second algorithm subkey, The first algorithm subkey is used to perform an encryption operation on a downlink data packet on each DRB or a decryption operation on an uplink data packet on each DRB, and the second algorithm subkey is used on each DRB. The downlink packet performs an integrity protection operation or performs an integrity protection check operation on the uplink packet on each DRB.
The method of claim 1, wherein the sending, by the CP entity, the security control information to the user equipment UE by the CP entity comprises:

The UP entity sends the security control information to the CP entity by using a flow message of the first designated interface, so that the CP entity sends the security control information to the UE by using a second designated interface.
The method of claim 5, wherein

The first designated interface is an E1 logical interface between a CP entity and a UP entity network element, and the second designated interface is an air interface Uu.
The method of claim 1 wherein the method further comprises:

The security control information is updated and reconfigured if the DRB meets a preset condition.
A data stream transmission security control method includes:

The user equipment UE receives the security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The method includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least one of the following: a security algorithm, Security configuration parameters;

The UE performs independent security control processing on each DRB data stream according to the security control information.
The method of claim 8 wherein

The security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm;

The security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a subkey derivation assistance value DSKF of each DRB.
The method according to claim 8, wherein the UE performs independent security control processing on each DRB data stream according to the security control information, including:

The UE independently encrypts the data stream on each DRB by using an uplink encrypted stream and an integrity protection bit string respectively generated by the first algorithm subkey and the second algorithm subkey corresponding to each DRB; or

Independent data integrity protection for each data stream on the DRB;

The first algorithm subkey and the second algorithm subkey are: the algorithm subkey derived by the UP entity according to the security configuration parameter configured by itself, or the UP entity according to the The security configuration parameter sent by the CP entity is an algorithm subkey derived by each DRB.
A data stream transmission security control device is applied to a user plane UP entity, including:

The configuration module is configured to independently configure security control information for each data radio bearer DRB according to a predetermined manner, where the predetermined manner includes: the UP entity independently configures the security control information, and the UP entity is combined with a control plane CP entity. And sending the security control information; the security control information includes at least one of the following: a security algorithm, a security configuration parameter;

The sending module is configured to send the security control information to the user equipment UE by using the CP entity, so that the UE performs a data uplink and downlink transmission security control operation.
The apparatus according to claim 11, wherein

The security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm;

The security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a subkey derivation assistance value DSKF for each DRB.
The apparatus of claim 11 wherein said apparatus further comprises:

The first derivation module is configured to derive a corresponding algorithm subkey for each DRB according to the security configuration parameter configured by the first derivation module;

The algorithm subkey includes a first algorithm subkey and a second algorithm subkey, and the first algorithm subkey is used to encrypt the downlink data packet on each DRB or for each DRB. The upper uplink data packet performs a decryption operation, and the second algorithm subkey is used to perform an integrity protection operation on the downlink data packet on each DRB or perform an integrity protection verification operation on the uplink data packet on each DRB. .
The apparatus of claim 11 wherein said apparatus further comprises:

a receiving module configured to receive a security configuration parameter sent by the control plane CP entity through the E1 logical interface;

a second derivation module, configured to derive a corresponding algorithm subkey for each DRB according to the security configuration parameter, where the algorithm subkey includes at least a first algorithm subkey and a second algorithm subkey. The first algorithm subkey is used to perform an encryption operation on a downlink data packet on each DRB or a decryption operation on an uplink data packet on each DRB, and the second algorithm subkey is used for each DRB. The downlink packet on the uplink performs an integrity protection operation or performs an integrity protection check operation on the uplink packet on each DRB.
The apparatus according to claim 11, wherein the sending module is further configured to send the security control information to the CP entity by using a flow message of the first designated interface, so that the CP entity passes the second designated interface Sending the security control information to the UE.
The device according to claim 15, wherein

The first designated interface is an E1 logical interface between a CP entity and a UP entity network element, and the second designated interface is an air interface Uu.
The apparatus of claim 11 wherein said apparatus further comprises:

And an update module configured to update and reconfigure the security control information if the DRB meets a preset condition.
A data stream transmission security control device is applied to a user equipment UE, including:

a receiving module, configured to receive security control information sent by the user plane UP entity through the control plane CP entity; wherein the security control information is information that the UP entity independently configures each data radio bearer DRB according to a predetermined manner; The predetermined manner includes: the UP entity independently configuring the security control information, and the UP entity, in combination with the parameter sent by the control plane CP entity, configuring the security control information; the security control information includes at least one of the following: Algorithm, security configuration parameters;

The processing module is configured to perform independent security control processing on each DRB data stream according to the security control information.
The device according to claim 18, wherein

The security algorithm includes at least one of the following: an encryption algorithm, an integrity protection algorithm;

The security configuration parameter includes at least one of the following: a common root key KgNB, a mobile next hop parameter NH, and a subkey derivation assistance value DSKF of each DRB.
The apparatus of claim 18, wherein the processing module comprises:

The first processing unit is configured to separately encrypt the data stream on each DRB by using an uplink encrypted stream and an integrity protection bit string respectively generated by the first algorithm subkey and the second algorithm subkey corresponding to each DRB. ;or,

a second processing unit configured to perform data integrity protection independently on the data stream on each DRB;

The first algorithm subkey and the second algorithm subkey are algorithm subkeys derived by the UP entity according to the security configuration parameters configured by the UP entity, or the UP entity according to the The security configuration parameter sent by the CP entity is the algorithm subkey derived by each DRB.
A storage medium, the storage medium comprising a stored program, wherein the program is executed to perform the method of any one of claims 1 to 7 or 8-10.
A processor for running a program, wherein the program is executed to perform the method of any one of claims 1 to 7 or 8-10.