WO2019062920A1 - 数据安全处理方法及装置 - Google Patents

数据安全处理方法及装置 Download PDF

Info

Publication number
WO2019062920A1
WO2019062920A1 PCT/CN2018/108657 CN2018108657W WO2019062920A1 WO 2019062920 A1 WO2019062920 A1 WO 2019062920A1 CN 2018108657 W CN2018108657 W CN 2018108657W WO 2019062920 A1 WO2019062920 A1 WO 2019062920A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
user plane
base station
pdu session
target
Prior art date
Application number
PCT/CN2018/108657
Other languages
English (en)
French (fr)
Inventor
罗海燕
戴明增
郭轶
杨旭东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18862074.4A priority Critical patent/EP3567797B1/en
Publication of WO2019062920A1 publication Critical patent/WO2019062920A1/zh
Priority to US16/576,121 priority patent/US11510059B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/24—Negotiation of communication capabilities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/19—Connection re-establishment
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/02—Data link layer protocols

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a data security processing method and apparatus.
  • the security of the data is implemented based on the security algorithm, and various security algorithms can provide confidentiality and integrity protection for the data.
  • LTE long term evolution
  • UE User Equipment
  • MME Mobility Management Entity
  • KeNB an air interface protection key
  • the base station selects an appropriate security algorithm (encryption algorithm and integrity protection algorithm) according to the UE security capability information and the security capability of the base station itself.
  • the base station uses the key deduction algorithm to derive the user plane key and the control plane key of the access layer according to the KeNB.
  • the user plane key includes a Key User Plane encryption (KUPenc) and a user.
  • control plane key includes Radio Resource Control (RRC) signaling protection key (RRC RRC encryption (KRRCenc) and RRC integrity) Key RRC integrity (KRRCint).
  • RRC Radio Resource Control
  • the UE side can derive all non-access stratum keys and access stratum keys
  • UE side According to the KeNB, the process of deriving the user plane key and the control plane key of the access layer by using the key deduction algorithm is the same as that of the base station side, and the same key deduction algorithm specified by the protocol is adopted.
  • the final UE selects the encryption algorithm according to the base station.
  • the integrity protection algorithm, as well as the user plane key and the control plane key, encrypt and/or integrity protect the user plane data and the RRC message, as well as when the base station side transmits the data.
  • both the UE side and the base station side use the key deduction algorithm according to the KeNB to derive the user plane key and the control plane key of the access layer.
  • the key after which the encryption and integrity protection of all services of the UE use the same key as the key (including the user plane key and the control plane key) generated when the first PDU session is established.
  • the application provides a data security processing method and device to improve the security of data transmission.
  • the present application provides a data security processing method, including: establishing a first protocol data unit PDU session, the first base station deriving a first user plane key according to the received base key, and the first base station uses the first user
  • the face key and the security algorithm perform security processing on the user plane data in the first PDU session to establish a second PDU session, the first base station derives the second user plane key according to the base key, and the first base station uses the second user plane secret
  • the key and security algorithm securely processes the user plane data in the second PDU session
  • the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the first base station derives the user plane key according to the base key and the PDU session identifier of each PDU session, and uses the derived user plane key, each time the PDU session is established.
  • the security algorithm performs security processing on the user plane data in the PDU session, and different PDU sessions use different user plane keys, thereby improving the security of data transmission.
  • the first base station deducts the first user plane key according to the received base key, including: the first base station deducing the first user plane key according to the base key and the first parameter, the first parameter And determining, by the first base station, the second user plane key according to the basic key, the first base station deducing the second user plane key according to the basic key and the second parameter, where the second parameter is the second PDU Session ID.
  • the method further includes: the first base station sends a target base key and at least one PDU session identifier to the second base station, where the second base station derives the PDU session identifier according to the target base key and the at least one PDU session identifier.
  • the corresponding user plane key, the target base key is derived by the first base station according to the base key and the third parameter.
  • the method further includes:
  • the first base station sends the target security algorithm to the user equipment UE, and the target security algorithm is that the second base station selects and sends to the first base station according to the UE security capability information sent by the first base station;
  • the UE Transmitting, by the first base station, the third parameter and the at least one PDU session identifier to the UE, the UE deducing the target base key according to the base key and the third parameter, and deriving the PDU according to the target basic key and the at least one PDU session identifier.
  • the user plane key corresponding to the session identifier is used to securely process the user plane data in the PDU session by using the user plane key corresponding to the PDU session identifier and the target security algorithm.
  • the first base station is a source base station
  • the second base station is a target handover base station
  • the third parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information.
  • the data security processing method provided by the embodiment sends the deduced target base key and the at least one PDU session identifier to the second base station by using the first base station to derive the target base key according to the basic key and the third parameter, and second The base station derives a user plane key corresponding to the PDU session identifier according to the target base key and the at least one PDU session identifier, and the second base station selects a target security algorithm for the UE according to the UE security capability information sent by the first base station, so that the second base station uses the PDU session.
  • the first base station further sends the third parameter and the at least one PDU session identifier to the UE, and the UE according to the basic key and the first
  • the third parameter deduces the target base key, and then derives the user plane key corresponding to the PDU session identifier according to the target base key and the at least one PDU session identifier, and then uses the user plane key corresponding to the PDU session identifier and the target security algorithm to the PDU session.
  • the user plane data is processed securely, and the third parameter includes the NCC, the target cell identifier, and the frequency point information.
  • the first base station is the primary base station
  • the second base station is the secondary base station
  • the third parameter includes the secondary cell group SCG counter.
  • the first base station sends an indication to the second base station whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether to deduct the user corresponding to the PDU session identifier. Face integrity protection key.
  • the first base station comprises a centralized unit CU and a distributed unit DU
  • the CU comprises a control plane CU and a user plane CU
  • the control plane CU is connected to the user plane CU through a communication interface
  • the first base station is based on the basic network.
  • the control plane CU deducing the first user plane key according to the base key and the first parameter, and the first user face key corresponding to the first parameter and the first parameter Sending the key to the user plane CU;
  • the first base station deducing the second user plane key according to the basic key and the second parameter, comprising: the control plane CU deducing the second user plane key according to the basic key and the second parameter, and The second user plane key corresponding to the second parameter and the second parameter is sent to the user plane CU.
  • the control plane CU receives the base key sent by the core network, and the control plane CU derives the user plane key according to the base key and the PDU session identifier of each PDU session, and the PDU session is performed.
  • the user plane key corresponding to the identifier and the PDU session identifier is sent to the user plane CU, and the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to perform security processing on the user plane data in the PDU session.
  • the first base station comprises a centralized unit CU and a distributed unit DU
  • the CU comprises a control plane CU and a user plane CU
  • the control plane CU is connected to the user plane CU through a communication interface
  • the first base station is based on the basic network.
  • the control plane CU sends the base key and the first parameter to the user plane CU, and the user plane CU derives the first user plane key according to the basic key and the first parameter Deriving the second user plane key according to the basic key and the second parameter, the control unit CU sends the basic key and the second parameter to the user plane CU, and the user plane CU according to the basic key and the second parameter Deriving the second user plane key.
  • the control plane CU receives the base key sent by the core network, and the control plane CU sends the base key and the PDU session identifier of each PDU session to the user plane CU, where the user plane CU Deriving the user plane key according to the derivation base key and the PDU session identifier of each PDU session, the user plane CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier.
  • the control plane CU receives the base key sent by the core network, and the control plane CU sends the base key and the PDU session identifier of each PDU session to the user plane CU, where the user plane CU Deriving the user plane key according to the derivation base key and the PDU session identifier of each PDU session, the user plane CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier.
  • control plane CU sends an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is enabled.
  • the user plane CU determines whether to deduct the user plane complete corresponding to the PDU session identifier according to the indication.
  • Sexual protection key
  • the method further includes: the control plane CU sends a security algorithm to the user plane CU; the first base station uses the first user plane key and the security algorithm to perform security processing on the user plane data in the first PDU session, including
  • the user plane CU securely processes the user plane data in the first PDU session by using the first user plane key and the security algorithm; the first base station uses the second user plane key and the security algorithm to the user plane in the second PDU session.
  • the data is processed in security, and the user plane CU uses the second user plane key and the security algorithm to perform security processing on the user plane data in the second PDU session.
  • the method further includes: receiving, by the first base station, a radio resource control RRC re-establishment message or an RRC re-establishment message sent by the UE, where the RRC re-establishment message or the RRC re-recovery message includes the UE identifier, the original cell identifier, and the check code.
  • the shortMAC-I is generated, and the generated shortMAC-I is compared with the shortMAC-I sent by the UE to determine whether the verification is successful.
  • the data security processing method provided by the embodiment receives the RRC re-establishment message or the RRC recovery message sent by the UE by using the first base station, and the first base station according to the UE identifier, the original cell identifier, the control plane CU indication, or the user plane CU indication and the PDU. At least one of the session identifiers generates a short MAC-I, and compares the generated shortMAC-I with the short MAC-I sent by the UE to determine whether the verification is successful, and implements the security of data transmission in the RRC re-establishment or RRC recovery scenario.
  • the first base station receives an indication of whether the first PDU session identifier sent by the core network and the user plane integrity protection corresponding to the first PDU session identifier are turned on; and the first base station determines whether to deduct according to the indication.
  • a first PDU session identifier corresponding to the user plane integrity protection key the first base station receives an indication of whether the second PDU session identifier sent by the core network and the user plane integrity protection corresponding to the second PDU session identifier are enabled; The indication determines whether to derive the user plane integrity protection key corresponding to the second PDU session identifier.
  • the present application provides a data security processing method, including: a first base station transmitting, to a second base station, a target control plane base key, at least one PDU session identifier, and at least one PDU session identifier respectively corresponding to a target user plane basis a key, used by the second base station to derive a target control plane key according to the target control plane base key, and deriving the target user plane key according to the target user plane base key, where the target control plane key includes: a control plane encryption key and/or
  • the control plane integrity protection key includes: a user plane encryption key and/or a user plane integrity protection key;
  • the target control plane base key is a first base station according to a control plane basis key and the first According to the parameter derivation, the target user plane base key is derived by the first base station according to the user plane base key and the second parameter, and the second parameter is in one-to-one correspondence with the PDU session identifier, and the control plane base key is the core when the PDU session is first established
  • the data security processing method provided by the second aspect the target base plane basic key corresponding to the target control plane base key, the at least one PDU session identifier, and the at least one PDU session identifier respectively sent by the first base station to the second base station, where
  • the second base station derives the target control plane key according to the target control plane base key, and derives the target user plane key according to the target user plane base key, so that the second base station uses the target control plane key and the target first security algorithm to control plane data.
  • the security process is performed, and the user plane data in the PDU session is securely processed by using the target user plane key and the target second security algorithm, thereby realizing derivation and interaction of keys in the process of the source base station switching to the target handover base station.
  • the method further includes:
  • the first base station sends the target first security algorithm and the target second security algorithm to the user equipment UE, where the target first security algorithm and the target second security algorithm are selected by the second base station according to the UE security capability information sent by the first base station, and Sent to the first base station;
  • the first base station sends the first parameter and the second parameter to the UE, and is used by the UE to derive the target control plane base key according to the control plane base key and the first parameter of the UE, according to the user plane base key and the second parameter of the user plane. Deriving the target user plane base key, then deriving the target control plane key according to the target control plane base key, deducing the target user plane key according to the target user plane base key, using the target control plane key and the target first security algorithm pair
  • the control plane data is processed securely, and the user plane data in the PDU session is securely processed using the target user plane key and the target second security algorithm.
  • the first base station is a source base station
  • the second base station is a target handover base station
  • the first parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information
  • the second parameter includes At least one of an NCC, a target cell identity, a PDU session identifier, and frequency point information.
  • the application provides a data security processing method, including:
  • the first base station sends, to the second base station, a target user plane basic key corresponding to the at least one PDU session identifier and the at least one PDU session identifier, where the second base station derives the target user plane key according to the target user plane base key, and the target user
  • the face key includes: a user plane encryption key and/or a user plane integrity protection key;
  • the target user plane base key is derived by the first base station according to the user plane base key and the second parameter, and the second parameter is in one-to-one correspondence with the PDU session identifier, and the user plane base key is sent by the core network when the PDU session is established.
  • the first base station sends the target user plane basic key corresponding to the at least one PDU session identifier and the at least one PDU session identifier to the second base station, and the second base station is densely configured according to the target user plane.
  • Deriving the target user plane key so that the second base station uses the target control plane key and the target first security algorithm to securely process the control plane data, and uses the target user plane key and the target second security algorithm to the user in the PDU session.
  • the surface data is processed securely, thereby realizing the derivation and interaction of keys in the DC scenario.
  • the method further includes: the first base station adopts the target second security algorithm Sending to the user equipment UE, the target second security algorithm is that the second base station selects and sends the UE security capability information sent by the first base station to the first base station; the first base station sends the second parameter to the UE for the UE. Deriving the target user plane base key according to its own user plane base key and the second parameter, and then deriving the target user plane key according to the target user plane base key, using the target user plane key and the target second security algorithm to the PDU session. Identify the corresponding user plane data for security processing.
  • the method when the first base station sends the at least one PDU session identifier and the target user plane base key corresponding to the at least one PDU session identifier to the second base station, the method further includes:
  • the method further includes:
  • the first base station sends the target first security algorithm to the UE, and the target first security algorithm is that the second base station selects and sends to the first base station according to the UE security capability information sent by the first base station;
  • the first base station sends the first parameter to the UE, and the UE derives the target control plane base key according to the control plane base key and the first parameter, and then derives the target control plane key according to the target control plane base key, and uses The target control plane key and the target first security algorithm securely process the control plane data.
  • the first base station is the primary base station
  • the second base station is the secondary base station
  • the first parameter includes an SCG counter
  • the second parameter includes an SCG counter and a PDU session identifier
  • the first base station sends an indication to the second base station whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether to derive the corresponding PDU session identifier.
  • User face integrity protection key
  • the present application provides a data security processing method, including: establishing a PDU session, the control plane centralized unit CU receiving a user plane base key sent by the core network; and the control plane CU deducing the user plane key according to the user plane base key
  • the user plane key corresponding to the PDU session identifier and the PDU session identifier is sent to the user plane CU, and the user plane key includes: a user plane encryption key and/or a user plane integrity protection key; the user plane CU uses the PDU session.
  • the corresponding user plane key and the security algorithm are used to securely process the user plane data in the PDU session; wherein the control plane CU and the user plane CU are connected through a communication interface.
  • the control plane CU receives the user plane base key sent by the core network, and the control plane CU derives the user plane key according to the user plane base key, and corresponds the PDU session identifier to the PDU session identifier.
  • the user plane key is sent to the user plane CU, and the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to perform security processing on the user plane data in the PDU session.
  • the present application provides a data security processing method, including: establishing a PDU session, the control plane centralized unit CU receiving a user plane basic key sent by the core network; and the control plane CU corresponding to the PDU session identifier and the PDU session identifier.
  • the user plane key is sent to the user plane CU; the user plane CU derives the user plane key according to the user plane base key, and the user plane key includes: a user plane encryption key and/or a user plane integrity protection key;
  • the CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier.
  • the control plane CU is connected to the user plane CU through a communication interface.
  • the control plane CU receives the user plane basic key sent by the core network, and the control plane CU sends the user plane basic key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU.
  • the user plane CU derives the user plane key according to the user plane base key.
  • the user plane CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier. Thereby improving the security of data transmission in the CP-UP separation scenario.
  • control plane CU sends an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is enabled.
  • the user plane CU determines whether to deduct the user plane complete corresponding to the PDU session identifier according to the indication.
  • Sexual protection key
  • control plane CU sends the security algorithm selected according to the user equipment UE security capability information to the user plane CU.
  • the application provides a base station, including: a key derivation module, configured to derive a first user plane key according to the received base key when establishing a first protocol data unit PDU session;
  • the user plane data in the first PDU session is securely processed by using the first user plane key and the security algorithm;
  • the key deduction module is further configured to: when the second PDU session is established, deduct the second user face density according to the basic key
  • the processing module is further configured to perform security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm;
  • the user plane key includes: a user plane encryption key and/or a user plane integrity protection Key.
  • the key derivation module is specifically configured to: derive a first user plane key according to the basic key and the first parameter, where the first parameter is a first PDU session identifier; and the basic key and the second parameter are The second user plane key is derived, and the second parameter is the second PDU session identifier.
  • the method further includes: a sending module, configured to send a target base key and at least one PDU session identifier to the second base station, where the second base station derives the PDU according to the target base key and the at least one PDU session identifier.
  • the user plane key corresponding to the session identifier, and the target base key is derived by the base station according to the base key and the third parameter.
  • the sending module is further configured to: after sending the target base key and the at least one PDU session identifier to the second base station, send the target security algorithm to the user equipment UE, where the target security algorithm is the second base station according to the base station.
  • the transmitted UE security capability information is selected and sent by the UE to the base station; the third parameter and the at least one PDU session identifier are sent to the UE, and the UE is used to derive the target base key according to the basic key and the third parameter, and then The target base key and the at least one PDU session identifier deduct the user plane key corresponding to the PDU session identifier, and then use the user plane key corresponding to the PDU session identifier and the target security algorithm to securely process the user plane data in the PDU session.
  • the base station is the source base station
  • the second base station is the target handover base station
  • the third parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information.
  • the base station is the primary base station
  • the second base station is the secondary base station
  • the third parameter includes the secondary cell group SCG counter.
  • the sending module is further configured to: send, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is turned on, and the second base station determines, according to the indication, whether to deduct the user corresponding to the PDU session identifier. Face integrity protection key.
  • the base station includes a centralized unit CU and a distributed unit DU.
  • the CU includes a control plane CU and a user plane CU.
  • the control plane CU is connected to the user plane CU through a communication interface, and the key derivation module is specifically configured to:
  • the control control plane CU derives the first user plane key according to the base key and the first parameter, and sends the first parameter and the first user plane key corresponding to the first parameter to the user plane CU;
  • the key derivation module is specifically configured to: the control control plane CU derives the second user plane key according to the basic key and the second parameter, and sends the second user plane key corresponding to the second parameter and the second parameter to the user plane CU .
  • the base station includes a centralized unit CU and a distributed unit DU.
  • the CU includes a control plane CU and a user plane CU.
  • the control plane CU is connected to the user plane CU through a communication interface, and the key derivation module is specifically configured to:
  • the control control plane CU sends the basic key and the first parameter to the user plane CU, and the user plane CU derives the first user plane key according to the basic key and the first parameter;
  • the key deduction module is specifically configured to: the control control plane CU sends the basic key and the second parameter to the user plane CU, and the user plane CU derives the second user plane key according to the basic key and the second parameter.
  • the key derivation module is further configured to: control the control plane CU to send an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is turned on; and control the user plane CU to determine whether to deduct the PDU according to the indication.
  • the user plane integrity protection key corresponding to the session identifier is further configured to: control the control plane CU to send an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is turned on; and control the user plane CU to determine whether to deduct the PDU according to the indication.
  • the user plane integrity protection key corresponding to the session identifier.
  • the processing module is configured to: control the control plane CU to send a security algorithm to the user plane CU;
  • the processing module is configured to: control the user plane CU to perform security processing on the user plane data in the first PDU session by using the first user plane key and the security algorithm;
  • the processing module is configured to: control the user plane CU to perform security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm.
  • the method further includes: a first receiving module, configured to receive a radio resource control RRC re-establishment message or an RRC re-establishment message sent by the UE, where the RRC re-establishment message or the RRC re-recovery message includes the UE identifier and the original cell identifier.
  • a first receiving module configured to receive a radio resource control RRC re-establishment message or an RRC re-establishment message sent by the UE, where the RRC re-establishment message or the RRC re-recovery message includes the UE identifier and the original cell identifier.
  • the method further includes: receiving, by the second receiving module, an indication that the first PDU session identifier sent by the core network and the user plane integrity protection corresponding to the first PDU session identifier are enabled; and the processing module further uses And determining, according to the indication, whether to deduct the user plane integrity protection key corresponding to the first PDU session identifier; the second receiving module is further configured to: receive the second PDU session identifier sent by the core network, and the user plane corresponding to the second PDU session identifier The indication of whether the integrity protection is enabled; the processing module is further configured to: determine, according to the indication, whether to derive the user plane integrity protection key corresponding to the second PDU session identifier.
  • the application provides a base station, including: a sending module, configured to send, to a second base station, a target user plane base key, a target user plane base key, and at least one PDU session identifier respectively corresponding to the target base plane key
  • the second base station derives the target control plane key according to the target control plane base key, and derives the target user plane key according to the target user plane base key
  • the target control plane key includes: control plane encryption key and/or control The face integrity protection key
  • the target user plane key includes: a user plane encryption key and/or a user plane integrity protection key
  • a derivation module which is used to derive a target control plane basis according to the control plane base key and the first parameter
  • the key derives the target user plane base key according to the user plane base key and the second parameter, and the second parameter corresponds to the PDU session identifier one by one
  • the control plane base key is sent by the core network when the PDU session is first established, and the user plane
  • the base key is sent by the core
  • the sending module is further configured to: after sending the target control plane base key, the at least one PDU session identifier, and the at least one PDU session identifier respectively corresponding to the target user plane base key to the second base station,
  • the first security algorithm and the target second security algorithm are sent to the user equipment UE, and the target first security algorithm and the target second security algorithm are selected by the second base station according to the UE security capability information sent by the base station and sent to the base station;
  • a parameter and a second parameter are sent to the UE, and the UE derives the target control plane base key according to the control plane base key and the first parameter of the UE, and derives the target user plane basis according to the user plane base key and the second parameter.
  • the base station is a source base station
  • the second base station is a target handover base station
  • the first parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information
  • the second parameter includes an NCC, At least one of a target cell identity, a PDU session identifier, and frequency point information.
  • the application provides a base station, including: a sending module, configured to send, to a second base station, a target user plane basic key corresponding to at least one PDU session identifier and at least one PDU session identifier, where the second base station is configured according to The target user plane base key derives the target user plane key, and the target user plane key includes: a user plane encryption key and/or a user plane integrity protection key; a derivation module is configured to use the user plane based key and the second The parameter deduces the target user plane base key, and the second parameter corresponds to the PDU session identifier, and the user plane base key is sent by the core network when the PDU session is established.
  • a sending module configured to send, to a second base station, a target user plane basic key corresponding to at least one PDU session identifier and at least one PDU session identifier, where the second base station is configured according to The target user plane base key derives the target user plane key, and the target user plane key includes: a user plane encryption key
  • the sending module is further configured to send the target second security algorithm to the user after sending the at least one PDU session identifier and the target user plane base key corresponding to the at least one PDU session identifier respectively to the second base station.
  • the device UE, the target second security algorithm is that the second base station selects and sends the UE security capability information to the UE according to the UE security capability information sent by the base station, and sends the second parameter to the UE, and is used by the UE according to the user plane key and the user plane.
  • the second parameter deduces the target user plane base key, and then derives the target user plane key according to the target user plane base key, and uses the target user plane key and the target second security algorithm to securely process the user plane data corresponding to the PDU session identifier.
  • the sending module is further configured to: when the at least one PDU session identifier and the target user plane base key corresponding to the at least one PDU session identifier are respectively sent to the second base station, send the target control plane basis to the second base station.
  • the key is used by the second base station to derive the target control plane key according to the target control plane base key
  • the target control plane base key is derived by the base station according to the control plane base key and the first parameter.
  • the sending module is further configured to: after sending the target control plane base key to the second base station, send the target first security algorithm to the UE, where the target first security algorithm is sent by the second base station according to the base station.
  • the UE security capability information is selected and sent by the UE to the base station; the first parameter is sent to the UE, and the UE is used to derive the target control plane base key according to the control plane base key and the first parameter, and then according to the target control plane basis.
  • the key derivation target control plane key uses the target control plane key and the target first security algorithm to securely process the control plane data.
  • the base station is the primary base station
  • the second base station is the secondary base station
  • the first parameter includes an SCG counter
  • the second parameter includes an SCG counter and a PDU session identifier
  • the sending module is further configured to: send, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether to deduct the PDU session. Identifies the corresponding user plane integrity protection key.
  • the application provides a base station, including a centralized unit CU and a distributed unit DU, where the CU includes a control plane CU and a user plane CU, and the control plane CU and the user plane CU are connected through a communication interface;
  • the control plane CU is used to:
  • the user plane key includes: user plane encryption key and/or user plane integrity Protection key
  • the user plane CU is configured to perform security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier.
  • the application provides a base station, including a centralized unit CU and a distributed unit DU, where the CU includes a control plane CU and a user plane CU, and the control plane CU and the user plane CU are connected through a communication interface;
  • the control plane CU is configured to: when establishing a PDU session, receive a user plane basic key sent by the core network; and send the user plane basic key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU;
  • the user plane CU is configured to: derive a user plane key according to the user plane base key, where the user plane key includes: a user plane encryption key and/or a user plane integrity protection key; and the user plane key corresponding to the PDU session identifier is used. And the security algorithm securely processes the user plane data in the PDU session.
  • control plane CU is further configured to: send an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is enabled;
  • the user plane CU is further configured to: determine, according to the indication, whether to derive a user plane integrity protection key corresponding to the PDU session identifier.
  • control plane CU is further configured to: send a security algorithm selected according to user equipment UE security capability information to the user plane CU.
  • the application provides a base station, a memory, a processor, and a transceiver, where the memory, the processor, and the transceiver are communicated through a bus;
  • the transceiver is configured to perform data transmission and reception between the base station and an external device
  • the memory stores program instructions
  • the processor by calling the program instructions stored in the memory, to perform any of the possible designs in the first aspect and the first aspect or in any of the possible designs or the third aspect and the second aspect Aspect and third aspect of any of the possible designs in the fourth aspect and the fourth aspect of any one of the possible designs or the fifth aspect and the fifth aspect of any of the possible designs of the data security processing method at the base station .
  • the present application provides a system chip, which is applied to a base station, where the system chip includes: an input/output interface, at least one processor, a memory, and a bus;
  • the input/output interface, the at least one processor, and the memory are communicated by a bus, and the memory stores program instructions, and the input/output interface is used for data transmission and reception between the system chip and an external device;
  • the present application provides a computer program product for use in a base station, the computer program product comprising instructions, when the instructions are executed by a computing device, to perform any of the first aspect and the first aspect Any of the possible designs or the fifth aspect and the fourth aspect of the fourth aspect and the fourth aspect of any of the possible designs in the second aspect and the second aspect And the fifth aspect of any of the possible designs of the data security processing method at the operation of the base station.
  • the present application provides a computer readable storage medium for use in a base station, the computer readable storage medium storing instructions for performing the first aspect and the first aspect when the instructions are executed by a computing device Any of the possible designs or the second and second aspects of any of the possible designs or the third and third aspects of any of the possible designs of the fourth and fourth aspects of any possible design The operation of the base station in any of the possible designs of the fifth or fifth aspect and the fifth aspect.
  • 1 is a schematic diagram of a network architecture of a 5G system
  • FIG. 2 is a schematic diagram of CU-DU segmentation in a 5G system
  • FIG. 3 is a schematic diagram of a division of a CU
  • 4a-4d are schematic diagrams of four architectures in which LTE and NR are dual-connected;
  • FIG. 5 is a schematic diagram of an MCG bearer, an SCG bearer, an MCG offload bearer, and an SCG split bearer;
  • FIG. 6 is a flowchart of an embodiment of a data security processing method provided by the present application.
  • FIG. 7 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 8 is a flowchart of an embodiment of a data security processing method provided by the present application.
  • FIG. 9 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 10 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 11 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 12 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 13 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 14 is a flowchart of an embodiment of a data security processing method provided by the present application.
  • 15 is a flowchart of an embodiment of a data security processing method provided by the present application.
  • 16 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • FIG. 17 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 18 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 19 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • 20 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 21 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 22 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 23 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • 24 is a schematic structural diagram of an embodiment of a base station provided by the present application.
  • FIG. 25 is a schematic structural diagram of a base station provided by the present application.
  • the technical solution of the present application can be applied to a mobile communication system such as the 5th Generation mobile communication technology (5G) system or an LTE system, and can also be applied to various systems including partial functional separation in a base station.
  • the network elements involved are a base station (also referred to as an access network device) and a UE (also referred to as a terminal device).
  • terminal device includes but is not limited to a mobile station, a fixed or mobile subscriber unit, a pager, a cellular phone, a personal digital assistant (PDA), a computer, or any other.
  • PDA personal digital assistant
  • base station includes but is not limited to a base station, a node, a base station controller, an Access Point (AP), a Remote Unit (RU), or any other type of interface capable of operating in a wireless environment. device.
  • AP Access Point
  • RU Remote Unit
  • the basic key refers to the key sent by the core network to the base station (the base key (KeNB) generated by the core network), or the key sent by the source base station to the target handover base station, or sent by the primary base station to the secondary base station.
  • the key of the base station refers to the key sent by the core network to the base station (the base key (KeNB) generated by the core network), or the key sent by the source base station to the target handover base station, or sent by the primary base station to the secondary base station.
  • the key of the base station refers to the key sent by the core network to the base station (the base key (KeNB) generated by the core network), or the key sent by the source base station to the target handover base station, or sent by the primary base station to the secondary base station.
  • the key of the base station refers to the key sent by the core network to the base station (the base key (KeNB) generated by the core network), or the key sent by the source base station to the target handover base station, or sent by the
  • the control plane key includes KRRCenc and KRRCint, KRRCenc is used for encryption and decryption, KRRCint is used for integrity protection, the user plane key includes KUPenc and KUPint, KUPenc is used for encryption and decryption, and KUPint is used for integrity protection.
  • the technical solution of the present application is mainly applied to the security authentication process between the base station and the UE.
  • the base station and the UE deduct the user according to the basic key or the user plane basic key. Face key, key generation and interaction of PDU session granularity, and scenario in which the control plane CU is separated from the user plane CU in the 5G system, dual-connectivity (DC) scenario, RRC re-establishment scenario and handover (Handover, HO) Scenes and other scenarios, how the key is deduced and interacted.
  • DC dual-connectivity
  • Scenes and other scenarios how the key is deduced and interacted.
  • the network architecture of the present application, the CU-DU separation scenario, the DC scenario, the RRC re-establishment scenario, and the HO scenario involved in the present application are described in detail below with reference to the accompanying drawings.
  • FIG. 1 is a schematic diagram of a network architecture of a 5G system.
  • a Next Generation Radio Access Network NG-RAN
  • a core network is a 5G Core Network (5GC)
  • the base station is called The gNB/ng-eNB mainly includes RRC/Service Data Adaptation Protocol (SDAP)/PDCP/Radio Link Control (RLC)/Medium Access Control (MAC). ) / Physical Layer (PHY) protocol layer.
  • SDAP Service Data Adaptation Protocol
  • RLC Radio Link Control
  • MAC Medium Access Control
  • PHY Physical Layer
  • the base station in the 5G system is uniformly represented by gNB in FIG. 1, and the gNBs are connected through the Xn interface, and the gNB and the 5GC are connected through the Ng interface.
  • the Access and Mobility Management Function (AMF)/User Plane Function (UPF) is equivalent to the MME in the LTE system. Among them, AMF is mainly responsible for access, and UPF is mainly responsible for session
  • FIG. 2 is a schematic diagram of CU-DU segmentation in a 5G system.
  • the base station may be a Centralized Unit (CU) and a distributed unit ( The distributed unit (DU) is configured to split the functions of the base stations in the original access network, deploy some functions of the base station in one CU, deploy the remaining functions in the DU, and share multiple CUs in multiple DUs, which can save costs. Easy network expansion.
  • the CU and the DU are connected through the F1 interface, and the CU represents the gNB connected to the core network through the Ng interface. The severing of the CU and the DU may be performed according to the protocol stack.
  • FIG. 3 is a schematic diagram of a division of the CU. As shown in FIG. 3, the CU-CP and the CU-UP pass E1 interface is connected.
  • the CU-CP represents the gNB connected to the core network through the Ng interface, the CU-CP is connected to the DU through the F1-C (control plane), and the CU-UP is connected to the DU through the F1-U (user plane).
  • PDCP-C is also in CU-UP.
  • the CU-CP is responsible for the control plane function, and mainly includes the RRC and Packet Data Convergence Protocol-Control (PDCP-C).
  • the PDCP-C is mainly responsible for the encryption and decryption, integrity protection, and data transmission of the control plane data. Wait.
  • the CU-UP is responsible for the user plane function, and mainly includes the SDAP and the user plane PDCP (PDCP-U).
  • the SDAP is mainly responsible for processing the data of the core network and mapping the data flow to the bearer.
  • PDCP-U is mainly responsible for encryption and decryption of data planes, integrity protection, header compression, serial number maintenance, and data transmission.
  • the DC scenario is described below with reference to FIG. 4a to FIG. 5.
  • the UE can obtain radio resources from the LTE and NR air interfaces for data transmission at the same time, and obtain the gain of the transmission rate.
  • 4a-4d are schematic diagrams of four architectures in which LTE and NR are dual-connected.
  • the core network in FIG. 4a is an Evolved Packet Core (EPC) of an LTE system, and the LTE eNB functions as a primary base station (MeNB). In the 5G, it is called MN), and the control plane and the user plane connection can be established between the EPC and the EPC.
  • EPC Evolved Packet Core
  • MN primary base station
  • the control plane and the user plane connection can be established between the EPC and the EPC.
  • the gNB is used as a secondary node (SeNB, SeNB, called SN in 5G), and only a user plane connection can be established with the EPC.
  • the EPC and the gNB are connected through the S1 interface, the EPC and the eNB are connected through the S1 interface, and the eNB and the gNB are connected through the X2/Xn interface.
  • the core network in FIG. 4b is a (Next Generation Core Network, NGC) (or 5GC), and the gNB is used as a primary base station, and a connection between the control plane and the user plane can be established between the UE and the NGC, and the LTE eNB functions as a secondary base station. Only the user plane connection can be established between the NGCs.
  • NGC Next Generation Core Network
  • the NGC and the gNB are connected through the NG interface, the NGC and the eNB are connected through the NG interface, and the eNB and the gNB are connected through the X2/Xn interface.
  • the core network in Figure 4c is the NGC.
  • the LTE eNB acts as the primary base station and can establish a connection between the control plane and the user plane for the UE.
  • the gNB functions as the secondary base station. Only the user plane connection can be established between the NGC and the NGC.
  • the NGC and the gNB pass.
  • the NG interface is connected, the NGC and the eNB are connected through the NG interface, and the eNB and the gNB are connected through the X2/Xn interface.
  • the core network in Figure 4d is the NGC.
  • the first gNB can be used as the primary base station to establish a connection between the control plane and the user plane for the UE.
  • the second gNB serves as the secondary base station, and only the user plane connection can be established with the NGC.
  • the first gNB is connected through the NG interface, the NGC and the second gNB are connected through the NG interface, and the gNB and the gNB are connected through the Xn interface.
  • the bearer type includes the primary cell group (MCG) bearer, the secondary cell group (SCG) bearer, the MCG offload bearer, and the SCG offload bearer.
  • MCG primary cell group
  • SCG secondary cell group
  • FIG. 5 shows the MCG bearer and the SCG bearer.
  • the schematic diagram of the MCG offloading bearer and the SCG shunting bearer is shown in FIG. 5.
  • the primary base station is simply referred to as the primary station
  • the secondary base station is simply referred to as the secondary station
  • the data carried by the MCG is all sent by the primary base station to the UE, and the data carried by the SCG is carried.
  • All are sent by the secondary base station to the UE, and the data of the MCG offloading is sent from the core network to the primary base station.
  • the primary base station performs offloading at the PDCP layer, and sends part of the data to the secondary base station, and the secondary base station sends the data to the UE.
  • the remaining data is sent by the primary base station.
  • the data carried by the SCG offloading is sent from the core network to the secondary base station.
  • the secondary base station performs offloading on the PDCP layer, and sends part of the data to the primary base station.
  • the primary base station sends the data to the UE, and the remaining data is sent by the secondary base station to the UE.
  • the RRC re-establishment scenario is described below.
  • the UE initiates an RRC re-establishment procedure, and the UE sends an RRC re-establishment request message to the base station, where the RRC re-establishment request message includes a Cell Radio Network Temporary Identifier (Cell Radio Network Temporary Identifier, C-RNTI), the original cell physical cell identity (PCI) and the check code (shortMAC-I).
  • C-RNTI Cell Radio Network Temporary Identifier
  • PCI cell physical cell identity
  • shortMAC-I short MAC-I is used to authenticate the validity of the RRC re-establishment message.
  • Short MAC-I input parameters KRRCint, the check code input parameter (VarShort MAC-Input) contains Cell ID, PCI and C-RNTI.
  • the Cell ID is the target cell identifier
  • the PCI is the original cell identifier that is connected before the radio link fails.
  • the eNB that the UE reconnects may derive the shortMAC according to the C-RNTI, PCI, and the like provided by the UE, and combined with the existing information (such as the UE connected to the original eNB, or obtained from the original eNB through the HO preparation procedure or the radio link failure indication).
  • -I to verify UE legitimacy.
  • the RRC recovery process is initiated. The only difference from the RRC re-establishment is that the user identity C-RNTI is replaced by the recovery A-RNTI. The other descriptions are the same and will not be described again.
  • a security mode command (SMC) process of a non-access stratum security is mainly used for the MME.
  • the UE generates a non-access stratum encryption and integrity protection key respectively, and then the MME generates an air interface protection key (hereinafter referred to as KeNB) on the network side, and performs KeNB and UE security capabilities through an initial context setting request (Initial Context Setup Request).
  • Information is sent to the eNB.
  • the eNB selects an appropriate security algorithm (encryption algorithm and integrity protection algorithm) according to the UE security capability information and the security capabilities of the base station itself.
  • the SMC process of the access layer security is used by the eNB and the UE to negotiate a security algorithm, and respectively generates a control plane key and a user plane key.
  • the specific process is that the eNB derives the user plane key (KUPenc and KUPint) of the access layer and the control plane key-RRC signaling protection key (KRRCenc and KRRCint according to the KeNB, the former is used for encryption and decryption, and the latter is used for integrity). protection).
  • the security algorithm includes an encryption algorithm and an integrity protection algorithm.
  • the eNB derives the user plane key (KUPenc and KUPint) of the access layer and the RRC signaling protection key (KRRCenc and KRRCint) according to the KeNB as a key derivation algorithm.
  • the algorithm is specified by the protocol and does not need to be negotiated.
  • the algorithm used is an encryption algorithm or an integrity protection algorithm.
  • the encryption algorithm and the integrity protection algorithm require the eNB to select according to the security algorithm supported by the UE included in the UE security capability information and the security algorithm supported by the eNB.
  • the UE finally performs user plane data and RRC message according to the encryption algorithm and integrity protection algorithm selected by the eNB, and the user plane key (KUPenc, KUPint) and the control plane key-RRC signaling protection key (KRRCenc and KRRCint). Encryption and or integrity protection.
  • the quality of service (QoS) management is based on DRB, and the QoS in the 5G system.
  • the management is based on QoS flow, that is, the data from the NGC is different from different flows, and the NGC establishes at least one PDU session with the base station, each PDU session includes at least one QoS flow, and the base station maps one or more QoS flows.
  • each DRB corresponds to at least one QOS flow. Therefore, for a PDU session, multiple DRBs can be corresponding. Therefore, there is a need to implement key generation and interaction of DRB granularity.
  • the present application can also implement key generation and interaction of DRB granularity.
  • the data transmission method used in the prior art is not high in security.
  • the present application provides a data security processing method and apparatus, and to improve the security of data transmission, each PDU session When establishing, the base station and the UE derive a user plane key according to the KeNB, and implement user plane key generation and interaction of the PDU session granularity.
  • FIG. 6 is a flowchart of an embodiment of a data security processing method provided by the present application. As shown in FIG. 6, the method in this embodiment may include:
  • the basic key is a network-side basic key (KgNB) generated by the core network, and the core network (such as an AMF network element) sends a basic key to the first base station, and may also include UE security capability information.
  • the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the first base station deriving the first user plane key according to the received basic key in the S101, the first base station deducing the first user plane key according to the basic key and the first parameter, where the first parameter is the first PDU session ID.
  • the first base station derives the first user plane key according to the basic key, the first PDU session identifier, and the key deduction algorithm. It should be noted that the first base station derives the key deduction algorithm of the first user plane key according to the base key. It can be stipulated in the agreement and does not require negotiation. It may also be obtained through negotiation.
  • the UE includes a key deduction algorithm supported by the UE (which can be extended to a control plane key deduction algorithm, a user plane key deduction algorithm) in the UE security capability information, and then the first base station According to the UE and its own supported key deduction algorithm, the appropriate key deduction algorithm, or the control plane key deduction algorithm and the user plane key deduction algorithm can be selected.
  • a key deduction algorithm supported by the UE which can be extended to a control plane key deduction algorithm, a user plane key deduction algorithm
  • the first base station According to the UE and its own supported key deduction algorithm, the appropriate key deduction algorithm, or the control plane key deduction algorithm and the user plane key deduction algorithm can be selected.
  • the first base station performs security processing on the user plane data in the first PDU session by using the first user plane key and the security algorithm, and specifically includes:
  • the first base station selects an appropriate security algorithm according to the UE security capability information and the security algorithm supported by the first base station, and the security algorithm includes an encryption algorithm and an integrity protection algorithm. Further, the security algorithm may also include a control plane security algorithm and a user plane security algorithm.
  • the control plane security algorithm includes a control plane encryption algorithm and a control plane integrity protection algorithm
  • the user plane security algorithm includes a user plane encryption algorithm and a user plane integrity protection algorithm. Then, the first base station performs security processing on the user plane data in the first PDU session by using the first user plane key and the security algorithm or the user plane security algorithm.
  • the first base station sends the selected security algorithm or the control plane security algorithm and the user plane security algorithm to the UE, and may also include a first PDU session identifier, a Next Hop Chaining Count (NCC), and the like.
  • the first base station informs the UE by using an SMC message or an RRC reconfiguration message.
  • the UE derives the first user plane key by using a key deduction algorithm or a user plane key deduction algorithm (provided by the protocol or given by the first base station) according to the base key and the first PDU session identifier.
  • the user plane data in the first PDU session is securely processed using the first user plane key and a security algorithm or a user plane security algorithm.
  • the first base station derives a second user plane key according to the basic key, and the first base station performs security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm.
  • the first base station deriving the second user plane key according to the basic key in S102 may be: the first base station derives the second user plane key according to the base key and the second parameter, and the second parameter is the second PDU session identifier. .
  • the first base station performs the security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm, and specifically includes:
  • the first base station selects an appropriate security algorithm according to the UE security capability information and the security algorithm supported by the first base station, and the security algorithm includes an encryption algorithm and an integrity protection algorithm. Further, the security algorithm may also include a control plane security algorithm and a user plane security algorithm.
  • the control plane security algorithm includes a control plane encryption algorithm and a control plane integrity protection algorithm
  • the user plane security algorithm includes a user plane encryption algorithm and a user plane integrity protection algorithm.
  • the first base station sends the selected security algorithm or the control plane security algorithm and the user plane security algorithm to the UE, and may also include a second PDU session identifier, a next hop link counter, etc., for example, the first base station passes the SMC message or The RRC reconfiguration message informs the UE.
  • the UE derives the second user plane key according to the base key and the second PDU session identifier by a key deduction algorithm or a user plane key deduction algorithm (provided by the protocol or by the first base station).
  • the user plane data in the second PDU session is securely processed using the second user plane key and the security algorithm or the user plane security algorithm.
  • the method further includes:
  • the first base station receives an indication of whether the first PDU session identifier sent by the core network and the user plane integrity protection corresponding to the first PDU session identifier are turned on, and the first base station determines, according to the indication, whether to deduct the user plane integrity corresponding to the first PDU session identifier.
  • the protection key, and whether the integrity protection key is used to perform user plane integrity protection on the user plane data corresponding to the first PDU session identifier.
  • the first base station receives the first PDU session identifier sent by the core network, the QoS flow list included in the first PDU session, and an indication of whether the user plane integrity protection corresponding to each QoS flow identifier is turned on.
  • the user plane data corresponding to the QoS flow identifier is used for integrity protection.
  • the first PDU session includes 5 QoS flows, the user plane integrity protection of QoS flow 3 is enabled, and the user plane integrity protection of other QoS flows is turned off.
  • the first base station deduces the user plane integrity protection key corresponding to the first PDU session, and then determines whether to perform integrity protection on the user plane data of the QoS flow according to the indication.
  • the first PDU session includes five QoS flows, and all user plane integrity protections of all QoS flows are closed.
  • the first base station derives the user plane integrity protection key corresponding to the first PDU session, it does not correspond to any QoS flow.
  • User plane data for integrity protection or, the first base station derives the user plane integrity corresponding to the first PDU session identifier only if at least one of the indications that the user plane integrity protection corresponding to the QoS flow list included in the first PDU session is enabled is displayed.
  • Protect the key The user plane data corresponding to the QoS flow identifier opened by the user plane integrity protection indication is only integrity protected.
  • the first PDU session includes 5 QoS flows, the user plane integrity protection indication of QoS flow 3 is turned on, and the user plane integrity protection indication of other QoS flows is turned off.
  • the first base station deduces the user plane integrity protection key, and then determines whether to perform integrity protection on the user plane data of the QoS flow according to the indication.
  • the first PDU session contains 5 QoS flows, and the user plane integrity protection indications of all QoS flows are all closed. Then, the first base station decides not to deduct the user plane integrity protection key corresponding to the first PDU session.
  • the first base station receives an indication of whether the second PDU session identifier sent by the core network and the user plane integrity protection corresponding to the second PDU session identifier are turned on, and the first base station determines, according to the indication, whether to deduct the user plane integrity corresponding to the second PDU session identifier. Protect the key.
  • the first base station receives the second PDU session identifier sent by the core network, the QoS flow list included in the first PDU session, and an indication of whether the user plane integrity protection corresponding to each QoS flow identifier is turned on.
  • the operation is the same as the indication of whether the first PDU session identifier and the user plane integrity protection are enabled.
  • the core network sends an indication to the first base station whether the user plane integrity protection corresponding to the PDU session identifier and the PDU session identifier is turned on. If the indication is "on”, the first base station derives the PDU session identifier according to the received indication. The corresponding user plane integrity protection key, if the indication is "off”, the first base station does not need to derive the user plane integrity protection key corresponding to the PDU session identifier.
  • the indication is not limited to whether the user plane integrity protection is enabled, and may also be extended to control plane encryption, control plane integrity protection, user plane encryption, user plane integrity protection indication, integrity protection key abbreviation Integrity protection.
  • the core network provides the KgNB, the UE security capability information, and the indication of whether the user plane integrity protection is enabled when the UE establishes the PDU session for the first time, and may also give the control plane of the PDU session each time the PDU session is established.
  • the first base station derives the user plane key according to the basic key and the PDU session identifier of each PDU session, and uses the derived user plane key and each time the PDU session is established.
  • the security algorithm securely processes the user plane data in the PDU session, and different PDU sessions use different user plane keys, thereby improving the security of data transmission.
  • FIG. 7 is another data security processing method provided by the present application.
  • the flowchart of the example, as shown in FIG. 7, the method of the embodiment may further include:
  • the first base station derives a target base key for the second base station according to the base key and the third parameter.
  • the first base station is a source base station
  • the second base station is a target handover base station.
  • the first base station performs a handover action for the UE in the decision, and derives a target base key for the second base station based on the basic key and the third parameter.
  • the three parameters include at least one of an NCC, a target cell identifier, and frequency point information.
  • the first base station sends the target base key and the at least one PDU session identifier to the second base station.
  • the first base station sends the at least one of the UE security capability information, the target cell identifier, the frequency point information, and the key derivation algorithm to the second base station, and the method includes: the first base station sends the PDU session to the second base station.
  • An indication of whether the corresponding user plane integrity protection is enabled is used by the second base station to determine, according to the indication, whether to derive the user plane integrity protection key corresponding to the PDU session identifier.
  • the first base station receives an indication of whether the user plane integrity protection corresponding to the PDU session identifier sent by the core network is enabled, and the first base station may further send, to the second base station, whether the user plane encryption key corresponding to the PDU session identifier is Instructions to turn on.
  • the first base station may receive an indication that the user plane integrity protection corresponding to the QoS flow identifier of the PDU session sent by the core network is enabled, and the first base station may further send the QoS flow identifier corresponding to the PDU session identifier to the second base station. An indication of whether the corresponding user plane integrity protection is turned on.
  • the first base station may also send an indication to the second base station whether the user plane integrity protection corresponding to the DRB identifier is turned on.
  • the above indication may also be extended to an indication of whether control plane encryption is enabled, an indication of whether control plane integrity protection is enabled, an indication of whether user plane encryption is enabled, and an indication of whether user plane integrity protection is enabled.
  • the first base station provides an indication of whether the user plane integrity protection of the DRB granularity is enabled, for example:
  • the first base station provides an indication of whether the user plane integrity protection of the QoS flow granularity is enabled, for example:
  • the second base station derives a user plane key corresponding to the PDU session identifier according to the target basic key and the at least one PDU session identifier.
  • the second base station after receiving the UE security capability information sent by the first base station, the second base station selects a security algorithm according to the UE security capability information and the security capability of the second base station (may also include a control plane security algorithm and a user plane security algorithm, or control Face encryption algorithm, control plane integrity protection algorithm, user plane encryption algorithm, user plane integrity protection algorithm, etc.).
  • the second base station derives a user plane key corresponding to the PDU session identifier according to the target base key and the at least one PDU session identifier, where the PDU session identifier is corresponding to the target base key and the at least one PDU session identifier.
  • the user plane key is specifically, for example, a total of 5 PDU session identifiers, deriving the user plane key 1 according to the target base key and the PDU session identifier 1, and deducing the user plane key according to the target base key and the PDU session identifier 2. 2, ..., deriving the user plane key 5 based on the target base key and the PDU session identifier 5.
  • the second base station passes the selected security algorithm and other information (for example, the Cell Radio Network Temporary Identifier (C-RNTI) used by the UE in the target cell passes the Xn interface (the interface between the first base station and the second base station) ) is sent to the second base station.
  • C-RNTI Cell Radio Network Temporary Identifier
  • the method further includes:
  • the first base station sends the target security algorithm to the UE, where the target security algorithm is selected by the second base station according to the UE security capability information sent by the first base station and sent to the first base station.
  • the first base station sends the third parameter and the at least one PDU session identifier to the UE.
  • the third parameter includes at least one of an NCC, a target cell identifier, and frequency point information. In addition, it may also include an indication of whether user face integrity protection is turned on. Similarly, the indication of whether the user plane integrity protection is enabled may be a PDU session granularity, a DRB granularity or a QoS flow granularity. If the target security algorithm is UE-level, the information sent to the UE in S105 and S106 may include, for example, information in the following form in the RRC message:
  • the information sent to the UE in S105 and S106 may include, for example, information in the following form in the RRC message:
  • the indication that the user plane integrity protection is enabled in the above example is the granule of the PDU.
  • the foregoing indication may also be the DRB granularity or the QoS flow granularity, which will not be repeated here. All of the above parameters will exist or not exist according to the actual situation.
  • the UE deducts the target basic key according to the basic key and the third parameter, and then deduces the user plane key corresponding to the PDU session identifier according to the target basic key and the at least one PDU session identifier, and then uses the user corresponding to the PDU session identifier.
  • the face key and the target security algorithm securely process the user plane data in the PDU session.
  • the solution is how to deduct and interact the key in the DC scenario.
  • the third parameter includes the secondary cell group SCG counter, and the same process is performed. ⁇ S107.
  • the first base station derives the target base key according to the base key and the third parameter, and sends the derived target base key and the at least one PDU session identifier to the second base station, and the second base station according to the target base key And the at least one PDU session identifies the user plane key corresponding to the derivation PDU session identifier, and the second base station selects a target security algorithm for the UE according to the UE security capability information sent by the first base station, so that the second base station uses the PDU session identifier corresponding to the user plane key.
  • the key and the target security algorithm perform security processing on the user plane data in the PDU session
  • the first base station sends the third parameter and the at least one PDU session identifier to the UE
  • the UE derives the target base based on the base key and the third parameter of the UE.
  • Key and then deriving the user plane key corresponding to the PDU session identifier according to the target base key and the at least one PDU session identifier, and then using the user plane key corresponding to the PDU session identifier and the target security algorithm to secure the user plane data in the PDU session.
  • the third parameter includes at least one of an NCC, a target cell identifier, and frequency point information
  • the source base station is cut.
  • the third parameter comprises a cell group SCG secondary counters, and achieve interactive key derivation in DC scene.
  • FIG. 8 is a flowchart of an embodiment of a data security processing method provided by the present application.
  • a first base station includes a CU and a DU
  • the CU includes a control plane CU and a user plane CU, and a control plane.
  • the CU and the user plane CU are connected through a communication interface.
  • the method in this embodiment may include:
  • the core network sends a basic key to the first base station, and may also include UE security capability information.
  • the indication of whether the user plane integrity protection of the PDU session granularity or the QoS flow granularity is enabled may also be included. It can also be extended to control plane encryption, control plane integrity protection, user plane encryption, and indication of whether user plane integrity protection is enabled.
  • the control plane CU receives the base key sent by the core network, optionally, by The control plane CU receives an indication of whether the PDU session granularity or the QoS flow granularity of the user plane integrity protection sent by the core network is enabled.
  • the first PDU session is established, and the control plane CU derives the first user plane key according to the received basic key and the first PDU session identifier, and the first user corresponding to the first PDU session identifier and the first PDU session identifier.
  • the face key is sent to the user plane CU.
  • the key derivation algorithm for deriving the first user plane key may be specified by a protocol, or may be selected by the control plane CU according to the UE security capability and its own security capability. If the control plane CU is selected according to the security capability of the UE and its own security capability, the key derivation algorithm may be the UE granularity or the PDU session granularity. Optionally, the key deduction algorithm may also be that the user plane CU sends its own security capability to the control plane CU, and the control plane CU selects according to the UE security capability and the user plane security capability.
  • the control plane CU may send the first PDU session identifier and the first user plane key corresponding to the first PDU session identifier to the user plane CU through the E1 interface, for example, the control plane CU establishes a request through the UE context connection (UE context setup).
  • the request or PDU session setup request message includes a first user plane key corresponding to the first PDU session identifier and the first PDU session identifier. If it is sent through a UE level message (for example, UE context setup request), it may include information in the following form:
  • control plane CU will decide whether to derive the user plane integrity protection key KUPint according to the user plane integrity protection indication sent by the core network. If the core network indicates shutdown, the control plane CU will not provide the user plane integrity protection key to the user plane CU. Similarly, if the user plane encryption indication given by the core network is off, the control plane CU will not provide the user plane encryption key KUPenc to the user plane CU.
  • the message sent by the control plane CU to the user plane CU may include the following contents:
  • PDU session level e.g. PDU session setup request
  • control plane CU provides the user plane integrity protection key KUPint and the user plane encryption key KUPenc, as described above.
  • the message sent by the control plane CU to the user plane CU may include the following contents:
  • the control plane CU sends a security algorithm to the user plane CU.
  • the security algorithm is that the control plane CU selects the UE according to the UE security capability information and the security capability of the first base station. It is also possible that the user plane CU sends the security algorithm supported by the user plane to the control plane CU in advance, and the control plane CU selects an appropriate security algorithm according to the security algorithm supported by the user plane CU and the UE security algorithm capability.
  • the security algorithms include encryption algorithms and integrity protection algorithms. When the security algorithm includes a control plane security algorithm and a user plane security algorithm, the control plane CU sends a user plane security algorithm to the user plane CU, including a user plane encryption algorithm and a user plane integrity protection algorithm.
  • the user plane CU performs security processing on the user plane data in the first PDU session by using the first user plane key and a security algorithm.
  • the second PDU session is established.
  • the control plane CU derives the second user plane key according to the basic key and the second PDU session identifier, and the second user plane key corresponding to the second PDU session identifier and the second PDU session identifier. Send to the user plane CU.
  • the control plane CU sends a security algorithm to the user plane CU.
  • the control plane CU sends a security algorithm to the user plane CU when the PDU session is first established.
  • the security algorithm is a PDU session level, that is, the security algorithm of each PDU session is different, each time a PDU session is established. All need to execute S206.
  • the user plane CU performs security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm.
  • the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • control plane CU receives the basic key sent by the core network, and the control plane CU derives the user plane key according to the basic key and the PDU session identifier of each PDU session, and corresponds the PDU session identifier to the PDU session identifier.
  • the user plane key is sent to the user plane CU, and the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to perform security processing on the user plane data in the PDU session.
  • FIG. 9 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • a first base station includes a CU and a DU
  • the CU includes a control plane CU and a user plane CU.
  • the CU and the user plane CU are connected through a communication interface.
  • the method in this embodiment may include:
  • the core network sends a basic key to the first base station, and may also include UE security capability information.
  • the indication of whether the user plane integrity protection of the PDU granularity or the QoS flow granularity is enabled may also be extended, and the control plane encryption, the control plane integrity protection, the user plane encryption, and the user plane integrity protection are enabled.
  • the indication receives the base key sent by the core network by the control plane CU.
  • the first PDU session is established, and the control plane CU sends the basic key and the first PDU session identifier to the user plane CU.
  • the user plane CU derives the first user plane key according to the basic key and the first PDU session identifier.
  • control plane CU sends an indication of whether the user plane integrity protection corresponding to the first PDU session identifier sent by the core network is opened to the user plane CU, and may also include whether the user plane encryption corresponding to the first PDU session identifier is enabled. Instructions.
  • the user plane CU will determine whether to derive the user plane integrity protection key and the user plane encryption key according to the indication. When the control plane CU does not give the indication, the user plane CU needs to derive the corresponding user plane key by default.
  • the control plane CU sends an indication of whether the user plane integrity protection corresponding to each QoS flow identifier in the first PDU session identifier sent by the core network is turned on to the user plane CU, and the user plane CU determines whether to deduct the first PDU session.
  • the corresponding user plane data is processed for integrity protection.
  • the control plane CU sends a security algorithm to the user plane CU.
  • the security algorithm is that the control plane CU selects the UE according to the UE security capability information and the security capability of the first base station. It is also possible that the user plane CU sends the user plane security algorithm supported by the user plane to the control plane CU in advance, and the control plane CU selects an appropriate security algorithm according to the user plane security algorithm and the UE security algorithm capability supported by the user plane CU.
  • the security algorithms include encryption algorithms and integrity protection algorithms. When the security algorithm includes a control plane security algorithm and a user plane security algorithm, the control plane CU sends a user plane security algorithm to the user plane CU, including a user plane encryption algorithm and a user plane integrity protection algorithm.
  • the user plane CU performs security processing on the user plane data in the first PDU session by using the first user plane key and a security algorithm.
  • the second PDU session is established, and the control plane CU sends the basic key and the second PDU session identifier to the user plane CU.
  • the user plane CU derives the second user plane key according to the basic key and the second PDU session identifier.
  • the control plane CU sends a security algorithm to the user plane CU.
  • the control plane CU sends a security algorithm to the user plane CU when the PDU session is first established.
  • the security algorithm is a PDU session level, that is, the security algorithm of each PDU session is different, each time a PDU session is established. All need to execute S206.
  • the user plane CU performs security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm.
  • control plane CU receives the basic key sent by the core network, and the control plane CU sends the basic key and the PDU session identifier of each PDU session to the user plane CU, and the user plane CU according to the basic key and each The PDU session identifier of the secondary PDU session deduces the user plane key, and the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to securely process the user plane data in the PDU session.
  • the control plane CU receives the basic key sent by the core network, and the control plane CU sends the basic key and the PDU session identifier of each PDU session to the user plane CU, and the user plane CU according to the basic key and each The PDU session identifier of the secondary PDU session deduces the user plane key, and the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to securely process the user plane data in the PDU session.
  • FIG. 10 is a flowchart of another embodiment of a data security processing method provided by the present application.
  • a UE occurs. After the radio link fails, the RRC re-establishment process is initiated.
  • the method in this embodiment may further include:
  • the first base station receives an RRC re-establishment message or an RRC recovery message sent by the UE, where the RRC re-establishment message or the RRC re-recovery message includes a UE identifier, an original cell identifier, a check code (short MAC-I), a control plane CU indication, or a user. At least one of a face CU indication and a PDU session identification.
  • the UE identifier may be an air interface identifier such as a C-RNTI or a recovery identifier (A-RNTI).
  • the first base station generates a shortMAC-I according to at least one of a UE identifier, an original cell identifier, a control plane CU indication, or a user plane CU indication and a PDU session identifier, and performs the generated shortMAC-I and the shortMAC-I sent by the UE. Compare and judge whether the verification is successful.
  • the base station According to the control plane indication or the user plane CU indication, select the corresponding control plane integrity protection key or the user plane integrity protection key to generate shortMAC-I.
  • the base station When there are multiple user integrity protection keys, for example, each PDU session has a corresponding user plane integrity protection key.
  • the user plane integrity protection key may select, for example, a user plane integrity protection key with a minimum PDU session identifier according to the protocol.
  • the base station According to the PDU session identifier, select the user plane integrity protection key corresponding to the PDU session identifier to generate shortMAC-I. For example, the base station generates a shortMAC-I according to the UE identity, the original cell identifier, the current access cell identifier, and the user plane integrity protection key corresponding to the PDU session identifier.
  • the first base station receives the RRC re-establishment message or the RRC recovery message sent by the UE, and the first base station performs at least one of the UE identifier, the original cell identifier, the control plane CU indication, or the user plane CU indication and the PDU session identifier.
  • the short MAC-I is generated, and the validity of the UE is verified by the short MAC-I, and the security of data transmission in the RRC re-establishment or RRC recovery scenario is implemented.
  • the method provided by the foregoing embodiment shown in FIG. 6 to FIG. 10 may be adopted, and the difference is that the PDU session identifier in the embodiment shown in FIG. 6-10 is used. Changed to the DRB identifier, the first base station derives the user plane key of the DRB granularity.
  • FIG. 11 is a flowchart of another embodiment of a data security processing method provided by the present application. As shown in FIG. 11, the method in this embodiment may include:
  • the core network sends a basic key to the first base station, where the basic key includes a control plane basic key and a user plane basic key, and the user plane basic key and the PDU session identifier are in one-to-one correspondence.
  • the control plane base key may be provided when the core network first establishes a PDU session for the user, and the user plane base key (UP KgNB) may be provided each time a PDU session is established.
  • the core network sends the base key to the first base station, and may also include an indication of whether the UE security capability information and the user plane integrity protection are enabled. It can also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the user plane integrity protection whether the user plane encryption is enabled, may be a PDU session granularity or a QoS flow granularity.
  • the AMF network element of the core network simultaneously gives CP KgNB and UP KgNB1 and UE security capability information and the like in the initial context setup request of the Ng interface, for example, including the following form message:
  • the initial context setup request message includes the following form message:
  • UP KgNB2 UP KgNB3...etc.
  • UE security capability information which may not be provided most because the first time has been provided
  • the indication that the user plane integrity protection is enabled may also be QoS flow granularity, which will not be repeated here.
  • the first base station derives a control plane key according to the control plane base key, and derives the user plane key according to the user plane base key.
  • the user plane base key is the PDU session granularity, and the user plane base key is sent each time a PDU session is established.
  • the key derivation algorithm for deriving the user plane key according to the user plane base key may be specified by the protocol, and no negotiation is required. It may also be obtained through negotiation.
  • the UE includes a key deduction algorithm supported by the UE (which can be extended to a control plane key deduction algorithm, a user plane key deduction algorithm) in the UE security capability information, and then the first base station The algorithm can be deduced according to the UE and its own supported key, and finally the appropriate key deduction algorithm is selected.
  • the first base station performs security processing on the user plane data in the PDU session by using a user plane key and a security algorithm.
  • the first base station selects an appropriate security algorithm according to the UE security capability information and the security algorithm supported by the first base station, and the security algorithm includes an encryption algorithm and an integrity protection algorithm. Further security algorithms can also be divided into control plane security algorithms and user plane security algorithms.
  • the control plane security algorithm includes a control plane encryption algorithm and a control plane integrity protection algorithm
  • the user plane security algorithm includes a user plane encryption algorithm and a user plane integrity protection algorithm.
  • the first base station then performs security processing on the user plane data in the PDU session using the user plane key and the security algorithm or the user plane security algorithm.
  • the first base station sends the selected security algorithm or the control plane security algorithm and the user plane security algorithm to the UE, and may also include an indication that the user plane integrity protection is enabled, for example, the first base station uses the SMC message or the RRC reconfiguration.
  • the message informs the UE.
  • the UE derives the user plane key based on the base key by a key derivation algorithm or a user plane key derivation algorithm (provided by the protocol or by the first base station).
  • the user plane data in the PDU session is securely processed using the user plane key and the security algorithm or the user plane security algorithm.
  • the first base station determines whether to perform user plane integrity protection on the user plane data corresponding to the PDU session identifier or the QoS flow identifier according to the PDU session granularity or the QoS flow granularity of the user plane integrity protection sent by the core network. deal with.
  • the first base station sends an indication of whether the user plane integrity protection of the PDU session granularity or the QoS flow granularity is turned on, and the UE determines whether to perform user plane data corresponding to the PDU session identifier or the QoS flow identifier.
  • the indication may also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the data security processing method provided in this embodiment is: when each PDU session is established, the first base station receives the user plane basic key, deduces the user plane key according to the user plane base key, and uses the derived user plane key and
  • the security algorithm securely processes the user plane data in the PDU session, and different PDU sessions use different user plane keys, thereby improving the security of data transmission.
  • FIG. 12 is another data security processing method provided by the present application.
  • the method of this embodiment may further include:
  • the first base station derives a target control plane base key according to the control plane base key and the first parameter, and deduces the target user plane base key according to the user plane base key and the second parameter, and the second parameter and the PDU session identifier are one by one. correspond.
  • the control plane basic key is sent by the core network when the PDU session is first established, and the user plane basic key is sent by the core network when the PDU session is established.
  • the first base station is a source base station
  • the second base station is a target handover base station
  • the first parameter includes at least one of an NCC, a target cell identifier, and frequency point information
  • the second parameter includes an NCC, a target cell identifier, a PDU session identifier, and frequency point information. At least one of them.
  • the first base station derives the target user plane basic key according to the user plane basic key and the second parameter, for example, four PDU sessions have been established before the handover, and there are four user plane basic keys and four PDU sessions.
  • the first base station derives the target user plane basic key 1 according to at least one of the user plane basic key 1, the NCC, the target cell identifier 1, the PDU session identifier 1 and the frequency point information 1.
  • the first base station is dense according to the user plane basis.
  • At least one of the key 2, the NCC, the target cell identifier 2, the PDU session identifier 2, and the frequency point information 2 derives the target user plane base key 2, ..., the first base station according to the user plane base key 4, the NCC, the target cell identifier 4.
  • At least one of the PDU session identifier 4 and the frequency point information 4 derives the target user plane base key 4.
  • the target cell identifiers 1, 2, 3, and 4 are the same.
  • the first base station sends, to the second base station, a target user plane base key corresponding to the target control plane base key, the at least one PDU session identifier, and the at least one PDU session identifier.
  • the first base station sends the target control plane base key to the second base station, and the target user plane base key corresponding to the four PDU session identifiers and the four PDU session identifiers respectively .
  • the first base station sends, to the second base station, an indication that the PDU session identifier corresponds to the DRB identifier or the user plane integrity protection corresponding to the QoS flow identifier is turned on, and is used by the second base station to determine whether to deduct according to the indication.
  • the user plane integrity protection key corresponding to the PDU session identifier or the DRB identifier or the QoS flow identifier It can also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the foregoing information may be included in a Handover Request message sent by the first base station to the second base station, where the handover request includes the following information:
  • the second base station derives a target control plane key according to the target control plane base key, and derives a target user plane key according to the target user plane base key, and the second base station uses the target control plane key and the target first security algorithm to control
  • the face data is securely processed, and the user plane data in the PDU session is securely processed using the target user plane key and the target second security algorithm.
  • the target control plane key includes: a control plane encryption key and/or a control plane integrity protection key
  • the target user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the target first security algorithm is that the second base station selects according to the UE security capability and the security capability sent by the first base station
  • the target second security algorithm is that the second base station selects according to the UE security capability and the security capability sent by the first base station. of.
  • the second base station further determines whether to perform the PDU session identifier, or the DRB identifier, or the user plane data corresponding to the QoS flow identifier according to the indication of whether the user plane integrity protection of the PDU session granularity or the DRB granularity or the QoS flow granularity is turned on. Integrity protection processing.
  • the method may further include:
  • the second base station selects the target first security algorithm and the target second security algorithm for the UE according to the UE security capability information sent by the first base station, and sends the target to the first base station.
  • the target first security algorithm and the target second security algorithm are the same, the first base station only needs to send the target security algorithm to the second base station.
  • the first base station sends the target first security algorithm and the target second security algorithm to the UE.
  • the first base station sends the first parameter and the second parameter to the UE.
  • the first parameter includes at least one of an NCC, a target cell identifier, and frequency point information
  • the second parameter includes at least one of an NCC, a PDU session identifier, a target cell identifier, and frequency point information.
  • the information sent to the UE in S408 and S409 may include, for example, information in the following form in the RRC message:
  • NCC for CP and NCC for UP are the same value, only one NCC is required.
  • the information sent to the UE in S408 and S409 may include, for example, information in the following form in the RRC message:
  • NCC for CP and NCC for UP are the same value, only one NCC is required.
  • the UE derives a target control plane base key according to its own control plane base key and the first parameter, and derives a target user plane base key according to its own user plane base key and the second parameter, and then bases the target control plane based on the key Deriving the target control plane key, deriving the target user plane key according to the target user plane base key, using the target control plane key and the target first security algorithm to securely process the control plane data, using the target user plane key and target
  • the second security algorithm performs secure processing on the user plane data in the PDU session.
  • the target base plane basic key corresponding to the target control plane base key, the at least one PDU session identifier, and the at least one PDU session identifier are respectively sent by the first base station to the second base station according to the target control plane.
  • the base key derives the target control plane key, and derives the target user plane key according to the target user plane base key, so that the second base station uses the target control plane key and the target first security algorithm to securely process the control plane data, and uses the target.
  • the user plane key and the target second security algorithm perform security processing on the user plane data in the PDU session, thereby realizing the derivation and interaction of the key in the process of the source base station switching to the target handover base station.
  • FIG. 13 is a flowchart of another embodiment of the data security processing method provided by the present application, such as As shown in FIG. 13, the method of this embodiment may further include:
  • the first base station derives the target user plane base key according to the user plane base key and the second parameter, and the second parameter is in one-to-one correspondence with the PDU session identifier, and the user plane base key is sent by the core network when the PDU session is established.
  • the first base station sends, to the second base station, a target user plane basic key corresponding to the at least one PDU session identifier and the at least one PDU session identifier respectively.
  • the first base station is a primary base station
  • the second base station is a secondary base station
  • the second parameter includes at least one of an SCG counter and a PDU session identifier.
  • the first base station will also send an indication of whether the PDU session granularity or the user plane integrity protection of the DRB granularity or QoS flow granularity is turned on.
  • the indication may also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the second base station deducts the target user plane key according to the target user plane base key, and performs security processing on the user plane data corresponding to the PDU session identifier by using the target user plane key and the target second security algorithm.
  • the target second security algorithm is that the second base station selects a target second security algorithm for the UE according to the UE security capability information sent by the first base station.
  • the target user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the method may further include:
  • the second base station selects a target second security algorithm for the UE according to the UE security capability information sent by the first base station, and sends the target second security algorithm to the first base station.
  • the first base station sends the target second security algorithm to the UE, and the first base station sends the second parameter to the UE.
  • the UE derives the target user plane base key according to the user plane base key and the second parameter, and then derives the target user plane key according to the target user plane base key, and uses the target user plane key and the target second security.
  • the algorithm performs security processing on the user plane data corresponding to the PDU session identifier.
  • the method may further include:
  • the first base station derives a target control plane base key according to the control plane base key and the first parameter, and the first base station sends the target control plane base key to the second base station.
  • the first parameter includes an SCG counter.
  • the dual-connection DC extension may also send the RRC message to the secondary base station.
  • the secondary base station also needs to derive the control plane key according to the basic key or the control plane basic key.
  • the second base station derives the target control plane key according to the target control plane base key, and performs security processing on the control plane data by using the target control plane key and the target first security algorithm.
  • the target first security algorithm is that the second base station selects a target first security algorithm for the UE according to the UE security capability information sent by the first base station.
  • the second base station selects a target first security algorithm for the UE according to the UE security capability information sent by the first base station, and sends the target first security algorithm to the first base station.
  • the first base station sends the target first security algorithm to the UE, and the first base station sends the first parameter to the UE.
  • the UE derives the target control plane base key according to the control plane base key and the first parameter, and then derives the target control plane key according to the target control plane base key, and uses the target control plane key and the target first security.
  • the algorithm performs secure processing on the control plane data.
  • the method further includes: the first base station transmitting, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determining, according to the indication, whether to deduct the user plane integrity protection key corresponding to the PDU session identifier .
  • the indication of whether the user plane integrity protection sent by the first base station is enabled may be PDU session granularity, DRB granularity or QoS flow granularity.
  • the indication may also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the first base station sends the target user plane basic key corresponding to the at least one PDU session identifier and the at least one PDU session identifier to the second base station, and the second base station derives the target user face density according to the target user plane base key.
  • the second base station uses the target control plane key and the target first security algorithm to securely process the control plane data, and uses the target user plane key and the target second security algorithm to securely process the user plane data in the PDU session.
  • FIG. 14 is an interaction flowchart of an embodiment of a data security processing method provided by the present application.
  • a base station includes a CU and a DU
  • the CU includes a control plane CU and a user plane CU, and a control plane CU.
  • the method in this embodiment may include: connecting the user plane CU through a communication interface, and in a CU-DU separation scenario, the method in this embodiment may include:
  • the control plane CU derives the user plane key according to the user plane key, and sends the user plane key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU.
  • the user plane key includes: a user plane encryption key and/or Or user plane integrity protection key.
  • the user plane CU performs security processing on the user plane data in the PDU session by using a user plane key and a security algorithm corresponding to the PDU session identifier.
  • the security algorithm includes an encryption algorithm and an integrity protection algorithm.
  • the control plane security algorithm and the user plane security algorithm may or may not be the same.
  • the above security algorithm is a user plane security algorithm.
  • the foregoing security algorithm is a user plane security algorithm corresponding to the PDU session identifier.
  • the security algorithm here is a security algorithm selected by the control plane CU according to its own security capability and UE security capability information.
  • the user plane CU sends the user plane security algorithm supported by the user plane to the control plane CU in advance, and the control plane CU selects an appropriate security algorithm according to the user plane security algorithm and the UE security algorithm capability supported by the user plane CU.
  • control plane CU may also send a user plane integrity protection indication of DRB granularity or QoS flow granularity to the user plane CU.
  • the control plane CU sends the user plane integrity protection key of the PDU1 to the user plane CU, and gives an indication of whether the user plane integrity protection of the DRB, for example, or QoS flow granularity is turned on, and the user decides whether to the DRB according to the decision.
  • the user plane data corresponding to the identifier or QoS flow identifier is integrity protected.
  • the indication may also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • control plane CU receives the user plane basic key sent by the core network, and the control plane CU derives the user plane key according to the user plane base key, and sends the user plane key corresponding to the PDU session identifier and the PDU session identifier.
  • the user plane CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier. Thereby improving the security of data transmission in the CP-UP separation scenario.
  • FIG. 15 is a flowchart of a data security processing method according to an embodiment of the present disclosure.
  • a base station includes a CU and a DU
  • the CU includes a control plane CU and a user plane CU
  • the control plane CU and The user plane CU is connected through a communication interface
  • the CU-DU is separated from the scenario.
  • the method in this embodiment may include:
  • the control plane CU sends the user plane key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU.
  • the user plane CU derives a user plane key according to the user plane base key, where the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the user plane CU performs security processing on the user plane data in the PDU session by using the user plane key and the security algorithm corresponding to the PDU session identifier.
  • the obtaining of the security algorithm is the same as step S503.
  • the control plane CU sends an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is enabled.
  • the control plane CU will also send an indication of whether the user plane integrity protection of the DRB granularity or QoS flow granularity is turned on.
  • the indication may also be extended to control plane encryption, control plane integrity protection, user interface encryption, and indication of whether user plane integrity protection is enabled.
  • the user plane CU determines, according to the indication, whether to derive the user plane integrity protection key corresponding to the PDU session identifier.
  • the method further includes: the control plane CU sends the security algorithm selected according to the UE security capability information to the user plane CU.
  • the security algorithm here is a security algorithm selected by the control plane CU according to its own security algorithm capability and UE security algorithm capability. It is also possible that the inter-user CU sends the user plane security algorithm supported by the user to the control plane CU in advance, and the control plane CU selects an appropriate security algorithm according to the user plane security algorithm and the UE security algorithm capability supported by the user plane CU. The user plane CU uses the user plane key and the security algorithm to securely process the user plane data.
  • control plane CU receives the user plane basic key sent by the core network, and the control plane CU sends the user plane basic key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU, and the user plane CU is based on the user plane.
  • the basic key deduces the user plane key.
  • the user plane CU uses the user plane key corresponding to the PDU session identifier and the security algorithm to securely process the user plane data in the PDU session. Thereby improving the security of data transmission in the CP-UP separation scenario.
  • FIG. 16 is a flowchart of another embodiment of a data security processing method provided by the present application. As shown in FIG. 16, in this embodiment, on the basis of the method shown in FIG. 11, in an RRC re-establishment scenario, a UE occurs. After the radio link fails, the RRC re-establishment process is initiated.
  • the method in this embodiment may further include:
  • S411 to S412 and S411 to S412 are the same as those of S108 to S109 shown in FIG. 10, and the technical effects are also the same. For details, refer to the detailed description of S108 to S109, and details are not described herein again.
  • FIG. 17 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station in this embodiment may include: a key derivation module 11 and a processing module 12, where the key derivation module 11 is used to establish When a protocol data unit PDU session is performed, the first user plane key is derived according to the received base key, and the processing module 12 is configured to use the first user plane key and the security algorithm to secure the user plane data in the first PDU session. deal with.
  • the key deduction module 11 is further configured to derive a second user plane key according to the base key when establishing the second PDU session, and the processing module 12 is further configured to use the second user plane key and the security algorithm in the second PDU session.
  • the user plane data is securely processed, and the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the key deduction module 11 is specifically configured to: derive a first user plane key according to the basic key and the first parameter, where the first parameter is a first PDU session identifier; and the second key is derived according to the basic key and the second parameter.
  • the second parameter is the second PDU session identifier.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 6.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 18 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station of the present embodiment further includes: a sending module 13 and a sending module 13 on the basis of the structure of the base station shown in FIG. And configured to send, to the second base station, a target base key and at least one PDU session identifier, where the second base station derives a user plane key corresponding to the PDU session identifier according to the target base key and the at least one PDU session identifier, where the target base key is
  • the key derivation module is derived based on the base key and the third parameter.
  • the sending module 13 is further configured to: after sending the target base key and the at least one PDU session identifier to the second base station, send the target security algorithm to the user equipment UE, where the target security algorithm is the UE sent by the second base station according to the base station.
  • the security capability information is selected by the UE and sent to the base station, and the third parameter and the at least one PDU session identifier are sent to the UE, and the UE is used to derive the target base key according to the basic key and the third parameter, and then according to the target basis.
  • the key and the at least one PDU session identify the user plane key corresponding to the derivation PDU session identifier, and then perform security processing on the user plane data in the PDU session by using the user plane key corresponding to the PDU session identifier and the target security algorithm.
  • the base station in this embodiment is a source base station
  • the second base station is a target handover base station
  • the third parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information.
  • the base station in this embodiment is a primary base station
  • the second base station is a secondary base station
  • the third parameter includes a secondary cell group SCG counter.
  • the sending module 13 is further configured to: send, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether to deduct the user plane integrity corresponding to the PDU session identifier. Protect the key.
  • the base station includes a centralized unit CU and a distributed unit DU.
  • the CU includes a control plane CU and a user plane CU.
  • the control plane CU is connected to the user plane CU through a communication interface.
  • the key derivation module 11 is specifically configured to: control the control plane CU. And deriving the first user plane key according to the basic key and the first parameter, and sending the first parameter and the first user plane key corresponding to the first parameter to the user plane CU.
  • the key derivation module 11 is specifically configured to: the control control plane CU derives the second user plane key according to the basic key and the second parameter, and sends the second user plane key corresponding to the second parameter and the second parameter to the user plane CU.
  • the base station includes a centralized unit CU and a distributed unit DU.
  • the CU includes a control plane CU and a user plane CU.
  • the control plane CU is connected to the user plane CU through a communication interface.
  • the key derivation module 11 is specifically configured to: control the control plane CU. Transmitting the basic key and the first parameter to the user plane CU, and the user plane CU derives the first user plane key according to the basic key and the first parameter;
  • the key derivation module 11 is specifically configured to: the control control plane CU sends the basic key and the second parameter to the user plane CU, and the user plane CU derives the second user plane key according to the basic key and the second parameter.
  • the key deduction module 11 is further configured to: control the control plane CU to send an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is turned on; and control the user plane CU to determine whether to derive the PDU session identifier according to the indication.
  • User face integrity protection key is further configured to: control the control plane CU to send an indication to the user plane CU whether the user plane integrity protection corresponding to the PDU session identifier is turned on; and control the user plane CU to determine whether to derive the PDU session identifier according to the indication.
  • the processing module 12 is configured to: control the control plane CU to send a security algorithm to the user plane CU;
  • the processing module is configured to: control the user plane CU to perform security processing on the user plane data in the first PDU session by using the first user plane key and the security algorithm;
  • the processing module 12 is configured to: control the user plane CU to perform security processing on the user plane data in the second PDU session by using the second user plane key and the security algorithm.
  • the device of this embodiment may be used to implement the technical solution of the method embodiment shown in any one of FIG. 7 to FIG. 9.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 19 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station in this embodiment may further include: a first receiving module 14 according to the structure of the base station shown in FIG.
  • a receiving module 14 is configured to receive a radio resource control RRC re-establishment message or an RRC re-establishment message sent by the UE, where the RRC re-establishment message or the RRC re-recovery message includes a UE identifier, an original cell identifier, a short MAC-I, a control plane CU indication, or a user plane. At least one of a CU indication and a PDU session identification.
  • the processing module 12 is further configured to: generate shortMAC-I according to at least one of a UE identifier, an original cell identifier, a control plane CU indication, or a user plane CU indication and a PDU session identifier, and generate the shortMAC-I and the shortMAC sent by the UE. I compare and judge whether the verification is successful.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 10 or FIG. 16 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 20 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station in this embodiment may further include: a second receiving module 15 according to the structure of the base station shown in FIG.
  • the receiving module 15 is configured to receive an indication that the first PDU session identifier sent by the core network and the user plane integrity protection corresponding to the first PDU session identifier are turned on, and the processing module 12 is further configured to: determine, according to the indication, whether to deduct the first PDU session.
  • the second receiving module 15 is further configured to: receive an indication that the second PDU session identifier sent by the core network and the user plane integrity protection corresponding to the second PDU session identifier are enabled, and the processing module 12 is further configured to: determine, according to the indication, whether to deduct a user plane integrity protection key corresponding to the second PDU session identifier.
  • FIG. 21 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station in this embodiment may include: a sending module 21 and a derivation module 22, where the sending module 21 is configured to send a target control plane basis to the second base station.
  • the target control plane key includes: a control plane encryption key and/or a control plane integrity protection key
  • the target user plane key includes: a user plane encryption key and/or a user plane integrity protection Key
  • the deduction module 22 is configured to derive a target control plane base key according to the control plane base key and the first parameter, and derive a target user plane base key according to the user plane base key and the second parameter, and the second parameter and the PDU session identifier are one by one
  • the control plane base key is sent by the core network when the PDU session is first established
  • the user plane base key is sent by the core network when the PDU session is established.
  • the sending module 21 is further configured to: after the target base plane key, the at least one PDU session identifier, and the at least one PDU session identifier respectively corresponding to the target user plane base key are sent to the second base station, the target first security is performed.
  • the algorithm and the target second security algorithm are sent to the user equipment UE, and the target first security algorithm and the target second security algorithm are selected by the second base station according to the UE security capability information sent by the base station and sent to the base station;
  • the target control surface key is derived based on the target control plane base key
  • the target user plane key is derived based on the target user plane base key
  • the target control plane key and the target first security algorithm are used to control the plane data. Perform security processing to securely process user plane data in the PDU session using the target user plane key and the target second security algorithm.
  • the base station in this embodiment is a source base station
  • the second base station is a target handover base station
  • the first parameter includes at least one of a next hop link counter NCC, a target cell identifier, and frequency point information
  • the second parameter includes At least one of an NCC, a target cell identity, a PDU session identifier, and frequency point information.
  • the sending module 21 is further configured to: send, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether the user plane corresponding to the PDU session identifier is deduced Sexual protection key.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 12, and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 22 is a schematic structural diagram of an embodiment of a base station according to the present application.
  • the base station in this embodiment may include: a sending module 31 and a derivation module 32, where the sending module 31 is configured to send at least one PDU session to the second base station. Determining, by the second base station, a target user plane key corresponding to the at least one PDU session identifier, where the target user plane key comprises: a user plane encryption key and/or Or user plane integrity protection key.
  • the deduction module 32 is configured to derive a target user plane base key according to the user plane base key and the second parameter, where the second parameter is in one-to-one correspondence with the PDU session identifier, and the user plane base key is sent by the core network when the PDU session is established.
  • the sending module 31 is further configured to send the target second security algorithm to the user equipment UE after sending the target user plane basic key corresponding to the at least one PDU session identifier and the at least one PDU session identifier to the second base station,
  • the target second security algorithm is that the second base station selects and transmits to the UE according to the UE security capability information sent by the base station, and sends the second parameter to the UE, and is used by the UE to derive the user base key and the second parameter according to the user plane.
  • the target user plane base key is used to derive the target user plane key according to the target user plane base key
  • the target user plane key and the target second security algorithm are used to securely process the user plane data corresponding to the PDU session identifier.
  • the sending module 31 is further configured to: when the at least one PDU session identifier and the target user plane base key corresponding to the at least one PDU session identifier are respectively sent to the second base station, send the target control plane base key to the second base station, where The second base station derives a target control plane key according to the target control plane base key, and the target control plane base key is derived by the base station according to the control plane base key and the first parameter.
  • the sending module 31 is further configured to: after sending the target control plane base key to the second base station, send the target first security algorithm to the UE, where the target first security algorithm is the second base station according to the UE security capability sent by the base station The information is selected and sent by the UE to the base station; the first parameter is sent to the UE, and the UE derives the base control key of the target control plane according to the control key base key and the first parameter, and then derives the base key based on the target control plane.
  • the target control plane key uses the target control plane key and the target first security algorithm to securely process the control plane data.
  • the base station in this embodiment is a primary base station, and the second base station is a secondary base station.
  • the first parameter includes an SCG counter, and the second parameter includes an SCG counter and a PDU session identifier.
  • the sending module 31 is further configured to: send, to the second base station, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the second base station determines, according to the indication, whether the user plane corresponding to the PDU session identifier is deduced Sexual protection key.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 13 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 23 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • the base station of the embodiment includes a CU41 and a DU42.
  • the CU includes a control plane CU411 and a user plane CU412, and the control plane CU411 and the user plane CU412 communicate with each other.
  • the control plane CU411 is configured to: when establishing a PDU session, receive a user plane base key sent by the core network; deduct a user plane key according to the user plane base key, and associate the PDU session identifier with the PDU session identifier The key is sent to the user plane CU 412.
  • the user plane key includes: a user plane encryption key and/or a user plane integrity protection key.
  • the user plane CU 412 is configured to: use the PDU session identifier corresponding to the user plane key and the security algorithm to the PDU. User plane data in the session is handled securely.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 14.
  • the implementation principle and technical effects are similar, and details are not described herein again.
  • FIG. 24 is a schematic structural diagram of a base station according to an embodiment of the present disclosure.
  • the base station of this embodiment includes a CU 51 and a DU 52.
  • the CU includes a control plane CU 511 and a user plane CU 512 , and the control plane CU 511 and the user plane CU 512 pass the communication interface.
  • the control plane CU511 is configured to: when establishing a PDU session, receive a user plane base key sent by the core network; and send the user plane base key corresponding to the PDU session identifier and the PDU session identifier to the user plane CU512.
  • the user plane CU512 is configured to: derive a user plane key according to the user plane base key, where the user plane key includes: a user plane encryption key and/or a user plane integrity protection key; and a user plane key corresponding to the PDU session identifier is used. And the security algorithm securely processes the user plane data in the PDU session.
  • control plane CU511 is further configured to: send, to the user plane CU512, an indication of whether the user plane integrity protection corresponding to the PDU session identifier is enabled, and the user plane CU512 is further configured to: determine, according to the indication, whether to deduct the user plane corresponding to the PDU session identifier. Integrity protection key.
  • control plane CU511 is further configured to: send the security algorithm selected according to the user equipment UE security capability information to the user plane CU512.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 15 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • the base station 700 includes a memory 701, a processor 702, and a transceiver 703.
  • the memory 701, the processor 702, and the transceiver 703 are in communication through a bus 704.
  • the transceiver 702 is configured to send and receive data to and from the base station, and the memory 701 stores program instructions.
  • the processor invokes the program instructions stored in the memory to perform the method shown in any one of the embodiments of FIG. 6 to FIG. 16.
  • the operation at the base station For details, refer to the related description in the foregoing method embodiments.
  • the application further provides a system chip, which is applied to a base station, the system chip includes: an input/output interface, at least one processor, a memory, and a bus; the input/output interface, the at least one processor, and the memory through a bus phase Communication, the memory storing program instructions, the input/output interface is used for transceiving and receiving data between the system chip and the external; the at least one processor is configured to call the program instructions stored in the memory to perform as shown in FIG. 6 Figure 16 illustrates the operation of the method at any of the embodiments of the base station. For details, refer to the related description in the foregoing method embodiments.
  • the application further provides a program product for use in a base station, the computer program product comprising instructions for performing the operation of the base station as shown in any of the embodiments of Figures 6-16 when the instructions are executed by the computing device.
  • the present application also provides a readable storage medium for use in a base station, the computer readable storage medium storing instructions for performing the method as shown in any of the embodiments of FIGS. 6-16 when the instructions are executed by the computing device The operation at the base station.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种数据安全处理方法及装置。该方法包括：建立第一PDU会话，第一基站根据接收到的基础密钥推演第一用户面密钥，第一基站使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理，建立第二PDU会话，第一基站根据基础密钥推演第二用户面密钥，第一基站使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理，其中，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。不同PDU会话使用不同的用户面密钥，因此提高了数据传输的安全性。

Description

数据安全处理方法及装置
本申请要求于2017年09月29日提交中国专利局、申请号为201710910826.5、申请名称为“数据安全处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种数据安全处理方法及装置。
背景技术
通信系统中，数据的安全性都是基于安全算法来实现的，各种安全算法可以为数据提供机密性和完整性的保护。长期演进(long term evolution，LTE)系统中，基站与用户设备(User Equipment，UE)之间的通信需要通过安全算法进行安全认证，安全认证的过程为：移动管理实体(Mobility Management Entity，MME)生成网络侧的空口保护密钥(KeNB)，然后将KeNB和UE安全能力信息发给基站，基站根据UE安全能力信息和基站自身的安全能力选择合适的安全算法(加密算法和完整性保护算法)后发送给UE，同时基站根据KeNB采用密钥推演算法推演出接入层的用户面密钥和控制面密钥，用户面密钥包括用户面加密密钥(Key User Plane encryption，KUPenc)和用户面完整性保护密钥(Key User Plane integrity，KUPint)，控制面密钥包括无线资源控制(Radio Resource Control，RRC)信令保护密钥(RRC加密密钥(Key RRC encryption，KRRCenc)和RRC完整性保护密钥(Key RRC integrity，KRRCint)。UE侧可推演出所有非接入层密钥和接入层密钥，UE侧根据KeNB采用密钥推演算法推演接入层的用户面密钥和控制面密钥的过程与基站侧相同，均采用协议规定的相同的密钥推演算法。最终UE根据基站所选择的加密算法和完整性保护算法，以及用户面密钥和控制面密钥，对用户面数据和RRC消息进行加密和/或完整性保护，基站侧发送数据时也是如此。
现有技术中，UE与基站首次建立协议数据单元(Protocol Data Unit，PDU)会话时，UE侧与基站侧均根据KeNB采用密钥推演算法推演产生接入层的用户面密钥和控制面密钥，之后该UE所有业务的加密和完整性保护都使用与首次PDU会话建立时产生的密钥(包括用户面密钥和控制面密钥)相同的密钥。
然而，若首次PDU会话建立时产生的密钥被破解，之后UE的业务将无法使用，数据传输的安全性不高。
发明内容
本申请提供一种数据安全处理方法及装置，以提高数据传输的安全性。
第一方面，本申请提供一种数据安全处理方法，包括：建立第一协议数据单元PDU会话，第一基站根据接收到的基础密钥推演第一用户面密钥，第一基站使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理，建立第二PDU会话，第一基站根据基础密钥推演第二用户面密钥，第一基站使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
通过第一方面提供的数据安全处理方法，通过在每次PDU会话建立时，第一基站根据基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，并使用推演的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理，不同PDU会话使用不同的用户面密钥，因此提高了数据传输的安全性。
在一种可能的设计中，第一基站根据接收到的基础密钥推演第一用户面密钥，包括：第一基站根据基础密钥和第一参数推演第一用户面密钥，第一参数为第一PDU会话标识；第一基站根据基础密钥推演第二用户面密钥，包括：第一基站根据基础密钥和第二参数推演第二用户面密钥，第二参数为第二PDU会话标识。
在一种可能的设计中，还包括：第一基站向第二基站发送目标基础密钥和至少一个PDU会话标识，用于第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，目标基础密钥是第一基站根据基础密钥和第三参数推演的。
在一种可能的设计中，第一基站向第二基站发送目标基础密钥和至少一个PDU会话标识之后，还包括：
第一基站将目标安全算法发送给用户设备UE，目标安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择并发送给第一基站的；
第一基站将第三参数和至少一个PDU会话标识发送给UE，用于UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，第一基站为源基站，第二基站为目标切换基站，第三参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个。
通过该实施方式提供的数据安全处理方法，通过第一基站根据基础密钥和第三参数推演目标基础密钥，将推演的目标基础密钥和至少一个PDU会话标识发送给第二基站，第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，第二基站根据第一基站发送的UE安全能力信息为UE选择目标安全算法，从而第二基站使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理，第一基站还将第三参数和至少一个PDU会话标识发送给UE，UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理，第三参数包括NCC、目标小区标识和频点信息中的至少一个时，实现了源基站切换到目标切换基站过程中密钥的推演和交互。
在一种可能的设计中，第一基站为主基站，第二基站为辅基站，第三参数包括辅小区组SCG计数器。
通过该实施方式提供的数据安全处理方法，实现了DC场景下的密钥的推演和交互。
在一种可能的设计中，还包括：第一基站向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，第一基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，第一基站根据基础密钥和第一参数推演第一用户面密钥，包括：控制面CU根据基础密钥和第一参数推演第一用户面密钥，并将第一参数和第一参数对应的第一用户面密钥发送给用户面CU；第一基站根据基础密钥和第二参数推演第二用户面密钥，包括：控制面CU根据基础密钥和第二参数推演第二用户面密钥，并将第二参数和第二参数对应的第二用户面密钥发送给用户面CU。
通过该实施方式提供的数据安全处理方法，通过控制面CU接收核心网发送的基础密钥，控制面CU根据基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，并将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
在一种可能的设计中，第一基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，第一基站根据基础密钥和第一参数推演第一用户面密钥，包括：控制面CU将基础密钥和第一参数发送给用户面CU，用户面CU根据基础密钥和第一参数推演第一用户面密钥；第一基站根据基础密钥和第二参数推演第二用户面密钥，包括：控制面CU将基础密钥和第二参数发送给用户面CU，用户面CU根据基础密钥和第二参数推演第二用户面密钥。
通过该实施方式提供的数据安全处理方法，通过控制面CU接收核心网发送的基础密钥，控制面CU将基础密钥和每次PDU会话的PDU会话标识发送给用户面CU，由用户面CU根据推演基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
在一种可能的设计中，还包括：控制面CU向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；用户面CU根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，还包括：控制面CU向用户面CU发送安全算法；第一基站使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理，包括：用户面CU使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理；第一基站使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理，包括：用户面CU使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，还包括：第一基站接收UE发送的无线资源控制RRC重建立消息或RRC恢复消息，RRC重建立消息或RRC恢复消息中包括UE标识、原小区标识、校验码shortMAC-I、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个；第一基站根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和UE发送的shortMAC-I进行对比判断校验是否成功。
通过该实施方式提供的数据安全处理方法，通过第一基站接收UE发送的RRC重建立消息或RRC恢复消息，第一基站根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和UE发送的shortMAC-I进行对比判断校验是否成功，实现了RRC重建立或RRC恢复场景下数据传输的安全性。
在一种可能的设计中，还包括：第一基站接收核心网发送的第一PDU会话标识和第一PDU会话标识对应的用户面完整性保护是否开启的指示；第一基站根据指示确定是否推演第一PDU会话标识对应的用户面完整性保护密钥；第一基站接收核心网发送的第二PDU会话标识和第二PDU会话标识对应的用户面完整性保护是否开启的指示；第一基站根据指示确定是否推演第二PDU会话标识对应的用户面完整性保护密钥。
第二方面，本申请提供一种数据安全处理方法，包括：第一基站向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，目标控制面密钥包括：控制面加密密钥和/或控制面完整性保护密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；目标控制面基础密钥是第一基站根据控制面基础密钥和第一参数推演的，目标用户面基础密钥是第一基站根据用户面基础密钥和第二参数推演的，第二参数与PDU会话标识一一对应，控制面基础密钥是首次建立PDU会话时核心网发送的，用户面基础密钥是PDU会话建立时核心网发送的。
通过第二方面提供的数据安全处理方法，通过第一基站将目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥发送给第二基站，第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，从而第二基站使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理，从而实现了源基站切换到目标切换基站过程中密钥的推演和交互。
在一种可能的设计中，第一基站向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，还包括：
第一基站将目标第一安全算法和目标第二安全算法发送给用户设备UE，目标第一安全算法和目标第二安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择并发送给第一基站的；
第一基站将第一参数和第二参数发送给UE，用于UE根据自身的控制面基础密钥 和第一参数推演目标控制面基础密钥，根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，第一基站为源基站，第二基站为目标切换基站，第一参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个，第二参数包括NCC、目标小区标识、PDU会话标识和频点信息中的至少一个。
第三方面，本申请提供一种数据安全处理方法，包括：
第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标用户面基础密钥推演目标用户面密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
目标用户面基础密钥是第一基站根据用户面基础密钥和第二参数推演的，第二参数与PDU会话标识一一对应，用户面基础密钥是PDU会话建立时核心网发送的。
通过第三方面提供的数据安全处理方法，通过第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，第二基站根据目标用户面基础密钥推演目标用户面密钥，从而第二基站使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理，从而实现了DC场景下密钥的推演和交互。
在一种可能的设计中，第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，还包括：第一基站将目标第二安全算法发送给用户设备UE，目标第二安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择并发送给第一基站的；第一基站将第二参数发送给UE，用于UE根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标用户面基础密钥推演目标用户面密钥，使用目标用户面密钥和目标第二安全算法对PDU会话标识对应的用户面数据进行安全处理。
在一种可能的设计中，第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥时，还包括：
第一基站向第二基站发送目标控制面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，目标控制面基础密钥是第一基站根据控制面基础密钥和第一参数推演的。
在一种可能的设计中，第一基站向第二基站发送目标控制面基础密钥之后，还包括：
第一基站将目标第一安全算法发送给UE，目标第一安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择并发送给第一基站的；
第一基站将第一参数发送给UE，用于UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理。
在一种可能的设计中，第一基站为主基站，第二基站为辅基站，第一参数包括SCG计数器，第二参数包括SCG计数器和PDU会话标识。
在一种可能的设计中，还包括：第一基站向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据该指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
第四方面，本申请提供一种数据安全处理方法，包括：建立PDU会话，控制面集中式单元CU接收核心网发送的用户面基础密钥；控制面CU根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理；其中，控制面CU与用户面CU通过通信接口相连。
通过第四方面提供的数据安全处理方法，通过控制面CU接收核心网发送的用户面基础密钥，控制面CU根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
第五方面，本申请提供一种数据安全处理方法，包括：建立PDU会话，控制面集中式单元CU接收核心网发送的用户面基础密钥；控制面CU将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU；用户面CU根据用户面基础密钥推演用户面密钥，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理；其中，控制面CU与用户面CU通过通信接口相连。
通过第五方面提供的数据安全处理方法，通过控制面CU接收核心网发送的用户面基础密钥，控制面CU将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU，用户面CU根据用户面基础密钥推演用户面密钥，最后用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
在一种可能的设计中，还包括：控制面CU向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；用户面CU根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，还包括：控制面CU将根据用户设备UE安全能力信息选择的安全算法发送给用户面CU。
第六方面，本申请提供一种基站，包括：密钥推演模块，用于在建立第一协议数据单元PDU会话时，根据接收到的基础密钥推演第一用户面密钥；处理模块，用于使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理；密钥推演模块还用于在建立第二PDU会话时，根据基础密钥推演第二用户面密钥；处理模块还用于使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理；用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
在一种可能的设计中，密钥推演模块具体用于：根据基础密钥和第一参数推演第 一用户面密钥，第一参数为第一PDU会话标识；根据基础密钥和第二参数推演第二用户面密钥，第二参数为第二PDU会话标识。
在一种可能的设计中，还包括：发送模块，用于向第二基站发送目标基础密钥和至少一个PDU会话标识，用于第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，目标基础密钥是基站根据基础密钥和第三参数推演的。
在一种可能的设计中，发送模块还用于：向第二基站发送目标基础密钥和至少一个PDU会话标识之后，将目标安全算法发送给用户设备UE，目标安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第三参数和至少一个PDU会话标识发送给UE，用于UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，基站为源基站，第二基站为目标切换基站，第三参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个。
在一种可能的设计中，基站为主基站，第二基站为辅基站，第三参数包括辅小区组SCG计数器。
在一种可能的设计中，发送模块还用于：向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，密钥推演模块具体用于：控制控制面CU根据基础密钥和第一参数推演第一用户面密钥，并将第一参数和第一参数对应的第一用户面密钥发送给用户面CU；
密钥推演模块具体用于：控制控制面CU根据基础密钥和第二参数推演第二用户面密钥，并将第二参数和第二参数对应的第二用户面密钥发送给用户面CU。
在一种可能的设计中，基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，密钥推演模块具体用于：控制控制面CU将基础密钥和第一参数发送给用户面CU，用户面CU根据基础密钥和第一参数推演第一用户面密钥；
密钥推演模块具体用于：控制控制面CU将基础密钥和第二参数发送给用户面CU，用户面CU根据基础密钥和第二参数推演第二用户面密钥。
在一种可能的设计中，密钥推演模块还用于：控制控制面CU向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；控制用户面CU根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，处理模块用于：控制控制面CU向用户面CU发送安全算法；
处理模块用于：控制用户面CU使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理；
处理模块用于：控制用户面CU使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，还包括：第一接收模块，用于接收UE发送的无线资源控制RRC重建立消息或RRC恢复消息，RRC重建立消息或RRC恢复消息中包括UE标识、原小区标识、校验码shortMAC-I、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个；处理模块还用于：根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和UE发送的shortMAC-I进行对比判断校验是否成功。
在一种可能的设计中，还包括：第二接收模块，用于接收核心网发送的第一PDU会话标识和第一PDU会话标识对应的用户面完整性保护是否开启的指示；处理模块还用于：根据指示确定是否推演第一PDU会话标识对应的用户面完整性保护密钥；第二接收模块还用于：接收核心网发送的第二PDU会话标识和第二PDU会话标识对应的用户面完整性保护是否开启的指示；处理模块还用于：根据指示确定是否推演第二PDU会话标识对应的用户面完整性保护密钥。
上述第六方面以及上述第六方面的各可能的设计中所提供的基站，其有益效果可以参见上述第一方面和第一方面的各可能的实施方式所带来的有益效果，在此不再赘述。
第七方面，本申请提供一种基站，包括：发送模块，用于向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，目标控制面密钥包括：控制面加密密钥和/或控制面完整性保护密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；推演模块，用于根据控制面基础密钥和第一参数推演目标控制面基础密钥，根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一对应，控制面基础密钥是首次建立PDU会话时核心网发送的，用户面基础密钥是PDU会话建立时核心网发送的。
在一种可能的设计中，发送模块还用于：向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，将目标第一安全算法和目标第二安全算法发送给用户设备UE，目标第一安全算法和目标第二安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第一参数和第二参数发送给UE，用于UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，基站为源基站，第二基站为目标切换基站，第一参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个，第二参数包括NCC、目标小区标识、PDU会话标识和频点信息中的至少一个。
上述第七方面以及上述第七方面的各可能的设计中所提供的基站，其有益效果可以参见上述第二方面和第二方面的各可能的实施方式所带来的有益效果，在此不再赘述。
第八方面，本申请提供一种基站，包括：发送模块，用于向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标用户面基础密钥推演目标用户面密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；推演模块，用于根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一对应，用户面基础密钥是PDU会话建立时核心网发送的。
在一种可能的设计中，发送模块还用于：向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，将目标第二安全算法发送给用户设备UE，目标第二安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第二参数发送给UE，用于UE根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标用户面基础密钥推演目标用户面密钥，使用目标用户面密钥和目标第二安全算法对PDU会话标识对应的用户面数据进行安全处理。
在一种可能的设计中，发送模块还用于：向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥时，向第二基站发送目标控制面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，目标控制面基础密钥是基站根据控制面基础密钥和第一参数推演的。
在一种可能的设计中，发送模块还用于：向第二基站发送目标控制面基础密钥之后，将目标第一安全算法发送给UE，目标第一安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第一参数发送给UE，用于UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理。
在一种可能的设计中，基站为主基站，第二基站为辅基站，第一参数包括SCG计数器，第二参数包括SCG计数器和PDU会话标识。
在一种可能的设计中，还包括：发送模块还用于：向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据该指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
上述第八方面以及上述第八方面的各可能的设计中所提供的基站，其有益效果可以参见上述第三方面和第三方面的各可能的实施方式所带来的有益效果，在此不再赘述。
第九方面，本申请提供一种基站，包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连；
控制面CU用于：
在建立PDU会话时，接收核心网发送的用户面基础密钥；
根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的 用户面密钥发送给用户面CU，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
用户面CU用于：使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。
上述第九方面以及上述第九方面的各可能的设计中所提供的基站，其有益效果可以参见上述第四方面和第四方面的各可能的实施方式所带来的有益效果，在此不再赘述。
第十方面，本申请提供一种基站，包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连；
控制面CU用于：在建立PDU会话时，接收核心网发送的用户面基础密钥；将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU；
用户面CU用于：根据用户面基础密钥推演用户面密钥，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。
在一种可能的设计中，控制面CU还用于：向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；
用户面CU还用于：根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
在一种可能的设计中，控制面CU还用于：将根据用户设备UE安全能力信息选择的安全算法发送给用户面CU。
上述第十方面以及上述第十方面的各可能的设计中所提供的基站，其有益效果可以参见上述第五方面和第五方面的各可能的实施方式所带来的有益效果，在此不再赘述。
第十一方面，本申请提供一种基站，存储器、处理器和收发器，所述存储器、所述处理器以及所述收发器通过总线相通信；
所述收发器用于所述基站与外部进行数据收发；
所述存储器存储有程序指令；
所述处理器通过调用所述存储器中存储的程序指令，以进行如第一方面及第一方面任一种可能的设计中或者第二方面及第二方面任一种可能的设计中或者第三方面及第三方面任一种可能的设计中第四方面及第四方面任一种可能的设计中或者第五方面及第五方面任一种可能的设计中的数据安全处理方法在基站的操作。
第十二方面，本申请提供一种系统芯片，应用于基站，所述系统芯片包括：输入输出接口，至少一个处理器，存储器，以及总线；
所述输入输出接口、所述至少一个处理器和所述存储器通过总线相通信，所述存储器存储有程序指令，所述输入输出接口用于所述系统芯片与外部的数据收发；
所述至少一个处理器通过调用所述存储器中存储的程序指令，以进行如第一方面及第一方面任一种可能的设计中或者第二方面及第二方面任一种可能的设计中或者第三方面及第三方面任一种可能的设计中第四方面及第四方面任一种可能的设计中或者第五方面及第五方面任一种可能的设计中的数据安全处理方法在基站的操作。
第十三方面，本申请提供一种计算机程序产品，应用于基站，该计算机程序产品包括指令，当所述指令被计算装置执行时，以进行如第一方面及第一方面任一种可能的设计中或者第二方面及第二方面任一种可能的设计中或者第三方面及第三方面任一种可能的设计中第四方面及第四方面任一种可能的设计中或者第五方面及第五方面任一种可能的设计中的数据安全处理方法在基站的操作。
第十四方面，本申请提供一种计算机可读存储介质，应用于基站，该计算机可读存储介质中存储指令，当所述指令被计算装置执行时，以进行如第一方面及第一方面任一种可能的设计中或者第二方面及第二方面任一种可能的设计中或者第三方面及第三方面任一种可能的设计中第四方面及第四方面任一种可能的设计中或者第五方面及第五方面任一种可能的设计中的数据安全处理方法在基站的操作。
附图说明
图1为5G系统的网络架构示意图；
图2为5G系统中CU-DU切分示意图；
图3为CU的一种划分示意图；
图4a-图4d为LTE与NR做双连接的四种架构示意图；
图5为MCG承载、SCG承载、MCG分流承载和SCG分流承载的示意图；
图6为本申请提供的一种数据安全处理方法实施例的流程图；
图7为本申请提供的另一种数据安全处理方法实施例的流程图；
图8为本申请提供的一种数据安全处理方法实施例的流程图；
图9为本申请提供的另一种数据安全处理方法实施例的流程图；
图10为本申请提供的另一种数据安全处理方法实施例的流程图；
图11为本申请提供的另一种数据安全处理方法实施例的流程图；
图12为本申请提供的另一种数据安全处理方法实施例的流程图；
图13为本申请提供的另一种数据安全处理方法实施例的流程图；
图14为本申请提供的一种数据安全处理方法实施例的流程图；
图15为本申请提供的一种数据安全处理方法实施例的流程图；
图16为本申请提供的另一种数据安全处理方法实施例的流程图；
图17为本申请提供的基站实施例的结构示意图；
图18为本申请提供的基站实施例的结构示意图；
图19为本申请提供的基站实施例的结构示意图；
图20为本申请提供的基站实施例的结构示意图；
图21为本申请提供的基站实施例的结构示意图；
图22为本申请提供的基站实施例的结构示意图；
图23为本申请提供的基站实施例的结构示意图；
图24为本申请提供的基站实施例的结构示意图；
图25为本申请提供的一种基站结构示意图。
具体实施方式
本申请下文中描述的网络架构以及业务场景是为了清楚的说明本申请的技术方案，并不构成对本申请提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
本申请的技术方案，可以应用于第五代移动通信(the 5th Generation mobile communication technology，5G)系统或者LTE系统等移动通信系统，还可以应用于各种形式的包含基站中部分功能分离的系统，本申请应用的通信系统中，涉及的网元是基站(也称接入网设备)和UE(也称终端设备)。
以下，对本申请中的部分用语进行解释说明，以便于本领域技术人员理解。
1、本申请实施例中，术语“终端设备”或“UE”包括但不限于移动站、固定或移动用户单元、寻呼机、蜂窝电话、个人数字助理(Personal Digital Assistant，PDA)、计算机或任何其它类型的能在无线环境中工作的UE。
2、术语“基站”包括但不限于基站、节点、基站控制器、接入点(Access Point，AP)、远端节点(Remote Unit，RU)或任何其它类型的能够在无线环境中工作的接口设备。
3、基础密钥是指核心网发送给基站的密钥(由核心网生成的网络侧的基础密钥(KeNB))，或者源基站发送给目标切换基站的密钥，或者主基站发送给辅基站的密钥。
4、控制面密钥包括KRRCenc和KRRCint，KRRCenc用于加解密，KRRCint用于完整性保护，用户面密钥包括KUPenc和KUPint，KUPenc用于加解密，KUPint用于完整性保护。
本申请的技术方案，主要应用于基站与UE之间的安全认证过程中，为提高数据传输的安全性，每一次PDU会话建立时，基站和UE根据基础密钥或用户面基础密钥推演用户面密钥，实现PDU会话粒度的密钥产生和交互，以及在5G系统中控制面CU与用户面CU分离的场景下、双连接(Dual-connectivity，DC)场景下、RRC重建立场景和切换(Handover，HO)场景等场景下，密钥如何推演和交互。下面结合附图详细说明本申请的网络架构、本申请中涉及的CU-DU分离场景、DC场景、RRC重建立场景和HO场景。
图1为5G系统的网络架构示意图，在5G系统中，下一代无线接入网络(Next Generation Radio Access Network，NG-RAN)，核心网为5G核心网(5G Core Network，5GC)，基站被称为gNB/ng-eNB，主要包含RRC/服务数据自适应协议层(Service Data Adaptation Protocol，SDAP)/PDCP/无线链路控制(Radio Link Control，RLC)/媒质接入控制(Medium Access Control，MAC)/物理层(Physical Layer，PHY)协议层。下文中和图1中统一用gNB表示5G系统中的基站，gNB之间通过Xn接口连接，gNB和5GC通过Ng接口连接。其中接入与移动性管理功能(Access and Mobility management Function，AMF)/用户面功能(User Plane Function，UPF)相当于LTE系统中的MME。其中AMF主要负责准入方面，UPF主要负责会话(session)管理。
应理解，本申请中的字符“/”，表示前后关联对象是一种“或”的关系。
下面结合图2和图3介绍CU-DU分离场景，图2为5G系统中CU-DU切分示意图，如图2所示，基站可以由集中式单元(Centralized Unit，CU)和分布式单元 (Distributed Unit，DU)构成，即对原接入网中的基站的功能进行拆分，将基站的部分功能部署在一个CU，将剩余功能部署在DU，多个DU共用一个CU，可以节省成本，易于网络扩展。CU和DU之间通过F1接口连接，CU代表gNB通过Ng接口和核心网连接。CU和DU的切分可以按照协议栈切分，其中一种可能的方式是将RRC以及PDCP层部署在CU，其余的RLC层、MAC层以及PHY层部署在DU。更进一步，CU还可以划分为控制面CU(CU-CP)和用户面CU(CU-UP)，图3为CU的一种划分示意图，如图3所示，CU-CP和CU-UP通过E1接口连接。CU-CP代表gNB通过Ng接口和核心网连接，CU-CP通过F1-C(控制面)和DU连接，CU-UP通过F1-U(用户面)和DU连接。还有一种可能的实现是PDCP-C也在CU-UP。其中CU-CP负责控制面功能，主要包含RRC和控制面分组数据汇聚协议(Packet Data Convergence Protocol-Control，PDCP-C)，PDCP-C主要负责控制面数据的加解密、完整性保护、数据传输等。CU-UP负责用户面功能，主要包含SDAP和用户面PDCP(PDCP-U)，SDAP主要负责将核心网的数据进行处理并将数据流(flow)映射到承载。PDCP-U主要负责数据面的加解密、完整性保护、头压缩、序列号维护、数据传输等。
下面结合图4a-图5介绍DC场景，LTE和新空口(New Radio，NR)做DC时，UE可以同时从LTE和NR空口获得无线资源进行数据传输，获得传输速率的增益。图4a-图4d为LTE与NR做双连接的四种架构示意图，图4a中的核心网为LTE系统的分组核心演进(Evolved Packet Core，EPC)，LTE eNB作为主基站(Master Node，MeNB，5G中称为MN)，与EPC之间可以为UE建立控制面和用户面连接，gNB作为辅基站(Secondary Node，SeNB，5G中称为SN)，与EPC之间只能建立用户面连接，EPC与gNB通过S1接口连接，EPC与eNB通过S1接口连接，eNB与gNB通过X2/Xn接口连接。图4b中的核心网为(Next Generation Core network，NGC)(或称为5GC)，gNB作为主基站，与NGC之间可以为UE建立控制面和用户面的连接，LTE eNB作为辅基站，与NGC之间只能建立用户面连接，NGC与gNB通过NG接口连接，NGC与eNB通过NG接口连接，eNB与gNB通过X2/Xn接口连接。图4c中的核心网为NGC，LTE eNB作为主基站可以与NGC之间为UE建立控制面和用户面的连接，gNB作为辅基站，与NGC之间只能建立用户面连接，NGC与gNB通过NG接口连接，NGC与eNB通过NG接口连接，eNB与gNB通过X2/Xn接口连接。图4d中的核心网为NGC，第一gNB作为主基站可以与NGC之间为UE建立控制面和用户面的连接，第二gNB作为辅基站，与NGC之间只能建立用户面连接，NGC与第一gNB通过NG接口连接，NGC与第二gNB通过NG接口连接，gNB与gNB通过Xn接口连接。
以图4a为例，承载类型包括主小区组(Mater Cell Group，MCG)承载，辅小区组(Secondary Cell Group，SCG)承载，MCG分流承载，SCG分流承载，图5为MCG承载、SCG承载、MCG分流承载和SCG分流承载的示意图，如图5所示，图5中将主基站简称为主站，辅基站简称为辅站，MCG承载的数据全部由主基站发送给UE，SCG承载的数据全部由辅基站发送给UE，MCG分流承载的数据从核心网发送到主基站上，主基站在PDCP层进行分流，将部分数据发送到辅基站，由辅基站向UE发送，剩余数据由主基站向UE发送。SCG分流承载的数据从核心网发送到辅基站上，辅基 站在PDCP层进行分流，将部分数据发送到主基站，由主基站向UE发送，剩余数据由辅基站向UE发送。
下面介绍RRC重建立场景，UE发生无线链路失败后，发起RRC重建立流程，UE向基站发送RRC重建立请求消息，RRC重建立请求消息中包含小区无线网络临时标识(Cell Radio Network Temporary Identifier，C-RNTI)，原小区物理小区标识(Physical Cell Identity，PCI)以及校验码(shortMAC-I)。其中，shortMAC-I用来认证RRC重建立消息的合法性。Short MAC-I的输入参数：KRRCint，校验码输入参数(VarShort MAC-Input)包含Cell ID、PCI和C-RNTI。其中Cell ID是目标小区标识，PCI是无线链路失败前连接的原小区标识。UE重新连接的eNB可以根据UE提供的C-RNTI，PCI等，并结合自身已有信息(比如UE连接了原eNB，或者通过HO准备流程或无线链路失败指示从原eNB获取)来推演shortMAC-I，以此来验证UE合法性。对于RRC恢复场景，UE进入非激活态(inactive)后，发起RRC恢复流程。和RRC重建唯一不同的是，用户标识C-RNTI用恢复A-RNTI替代，其他描述相同，不再一一赘述。
下面以附着(Attach)过程为例来说明LTE系统中基站与UE之间的安全认证过程，首先，非接入层安全(security)的安全模式命令(Security Mode Command，SMC)过程主要用于MME和UE分别产生非接入层加密和完整性保护密钥，接着MME生成网络侧的空口保护密钥(以下简称KeNB)，并通过初始上下文设置请求(Initial Context Setup Request)将KeNB和UE安全能力信息发给eNB。eNB根据UE安全能力信息和基站自身的安全能力选择合适的安全算法(加密算法和完整性保护算法)。接入层安全的SMC过程则用于eNB和UE协商安全算法，并分别产生控制面密钥和用户面密钥。具体过程为eNB根据KeNB推演出接入层的用户面密钥(KUPenc和KUPint)和控制面密钥—RRC信令保护密钥(KRRCenc和KRRCint，前者用于加解密，后者用于完整性保护)。其中，安全算法包含加密算法和完整性保护算法。其中eNB根据KeNB推演接入层的用户面密钥(KUPenc和KUPint)和RRC信令保护密钥(KRRCenc和KRRCint)属于密钥推演算法，LTE系统中该算法由协议规定，不需要协商。而基于用户面密钥或控制面密钥对数据或RRC消息进行加密或完整性保护时，采用的算法是加密算法或完整性保护算法。加密算法和完整性保护算法需要eNB根据UE安全能力信息里面包含的UE支持的安全算法以及eNB自己支持的安全算法进行选择。最终UE根据eNB所选择的加密算法和完整性保护算法，以及用户面密钥(KUPenc，KUPint)和控制面密钥—RRC信令保护密钥(KRRCenc和KRRCint)，对用户面数据和RRC消息进行加密和或完整性保护。
下面简单介绍下PDU会话与数据流(flow)和数据无线承载(Data radio bearer，DRB)之间的关系，在LTE系统中，服务质量(QoS)管理是基于DRB的，而在5G系统中QoS管理是基于QoS flow的，即从NGC下来的数据是区分不同flow的，NGC与基站之间建立至少一个PDU会话，每个PDU会话包括至少一个QoS flow，基站会将一个或多个QoS flow映射成DRB，每个DRB至少对应一个QOS flow。因此，对于一个PDU会话，可对应多个DRB，因此，有实现DRB粒度的密钥产生和交互的需求，本申请还可实现DRB粒度的密钥产生和交互。
在基站与UE之间的安全认证过程中，现有技术采用的方法数据传输的安全性不 高，本申请提供一种数据安全处理方法及装置，为提高数据传输的安全性，每一次PDU会话建立时，基站和UE根据KeNB推演用户面密钥，实现PDU会话粒度的用户面密钥产生和交互。下面结合附图详细说明书本申请的技术方案。
图6为本申请提供的一种数据安全处理方法实施例的流程图，如图6所示，本实施例的方法可以包括：
S101、建立第一PDU会话，第一基站根据接收到的基础密钥推演第一用户面密钥，第一基站使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理。
其中，基础密钥是由核心网生成的网络侧的基础密钥(KgNB)，核心网(比如AMF网元)向第一基站发送基础密钥，同时还可以包括UE安全能力信息。用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
具体地，S101中第一基站根据接收到的基础密钥推演第一用户面密钥可以为：第一基站根据基础密钥和第一参数推演第一用户面密钥，第一参数为第一PDU会话标识。第一基站根据基础密钥、第一PDU会话标识和密钥推演算法推演第一用户面密钥，需要说明的是，第一基站根据基础密钥推演第一用户面密钥的密钥推演算法可以是协议规定的，不需要协商。也可能是通过协商获得的，比如UE在UE安全能力信息中包含了UE所支持的密钥推演算法(可以扩展为控制面密钥推演算法，用户面密钥推演算法)，然后第一基站就可以根据UE和自身支持的密钥推演算法，最终选择合适的密钥推演算法，或者控制面密钥推演算法和用户面密钥推演算法。
第一基站使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理，具体可以包括：
第一基站根据UE安全能力信息和第一基站支持的安全算法选择合适的安全算法，安全算法包括加密算法和完整性保护算法。进一步地，安全算法也可以包括控制面安全算法和用户面安全算法。其中控制面安全算法包含控制面加密算法和控制面完整性保护算法，用户面安全算法包含用户面加密算法和用户面完整性保护算法。接着第一基站使用第一用户面密钥和安全算法或者用户面安全算法对第一PDU会话中的用户面数据进行安全处理。对于UE侧，第一基站将选择的安全算法或者控制面安全算法和用户面安全算法发送给UE，还可以包括第一PDU会话标识，下一跳链接计数器(Next HopChaining Count，NCC)等，比如第一基站通过SMC消息或者RRC重配置消息告知UE。UE根据基础密钥和第一PDU会话标识通过密钥推演算法或者用户面密钥推演算法(协议规定或第一基站给出)推演出第一用户面密钥。最后使用第一用户面密钥和安全算法或者用户面安全算法对第一PDU会话中的用户面数据进行安全处理。
S102、建立第二PDU会话，第一基站根据基础密钥推演第二用户面密钥，第一基站使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
具体地，S102中第一基站根据基础密钥推演第二用户面密钥可以为：第一基站根据基础密钥和第二参数推演第二用户面密钥，第二参数为第二PDU会话标识。
第一基站使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理，具体可以包括：
第一基站根据UE安全能力信息和第一基站支持的安全算法选择合适的安全算法， 安全算法包括加密算法和完整性保护算法。进一步，安全算法也可以包括控制面安全算法和用户面安全算法。其中控制面安全算法包含控制面加密算法和控制面完整性保护算法，用户面安全算法包含用户面加密算法和用户面完整性保护算法。接着第一基站使用第二用户面密钥和安全算法或用户面安全算法对第二PDU会话中的用户面数据进行安全处理。对于UE侧，第一基站将选择的安全算法或者控制面安全算法和用户面安全算法发送给UE，还可以包括第二PDU会话标识，下一跳链接计数器等，比如第一基站通过SMC消息或者RRC重配置消息告知UE。UE根据基础密钥和第二PDU会话标识通过密钥推演算法或者用户面密钥推演算法(协议规定或第一基站给出)推演出第二用户面密钥。最后使用第二用户面密钥和安全算法或者用户面安全算法对第二PDU会话中的用户面数据进行安全处理。
当用户面密钥包括用户面加密密钥和用户面完整性保护密钥时，进一步地，上述方法还包括：
第一基站接收核心网发送的第一PDU会话标识和第一PDU会话标识对应的用户面完整性保护是否开启的指示，第一基站根据指示确定是否推演第一PDU会话标识对应的用户面完整性保护密钥，以及是否使用完整性保护密钥对第一PDU会话标识对应的用户面数据进行用户面完整性保护。还有一种可能的情况是，第一基站接收核心网发送的第一PDU会话标识、第一PDU会话包含的QoS flow列表、每个QoS flow标识对应的用户面完整性保护是否开启的指示。第一基站推演第一PDU会话标识对应的用户面完整性保护密钥，后续根据QoS flow标识对应的用户面完整性保护是否开启的指示，确定是否使用所述用户面完整性保护密钥对所述QoS flow标识对应的用户面数据进行完整性保护。例如第一PDU会话包含5个QoS flow，QoS flow 3的用户面完整性保护开启，其他QoS flow的用户面完整性保护关闭。第一基站推演第一PDU会话对应的用户面完整性保护密钥，再根据指示决定是否对QoS flow的用户面数据进行完整性保护。再例如第一PDU会话包含5个QoS flow，所有QoS flow的用户面完整性保护全部关闭，则第一基站推演第一PDU会话对应的用户面完整性保护密钥后，不对任何QoS flow对应的用户面数据进行完整性保护。或者，只有当第一PDU会话包含的QoS flow列表所对应的用户面完整性保护是否开启的所有指示中至少有一个指示显示开启，第一基站才推演第一PDU会话标识对应的用户面完整性保护密钥。后续只对用户面完整性保护指示开启的QoS flow标识对应的用户面数据进行完整性保护。例如第一PDU会话包含5个QoS flow，QoS flow 3的用户面完整性保护指示开启，其他QoS flow的用户面完整性保护指示关闭。第一基站推演用户面完整性保护密钥，再根据指示决定是否对QoS flow的用户面数据进行完整性保护。再例如第一PDU会话包含5个QoS flow，所有QoS flow的用户面完整性保护指示全部关闭。则第一基站决定不推演第一PDU会话对应的用户面完整性保护密钥。
第一基站接收核心网发送的第二PDU会话标识和第二PDU会话标识对应的用户面完整性保护是否开启的指示，第一基站根据指示确定是否推演第二PDU会话标识对应的用户面完整性保护密钥。还有一种可能的情况是，第一基站接收核心网发送的第二PDU会话标识、第一PDU会话包含的QoS flow列表、每个QoS flow标识对应的用户面完整性保护是否开启的指示。第一基站在收到第二PDU会话标识和用户面完整 性保护是否开启的指示时，其操作同收到第一PDU会话标识和用户面完整性保护是否开启的指示。
即就是说，核心网会向第一基站发送PDU会话标识和PDU会话标识对应的用户面完整性保护是否开启的指示，若指示“开启”，则第一基站根据接收到的指示推演PDU会话标识对应的用户面完整性保护密钥，若指示“关闭”，则第一基站不用推演PDU会话标识对应的用户面完整性保护密钥。可选的，不限于用户面完整性保护是否开启的指示，还可以扩展为控制面加密，控制面完整性保护，用户面加密，用户面完整性保护是否开启的指示，完整性保护密钥简称完整性保护。例如核心网在为某UE首次建立PDU会话的时候提供KgNB，UE安全能力信息以及用户面完整性保护是否开启的指示，而在每次建立PDU会话的时候还可能给出该PDU会话的控制面面完整性保护是否开启的指示，控制面加密是否开启的指示，用户面加密是否开启的指示。上述所有指示都可以扩展为QoS flow粒度的，即每个QoS flow标识对应控制面加密是否开启的指示，控制面完整性保护是否开启的指示，用户面加密是否开启的指示，用户面完整性保护是否开启的指示。
本实施例提供的数据安全处理方法，通过在每次PDU会话建立时，第一基站根据基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，并使用推演的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理，不同PDU会话使用不同的用户面密钥，因此提高了数据传输的安全性。
进一步地，第一基站与UE之间建立PDU会话之后，存在UE从源基站向目标切换基站切换，此时用户面密钥如何推演，图7为本申请提供的另一种数据安全处理方法实施例的流程图，如图7所示，本实施例的方法在图6所示方法的基础上，还可以包括：
S103、第一基站根据基础密钥和第三参数为第二基站推演目标基础密钥。
其中，第一基站为源基站，第二基站为目标切换基站，具体地，第一基站在决策为UE执行切换动作，基于基础密钥和第三参数为第二基站推演目标基础密钥，第三参数包括NCC、目标小区标识和频点信息中的至少一个。
S104、第一基站向第二基站发送目标基础密钥和至少一个PDU会话标识。
可选的，第一基站还将UE安全能力信息、目标小区标识、频点信息和密钥推演算法中的至少一个发送给第二基站，还可以包括：第一基站向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。此外，一种情况是第一基站接收核心网发送的PDU会话标识对应的用户面完整性保护是否开启的指示，第一基站还可能向第二基站发送PDU会话标识对应的用户面加密密钥是否开启的指示。另一种情况是，第一基站接收核心网发送的PDU会话内部QoS flow标识对应的用户面完整性保护是否开启的指示，第一基站还可能向第二基站发送PDU会话标识对应的QoS flow标识对应的用户面完整性保护是否开启的指示。针对上述两种情况，如果第一基站根据一定原则将一个或多个QoS flow映射到DRB时，第一基站还可能向第二基站发送DRB标识对应的用户面完整性保护是否开启的指示。上述指示还可以扩展为控制面加密是否开启的指示，控制面完整性保护是否开启的指示，用户面加密是否开启的指示，用户 面完整性保护是否开启的指示。
可将上述信息包含在第一基站向第二基站发送的切换请求(Handover request)消息中，例如切换请求中包含以下形式的信息：
>Target Cell ID               目标小区标识
>carrier Freq               频点信息
>UE security capability         UE安全能力信息
>K*gNB                     目标基础密钥
>PDU session to be setup List     PDU会话建立列表
>>PDU session ID             PDU会话标识
>>UP integrity indication       用户面完整性保护是否开启的指示
或者第一基站提供DRB粒度的用户面完整性保护是否开启的指示，例如：
>Target Cell ID               目标小区标识
>carrier Freq               频点信息
>UE security capability         UE安全能力信息
>K*gNB                     目标基础密钥
>PDU session to be setup List     PDU会话建立列表
>>PDU session ID             PDU会话标识
>>>DRB list
>>>>DRB ID
>>>>UP integrity indication       用户面完整性保护是否开启的指示
或者第一基站提供QoS flow粒度的用户面完整性保护是否开启的指示，例如：
>Target Cell ID               目标小区标识
>carrier Freq               频点信息
>UE security capability         UE安全能力信息
>K*gNB                     目标基础密钥
>PDU session to be setup List     PDU会话建立列表
>>PDU session ID             PDU会话标识
>>>QoS flow list
>>>>QoS flow ID
>>>>UP integrity indication       用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。
S105、第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥。
具体地，第二基站接收到第一基站发送的UE安全能力信息后，根据UE安全能力信息和第二基站的安全能力选择安全算法(还可能包含控制面安全算法和用户面安全算法，或者控制面加密算法，控制面完整性保护算法，用户面加密算法，用户面完整性保护算法等)。第二基站在接收到上述其他信息后根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，其中，根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，具体例如为：例如共5 个PDU会话标识，根据目标基础密钥和PDU会话标识1推演用户面密钥1，根据目标基础密钥和PDU会话标识2推演用户面密钥2，…，根据目标基础密钥和PDU会话标识5推演用户面密钥5。第二基站将选择的安全算法及其它信息(例如UE在目标小区使用的小区无线网络临时标识(Cell Radio Network Temporary Identifier，C-RNTI)通过Xn接口(第一基站与第二基站之间的接口)发送给第二基站。
在切换之后，为使UE侧能与第二基站之间进行安全认证，进一步地，还可以包括：
S106、第一基站将目标安全算法发送给UE，目标安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择并发送给第一基站的。
S107、第一基站将第三参数和至少一个PDU会话标识发送给UE。
第三参数包括NCC、目标小区标识和频点信息中的至少一个。此外，还可能包含用户面完整性保护是否开启的指示。同样地，用户面完整性保护是否开启的指示可以是PDU会话粒度，DRB粒度或者QoS flow粒度。若目标安全算法是UE级别的，S105和S106中发给UE的信息可以在RRC消息中例如包含以下形式的信息：
>Target Cell ID              目标小区标识
>carrier Freq              频点信息
>NCC    (用于生成目标基础密钥K*gNB)
>目标安全算法
>>加密算法(还可能区分控制面和用户面)
>>完整性保护算法(还可能区分控制面和用户面)
>>密钥推演算法(大概率不存在)
>PDU session list          PDU会话列表
>>PDU session ID         PDU会话标识
>>UP integrity indication       用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。
若目标安全算法是PDU会话粒度的，S105和S106中发给UE的信息可以在RRC消息中例如包含以下形式的信息：
>Target Cell ID              目标小区标识
>carrier Freq              频点信息
>NCC     (用于生成目标基础密钥K*gNB)
>PDU session list           PDU会话列表
>>PDU session ID          PDU会话标识
>>UP integrity indication       用户面完整性保护是否开启的指示
>>目标安全算法
>>>加密算法(还可能区分控制面和用户面)
>>>完整性保护算法(还可能区分控制面和用户面)
>>>密钥推演算法(大概率不存在)
上述例子的用户面完整性保护是否开启的指示都是PDU会话粒度的，上述指示还可以是DRB粒度或QoS flow粒度的，这里不再一一赘述。上述所有参数都将根据实 际情况存在或不存在。
S108、UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理。
本实施例中，第一基站为主基站，第二基站为辅基站时，解决的是DC场景下密钥如何推演和交互，此时第三参数包括辅小区组SCG计数器，执行相同的过程S103～S107。
本实施例中，通过第一基站根据基础密钥和第三参数推演目标基础密钥，将推演的目标基础密钥和至少一个PDU会话标识发送给第二基站，第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，第二基站根据第一基站发送的UE安全能力信息为UE选择目标安全算法，从而第二基站使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理，第一基站还将第三参数和至少一个PDU会话标识发送给UE，UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理，第三参数包括NCC、目标小区标识和频点信息中的至少一个时，实现了源基站切换到目标切换基站过程中密钥的推演和交互，第三参数包括辅小区组SCG计数器时，实现了DC场景下的密钥的推演和交互。
图8为本申请提供的一种数据安全处理方法实施例的流程图，如图8所示，本实施例中，第一基站包括CU和DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，CU-DU分离场景下，本实施例的方法可以包括：
S201、核心网向第一基站发送基础密钥，同时还可以包括UE安全能力信息。
可选的，还可以包括PDU会话粒度或者QoS flow粒度的用户面完整性保护是否开启的指示。还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示，具体地，由控制面CU接收核心网发送的基础密钥，可选地，由控制面CU接收核心网发送的PDU会话粒度或者QoS flow粒度的用户面完整性保护是否开启的指示。
S202、建立第一PDU会话，控制面CU根据接收到的基础密钥和第一PDU会话标识推演第一用户面密钥，并将第一PDU会话标识和第一PDU会话标识对应的第一用户面密钥发送给用户面CU。
其中，推演第一用户面密钥的密钥推演算法可以是协议规定的，也可以是控制面CU根据UE安全能力以及自身安全能力选择的。若是控制面CU根据UE安全能力以及自身安全能力选择的，则该密钥推演算法可能是UE粒度，也可能是PDU session粒度。可选的，所述密钥推演算法也可能是用户面CU将自身安全能力发送给控制面CU，控制面CU根据UE安全能力以及用户面安全能力选择的。
具体地，控制面CU可通过E1接口将第一PDU会话标识和第一PDU会话标识对应的第一用户面密钥发送给用户面CU，例如控制面CU通过UE上下文连接建立请求(UE context setup request)或PDU会话建立请求(session setup request)消息包含第 一PDU会话标识和第一PDU会话标识对应的第一用户面密钥。如果通过UE级别的消息发送(例如UE context setup request)，那么可以包括如下形式的信息：
>CU-CP E1APUE ID CU-CP侧UE的E1接口标识
>PDU session list
>>PDU session ID
>>KUPenc
>>KUPint
上述所有参数都将根据实际情况存在或不存在。特别地，控制面CU将根据核心网发送的用户面完整性保护指示决定是否推演用户面完整性保护密钥KUPint。如果核心网指示关闭，则控制面CU将不提供用户面完整性保护密钥给用户面CU。同样地，如果核心网给出的用户面加密指示为关闭，则控制面CU将不提供用户面加密密钥KUPenc给用户面CU。
当核心网提供的是QoS flow粒度的用户面完整性保护是否开启的指示，则控制面CU给用户面CU发送的消息可能包含如下内容：
>CU-CP E1APUE ID   CU-CP侧UE的E1接口标识
>PDU session list
>>PDU session ID
>>KUPenc
>>QoS flow list
>>>QoS flow ID
>>>KUPint
如果通过PDU会话级别的消息发送(例如PDU session setup request)，那么可以包括如下形式的信息：
>CU-CP E1APUEID   CU-CP侧UE的E1接口标识
>PDU session ID
>KUPenc
>KUPint
上述所有参数都将根据实际情况存在或不存在。控制面CU是否提供用户面完整性保护密钥KUPint和用户面加密密钥KUPenc，同上操作。
当核心网提供的是QoS flow粒度的用户面完整性保护是否开启的指示，则控制面CU给用户面CU发送的消息可能包含如下内容：
>CU-CP E1APUEID    CU-CP侧UE的E1接口标识
>PDU session ID
>KUPenc
>QoS flow list
>>QoS flow ID
>>KUPint
S203、控制面CU向用户面CU发送安全算法。
其中，安全算法是控制面CU根据UE安全能力信息和第一基站的安全能力为UE 选择的。还可以是，用户面CU预先将自身支持的安全算法发送给控制面CU，控制面CU根据用户面CU支持的安全算法和UE安全算法能力，选择合适的安全算法。其中的安全算法包括加密算法和完整性保护算法。当安全算法包含控制面安全算法和用户面安全算法时，此处控制面CU给用户面CU发送用户面安全算法，包含用户面加密算法和用户面完整性保护算法。
S204、用户面CU使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理。
例如当用户面完整性保护是否开启是PDU会话粒度时，如果控制面CU提供了第一PDU会话对应的KUPenc和KUPint，则用户面CU对第一PDU会话标识对应的用户面数据进行加密和完整性保护处理。当控制面CU只提供第一PDU会话对应的KUPenc时，用户面CU只对第一PDU会话对应的用户面数据进行加密处理。当用户面完整性保护是否开启是QoS flow粒度时，如果控制面CU提供了第一PDU会话对应的KUPenc和KUPint，用户面CU对第一PDU会话标识对应的用户面数据进行加密处理。然后再根据QoS flow标识对应的用户面完整性保护是否开启的指示，决定是否对QoS flow标识对应的用户面数据进行完整性保护处理。
S205、建立第二PDU会话，控制面CU根据基础密钥和第二PDU会话标识推演第二用户面密钥，并将第二PDU会话标识和第二PDU会话标识对应的第二用户面密钥发送给用户面CU。
S206、控制面CU向用户面CU发送安全算法。
当安全算法是UE级别时，控制面CU在首次建立PDU会话时向用户面CU发送安全算法，当安全算法是PDU会话级别，即每个PDU会话的安全算法不同时，每次建立PDU会话时都需要执行S206。
S207、用户面CU使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
其中，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
本实施例中，通过控制面CU接收核心网发送的基础密钥，控制面CU根据基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，并将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
图9为本申请提供的另一种数据安全处理方法实施例的流程图，如图9所示，本实施例中，第一基站包括CU和DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，CU-DU分离场景下，本实施例的方法可以包括：
S301、核心网向第一基站发送基础密钥，同时还可以包括UE安全能力信息。
可选的，还可以包括PDU粒度或者QoS flow粒度的用户面完整性保护是否开启的指示，还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示，具体地，由控制面CU接收核心网发送的基础密钥。
S302、建立第一PDU会话，控制面CU将基础密钥和第一PDU会话标识发送给用户面CU。
S303、用户面CU根据基础密钥和第一PDU会话标识推演第一用户面密钥。
特别地，控制面CU将核心网发送的第一PDU会话标识对应的用户面完整性保护是否开启的指示发送给用户面CU，当然还可能包含第一PDU会话标识对应的用户面加密是否开启的指示。用户面CU将根据所述指示确定是否推演用户面完整性保护密钥和用户面加密密钥。当控制面CU未给出所述指示时，用户面CU默认需要推演相应的用户面密钥。或者，控制面CU将核心网发送的第一PDU会话标识内每个QoS flow标识对应的用户面完整性保护是否开启的指示发送给用户面CU，用户面CU据此决策是否推演第一PDU会话对应的用户面完整性保护密钥，以及是否对QoS flow对应的用户面数据进行完整性保护处理。例如只要第一PDU会话内部有一个QoS flow标识对应的用户面完整性保护指示开启时，用户面CU推演第一PDU会话对应的用户面完整性保护密钥，并对所述指示开启的QoS flow对应的用户面数据进行完整性保护处理。
S304、控制面CU向用户面CU发送安全算法。
其中，安全算法是控制面CU根据UE安全能力信息和第一基站的安全能力为UE选择的。还可以是，用户面CU预先将自身支持的用户面安全算法发送给控制面CU，控制面CU根据用户面CU支持的用户面安全算法和UE安全算法能力，选择合适的安全算法。其中的安全算法包括加密算法和完整性保护算法。当安全算法包含控制面安全算法和用户面安全算法时，此处控制面CU给用户面CU发送用户面安全算法，包含用户面加密算法和用户面完整性保护算法。
S305、用户面CU使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理。
S306、建立第二PDU会话，控制面CU将基础密钥和第二PDU会话标识发送给用户面CU。
S307、用户面CU根据基础密钥和第二PDU会话标识推演第二用户面密钥。
S308、控制面CU向用户面CU发送安全算法。
当安全算法是UE级别时，控制面CU在首次建立PDU会话时向用户面CU发送安全算法，当安全算法是PDU会话级别，即每个PDU会话的安全算法不同时，每次建立PDU会话时都需要执行S206。
S309、用户面CU使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
本实施例中，通过控制面CU接收核心网发送的基础密钥，控制面CU将基础密钥和每次PDU会话的PDU会话标识发送给用户面CU，由用户面CU根据基础密钥和每次PDU会话的PDU会话标识推演用户面密钥，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
图10为本申请提供的另一种数据安全处理方法实施例的流程图，如图10所示，本实施例中，在图6所示方法的基础上，在RRC重建立场景下，UE发生无线链路失败后，发起RRC重建立流程，本实施例的方法还可以包括：
S108、第一基站接收UE发送的RRC重建立消息或RRC恢复消息，RRC重建立消息或RRC恢复消息中包括UE标识、原小区标识、校验码(shortMAC-I)、控制面 CU指示或用户面CU指示和PDU会话标识中的至少一个。
其中，UE标识可以是空口标识如C-RNTI，或者是恢复标识(A-RNTI)。
S109、第一基站根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和UE发送的shortMAC-I进行对比判断校验是否成功。
具体地，有如下几种可实施的方式：
1)根据控制面指示或用户面CU指示，选择对应的控制面完整性保护密钥或用户面完整性保护密钥生成shortMAC-I。例如基站根据UE标识，原小区标识，当前接入小区标识以及控制面完整性保护密钥或用户面完整性保护密钥生成shortMAC-I。当用户面完整性保护密钥有多个，例如每个PDU session都有对应的用户面完整性保护密钥。其中用户面完整性保护密钥可以根据协议规定选择例如PDU session标识最小的用户面完整性保护密钥。
2)根据PDU会话标识，选择PDU会话标识对应的用户面完整性保护密钥生成shortMAC-I。例如基站根据UE标识，原小区标识，当前接入小区标识以及PDU会话标识对应的用户面完整性保护密钥生成shortMAC-I。
本实施例中，通过第一基站接收UE发送的RRC重建立消息或RRC恢复消息，第一基站根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，以该shortMAC-I来验证UE合法性，实现了RRC重建立或RRC恢复场景下数据传输的安全性。
本申请实施例中，为实现DRB粒度的密钥产生和交互，可采用上述图6-图10所示实施例提供的方法，区别在于将图6-图10所示实施例中的PDU会话标识改为DRB标识，第一基站推演DRB粒度的用户面密钥。
图11为本申请提供的另一种数据安全处理方法实施例的流程图，如图11所示，本实施例的方法可以包括：
S401、核心网向第一基站发送基础密钥，基础密钥包括控制面基础密钥和用户面基础密钥，用户面基础密钥和PDU会话标识一一对应。
其中，控制面基础密钥(CP KgNB)可以是核心网在为该用户首次建立PDU会话的时候提供，而用户面基础密钥(UP KgNB)可以是每次建立PDU会话的时候提供。核心网向第一基站发送基础密钥，同时还可以包括UE安全能力信息和用户面完整性保护是否开启的指示。还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。此外，所述用户面完整性保护，用户面加密是否开启的指示，可以是PDU会话粒度的，也可以是QoS flow粒度的。例如，核心网的AMF网元在Ng接口的初始上下文建立请求(Initial Context setup request)中同时给出CP KgNB和UP KgNB1以及UE安全能力信息等，例如包括以下形式消息：
>AMF NGAPUEID   AMF侧UE的NG接口标识
>UE security capability  UE安全能力信息
>CP KgNB
>PDU session ID         PDU会话标识
>UP KgNB1
>UP integrity indication    用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。
当用户面完整性保护是QoS flow粒度时，初始上下文建立请求消息包括以下形式消息：
>AMF NGAPUEID     AMF侧UE的NG接口标识
>UE security capability  UE安全能力信息
>CP KgNB
>PDU session ID        PDU会话标识
>UP KgNB1
>>QoS flow list
>>>QoS flow ID
>>>UP integrity indication       用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。
在之后建立PDU会话比如PDU会话建立请求消息中只给出UP KgNB2(UP KgNB3…等)，UE安全能力信息(很大可能不提供，因为第一次已经提供了)等。上述消息都是示意，本申请不限于此。例如包括以下形式消息：
>AMF NGAPUEID           AMF侧UE的NG接口标识
>PDU session ID
>UP KgNB2
>UP integrity indication       用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。此外，上述用户面完整性保护是否开启的指示还可能是QoS flow粒度的，此处不再一一赘述。
S402、第一基站根据控制面基础密钥推演控制面密钥，根据用户面基础密钥推演用户面密钥。
用户面基础密钥是PDU会话粒度的，每次建立PDU会话时都会发送用户面基础密钥。需要说明的是，第一基站根据用户面基础密钥推演用户面密钥的密钥推演算法可以是协议规定的，不需要协商。也可能是通过协商获得的，比如UE在UE安全能力信息中包含了UE所支持的密钥推演算法(可以扩展为控制面密钥推演算法，用户面密钥推演算法)，然后第一基站就可以根据UE和自身支持的密钥推演算法，最终选择合适的密钥推演算法。
S403、第一基站使用用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。
具体地，第一基站根据UE安全能力信息和第一基站支持的安全算法选择合适的安全算法，安全算法包括加密算法和完整性保护算法。进一步安全算法还可以分为控制面安全算法和用户面安全算法。其中控制面安全算法包括控制面加密算法和控制面完整性保护算法，用户面安全算法包括用户面加密算法和用户面完整性保护算法。接着第一基站使用用户面密钥和安全算法或用户面安全算法对PDU会话中的用户面数据进行安全处理。对于UE侧，第一基站将选择的安全算法或控制面安全算法和用户面安全算法发送给UE，还可以包括用户面完整性保护是否开启的指示，比如第一基站通过SMC消息或者RRC重配置消息告知UE。UE根据基础密钥通过密钥推演算法或 用户面密钥推演算法(协议规定或第一基站给出)推演出用户面密钥。最后使用用户面密钥和安全算法或用户面安全算法对PDU会话中的用户面数据进行安全处理。特别地，第一基站根据核心网发送的PDU会话粒度或QoS flow粒度的用户面完整性保护是否开启的指示，决策是否对PDU会话标识或者QoS flow标识对应的用户面数据进行用户面完整性保护处理。可选地，第一基站还将所述PDU会话粒度或QoS flow粒度的用户面完整性保护是否开启的指示发送给UE，让UE决策是否对PDU会话标识或者QoS flow标识对应的用户面数据进行用户面完整性保护处理。所述指示还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。
本实施例提供的数据安全处理方法，通过在每次PDU会话建立时，第一基站接收用户面基础密钥，根据用户面基础密钥推演用户面密钥，并使用推演的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理，不同PDU会话使用不同的用户面密钥，因此提高了数据传输的安全性。
进一步地，第一基站与UE之间建立PDU会话之后，存在UE从源基站向目标切换基站切换，此时用户面密钥如何推演，图12为本申请提供的另一种数据安全处理方法实施例的流程图，如图12所示，本实施例的方法在图11所示方法的基础上，还可以包括：
S404、第一基站根据控制面基础密钥和第一参数推演目标控制面基础密钥，根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一对应。
其中，控制面基础密钥是首次建立PDU会话时核心网发送的，用户面基础密钥是PDU会话建立时核心网发送的。第一基站为源基站，第二基站为目标切换基站，第一参数包括NCC、目标小区标识和频点信息中的至少一个，第二参数包括NCC、目标小区标识、PDU会话标识和频点信息中的至少一个。
具体地，第一基站根据用户面基础密钥和第二参数推演目标用户面基础密钥，例如在切换之前已经建立了4个PDU会话，对应有4个用户面基础密钥和4个PDU会话标识，第一基站根据用户面基础密钥1、NCC、目标小区标识1、PDU会话标识1和频点信息1中的至少一个推演目标用户面基础密钥1，第一基站根据用户面基础密钥2、NCC、目标小区标识2、PDU会话标识2和频点信息2中的至少一个推演目标用户面基础密钥2，…，第一基站根据用户面基础密钥4、NCC、目标小区标识4、PDU会话标识4和频点信息4中的至少一个推演目标用户面基础密钥4。一般情况下，目标小区标识1，2，3，4相同。
S405、第一基站向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥。
具体地，例如在切换之前已经建立了4个PDU会话，第一基站向第二基站发送目标控制面基础密钥，4个PDU会话标识和4个PDU会话标识分别对应的目标用户面基础密钥。
可选的，还可以包括：第一基站向第二基站发送PDU会话标识对应或者DRB标识对应或者QoS flow标识对应的用户面完整性保护是否开启的指示，用于第二基站根 据指示确定是否推演PDU会话标识或者DRB标识或者QoS flow标识对应的用户面完整性保护密钥。还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。
可选的，可将上述信息包含在第一基站向第二基站发送的切换请求(Handover request)消息中，例如切换请求中包含以下形式的信息：
>Target Cell ID              目标小区标识
>carrier Freq               频点信息
>UE security capability         UE安全能力信息
>CP K*gNB                 目标控制面基础密钥
>PDU session to be setup List     PDU会话建立列表
>>PDU session ID              PDU会话标识
>>UP K*gNB                目标用户面基础密钥
>>UP integrity indication     用户面完整性保护是否开启的指示
上述所有参数都将根据实际情况存在或不存在。上述信息只给出了PDU会话粒度的用户面完整性保护是否开启的示例。对于DRB粒度和QoS flow粒度的示例，此处不再一一赘述。
S406、第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，第二基站使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理。
其中，目标控制面密钥包括：控制面加密密钥和/或控制面完整性保护密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。目标第一安全算法是第二基站根据第一基站发送的UE安全能力和自身安全能力进行选择的，目标第二安全算法是第二基站根据第一基站发送的UE安全能力和自身安全能力进行选择的。
此外，第二基站还将根据PDU会话粒度或者DRB粒度或者QoS flow粒度的用户面完整性保护是否开启的指示，决策是否对PDU会话标识，或者DRB标识，或者QoS flow标识对应的用户面数据进行完整性保护处理。
在切换之后，为使UE侧能与第二基站之间进行安全认证，进一步地，在S405之后，还可以包括：
S407、第二基站根据第一基站发送的UE安全能力信息为UE选择目标第一安全算法和目标第二安全算法并发送给第一基站。特别地，当目标第一安全算法和目标第二安全算法相同时，第一基站只需要发送目标安全算法给第二基站。
S408、第一基站将目标第一安全算法和目标第二安全算法发送给UE。
S409、第一基站将第一参数和第二参数发送给UE。
其中第一参数包括NCC、目标小区标识和频点信息中的至少一个，第二参数包括NCC、PDU会话标识、目标小区标识和频点信息中的至少一个。
若第一安全算法或第二安全算法是UE级别的，S408和S409中发给UE的信息可以在RRC消息中例如包含以下形式的信息：
>Target Cell ID              目标小区标识
>carrier Freq               频点信息
>NCC for CP       (用于生成目标控制面基础密钥)
>第一安全算法
>>加密算法(还可能区分控制面和用户面)
>>完整性保护算法(还可能区分控制面和用户面)
>>密钥推演算法(大概率不存在)
>第二安全算法
>>加密算法(还可能区分控制面和用户面)
>>完整性保护算法(还可能区分控制面和用户面)
>>密钥推演算法(大概率不存在)
>PDU session list        PDU会话列表
>>PDU session ID      PDU会话标识
>>NCC for UP      (用于生成目标用户面基础密钥)
上述所有参数都将根据实际情况存在或不存在。特别地，NCC for CP和NCC for UP为相同值时，只需要提供一个NCC。
若第一安全算法或第二安全算法是PDU会话粒度的，S408和S409中发给UE的信息可以在RRC消息中例如包含以下形式的信息：
>Target Cell ID              目标小区标识
>carrier Freq               频点信息
>NCC for CP     (用于生成目标控制面基础密钥)
>PDU session list     PDU会话列表
>>PDU session ID PDU会话标识
>>NCCfor UP     (用于生成目标用户面基础密钥)
>第一安全算法
>>加密算法(还可能区分控制面和用户面)
>>完整性保护算法(还可能区分控制面和用户面)
>>密钥推演算法(大概率不存在)
>第二安全算法
>>加密算法(还可能区分控制面和用户面)
>>完整性保护算法(还可能区分控制面和用户面)
>>密钥推演算法(大概率不存在)
上述所有参数都将根据实际情况存在或不存在，可选的，NCC for CP和NCC for UP为相同值时，只需要提供一个NCC。
S410、UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理。
本实施例中，通过第一基站将目标控制面基础密钥、至少一个PDU会话标识和至 少一个PDU会话标识分别对应的目标用户面基础密钥发送给第二基站，第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，从而第二基站使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理，从而实现了源基站切换到目标切换基站过程中密钥的推演和交互。
进一步地，第一基站与UE之间建立PDU会话之后，在DC场景下，此时用户面密钥如何推演，图13为本申请提供的另一种数据安全处理方法实施例的流程图，如图13所示，本实施例的方法在图11所示方法的基础上，还可以包括：
S404’、第一基站根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一对应，用户面基础密钥是PDU会话建立时核心网发送的。
S405’、第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥。
其中，第一基站为主基站，第二基站为辅基站，第二参数包括SCG计数器和PDU会话标识中至少一个。特别地，第一基站还将发送PDU会话粒度或者DRB粒度或者QoS flow粒度的用户面完整性保护是否开启的指示。所述指示还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。
S406’、第二基站根据目标用户面基础密钥推演目标用户面密钥，使用目标用户面密钥和目标第二安全算法对PDU会话标识对应的用户面数据进行安全处理。
其中所述目标第二安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择目标第二安全算法。
其中，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
为使UE侧能与第二基站之间进行用户面数据的安全认证，进一步地，在S405’之后，还可以包括：
S407’、第二基站根据第一基站发送的UE安全能力信息为UE选择目标第二安全算法并发送给第一基站。
S408’、第一基站将目标第二安全算法发送给UE，第一基站将第二参数发送给UE。
S409’、UE根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标用户面基础密钥推演目标用户面密钥，使用目标用户面密钥和目标第二安全算法对PDU会话标识对应的用户面数据进行安全处理。
为使UE侧能与第二基站之间进行控制面数据的安全认证，进一步地，在S405’之后，还可以包括：
S410’、第一基站根据控制面基础密钥和第一参数推演目标控制面基础密钥，第一基站向第二基站发送目标控制面基础密钥。
其中，第一参数包括SCG计数器。例如NR网络中，双连接DC扩展为辅基站也可以发送RRC消息，此时辅基站也需要根据基础密钥或者控制面基础密钥推演控制面密钥。
S411’、第二基站根据目标控制面基础密钥推演目标控制面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理。
其中所述目标第一安全算法是第二基站根据第一基站发送的UE安全能力信息为UE选择目标第一安全算法。
S412’、第二基站根据第一基站发送的UE安全能力信息为UE选择目标第一安全算法并发送给第一基站。
S413’、第一基站将目标第一安全算法发送给UE，第一基站将第一参数发送给UE。
S414’、UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理。
进一步地，还包括：第一基站向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，第二基站根据该指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。第一基站发送的用户面完整性保护是否开启的指示可以是PDU会话粒度，DRB粒度或者QoS flow粒度的。所述指示还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。
本实施例中，通过第一基站向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，第二基站根据目标用户面基础密钥推演目标用户面密钥，从而第二基站使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理，从而实现了DC场景下密钥的推演和交互。
图14为本申请提供的一种数据安全处理方法实施例的交互流程图，如图14所示，本实施例中，基站包括CU和DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，CU-DU分离场景下，本实施例的方法可以包括：
S501、建立PDU会话，控制面CU接收核心网发送的用户面基础密钥。
S502、控制面CU根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
S503、用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。其中安全算法包括加密算法和完整性保护算法。控制面安全算法和用户面安全算法可能相同，也可能不相同。当控制面安全算法和用户面安全算法不同时，上述安全算法即为用户面安全算法。当不同PDU会话标识的对应的用户面安全算法不同时，上述安全算法即为所述PDU会话标识对应的用户面安全算法。此处的安全算法是控制面CU根据自身安全能力和UE安全能力信息选择的安全算法。也可能是用户面CU预先将自身支持的用户面安全算法发送给控制面CU，控制面CU根据用户面CU支持的用户面安全算法和UE安全算法能力，选择合适的安全算法。
特别地，控制面CU还可能将DRB粒度或者QoS flow粒度的用户面完整性保护是否开启指示发送给用户面CU。比如控制面CU将PDU1的用户面完整性保护密钥发送给用户面CU，同时给出DRB例如或QoS flow粒度的用户面完整性保护是否开启的指示，用户面据此决策是否对所述DRB标识或QoS flow标识对应的用户面数据进行完整性保护。所述指示还可以扩展为控制面加密，控制面完整性保护，用户面面加密， 用户面完整性保护是否开启的指示。
本实施例中，通过控制面CU接收核心网发送的用户面基础密钥，控制面CU根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
图15为本申请提供的一种数据安全处理方法实施例的流程图，如图15所示，本实施例中，基站包括CU和DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，CU-DU分离场景下，本实施例的方法可以包括：
S601、建立PDU会话，控制面CU接收核心网发送的用户面基础密钥。
S602、控制面CU将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU。
S603、用户面CU根据用户面基础密钥推演用户面密钥，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
S604、用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。其中安全算法的获取同步骤S503。
进一步地，还包括：
控制面CU向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示。特别地，控制面CU还将发送DRB粒度或者QoS flow粒度的用户面完整性保护是否开启的指示。所述指示还可以扩展为控制面加密，控制面完整性保护，用户面面加密，用户面完整性保护是否开启的指示。
用户面CU根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
可选的，还包括：控制面CU将根据UE安全能力信息选择的安全算法发送给用户面CU。
此处的安全算法是控制面CU根据自身安全算法能力和UE安全算法能力选择的安全算法。也可能是用户间CU事先将自身支持的用户面安全算法发送给控制面CU，控制面CU根据用户面CU支持的用户面安全算法和UE安全算法能力，选择合适的安全算法。用户面CU使用用户面密钥和安全算法对用户面数据进行安全处理。
本实施例中，通过控制面CU接收核心网发送的用户面基础密钥，控制面CU将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU，用户面CU根据用户面基础密钥推演用户面密钥，最后用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。从而提高了CP-UP分离场景下数据传输的安全性。
图16为本申请提供的另一种数据安全处理方法实施例的流程图，如图16所示，本实施例中，在图11所示方法的基础上，在RRC重建立场景下，UE发生无线链路失败后，发起RRC重建立流程，本实施例的方法还可以包括：
S411～S412，S411～S412的具体执行过程与图10所示的S108～S109相同，技术效果也相同，可参见S108～S109的具体描述，此处不再赘述。
图17为本申请提供的基站实施例的结构示意图，如图17所示，本实施例的基站 可以包括：密钥推演模块11和处理模块12，其中，密钥推演模块11用于在建立第一协议数据单元PDU会话时，根据接收到的基础密钥推演第一用户面密钥，处理模块12用于使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理。密钥推演模块11还用于在建立第二PDU会话时，根据基础密钥推演第二用户面密钥，处理模块12还用于使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
可选的，密钥推演模块11具体用于：根据基础密钥和第一参数推演第一用户面密钥，第一参数为第一PDU会话标识；根据基础密钥和第二参数推演第二用户面密钥，第二参数为第二PDU会话标识。
本实施例的装置，可以用于执行图6所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图18为本申请提供的基站实施例的结构示意图，如图18所示，本实施例的基站在图17所示基站结构的基础上，进一步地，还可以包括：发送模块13，发送模块13用于向第二基站发送目标基础密钥和至少一个PDU会话标识，用于第二基站根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，目标基础密钥是密钥推演模块根据基础密钥和第三参数推演的。
可选的，发送模块13还用于：向第二基站发送目标基础密钥和至少一个PDU会话标识之后，将目标安全算法发送给用户设备UE，目标安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的，将第三参数和至少一个PDU会话标识发送给UE，用于UE根据自身的基础密钥和第三参数推演目标基础密钥，再根据目标基础密钥和至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用PDU会话标识对应的用户面密钥和目标安全算法对PDU会话中的用户面数据进行安全处理。
可选的，本实施例的基站为源基站，第二基站为目标切换基站，第三参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个。
可选的，本实施例的基站为主基站，第二基站为辅基站，第三参数包括辅小区组SCG计数器。
可选的，发送模块13还用于：向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
进一步地，基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，密钥推演模块11具体用于：控制控制面CU根据基础密钥和第一参数推演第一用户面密钥，并将第一参数和第一参数对应的第一用户面密钥发送给用户面CU。
密钥推演模块11具体用于：控制控制面CU根据基础密钥和第二参数推演第二用户面密钥，并将第二参数和第二参数对应的第二用户面密钥发送给用户面CU。
进一步地，基站包括集中式单元CU和分布式单元DU，CU包括控制面CU和用户面CU，控制面CU与用户面CU通过通信接口相连，密钥推演模块11具体用于：控制控制面CU将基础密钥和第一参数发送给用户面CU，用户面CU根据基础密钥和 第一参数推演第一用户面密钥；
密钥推演模块11具体用于：控制控制面CU将基础密钥和第二参数发送给用户面CU，用户面CU根据基础密钥和第二参数推演第二用户面密钥。
可选的，密钥推演模块11还用于：控制控制面CU向用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；控制用户面CU根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
可选的，处理模块12用于：控制控制面CU向用户面CU发送安全算法；
处理模块用于：控制用户面CU使用第一用户面密钥和安全算法对第一PDU会话中的用户面数据进行安全处理；
处理模块12用于：控制用户面CU使用第二用户面密钥和安全算法对第二PDU会话中的用户面数据进行安全处理。
本实施例的装置，可以用于执行图7～图9任一个所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图19为本申请提供的基站实施例的结构示意图，如图19所示，本实施例的基站在图17所示基站结构的基础上，进一步地，还可以包括：第一接收模块14，第一接收模块14用于接收UE发送的无线资源控制RRC重建立消息或RRC恢复消息，RRC重建立消息或RRC恢复消息中包括UE标识、原小区标识、shortMAC-I、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个。处理模块12还用于：根据UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和UE发送的shortMAC-I进行对比判断校验是否成功。
本实施例的装置，可以用于执行图10或图16所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图20为本申请提供的基站实施例的结构示意图，如图20所示，本实施例的基站在图17所示基站结构的基础上，进一步地，还可以包括：第二接收模块15，第二接收模块15用于接收核心网发送的第一PDU会话标识和第一PDU会话标识对应的用户面完整性保护是否开启的指示，处理模块12还用于：根据指示确定是否推演第一PDU会话标识对应的用户面完整性保护密钥，第二接收模块15还用于：接收核心网发送的第二PDU会话标识和第二PDU会话标识对应的用户面完整性保护是否开启的指示，处理模块12还用于：根据指示确定是否推演第二PDU会话标识对应的用户面完整性保护密钥。
图21为本申请提供的基站实施例的结构示意图，如图21所示，本实施例的基站可以包括：发送模块21和推演模块22，发送模块21用于向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，目标控制面密钥包括：控制面加密密钥和/或控制面完整性保护密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。推演模块22用于根据控制面基础密钥和第一参数推演目标控制面基础密钥，根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一 对应，控制面基础密钥是首次建立PDU会话时核心网发送的，用户面基础密钥是PDU会话建立时核心网发送的。
可选的，发送模块21还用于：向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，将目标第一安全算法和目标第二安全算法发送给用户设备UE，目标第一安全算法和目标第二安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；
将第一参数和第二参数发送给UE，用于UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理，使用目标用户面密钥和目标第二安全算法对PDU会话中的用户面数据进行安全处理。
其中，可选的，本实施例的基站为源基站，第二基站为目标切换基站，第一参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个，第二参数包括NCC、目标小区标识、PDU会话标识和频点信息中的至少一个。
可选的，发送模块21还用于：向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据该指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
本实施例的装置，可以用于执行图12所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图22为本申请提供的基站实施例的结构示意图，如图22所示，本实施例的基站可以包括：发送模块31和推演模块32，发送模块31用于向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥，用于第二基站根据目标用户面基础密钥推演目标用户面密钥，目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。推演模块32用于根据用户面基础密钥和第二参数推演目标用户面基础密钥，第二参数与PDU会话标识一一对应，用户面基础密钥是PDU会话建立时核心网发送的。
可选的，发送模块31还用于：向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥之后，将目标第二安全算法发送给用户设备UE，目标第二安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第二参数发送给UE，用于UE根据自身的用户面基础密钥和第二参数推演目标用户面基础密钥，再根据目标用户面基础密钥推演目标用户面密钥，使用目标用户面密钥和目标第二安全算法对PDU会话标识对应的用户面数据进行安全处理。
可选的，发送模块31还用于：向第二基站发送至少一个PDU会话标识和至少一个PDU会话标识分别对应的目标用户面基础密钥时，向第二基站发送目标控制面基础密钥，用于第二基站根据目标控制面基础密钥推演目标控制面密钥，目标控制面基础密钥是基站根据控制面基础密钥和第一参数推演的。
可选的，发送模块31还用于：向第二基站发送目标控制面基础密钥之后，将目标 第一安全算法发送给UE，目标第一安全算法是第二基站根据基站发送的UE安全能力信息为UE选择并发送给基站的；将第一参数发送给UE，用于UE根据自身的控制面基础密钥和第一参数推演目标控制面基础密钥，再根据目标控制面基础密钥推演目标控制面密钥，使用目标控制面密钥和目标第一安全算法对控制面数据进行安全处理。
其中，本实施例的基站为主基站，第二基站为辅基站，第一参数包括SCG计数器，第二参数包括SCG计数器和PDU会话标识。
可选的，发送模块31还用于：向第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于第二基站根据该指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
本实施例的装置，可以用于执行图13所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图23为本申请提供的基站实施例的结构示意图，如图23所示，本实施例的基站包括CU41和DU42，CU包括控制面CU411和用户面CU412，控制面CU411与用户面CU412通过通信接口相连，控制面CU411用于：在建立PDU会话时，接收核心网发送的用户面基础密钥；根据用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU412，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥，用户面CU412用于：使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。
本实施例的装置，可以用于执行图14所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图24为本申请提供的基站实施例的结构示意图，如图24所示，本实施例的基站包括CU51和DU52，CU包括控制面CU511和用户面CU512，控制面CU511与用户面CU512通过通信接口相连，控制面CU511用于：在建立PDU会话时，接收核心网发送的用户面基础密钥；将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU512。
用户面CU512用于：根据用户面基础密钥推演用户面密钥，用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理。
可选的，控制面CU511还用于：向用户面CU512发送PDU会话标识对应的用户面完整性保护是否开启的指示，用户面CU512还用于：根据指示确定是否推演PDU会话标识对应的用户面完整性保护密钥。
可选的，控制面CU511还用于：将根据用户设备UE安全能力信息选择的安全算法发送给用户面CU512。
本实施例的装置，可以用于执行图15所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图25为本申请提供的一种基站结构示意图，该基站700包括：存储器701、处理器702和收发器703，存储器701、所述处理器702以及所述收发器703通过总线704相通信。
收发器702用于所述基站与外部进行数据收发，存储器701存储有程序指令，处 理器通过调用所述存储器中存储的程序指令，以进行如图6～图16任一个实施例所示的方法在基站的操作。具体可以参见前面方法实施例中的相关描述。
本申请还提供一种系统芯片，应用于基站，系统芯片包括：输入输出接口，至少一个处理器，存储器，以及总线；所述输入输出接口、所述至少一个处理器和所述存储器通过总线相通信，所述存储器存储有程序指令，所述输入输出接口用于所述系统芯片与外部的数据收发；所述至少一个处理器通过调用所述存储器中存储的程序指令，以进行如图6～图16任一个实施例所示的方法在基站的操作。具体可以参见前面方法实施例中的相关描述。
本申请还提供一种程序产品，应用于基站，计算机程序产品包括指令，当所述指令被计算装置执行时，以进行如图6～图16任一个实施例所示的方法在基站的操作。
本申请还提供一种可读存储介质，应用于基站，计算机可读存储介质存储有指令，当所述指令被计算装置执行时，以进行如图6～图16任一个实施例所示的方法在基站的操作。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (30)

  1. 一种数据安全处理方法，其特征在于，包括：
    建立第一协议数据单元PDU会话，第一基站根据接收到的基础密钥推演第一用户面密钥，所述第一基站使用所述第一用户面密钥和安全算法对所述第一PDU会话中的用户面数据进行安全处理；
    建立第二PDU会话，所述第一基站根据所述基础密钥推演第二用户面密钥，所述第一基站使用所述第二用户面密钥和所述安全算法对所述第二PDU会话中的用户面数据进行安全处理；
    所述用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述第一基站根据接收到的基础密钥推演第一用户面密钥，包括：
    所述第一基站根据所述基础密钥和第一参数推演所述第一用户面密钥，所述第一参数为第一PDU会话标识；
    所述第一基站根据所述基础密钥推演第二用户面密钥，包括：
    所述第一基站根据所述基础密钥和第二参数推演所述第二用户面密钥，所述第二参数为第二PDU会话标识。
  3. 根据权利要求2所述的方法，其特征在于，还包括：
    所述第一基站向第二基站发送目标基础密钥和至少一个PDU会话标识，用于所述第二基站根据所述目标基础密钥和所述至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，所述目标基础密钥是所述第一基站根据所述基础密钥和第三参数推演的。
  4. 根据权利要求3所述的方法，其特征在于，所述第一基站向第二基站发送目标基础密钥和至少一个PDU会话标识之后，还包括：
    所述第一基站将目标安全算法发送给用户设备UE，所述目标安全算法是所述第二基站根据所述第一基站发送的UE安全能力信息为所述UE选择并发送给所述第一基站的；
    所述第一基站将所述第三参数和至少一个PDU会话标识发送给所述UE，用于所述UE根据自身的基础密钥和所述第三参数推演所述目标基础密钥，再根据所述目标基础密钥和所述至少一个PDU会话标识推演PDU会话标识对应的用户面密钥，再使用所述PDU会话标识对应的用户面密钥和所述目标安全算法对所述PDU会话中的用户面数据进行安全处理。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一基站为源基站，所述第二基站为目标切换基站，所述第三参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个。
  6. 根据权利要求3或4所述的方法，其特征在于，所述第一基站为主基站，所述第二基站为辅基站，所述第三参数包括辅小区组SCG计数器。
  7. 根据权利要求4所述的方法，其特征在于，还包括：
    所述第一基站向所述第二基站发送PDU会话标识对应的用户面完整性保护是否 开启的指示，用于所述第二基站根据所述指示确定是否推演所述PDU会话标识对应的用户面完整性保护密钥。
  8. 根据权利要求2所述的方法，其特征在于，所述第一基站包括集中式单元CU和分布式单元DU，所述CU包括控制面CU和用户面CU，所述控制面CU与所述用户面CU通过通信接口相连，所述第一基站根据所述基础密钥和第一参数推演所述第一用户面密钥，包括：
    所述控制面CU根据所述基础密钥和所述第一参数推演所述第一用户面密钥，并将所述第一参数和所述第一参数对应的第一用户面密钥发送给所述用户面CU；
    所述第一基站根据所述基础密钥和第二参数推演所述第二用户面密钥，包括：
    所述控制面CU根据所述基础密钥和所述第二参数推演所述第二用户面密钥，并将所述第二参数和所述第二参数对应的第二用户面密钥发送给所述用户面CU。
  9. 根据权利要求2所述的方法，其特征在于，所述第一基站包括集中式单元CU和分布式单元DU，所述CU包括控制面CU和用户面CU，所述控制面CU与所述用户面CU通过通信接口相连，所述第一基站根据所述基础密钥和第一参数推演所述第一用户面密钥，包括：
    所述控制面CU将所述基础密钥和所述第一参数发送给所述用户面CU，所述用户面CU根据所述基础密钥和所述第一参数推演所述第一用户面密钥；
    所述第一基站根据所述基础密钥和第二参数推演所述第二用户面密钥，包括：
    所述控制面CU将所述基础密钥和所述第二参数发送给所述用户面CU，所述用户面CU根据所述基础密钥和所述第二参数推演所述第二用户面密钥。
  10. 根据权利要求9所述的方法，其特征在于，还包括：
    所述控制面CU向所述用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；
    所述用户面CU根据所述指示确定是否推演所述PDU会话标识对应的用户面完整性保护密钥。
  11. 根据权利要求8或9所述的方法，其特征在于，还包括：
    所述控制面CU向所述用户面CU发送所述安全算法；
    所述第一基站使用所述第一用户面密钥和安全算法对所述第一PDU会话中的用户面数据进行安全处理，包括：
    所述用户面CU使用所述第一用户面密钥和所述安全算法对所述第一PDU会话中的用户面数据进行安全处理；
    所述第一基站使用所述第二用户面密钥和所述安全算法对所述第二PDU会话中的用户面数据进行安全处理，包括：
    所述用户面CU使用所述第二用户面密钥和所述安全算法对所述第二PDU会话中的用户面数据进行安全处理。
  12. 根据权利要求1或2所述的方法，其特征在于，还包括：
    所述第一基站接收UE发送的无线资源控制RRC重建立消息或RRC恢复消息，所述RRC重建立消息或RRC恢复消息中包括UE标识、原小区标识、校验码shortMAC-I、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个；
    所述第一基站根据所述UE标识、原小区标识、控制面CU指示或用户面CU指示和PDU会话标识中的至少一个生成shortMAC-I，并将生成的shortMAC-I和所述UE发送的shortMAC-I进行对比判断校验是否成功。
  13. 根据权利要求1所述的方法，其特征在于，还包括：
    所述第一基站接收核心网发送的所述第一PDU会话标识和所述第一PDU会话标识对应的用户面完整性保护是否开启的指示；
    所述第一基站根据所述指示确定是否推演所述第一PDU会话标识对应的用户面完整性保护密钥；
    所述第一基站接收核心网发送的所述第二PDU会话标识和所述第二PDU会话标识对应的用户面完整性保护是否开启的指示；
    所述第一基站根据所述指示确定是否推演所述第二PDU会话标识对应的用户面完整性保护密钥。
  14. 一种数据安全处理方法，其特征在于，包括：
    第一基站向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和所述至少一个PDU会话标识分别对应的目标用户面基础密钥，用于所述第二基站根据所述目标控制面基础密钥推演目标控制面密钥，根据目标用户面基础密钥推演目标用户面密钥，所述目标控制面密钥包括：控制面加密密钥和/或控制面完整性保护密钥，所述目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
    所述目标控制面基础密钥是所述第一基站根据控制面基础密钥和第一参数推演的，所述目标用户面基础密钥是所述第一基站根据用户面基础密钥和第二参数推演的，所述第二参数与PDU会话标识一一对应，所述控制面基础密钥是首次建立PDU会话时核心网发送的，所述用户面基础密钥是PDU会话建立时核心网发送的。
  15. 根据权利要求14所述的方法，其特征在于，所述第一基站向第二基站发送目标控制面基础密钥、至少一个PDU会话标识和所述至少一个PDU会话标识分别对应的目标用户面基础密钥之后，还包括：
    所述第一基站将目标第一安全算法和目标第二安全算法发送给用户设备UE，所述目标第一安全算法和所述目标第二安全算法是所述第二基站根据所述第一基站发送的UE安全能力信息为所述UE选择并发送给所述第一基站的；
    所述第一基站将所述第一参数和所述第二参数发送给所述UE，用于所述UE根据自身的控制面基础密钥和所述第一参数推演所述目标控制面基础密钥，根据自身的用户面基础密钥和所述第二参数推演所述目标用户面基础密钥，再根据所述目标控制面基础密钥推演目标控制面密钥，根据所述目标用户面基础密钥推演目标用户面密钥，使用所述目标控制面密钥和所述目标第一安全算法对控制面数据进行安全处理，使用所述目标用户面密钥和所述目标第二安全算法对所述PDU会话中的用户面数据进行安全处理。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第一基站为源基站，所述第二基站为目标切换基站，所述第一参数包括下一跳链接计数器NCC、目标小区标识和频点信息中的至少一个，所述第二参数包括NCC、目标小区标识、PDU会话标识和频点信息中的至少一个。
  17. 一种数据安全处理方法，其特征在于，包括：
    第一基站向第二基站发送至少一个PDU会话标识和所述至少一个PDU会话标识分别对应的目标用户面基础密钥，用于所述第二基站根据所述目标用户面基础密钥推演目标用户面密钥，所述目标用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
    所述目标用户面基础密钥是所述第一基站根据所述用户面基础密钥和第二参数推演的，所述第二参数与PDU会话标识一一对应，所述用户面基础密钥是PDU会话建立时核心网发送的。
  18. 根据权利要求17所述的方法，其特征在于，所述第一基站向第二基站发送至少一个PDU会话标识和所述至少一个PDU会话标识分别对应的目标用户面基础密钥之后，还包括：
    所述第一基站将目标第二安全算法发送给用户设备UE，所述目标第二安全算法是所述第二基站根据所述第一基站发送的UE安全能力信息为所述UE选择并发送给所述第一基站的；
    所述第一基站将所述第二参数发送给所述UE，用于所述UE根据自身的用户面基础密钥和所述第二参数推演所述目标用户面基础密钥，再根据所述目标用户面基础密钥推演目标用户面密钥，使用所述目标用户面密钥和所述目标第二安全算法对所述PDU会话标识对应的用户面数据进行安全处理。
  19. 根据权利要求18所述的方法，其特征在于，所述第一基站向第二基站发送至少一个PDU会话标识和所述至少一个PDU会话标识分别对应的目标用户面基础密钥时，还包括：
    所述第一基站向所述第二基站发送目标控制面基础密钥，用于所述第二基站根据所述目标控制面基础密钥推演目标控制面密钥，所述目标控制面基础密钥是所述第一基站根据所述控制面基础密钥和第一参数推演的。
  20. 根据权利要求19所述的方法，其特征在于，所述第一基站向所述第二基站发送目标控制面基础密钥之后，还包括：
    所述第一基站将目标第一安全算法发送给UE，所述目标第一安全算法是所述第二基站根据所述第一基站发送的UE安全能力信息为所述UE选择并发送给所述第一基站的；
    所述第一基站将所述第一参数发送给所述UE，用于所述UE根据自身的控制面基础密钥和所述第一参数推演所述目标控制面基础密钥，再根据所述目标控制面基础密钥推演目标控制面密钥，使用所述目标控制面密钥和所述目标第一安全算法对控制面数据进行安全处理。
  21. 根据权利要求19或20所述的方法，其特征在于，所述第一基站为主基站，所述第二基站为辅基站，所述第一参数包括辅小区组SCG计数器，所述第二参数包括SCG计数器和PDU会话标识。
  22. 根据权利要求14或17所述的方法，其特征在于，还包括：
    所述第一基站向所述第二基站发送PDU会话标识对应的用户面完整性保护是否开启的指示，用于所述第二基站根据所述指示确定是否推演所述PDU会话标识对应的 用户面完整性保护密钥。
  23. 一种数据安全处理方法，其特征在于，用于基站，所述基站包括包括集中式单元CU和分布式单元DU，所述CU包括控制面CU和用户面CU，所述控制面CU与所述用户面CU通过通信接口相连，所述方法包括：
    建立PDU会话，所述控制面CU接收核心网发送的用户面基础密钥；
    所述控制面CU根据所述用户面基础密钥推演用户面密钥，将PDU会话标识和PDU会话标识对应的用户面密钥发送给用户面CU，所述用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
    所述用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理；
    其中，所述控制面CU与所述用户面CU通过通信接口相连。
  24. 一种数据安全处理方法，其特征在于，用于基站，所述基站包括包括集中式单元CU和分布式单元DU，所述CU包括控制面CU和用户面CU，所述控制面CU与所述用户面CU通过通信接口相连，所述方法包括：
    建立PDU会话，所述控制面CU接收核心网发送的用户面基础密钥；
    所述控制面CU将PDU会话标识和PDU会话标识对应的用户面基础密钥发送给用户面CU；
    所述用户面CU根据所述用户面基础密钥推演用户面密钥，所述用户面密钥包括：用户面加密密钥和/或用户面完整性保护密钥；
    所述用户面CU使用PDU会话标识对应的用户面密钥和安全算法对PDU会话中的用户面数据进行安全处理；
    其中，所述控制面CU与所述用户面CU通过通信接口相连。
  25. 根据权利要求24所述的方法，其特征在于，还包括：
    所述控制面CU向所述用户面CU发送PDU会话标识对应的用户面完整性保护是否开启的指示；
    所述用户面CU根据所述指示确定是否推演所述PDU会话标识对应的用户面完整性保护密钥。
  26. 根据权利要求25所述的方法，其特征在于，还包括：
    所述控制面CU将根据用户设备UE安全能力信息选择的安全算法发送给所述用户面CU。
  27. 一种基站，其特征在于，包括：存储器、处理器和收发器，所述存储器、所述处理器以及所述收发器通过总线相通信；
    所述收发器用于所述基站与外部进行数据收发；
    所述存储器存储有程序指令；
    所述处理器通过调用所述存储器中存储的程序指令，以进行如权利要求1～13、权利要求14～16、权利要求17～22、权利要求23或权利要求24～26任一项所述的方法在基站的操作。
  28. 一种系统芯片，应用于基站，所述系统芯片包括：输入输出接口，至少一个处理器，存储器，以及总线；
    所述输入输出接口、所述至少一个处理器和所述存储器通过总线相通信，所述存储器存储有程序指令，所述输入输出接口用于所述系统芯片与外部的数据收发；
    所述至少一个处理器通过调用所述存储器中存储的程序指令，以进行如权利要求1～13、权利要求14～16、权利要求17～22、权利要求23或权利要求24～26任一项所述的方法在基站的操作。
  29. 一种计算机程序产品，应用于基站，其特征在于，所述计算机程序产品包括指令，当所述指令被计算装置执行时，以进行如权利要求1～13、权利要求14～16、权利要求17～22、权利要求23或权利要求24～26任一项所述的方法在基站的操作。
  30. 一种计算机可读存储介质，应用于基站，其特征在于，所述计算机可读存储介质存储有指令，当所述指令被计算装置执行时，以进行如权利要求1～13、权利要求14～16、权利要求17～22、权利要求23或权利要求24～26任一项所述的方法在基站的操作。
PCT/CN2018/108657 2017-09-29 2018-09-29 数据安全处理方法及装置 WO2019062920A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18862074.4A EP3567797B1 (en) 2017-09-29 2018-09-29 Data security processing method and apparatus
US16/576,121 US11510059B2 (en) 2017-09-29 2019-09-19 Data security processing method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710910826.5A CN109586900B (zh) 2017-09-29 2017-09-29 数据安全处理方法及装置
CN201710910826.5 2017-09-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/576,121 Continuation US11510059B2 (en) 2017-09-29 2019-09-19 Data security processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2019062920A1 true WO2019062920A1 (zh) 2019-04-04

Family

ID=65902520

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/108657 WO2019062920A1 (zh) 2017-09-29 2018-09-29 数据安全处理方法及装置

Country Status (4)

Country Link
US (1) US11510059B2 (zh)
EP (1) EP3567797B1 (zh)
CN (1) CN109586900B (zh)
WO (1) WO2019062920A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4016949A4 (en) * 2019-08-18 2022-08-10 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND DEVICE

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110366177B (zh) 2013-12-24 2022-06-14 日本电气株式会社 通信系统中的主基站、辅基站和用户设备及其通信方法
CN110167018B (zh) * 2018-02-11 2021-12-10 华为技术有限公司 一种安全保护的方法、装置及接入网设备
US11057766B2 (en) * 2018-11-01 2021-07-06 Nokia Technologies Oy Security management in disaggregated base station in communication system
CN111866857B (zh) * 2019-04-28 2022-03-08 华为技术有限公司 通信方法及其装置
CN112087816B (zh) * 2019-06-14 2023-05-16 华为技术有限公司 安全激活状态确定方法及相关产品
CN114365522A (zh) * 2019-09-27 2022-04-15 华为技术有限公司 数据安全处理的方法和通信装置
CN113795024A (zh) * 2020-05-26 2021-12-14 华为技术有限公司 一种获取密钥的方法及装置
CN113766497B (zh) * 2020-06-01 2023-03-21 中国电信股份有限公司 密钥分发方法、装置、计算机可读存储介质及基站
EP4238337A1 (en) * 2020-10-29 2023-09-06 Apple Inc. User plane integrity protection configuration in en-dc
EP4274282A4 (en) * 2021-01-30 2024-01-10 Huawei Tech Co Ltd METHOD, APPARATUS AND SYSTEM FOR OBTAINING SECURITY PARAMETERS
US11689975B2 (en) * 2021-06-17 2023-06-27 Qualcomm Incorporated Enhanced reestablishment procedure in integrated access and backhaul nodes
CN115696319A (zh) * 2021-07-27 2023-02-03 华为技术有限公司 一种通信方法及装置
US11902260B2 (en) * 2021-08-02 2024-02-13 Cisco Technology, Inc. Securing control/user plane traffic
CN113872752B (zh) * 2021-09-07 2023-10-13 哲库科技(北京)有限公司 安全引擎模组、安全引擎装置和通信设备
CN115884173A (zh) * 2021-09-28 2023-03-31 华为技术有限公司 一种通信方法及装置
CN116074814A (zh) * 2021-10-30 2023-05-05 华为技术有限公司 通信方法和装置
CN117062055A (zh) * 2022-05-06 2023-11-14 华为技术有限公司 安全保护方法及通信装置

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110305339A1 (en) * 2010-06-11 2011-12-15 Karl Norrman Key Establishment for Relay Node in a Wireless Communication System
CN103929740A (zh) * 2013-01-15 2014-07-16 中兴通讯股份有限公司 数据安全传输方法及lte接入网系统
CN104185177A (zh) * 2013-05-27 2014-12-03 中兴通讯股份有限公司 一种安全密钥管理方法、装置和系统
CN104937964A (zh) * 2013-01-17 2015-09-23 日本电气株式会社 用户面与控制面分离的蜂窝系统中的安全通信
US20170013454A1 (en) * 2015-07-12 2017-01-12 Qualcomm Incorporated Network architecture and security with encrypted network reachability contexts
US20170208516A1 (en) * 2016-01-20 2017-07-20 Qualcomm Incorporated Techniques for providing uplink-based mobility
CN106998537A (zh) * 2016-01-25 2017-08-01 展讯通信（上海）有限公司 组呼业务的信息传输方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102612029B (zh) * 2011-01-19 2015-09-30 华为技术有限公司 认证方法和认证设备
ES2890499T3 (es) 2013-09-11 2022-01-20 Samsung Electronics Co Ltd Procedimiento y sistema para posibilitar una comunicación segura para una transmisión inter-eNB
CN113676972A (zh) * 2016-08-10 2021-11-19 日本电气株式会社 无线接入网节点及其方法
WO2018174887A1 (en) * 2017-03-23 2018-09-27 Nokia Technologies Oy Tunnel flow control
US10681072B2 (en) * 2017-08-31 2020-06-09 Blackberry Limited Method and system for user plane traffic characteristics and network security

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110305339A1 (en) * 2010-06-11 2011-12-15 Karl Norrman Key Establishment for Relay Node in a Wireless Communication System
CN103929740A (zh) * 2013-01-15 2014-07-16 中兴通讯股份有限公司 数据安全传输方法及lte接入网系统
CN104937964A (zh) * 2013-01-17 2015-09-23 日本电气株式会社 用户面与控制面分离的蜂窝系统中的安全通信
CN104185177A (zh) * 2013-05-27 2014-12-03 中兴通讯股份有限公司 一种安全密钥管理方法、装置和系统
US20170013454A1 (en) * 2015-07-12 2017-01-12 Qualcomm Incorporated Network architecture and security with encrypted network reachability contexts
US20170208516A1 (en) * 2016-01-20 2017-07-20 Qualcomm Incorporated Techniques for providing uplink-based mobility
CN106998537A (zh) * 2016-01-25 2017-08-01 展讯通信（上海）有限公司 组呼业务的信息传输方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3567797A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4016949A4 (en) * 2019-08-18 2022-08-10 Huawei Technologies Co., Ltd. COMMUNICATION METHOD AND DEVICE

Also Published As

Publication number Publication date
CN109586900A (zh) 2019-04-05
CN109586900B (zh) 2020-08-07
EP3567797B1 (en) 2022-08-10
US20200015088A1 (en) 2020-01-09
US11510059B2 (en) 2022-11-22
EP3567797A1 (en) 2019-11-13
EP3567797A4 (en) 2020-02-12

Similar Documents

Publication Publication Date Title
US11510059B2 (en) Data security processing method and apparatus
US10812256B2 (en) Method, apparatus, and system for performing an establishment of a security context between user equipment and an access node
CN109309920B (zh) 安全实现方法、相关装置以及系统
US9049594B2 (en) Method and device for key generation
CN109246697B (zh) 基站、用户设备及其执行的方法
US11483705B2 (en) Method and device for generating access stratum key in communications system
US20170359719A1 (en) Key generation method, device, and system
WO2019062996A1 (zh) 一种安全保护的方法、装置和系统
US20160219025A1 (en) Security key generation for simultaneous multiple cell connections for mobile device
WO2018227638A1 (zh) 通信方法和装置
WO2012171281A1 (zh) 一种安全参数修改方法及基站
CN113170369A (zh) 用于在系统间改变期间的安全上下文处理的方法和装置
WO2021073382A1 (zh) 注册方法及装置
CN110830996B (zh) 一种密钥更新方法、网络设备及终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18862074

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018862074

Country of ref document: EP

Effective date: 20190807

NENP Non-entry into the national phase

Ref country code: DE