WO2019062996A1 - 一种安全保护的方法、装置和系统 - Google Patents

一种安全保护的方法、装置和系统 Download PDF

Info

Publication number
WO2019062996A1
WO2019062996A1 PCT/CN2018/108904 CN2018108904W WO2019062996A1 WO 2019062996 A1 WO2019062996 A1 WO 2019062996A1 CN 2018108904 W CN2018108904 W CN 2018108904W WO 2019062996 A1 WO2019062996 A1 WO 2019062996A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
security policy
access network
network device
protection
Prior art date
Application number
PCT/CN2018/108904
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to AU2018339744A priority Critical patent/AU2018339744B2/en
Priority to JP2020518431A priority patent/JP7074847B2/ja
Priority to KR1020207012357A priority patent/KR102347524B1/ko
Priority to EP22211583.4A priority patent/EP4221082A3/en
Priority to BR112020006242-1A priority patent/BR112020006242A2/pt
Priority to EP18860710.5A priority patent/EP3684024B1/en
Publication of WO2019062996A1 publication Critical patent/WO2019062996A1/zh
Priority to US16/731,994 priority patent/US10952106B2/en
Priority to US17/190,740 priority patent/US11589274B2/en
Priority to US18/171,198 priority patent/US20230284103A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0016—Hand-off preparation specially adapted for end-to-end data sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
    • H04W8/08—Mobility data transfer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W80/00—Wireless network protocols or protocol adaptations to wireless operation
    • H04W80/08—Upper layer protocols
    • H04W80/10—Upper layer protocols adapted for application session management, e.g. SIP [Session Initiation Protocol]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved

Definitions

  • the present application relates to the field of wireless communications technologies, and in particular, to a method, apparatus, and system for security protection.
  • the original base station initiates a handover procedure of the terminal, and the terminal The serving base station is handed over from the original base station to the target base station, and the target base station continues to support the ongoing service of the terminal.
  • the handover request sent by the original base station to the target base station includes the security capability of the terminal and the key of the base station in the terminal handover process (kye in evloved NodeB, KeNB*).
  • the target base station may determine a signaling plane encryption algorithm, a signaling plane integrity protection algorithm, and a user plane encryption algorithm according to the received security capability of the terminal and the KeNB*, and the target base station separately generates a signaling plane encryption key and a signaling plane. Integrity protection key and user plane encryption key.
  • the target base station sends a handover command message to the terminal through the original base station, where the handover command message carries the signaling plane encryption algorithm, the signaling plane integrity protection algorithm, and the user plane encryption algorithm determined by the target base station.
  • the terminal generates a signaling plane encryption algorithm, a signaling plane integrity protection algorithm, and a user plane encryption algorithm according to the algorithm carried in the handover command message, and then the terminal uses the signaling plane encryption algorithm and the signaling plane integrity protection algorithm to confirm the handover.
  • the message is encrypted and the encrypted handover confirmation message is sent to the target base station.
  • the target base station determines the signaling plane encryption algorithm, the signaling plane integrity protection algorithm, and the user plane encryption algorithm, which will increase the target base station.
  • the overhead and will increase the time for the target base station to prepare for terminal handover, thereby reducing the handover efficiency of the terminal.
  • the embodiments of the present application provide a method, an apparatus, and a system for security protection, which can solve the problem that the terminal switching service base station is inefficient.
  • an embodiment of the present application provides a method for security protection, where the method includes: receiving, by a first access network device, a correspondence between user plane information and a security policy from a second access network device, and then first receiving The network access device determines the first user plane protection algorithm corresponding to the user plane information according to the correspondence between the user plane information and the security policy.
  • the first user plane protection algorithm includes one or all of the user plane encryption algorithm and the user plane integrity protection algorithm.
  • the first access network device may only determine the user plane protection algorithm, and does not need to enable signaling plane protection, thereby saving network overhead. Further, if the scenario is applied to the terminal handover, the time for the first access network device to prepare for the terminal handover can be reduced, thereby improving the handover efficiency of the terminal.
  • the user plane information may include any one or more of a PDU session identifier, a QoS parameter, and a slice parameter.
  • the representation of the correspondence between the user plane information and the security policy may be a combination of user plane information and a security policy having a corresponding relationship.
  • the multiple user plane information can correspond to multiple security policies through a corresponding relationship.
  • the user plane information in the correspondence between a set of user plane information and the security policy includes a PDU session identifier and a QoS parameter
  • the security policy includes the security policy 1 and the security policy.
  • a user plane information corresponds to a security policy through a correspondence, for example, a correspondence between a set of user plane information and a security policy is a combination of a QoS parameter and a security policy.
  • User plane integrity protection using user plane encryption algorithm No. 2 for user plane encryption protection.
  • the solution of the embodiment of the present application may be applied to the process of the terminal switching the serving base station, where the first access network device may be a TgNB, and the second access network device may be a SgNB, in a process of the terminal switching the serving base station,
  • the first access network device can only determine the user plane protection algorithm, does not need to enable signaling plane protection, saves network overhead, and reduces the time for the first access network to prepare for terminal handover, thereby improving the handover efficiency of the terminal.
  • the first access network device determines that the first user plane protection algorithm is a signaling plane protection algorithm.
  • the first access network device determines a signaling plane protection algorithm
  • the signaling plane protection algorithm includes one or all of a signaling plane encryption algorithm and a signaling plane integrity protection algorithm.
  • the first access network device sends the first indication information to the terminal by using the second access network device, where the first indication information is used to indicate that the first user plane protection algorithm is the same as the signaling plane protection algorithm; Or the first indication information is used to indicate the signaling plane protection algorithm identifier determined by the first access network device.
  • the first access network device after determining the signaling plane protection algorithm, notifies the signaling plane protection algorithm that is available to the terminal, so that the terminal can open the signaling plane security protection in time, and secure the signaling plane message. Protection ensures the security of the signaling plane message.
  • the security policy is used to indicate the type of security protection that is enabled, and the security protection type includes one or all of user plane encryption protection and user plane integrity protection; the first access network device according to user plane information and security
  • the method for determining the first user plane protection algorithm corresponding to the user plane information is that the first access network device determines the first user plane protection algorithm corresponding to the security protection type that the security policy indicates.
  • Each security protection type corresponds to a set of algorithms.
  • the first access network device stores a user plane encryption algorithm set, a user plane integrity protection algorithm set, and the first access network device does not distinguish between a user plane encryption algorithm and a signaling plane encryption algorithm.
  • the user plane integrity protection algorithm and the signaling plane integrity protection algorithm are not distinguished, that is, the user plane encryption algorithm set can also be used as a signaling plane encryption algorithm set, and the user plane integrity protection algorithm set can also be used as a signaling plane integrity protection algorithm. set.
  • Another implementation manner is: the first access network device distinguishes the user plane encryption algorithm and the signaling plane encryption algorithm, and distinguishes the user plane integrity protection algorithm and the signaling plane integrity protection algorithm, and the first access network device stores the user.
  • a set of surface encryption algorithms, a set of user plane integrity protection algorithms, a set of signaling plane encryption algorithms, and a set of signaling plane integrity protection algorithms may all exist in the form of a priority list, and the algorithms in the priority list are arranged in descending order of priority.
  • the security policy includes a user plane protection algorithm identifier; and the method for determining, by the first access network device, the user plane protection algorithm according to the correspondence between the user plane information and the security policy is: An access network device determines a second user plane protection algorithm corresponding to the user plane protection algorithm identifier; if the first access network device and the terminal both support the second user plane protection algorithm, the first access network device determines the second user plane
  • the protection algorithm is a first user plane protection algorithm; or if the first access network device and the terminal do not support the second user plane protection algorithm, the first access network device belongs to the second user plane protection algorithm.
  • the first user plane protection algorithm supported by the first access network device and the terminal is selected in the security algorithm set corresponding to the security protection type.
  • the security algorithm set corresponding to the security protection type may exist in the form of a priority list, and the algorithms in the priority list are arranged in descending order of priority.
  • the first access network device may further receive the security capability of the terminal from the second access network device, where the security capability of the terminal includes a user plane protection algorithm supported by the terminal, and the first access network device may be the second In the security algorithm set corresponding to the security protection type to which the user plane protection algorithm belongs, the user plane protection algorithm with the highest priority supported by the terminal is selected.
  • the first access network device generates a user plane protection key according to the first user plane protection algorithm, and the user plane protection key includes one of a user plane encryption key and a user plane integrity protection key or All.
  • the first access network device generates a signaling plane protection key according to the signaling plane protection algorithm, and the signaling plane protection key includes a signaling plane encryption key and a signaling plane integrity protection. One or all of the keys.
  • the first access network device sends, by using the second access network device, a first message that is protected by a user plane integrity protection key or a signaling plane integrity protection key to the terminal, where The first user plane protection algorithm is included in a message.
  • the first message may further include a signaling plane protection algorithm.
  • the first access network device receives the second message protected by the user plane protection key or protected by the signaling plane protection key, and the second message is a response message of the first message. .
  • the method further includes: the first access network device sends a correspondence between the user plane information and the security policy to the access and mobility management function AMF node, and then the first access network device receives the AMF from the AMF.
  • the embodiment of the present application provides a solution, where the first access network device can verify the currently used security policy to obtain a security policy that adapts to the resource condition of the first access network device, if the second access network device is attacked by the attacker. And sending a security policy for lowering the security level to the first access network device, so that the security level of the user plane protection algorithm determined by the first access network device according to the security policy is lower, so that the user plane is used.
  • the information protected by the protection algorithm can be easily cracked. Therefore, the first access network device can use the security policy delivered by the AMF node to avoid this vulnerability and further improve security.
  • an embodiment of the present application provides a method for security protection, where the method includes: acquiring, by a second access network device, a correspondence between user plane information and a security policy, where the second access network device is to the first access network The device sends the correspondence between user plane information and security policy.
  • an embodiment of the present application provides a method for security protection, the method comprising: an access and mobility management function, an AMF node receiving user plane information from a second access network device, and then an AMF node to a session management function
  • the SMF node sends the user plane information
  • the AMF node receives the security policy corresponding to the user plane information from the SMF node
  • the AMF node sends the security policy corresponding to the user plane information to the first access network device.
  • the second access network device may trigger the AMF node and the SMF node to be the second access.
  • the network device provides a correspondence between the user plane information and the security policy, so that the terminal can switch to the second access network device.
  • an embodiment of the present application provides a method for security protection, the method comprising: a session management function SMF node receiving user plane information from an access and mobility management function AMF node, and an SMF node determining the user plane information And corresponding to the security policy, the SMF node sends the security policy corresponding to the user plane information to the first access network device by using the AMF node.
  • An embodiment of the present application provides a security policy for an SMF node to be a resource condition of a first access network device by using an AMF node, if the second access network device is attacked by an attacker, and a security policy for lowering the security level is sent.
  • the first access network device is configured such that the user plane protection algorithm determined by the first access network device according to the security policy has a lower security level, so that information protected by the user plane protection algorithm can be easily cracked. Therefore, the first access network device can use the security policy delivered by the AMF node to avoid this vulnerability and further improve security.
  • an embodiment of the present application provides a device, which has a function of implementing behavior of a first access network device in the foregoing method design.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device may be the first access network device or may be a chip in the first access network device.
  • the device is a first access network device, and the first access network device includes a processor configured to support the first access network device to perform a corresponding function in the above method. Further, the first access network device may further include a communication interface, where the communication interface is configured to support communication between the first access network device and the second access network device or the AMF node. Further, the first access network device may further include a transceiver, where the transceiver is configured to support communication between the first access network device and the terminal. Further, the first access network device may further include a memory for coupling with the processor, which stores necessary program instructions and data of the first access network device.
  • an embodiment of the present application provides a device, where the device has a function of implementing behavior of a second access network device in the foregoing method design.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a second access network device or can be a chip in the second access network device.
  • the device is a second access network device
  • the second access network device includes a processor configured to support the second access network device to perform a corresponding function in the above method.
  • the second access network device may further include a communication interface, a transmitter, and a receiver, where the communication interface is configured to support communication between the second access network device and the first access network or the AMF node, the transmitter And a receiver is used to support communication between the second access network device and the terminal.
  • the second access network device may further include a transceiver, where the transceiver is configured to support communication between the second access network device and the terminal.
  • the second access network device may further include a memory for coupling with the processor, which stores necessary program instructions and data of the second access network device.
  • an embodiment of the present application provides a device, which has a function of implementing an AMF node behavior in a method design.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be an AMF node or can be a chip in an AMF node.
  • the device is an AMF node
  • the AMF node includes a processor configured to support the AMF node to perform the corresponding functions in the above methods.
  • the AMF node may further include a communication interface for supporting communication between the AMF node and the first access network device, the second access network device, or the SMF node.
  • the AMF node can also include a memory for coupling with the processor that holds the necessary program instructions and data for the AMF node.
  • an embodiment of the present application provides a device, which has a function of implementing behavior of an SMF node in the design of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be an SMF node or can be a chip in an SMF node.
  • the device is an SMF node
  • the SMF node includes a processor configured to support the SMF node to perform the corresponding functions in the above methods.
  • the SMF node may further include a communication interface for supporting communication between the SMF node and the AMF node.
  • the SMF node may further include a memory for coupling with the processor, which stores necessary program instructions and data of the SMF node.
  • an embodiment of the present application provides a device, which has a function of implementing terminal behavior in the design of the foregoing method.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a terminal or can be a chip in the terminal.
  • the device is a terminal, and the terminal includes a processor configured to support the terminal to perform a corresponding function in the above method. Further, the terminal may further include a transmitter and a receiver for supporting communication between the terminal and the access network device. Further, the terminal may further include a memory for coupling with the processor, which stores program instructions and data necessary for the terminal.
  • the ninth aspect the embodiment of the present application provides a communication system, where the system includes the first access network device and the second access network device, and the system includes the first access in the foregoing aspect.
  • a network device, a second access network device, and an AMF node or the system includes the first access network device, the second access network device, the AMF node, and the SMF node described in the foregoing aspects; or, the system includes the foregoing aspects The first access network device, the second access network device, the AMF node, the SMF node, and the terminal.
  • the embodiment of the present application provides a computer storage medium for storing the computer software instructions used for the first access network device, which includes a program designed to perform the foregoing aspects.
  • the embodiment of the present application provides a computer storage medium for storing the computer software instructions for the second access network device, which includes a program designed to perform the above aspects.
  • the embodiment of the present application provides a computer storage medium for storing the computer software instructions used for the AMF node, which includes a program designed to perform the above aspects.
  • the embodiment of the present application provides a computer storage medium for storing the computer software instructions used by the SMF node, which includes a program designed to perform the above aspects.
  • the embodiment of the present application provides a computer storage medium for storing the above computer software instructions for a terminal, which includes a program designed to execute the above aspects.
  • an embodiment of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the first aspect described above.
  • an embodiment of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the second aspect described above.
  • an embodiment of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the third aspect described above.
  • an embodiment of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the method of the fourth aspect described above.
  • embodiments of the present application provide a chip system for use in a first access network device, the chip system including at least one processor, a memory and an interface circuit, the memory, the transceiver, and The at least one processor is interconnected by a line, the at least one memory storing instructions; the instructions being executed by the processor to perform the first access network device of the method of the first aspect described above operating.
  • an embodiment of the present application provides a chip system, which is applied to a second access network device, where the chip system includes at least one processor, a memory and an interface circuit, the memory, the transceiver, and The at least one processor is interconnected by a line, the at least one memory storing instructions; the instructions being executed by the processor to perform the second access network device of the method of the second aspect above operating.
  • an embodiment of the present application provides a chip system for use in an AMF node, the chip system including at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least A processor is interconnected by a line, the at least one memory storing instructions; the instructions being executed by the processor to perform the operations of the AMF node in the method of the third aspect above.
  • an embodiment of the present application provides a chip system for use in an SMF node, the chip system including at least one processor, a memory and an interface circuit, the memory, the transceiver, and the at least A processor is interconnected by a line, the at least one memory storing instructions; the instructions being executed by the processor to perform the operations of the SMF node in the method of the third aspect above.
  • the first access network device in the process of the terminal handover, can only determine the user plane protection algorithm, and does not need to enable signaling plane protection, thereby saving network overhead and reducing The time when the first access network device prepares for the terminal handover, thereby improving the handover efficiency of the terminal.
  • FIG. 1 is a schematic diagram of a possible network architecture provided by an embodiment of the present application
  • FIG. 3 is a flowchart of another method for security protection provided by an embodiment of the present application.
  • FIG. 5 is a flowchart of another method for security protection provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of another method for security protection according to an embodiment of the present application.
  • FIG. 7 is a flowchart of another method for security protection provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of another method for security protection according to an embodiment of the present application.
  • FIG. 9 is a flowchart of another method for security protection provided by an embodiment of the present application.
  • FIG. 10 is a schematic block diagram of an apparatus according to an embodiment of the present application.
  • Figure 11 is a schematic block diagram of another apparatus provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of an access network device according to an embodiment of the present application.
  • FIG. 13 is a schematic block diagram of another apparatus provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of an AMF node according to an embodiment of the present application.
  • Figure 15 is a schematic block diagram of another apparatus provided by an embodiment of the present application.
  • 16 is a schematic structural diagram of an SMF node according to an embodiment of the present application.
  • Figure 17 is a schematic block diagram of another apparatus provided by an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a terminal according to an embodiment of the present application.
  • FIG. 1 is a schematic diagram of a possible network architecture of the present application, where the network architecture includes:
  • Access and mobility management function (AMF) node a network element responsible for mobility management, which can be used to implement mobility management entity (MME) functions other than session management.
  • MME mobility management entity
  • Session management function (SMF) node used to allocate session resources for user planes.
  • the authentication server function (AUSF) node When the AUSF authenticates the terminal, it is responsible for verifying the authenticity of the parameters to be authenticated and the authentication terminal.
  • the main functions include: receiving an authentication request sent by a security anchor function (SEAF) node; and selecting an authentication method.
  • SEAF security anchor function
  • the SEAF node is part of the AMF node at this stage, and is mainly responsible for initiating an authentication request to the AUSF, and completing the authentication of the terminal by the network side in the EPS-AKA* authentication process.
  • User plane function (UPF) node is the exit of user plane data and is used to connect to the external network.
  • DN A network used to provide external data, such as the Internet (Internet).
  • (radio) access network (R) AN node can adopt different access technologies.
  • 3rd generation partnership project (3GPP) access technology such as wireless access technology used in 3G, 4G or 5G systems
  • non-third generation cooperation None 3rd generation partnership project (non-3GPP) access technology.
  • the 3GPP access technology refers to an access technology conforming to the 3GPP standard specification, and the access network adopting the 3GPP access technology is called a radio access network (RAN), wherein the access network device in the 5G system is called a next-generation base station node. (next generation node basestation, gNB).
  • the non-3GPP access technology refers to an access technology that does not conform to the 3GPP standard specification, for example, an air interface technology represented by a wifi access point (AP).
  • AP wifi access point
  • the terminal referred to in this application is a device with wireless transceiver function, which can be deployed on land, indoors or outdoors, handheld or on-board; it can also be deployed on the water surface (such as ships); it can also be deployed in In the air (such as airplanes, balloons, satellites, etc.).
  • the terminal may include various types of user equipment (UE), mobile phone, tablet, wireless transceiver computer, wireless data card, virtual reality (VR) terminal device.
  • UE user equipment
  • mobile phone tablet
  • wireless transceiver computer wireless data card
  • VR virtual reality
  • AR augmented reality
  • MTC machine type communication
  • industrial control industrial control
  • self-driving terminal equipment remote Terminal equipment in medical (remote medical)
  • remote Terminal equipment in medical remote Terminal equipment in smart grid
  • terminal equipment in transport safety terminal equipment in smart city
  • wearable devices such as smart Watches, smart bracelets, pedometers, etc.
  • the names of terminals having similar wireless communication functions may be different.
  • the devices having the wireless communication function are collectively referred to as terminals. .
  • the terminal in the present application stores a long-term key and a correlation function, and when the terminal performs bidirectional authentication with a core network node (such as an AMF node, an AUSF node, etc.), the long-term key and the correlation function may be used to verify the network. Authenticity.
  • a core network node such as an AMF node, an AUSF node, etc.
  • the access network device involved in the embodiment of the present application is a device deployed in a wireless access network to provide a wireless communication function for a terminal.
  • the access network device may be a base station (BS), and the base station may include various forms of macro base stations, micro base stations, relay stations, access points, and the like.
  • the names of devices with base station functions may be different, for example, in 5G systems, called next-generation base station nodes, in Long Term Evolution (LTE) systems. It is called an evolved NodeB (eNB or eNodeB), and is called a Node B or the like in a 3rd Generation (3G) communication system.
  • eNB evolved NodeB
  • 3G 3rd Generation
  • Network exposure function (NEF) node It is mainly used to interact with third parties, so that third parties can interact with network elements inside certain 3GPP networks indirectly.
  • Network function repository function (NRF) node used for network element discovery and network function (NF).
  • PCF node The PCF node stores the latest quality of service (QoS) rules.
  • QoS quality of service
  • the base station can allocate appropriate resources for the user plane transmission channel according to the QoS rules provided by the SMF node.
  • Unified data management (UDM) node used to store user subscription information.
  • the AF node can be located inside the DN and belongs to a functional network element deployed on a third party.
  • the primary function of this network element is to inform the PCF node of the latest third-party enterprise's service requirements for an application.
  • the PCF node can generate corresponding QoS rules according to the service requirements, and ensure that the services provided by the network meet the requirements put forward by the third party.
  • the target base station determines the signaling plane encryption algorithm, the signaling plane integrity protection, and the user plane encryption algorithm, that is, the target base station simultaneously opens the user plane.
  • Security protection and signaling plane security protection That is, in the process of the terminal switching the serving base station, whether the signaling plane security protection is required, the target base station will enable the signaling plane security protection, determine the signaling plane encryption algorithm and the signaling plane integrity protection algorithm, and increase the network overhead. And increasing the time for the target base station to prepare for terminal handover, resulting in lower handover efficiency of the terminal.
  • the decoupling between the opening process of the user plane security protection and the opening process of the signaling plane security protection may be implemented, that is, the user plane security protection algorithm may be first enabled, when needed When the signaling plane is protected, the signaling plane security protection is enabled, so that the network overhead of the signaling plane security protection is omitted in the handover process of the terminal, thereby improving the switching efficiency of the terminal.
  • the first access network device may be a RAN node, for example, may be a next generation base station node in a 5G system.
  • the first access network device may be a target next generation node base station (TgNB).
  • TgNB target next generation node base station
  • the second access network device may be a RAN node, for example, may be a next-generation base station node in the 5G system.
  • the second access network device may be the original Source next generation node basestation (SgNB).
  • SgNB Source next generation node basestation
  • an embodiment of the present application provides a method for security protection, the method comprising: steps 201-203.
  • Step 201 The second access network device acquires a correspondence between the user plane information and the security policy.
  • the user plane information may include a packet data unit (PDU) session identifier, a quality of service (QoS) parameter (such as a quality of service flow identifier (QFI)), and data.
  • PDU packet data unit
  • QoS quality of service
  • QFI quality of service flow identifier
  • DRB data radio bearer
  • slice parameter such as a slice identifier
  • the security policy is used to indicate the type of the user plane security protection that is enabled or the user plane protection algorithm identifier that is recommended to be opened.
  • the security protection type includes one or all of the user plane encryption protection and the user plane integrity protection.
  • the user plane algorithm identifier may be The user plane encryption algorithm identifier and the user plane integrity protection algorithm identifier may be carried by one or more user plane algorithm identifiers, for example, at least one user plane encryption algorithm identifier may be carried, or at least An integrity protection algorithm identifier, or carrying at least one user plane encryption algorithm identifier and at least one user plane integrity protection algorithm identifier.
  • the representation of the correspondence between the user plane information and the security policy may be a combination of user plane information and a security policy having a corresponding relationship, and such a combination may be referred to as a correspondence between a group of user plane information and a security policy.
  • the user plane information may correspond to multiple security policies by using a corresponding relationship, for example, the user plane information in the correspondence between the user plane information and the security policy includes a PDU session identifier, and the security policy includes the security policy 1 and the security policy 2 It can be understood that one PDU session identifier corresponds to two security policies at the same time.
  • the user plane information in the correspondence between the user plane information and the security policy includes a DRB identifier
  • the security policy includes the security policy 1 and the security policy 2.
  • a user plane information corresponds to a security policy through a correspondence
  • a correspondence between a set of user plane information and a security policy is a combination of a PDU session identifier and a security policy.
  • the correspondence between a set of user plane information and a security policy is a combination of a DRB identifier and a security policy.
  • the correspondence between multiple sets of user plane information and security policies is a plurality of sets of correspondences, for example, one set is a combination of PDU session identifier and QoS parameters and security policy 1 and security policy 2, and the other set is QoS parameters and security policies.
  • the second access network device determines whether to acquire a group or a plurality of sets of user plane information and a security policy according to the configuration information of the network side.
  • the combination of the user plane information and the security policy is used as an example for the combination of the PDU session identifier and the security policy.
  • the second access network device only obtains a combination of a set of PDU session identifiers and security policies; When there are multiple sessions, the second access network device needs to obtain a combination of each PDU session identifier and security policy that needs to be switched; or the second access network device obtains all the saved data according to the network side configuration information. A combination of PDU session identification and security policy.
  • the second access network device may obtain only one security policy, and the security policy applies to all user plane information.
  • the security policy corresponding to the QoS flow is enabled for user plane encryption protection, and user plane integrity protection is enabled.
  • the corresponding security policy is to enable user plane encryption protection, and the user plane is not enabled. Integrity protection.
  • the corresponding security policy is to enable user plane encryption protection, and the user plane integrity is not enabled. protection.
  • user plane integrity protection is enabled.
  • the recommended algorithm may also be used to identify the user plane protection algorithm identifier that is indicated by the security policy indication.
  • User plane integrity protection using user plane encryption algorithm No. 2 for user plane encryption protection.
  • User plane integrity protection is implemented.
  • the user plane integrity protection algorithm is used for user plane integrity protection.
  • the user plane encryption algorithm is recommended for user plane encryption protection.
  • the user plane encryption algorithm is recommended.
  • Sexual protection using the No. 2 user plane encryption algorithm for user plane encryption protection.
  • the No. 2 user plane encryption algorithm encrypts the user plane data.
  • the "1111” is an indication that is used to indicate that the protection is not enabled. If the location of the user plane information and the security policy is carried, the location of the user plane encryption algorithm identifier is "1111". The user plane encryption algorithm, if the location of the user plane integrity protection algorithm identifier is “1111”, means that the user plane integrity protection algorithm is not enabled. Note that the present invention uses “1111” as an example, and other indications of similar functions are within the scope of the present invention.
  • Step 202 The second access network device sends a correspondence between the user plane information and the security policy to the first access network device.
  • the first access network device receives the correspondence between the user plane information and the security policy from the second access network device.
  • the second access network device may send the correspondence between the user plane information and the security policy obtained in step 201 to the first access network device.
  • the second access network device may send the correspondence between the one or more sets of user plane information and the security policy to the first access network device.
  • the number of groups of the correspondence between the user plane information and the security policy sent by the second access network device is the same as the number of groups of the correspondence between the user plane information and the security policy acquired by the second access network device in step 201.
  • the second access network device may only send a security policy to the first access network device, and the security policy applies to all user plane information related to the terminal.
  • Step 203 The first access network device determines a first user plane protection algorithm corresponding to the user plane information according to the correspondence between the user plane information and the security policy.
  • the first user plane protection algorithm includes one or all of a user plane encryption algorithm and a user plane integrity protection algorithm.
  • the first access network device determines that each of the security policy indications is enabled.
  • each security protection type corresponds to a set of algorithms.
  • the first access network device stores a user plane encryption algorithm set, a user plane integrity protection algorithm set, and the first access network device does not distinguish between a user plane encryption algorithm and a signaling plane encryption algorithm.
  • the user plane integrity protection algorithm and the signaling plane integrity protection algorithm are not distinguished, that is, the user plane encryption algorithm set can also be used as a signaling plane encryption algorithm set, and the user plane integrity protection algorithm set can also be used as a signaling plane integrity protection algorithm. set.
  • Another implementation manner is: the first access network device distinguishes the user plane encryption algorithm and the signaling plane encryption algorithm, and distinguishes the user plane integrity protection algorithm and the signaling plane integrity protection algorithm, and the first access network device stores the user.
  • each algorithm set described above may exist in the form of a priority list.
  • the user plane encryption algorithm set may be a priority list, and the users in the priority list. Face encryption algorithms are arranged in order of priority from highest to lowest.
  • the first access network device selects an encryption algorithm from the user plane encryption algorithm set, and optionally, selects a terminal supported from the user plane encryption algorithm set.
  • the user plane encryption algorithm with the highest priority for example, the terminal supports the user plane encryption algorithm 1 and the user plane encryption algorithm 3.
  • the priority of the user plane encryption algorithm 1 is higher than the user plane encryption algorithm 3, then the first An access network device selects the user plane encryption algorithm 1.
  • the first access network device selects a user plane integrity protection algorithm from the set of user plane integrity protection algorithms, optionally, from the user plane integrity Selecting the highest priority user plane integrity protection algorithm supported by the terminal in the set of sexual algorithms, for example, the terminal supports the user plane integrity protection algorithm 1 and the user plane integrity protection algorithm 3, and the user plane in the user plane integrity protection algorithm set
  • the integrity protection algorithm 1 has a higher priority than the user plane integrity protection algorithm 3, and the first access network device selects the user plane integrity protection algorithm 1.
  • the first access network device selects a user plane encryption algorithm from the user plane encryption algorithm set, from the user plane integrity protection set. Select a user plane integrity protection algorithm.
  • the first access network device determines that the PDU session identifier is 1
  • the session opens the user plane encryption protection and the user plane integrity protection, and the first access network device selects the user plane encryption algorithm with the highest priority supported by the terminal from the set of user plane encryption algorithms, and selects from the set of user plane integrity protection algorithms.
  • step 203 may be specifically implemented as:
  • the first access network device determines that the second user plane protection algorithm is the first user plane protection algorithm
  • the first access network device selects the terminal from the security algorithm set corresponding to the security protection type to which the second user plane protection algorithm belongs.
  • the first user plane protection algorithm with the highest priority is supported.
  • the recommended user plane protection algorithm identifier is more than one, the above steps are repeated, and the first user plane protection algorithm is determined according to each recommended user plane protection algorithm identifier.
  • the security policy includes the user plane protection algorithm identifier, the type of security protection that is turned on is also implicitly indicated.
  • the first access network device determines that the PDU needs to be a PDU.
  • User session integrity protection and user plane encryption protection are enabled for sessions with session ID 1.
  • the first access network device determines whether the No. 1 user plane integrity protection algorithm satisfies the following conditions:
  • User plane integrity protection algorithm No. 1 is a user plane integrity protection algorithm supported by the first access network device and the terminal, and the user plane integrity protection algorithm of No. 1 is the user plane integrity of the first access network device.
  • the user plane integrity protection algorithm with the highest priority supported by the terminal Exemplarily, if the terminal supports the user plane integrity protection algorithms No. 1 and No. 3, both algorithms are in the set of user plane integrity protection algorithms, and the integrity of the user plane 1 is in the set of user plane integrity protection algorithms.
  • the priority of the protection algorithm is higher than the priority of the user plane integrity protection algorithm No. 3, and the user plane integrity protection algorithm No. 1 is considered to satisfy the condition 2.
  • the user plane integrity protection algorithm No. 1 If the No. 1 user plane integrity protection algorithm satisfies condition 1 or satisfies condition 2, the user plane integrity protection algorithm No. 1 is used. If the user plane integrity protection algorithm No. 1 does not satisfy the condition 1 or does not satisfy the condition 2, the first The access network device selects the user plane integrity algorithm with the highest priority supported by the terminal from the set of user plane integrity protection algorithms.
  • the first access network device can also determine whether the No. 2 user plane encryption algorithm satisfies the following conditions:
  • User plane encryption algorithm No. 2 is a user plane encryption algorithm supported by both the first access network device and the terminal.
  • User plane encryption algorithm No. 2 is a user plane encryption algorithm supported by the first access network device and the terminal, and the user plane encryption algorithm No. 2 is a user plane encryption algorithm set of the first access network device, and the terminal supports The highest priority user plane encryption algorithm.
  • the terminal supports the user plane encryption algorithms of No. 2 and No. 3, both algorithms are in the user plane encryption algorithm set, and the priority of the No. 2 user plane encryption algorithm is higher than that in the user plane encryption algorithm set.
  • the priority of the user plane encryption algorithm is considered to satisfy the condition 2 of the user plane encryption algorithm No. 2.
  • the No. 2 user plane encryption algorithm satisfies Condition 3 or Condition 4
  • the No. 2 user plane encryption algorithm is used. If the No. 2 user plane encryption algorithm does not satisfy the condition 3 or does not satisfy the condition 4, the first access network device is from the user plane. The user plane encryption algorithm with the highest priority supported by the terminal is selected in the encryption algorithm set.
  • the first access network device determines that the PDU needs to be a PDU.
  • User session encryption protection is enabled for sessions with session ID 1. There is no need to enable user plane integrity protection.
  • the first access network device only needs to determine the user plane encryption algorithm according to the above method, and does not need to determine the user plane integrity protection algorithm.
  • the first access network device may ignore the specific content of the received security policy, and the first access network device may determine to be enabled according to the pre-configured security policy.
  • Type of security protection may be used.
  • the pre-configured security policy indicates that user plane encryption protection is enabled, and the user plane is not enabled.
  • the first access network device enables user plane encryption protection according to the pre-configured security policy, and selects the user plane encryption algorithm with the highest priority supported by the first access network device and the terminal from the set of user plane encryption algorithms.
  • the first access network device needs to separately determine the first user plane protection algorithm corresponding to each group of user plane information.
  • the first access network device may only determine the user plane protection algorithm, and does not need to enable signaling plane protection, thereby saving network overhead, thereby improving handover efficiency of the terminal.
  • the first access network device determines, according to the correspondence between the user plane information and the security policy, the first user plane protection algorithm corresponding to the user plane information, that is, In step 203, the first access network device only determines the protection algorithm of the user plane, and the protection algorithm of the signaling plane is not determined.
  • the first access network device may determine, according to the correspondence between the user plane information and the security policy, the first user plane protection algorithm corresponding to the user plane information. And determining that the first user plane protection algorithm is a signaling plane protection algorithm. That is, in step 203, the first access network device determines a set of security protection algorithms, both as a user plane protection algorithm and as a signaling plane protection algorithm.
  • the first user plane algorithm is one of a user plane encryption algorithm and a user plane integrity protection algorithm
  • the determined first user plane algorithm is used as a signaling plane algorithm, and another type of information is further determined. Face protection algorithm.
  • the first user plane algorithm is a user plane encryption algorithm
  • the user plane encryption algorithm is used as a signaling plane encryption algorithm
  • the signaling plane integrity protection algorithm needs to be further determined.
  • the determining method is a set of signaling plane integrity protection algorithms pre-configured by the first access network device according to the security capability of the terminal (ie, the signaling plane integrity protection algorithm supported by the terminal) and the second access network device (with priority ordering)
  • the user plane integrity protection algorithm list determines the signaling plane integrity protection algorithm.
  • the first access network device may determine a signaling plane protection algorithm before determining the first user plane protection algorithm, that is, the first access network device may first determine a signaling plane protection algorithm, and determine signaling. After the face protection algorithm, it is determined whether the signaling plane protection algorithm can be used as the first user plane protection algorithm.
  • the first access network device may determine a signaling plane protection algorithm before sending the signaling plane message, as shown in FIG. 3, where FIG. 3 determines the first
  • the user plane protection algorithm determines the signaling plane protection algorithm as an example.
  • the method includes: steps 301-309.
  • Steps 301 to 303 may refer to the related descriptions in the foregoing steps 201 to 203. Of course, the application is not limited thereto.
  • the user plane protection key is also generated, that is, step 304 is performed.
  • Step 304 The first access network device generates a user plane protection key according to the first user plane protection algorithm.
  • the user plane protection key includes one or all of a user plane encryption key and a user plane integrity protection key.
  • the user plane protection key only includes the user plane encryption key; if the first access network device only determines the user plane integrity protection algorithm, The user plane protection key only includes the user plane integrity protection key; if the first access network device determines both the user plane encryption algorithm and the user plane integrity protection algorithm, the user plane protection key includes both the user and the user The face encryption key, which in turn includes the user plane integrity protection key.
  • the embodiment of the present application does not limit the step 304 to be performed before the step 305.
  • the step 304 may be performed when the user plane data needs to be sent. Generate a user plane protection key to secure user plane data.
  • Step 305 The first access network device determines a signaling plane protection algorithm.
  • the signaling plane protection algorithm includes one or all of a signaling plane encryption algorithm and a signaling plane integrity protection algorithm.
  • the triggering timing of step 305 includes the following:
  • the first type is triggered when the first access network device needs to send a signaling plane message, for example, when the first access network device needs to send a configuration message to the terminal device.
  • step 304 may be triggered after the first access network device sends the user plane data.
  • the suspend state refers to: in this state, the terminal and the base station maintain part of the AS context, such as the generated key and the determined algorithm.
  • the fourth type is triggered after the first access network device receives the uplink signaling plane data sent by the terminal, for example, after the terminal initiates the PDU session request.
  • Step 306 The first access network device generates a signaling plane protection key according to the signaling plane protection algorithm.
  • the signaling plane protection key includes one or all of a signaling plane encryption algorithm and a signaling plane integrity protection algorithm.
  • the signaling plane protection key only includes the signaling plane encryption key; optionally, if the first access network The device only determines the signaling plane integrity protection algorithm, and the signaling plane protection key only includes the signaling plane integrity protection key; optionally, if the first access network device determines the signaling plane encryption algorithm, The signaling plane integrity protection algorithm is further determined, and the signaling plane protection key includes both a signaling plane encryption key and a signaling plane integrity protection key.
  • Step 307 The first access network device sends, by using the second access network device, the first message that is protected by the user plane integrity protection key or protected by the signaling plane integrity protection key.
  • the first message includes a first user plane protection algorithm.
  • the first message further includes a signaling plane protection algorithm.
  • step 307 may be performed before step 305.
  • the order of execution between steps 305, 306 and step 307 is not limited in this application.
  • the first access network device may perform integrity protection on the first message by using a user plane integrity protection key; or the first access network device may complete the first message by using a user plane integrity protection key.
  • sexual protection or, if the first access network device generates both the user plane integrity protection key and the signaling plane integrity protection key, the first access network device can preferentially use the signaling plane integrity protection.
  • the key protects the integrity of the first message.
  • the first access network device may generate a random number, encrypt the random number by using a user plane encryption key, and carry the encrypted random number in the first message and send to the terminal At the same time, the unencrypted random number is sent to the terminal.
  • the signaling plane integrity protection key is generated, and the security policy received by the first access network device indicates that the user plane integrity protection is not enabled, the signaling plane integrity protection key is used. Complete protection of the first message.
  • the first access network device may use the user plane integrity protection key to perform the first message. Integrity protection, optionally, a random number may also be generated, and the random number encrypted by the user plane encryption key is carried in the first message and sent to the terminal, and the unencrypted random number is sent to the terminal.
  • the first message may carry the first indication information, where the first indication information is used to indicate that the first user plane protection algorithm is the same as the signaling plane protection algorithm, and is specifically used to indicate that the reuse signaling plane protection algorithm is the first user. a face protection algorithm; further, after receiving the correspondence between the user plane information and the security policy, the first access network device first determines a signaling plane encryption algorithm and a signaling plane integrity protection algorithm, and then decides to reuse according to the security policy. Which signaling plane protection algorithm is the user plane protection algorithm. or,
  • the first indication information is used to indicate the signaling plane protection algorithm identifier determined by the first access network device.
  • the first indication information may not be carried in the first message, and the first access network device may send a dedicated message to the terminal by using the second access network device, where the dedicated message carries the first indication information.
  • the method for determining a signaling plane protection key the first access network device needs to send the first indication information to the terminal, to notify the terminal that the first access network device
  • the signaling plane protection algorithm used enables the terminal to decrypt the message protected by the signaling plane.
  • Step 308 The terminal receives the first message.
  • the terminal may read the first user plane protection algorithm in the first message. If the first user plane protection algorithm includes a user plane integrity protection algorithm, the terminal generates a user according to the user plane integrity protection algorithm.
  • the face integrity protection key is used to verify the user plane integrity of the first message by using the user plane integrity protection key. If the verification fails, the handover process is not continued, or step 309 is performed.
  • the terminal may generate a user plane encryption key according to the user plane encryption algorithm, optionally using a user plane encryption key pair.
  • the random number in the first message is decrypted, and the decrypted random number is compared with the received unencrypted random number. If the comparison result is that the two random numbers are different, the switching process is not continued, or step 309 is performed. .
  • the terminal If the first message carries the signaling plane protection algorithm and uses the signaling plane integrity protection key for integrity protection, the terminal generates a signaling plane integrity protection key according to the signaling plane integrity protection algorithm, and uses the letter The face integrity protection key performs signaling plane integrity verification on the first message. If the verification fails, the reply message is optionally sent to the second access network device, indicating that the signaling plane integrity verification fails, or the handover process is not continued.
  • Step 309 The terminal sends, to the first access network device, a second message that is protected by the user plane protection key or protected by the signaling plane protection key.
  • the first access network device receives the second message.
  • the second message is a response message of the first message.
  • the second message is an acknowledgement message of the first message.
  • the terminal protects the second message by using the same protection method as the first message. That is, the terminal may perform integrity protection on the second message by using the user plane integrity protection key, or perform signaling plane integrity protection on the second message by using the signaling plane integrity protection key, or generate a random number.
  • the two random numbers are encrypted using the user plane encryption key, and the encrypted 2 random numbers and the unencrypted 2 random numbers are placed in the second message. If the terminal fails to verify the first message, the second message is an error message.
  • the first access network device can only enable user plane protection in the handover process of the terminal, and when the signaling plane message needs to be sent, the signaling plane protection algorithm is determined, which improves the terminal.
  • the switching efficiency ensures the security of the signaling plane message.
  • the first access network device further needs to verify the received security policy from the second access network device.
  • the method includes: Step 401 -404.
  • Step 401 The first access network device sends a correspondence between the user plane information and the security policy to the AMF node.
  • the AMF node receives the correspondence between the user plane information and the security policy.
  • Step 402 The AMF node sends one or all of the second indication information and the security policy to the first access network device.
  • the first access network device receives one or all of the second indication information and the security policy.
  • the second indication information is used to indicate whether the first access network device can continue to use the security policy from the second access network device.
  • the AMF node may first determine whether it stores the corresponding relationship between the user plane information and the security policy, and if yes, Determining whether the security policy corresponding to the received user plane information is the same as the security policy corresponding to the user plane information stored by itself; if the same, the first access network device can continue to use the device from the second access network device.
  • the AMF node may send the second indication information to the first access network device, where the second indication information is used to indicate that the first access network device can use the security policy from the second access network device, or the AMF node
  • the first access network device sends a security policy, which is the same as the security policy sent by the first access network device to the AMF node.
  • the device representing the first access network may not continue to use the device from the second access network device.
  • the security policy the AMF node sends the second indication information to the first access network device, where the second indication information is used to indicate that the first access network device cannot use the security policy from the second access network device, or the AMF node
  • the first access network device sends a security policy, where the security policy is a security policy corresponding to the user plane information stored in the AMF node.
  • the AMF node may forward the received correspondence between the user plane information and the security policy of the first access network device to the SMF node. Determining, by the SMF node, whether the first access network device can continue to use the correspondence between the user plane information and the security policy from the second access network device, and the specific determining method is the same as the determining method of the AMF node, and then the AMF node is based on the SMF node. The judgment result sends one or all of the second indication information and the security policy to the first access network device.
  • Step 403 If the first access network device receives the security policy from the AMF node, and the security policy from the AMF node is different from the security policy from the second access network device, restart according to the security policy from the AMF node.
  • the first user plane protection algorithm and the user plane protection key are determined.
  • the AMF node may continue to use the security policy from the second access network device without re-determining the first user plane protection algorithm. And user side protection keys.
  • Step 404 If the first access network device receives the second indication information from the AMF node, does not receive the security policy from the AMF node, and the second indication information indicates that the first access network device cannot use the second access The security policy of the network device, the first access network device re-determines the first user plane protection algorithm and the user plane protection key according to the default security policy.
  • the first access network device can continue to use the security policy from the second access network device, There is no need to redefine the first user plane protection algorithm and the user plane protection key.
  • the TgNB can verify the currently used security policy to obtain a security policy adapted to the TgNB resource condition, if the SgNB is attacked by the attacker and sent A security policy that reduces the security level is given to the TgNB, so that the user plane protection algorithm determined by the TgNB according to the security policy has a lower security level, so that information protected by the user plane protection algorithm can be easily cracked. Therefore, TgNB can avoid this vulnerability by using the security policy delivered by the AMF node, which can further improve security.
  • the second access network device may determine, by using the AMF node, the first access network device, for example, if the terminal is switched.
  • the SgNB can determine the TgNB through the AMF node. As shown in FIG. 5, the method includes steps 501-504.
  • Step 501 The second access network device sends user plane information to the AMF node. Accordingly, the AMF node receives user plane information.
  • Step 502 The AMF node sends the user plane information to the SMF node. Accordingly, the SMF node receives the user plane information.
  • Step 503 The SMF node determines a security policy corresponding to the user plane information.
  • the SMF node stores or obtains a correspondence between each user plane information and a security policy, and after receiving the user plane policy, the SMF may search for the corresponding relationship between the user plane information and the security policy.
  • the security policy corresponding to the user plane information.
  • Step 504 The SMF node sends the security policy corresponding to the user plane information to the first access network device by using the AMF node.
  • the first access network device receives the security policy corresponding to the user plane information.
  • processing flow after the first access network device receives the security policy corresponding to the user plane information may refer to the processing flow in the embodiment corresponding to FIG. 2 and FIG. 3, which is of course not limited thereto.
  • FIG. 6 illustrates the security protection method of the present application in the scenario of the terminal switching the serving base station, and the method specifically includes: steps 601-612.
  • Step 601 The terminal sends a measurement report to the SgNB. Accordingly, the SgNB receives the measurement report.
  • Step 602 The SgNB determines, according to the measurement report, that a key of the next generation base station (Ke in in next generation Node Basestation, KgNB*) is generated when the serving base station needs to be switched for the terminal.
  • KgNB* a key of the next generation base station
  • Step 603 The SgNB sends a handover request (HO request) message to the TgNB. Accordingly, the TgNB receives the handover request message.
  • HO request handover request
  • the handover request message includes a correspondence between the user plane information and the security policy, and may also include a user plane security related parameter.
  • the user plane information includes any one or more of a PDU session identifier, a QFI, a DRB ID, and a slice parameter.
  • the user plane information includes a PDU session identifier of the session that needs to be switched, a QFI of the session that needs to be switched, and a DRB ID corresponding to any one or more of the PDU sessions that need to be switched.
  • the PDU session identifier for all the sessions of the terminal is used for the polygon information, and indicates the PDU session identifier of the session that needs to be switched.
  • the user plane information is used as the PDU session identifier, and each PDU session represents a corresponding security policy.
  • the security policy is used to indicate whether the corresponding session needs to be enabled with user plane encryption protection and whether user plane integrity protection needs to be enabled.
  • the security policy may further include one or all of the user plane encryption protection algorithm identifier and the user plane integrity protection algorithm identifier.
  • the handover request message may carry the security policy corresponding to all the PDU session identifiers of the terminal, or may only carry the security policy corresponding to the PDU session identifier that needs to be switched.
  • the QoS flow with a QFI of 1 uses a DRB with a DRB ID of 2.
  • the QoS flow does not enable user plane encryption protection and enables user plane integrity protection.
  • the algorithm performs user plane integrity protection and uses the No. 2 user plane encryption algorithm for user plane encryption protection.
  • the terminal has a total of three user plane information and a security policy correspondence.
  • the handover message carries the correspondence between the three user plane information and the security policy, and uses one bit to indicate the user plane information and security policy to be switched.
  • the handover request message may only carry the security policy corresponding to the user plane information that needs to be switched.
  • the security policy corresponding to the user plane information that needs to be switched in the handover request message is taken as an example for description. .
  • the user plane security related parameters include the security capability of the terminal and KgNB*.
  • it may further include a freshness parameter (for example, a serial number, a counter value, etc.) for generating a key, which is used to identify the currently used key.
  • a freshness parameter for example, a serial number, a counter value, etc.
  • Information such as key identifiers.
  • the security capability of the terminal includes the user plane protection algorithm identifier supported by the terminal.
  • the security capability of the terminal is that the terminal supports the No. 1 user plane encryption algorithm, the No. 2 user plane encryption algorithm, and the No. 3 user plane integrity protection algorithm.
  • User plane integrity protection algorithm No. 5 User plane integrity protection algorithm No. 5.
  • Step 604 The TgNB determines a first user plane protection algorithm.
  • the TgNB may determine the first user plane protection algorithm according to the correspondence between the user plane information and the security policy, the security capability of the terminal, and the security capability priority list preconfigured by the TgNB.
  • the security capability priority list is a pre-configured list.
  • the signaling plane and the user plane can share the same security capability priority list, or different security capability priority lists can be used separately.
  • the TgNB includes at least two security capability lists.
  • the user plane and the signaling plane share the security capability priority list as an example.
  • the TgNB includes a priority list of an encryption algorithm and a priority list of an integrity protection algorithm.
  • the priority list of the encryption algorithm is Table 1
  • the priority list of integrity protection is Table 2, and the algorithms in the table are arranged in descending order of priority.
  • Encryption algorithm 1 Encryption algorithm 2 Encryption algorithm 3 Encryption algorithm 4 Encryption algorithm 5
  • the method for determining the first user plane protection algorithm is:
  • the security capability of the terminal is that the terminal supports the user plane encryption algorithm 1, the user plane encryption algorithm 2, the user plane integrity protection algorithm 3, and the user plane integrity protection algorithm 5.
  • the TgNB determines that the session 1 needs to enable the user plane encryption algorithm, does not open the user plane integrity protection algorithm, and then determines the user plane encryption algorithm supported by the terminal as the user plane encryption algorithm 1 and the user plane encryption algorithm 2 according to the security capability of the terminal, and further According to Table 1, it is determined that the priority of the user plane encryption algorithm 1 is higher than that of the user plane encryption algorithm 2, that is, the user plane encryption algorithm 1 is the user plane encryption algorithm with the highest priority supported by the terminal and the TgNB, that is, the TgNB is the session.
  • the first determined user plane protection algorithm is the user plane encryption algorithm 1.
  • the TgNB determines that the user plane encryption algorithm is not enabled in session 2, and the user plane integrity protection algorithm is enabled. Then, according to the security capability of the terminal, the user plane integrity protection algorithm supported by the terminal is determined as the user plane integrity protection algorithm 3 and the user plane integrity protection algorithm. 5, according to Table 2, the user plane integrity protection algorithm 3 is the highest priority user plane integrity protection algorithm supported by the terminal and the TgNB, that is, the first user plane protection algorithm determined by the TgNB for the session 2 is the user plane integrity. Protection algorithm 3.
  • the method for determining the first user plane protection algorithm is:
  • the TgNB determines that the session 1 needs to enable the user plane encryption protection and the user plane integrity protection according to the security policy.
  • the user plane encryption algorithm that the security policy indicates is the user plane encryption algorithm 2, and the security policy indicates that the user plane is open.
  • the sexual protection algorithm is the user plane integrity protection algorithm 1.
  • the user plane encryption algorithm supported by the terminal is determined as the user plane encryption algorithms 1 and 2.
  • the user plane integrity protection algorithm supported by the terminal is the user plane integrity protection algorithms 3 and 5.
  • the terminal and the TgNB support the user plane encryption algorithm 2 indicated by the security policy, but the terminal does not support the user plane integrity protection algorithm 1 indicated by the security policy, so the TgNB needs to reselect the user plane integrity protection according to the security capability of the terminal and Table 2.
  • the user plane integrity protection algorithm 3 is the highest priority user plane integrity protection algorithm supported by both the terminal and the TgNB. That is, the first user plane protection algorithm determined by the TgNB for the session 1 is the user plane encryption algorithm 2 and the user plane integrity protection algorithm 3.
  • the TgNB may determine to enable user plane encryption protection or enable user plane integrity protection according to a default policy, or Both user plane encryption protection and user plane integrity protection are enabled, and the corresponding user plane protection algorithm is determined.
  • the TgNB can also directly ignore the received security policy and determine the user plane protection algorithm according to the default policy.
  • TgNB can determine a set of algorithms, which can be used as both a user plane security algorithm and a control plane security algorithm. That is, in step 604, the first user plane protection algorithm determined by the TgNB can also be used as a signaling plane protection algorithm, or the signaling plane protection algorithm determined by the TgNB can also be used as the first user plane protection algorithm.
  • Step 605 The TgNB generates a user plane protection key according to the first user plane protection algorithm.
  • the TgNB may generate a user plane protection key for each user plane protection algorithm determined in step 604.
  • the first user plane protection algorithm determined by the TgNB for session 1 is the user plane encryption algorithm 1, determined for session 2
  • the first user plane protection algorithm is the user plane integrity protection algorithm 3.
  • the TgNB generates a user plane encryption key corresponding to the user plane encryption algorithm 1 for the session 1, and generates a user plane integrity protection key corresponding to the floor integrity protection algorithm 3 for the session 2.
  • TgNB can generate a key according to a key derive function (KDF), an algorithm ID, and KgNB*.
  • KDF key derive function
  • the other parameter may be one parameter or multiple parameters, for example, other parameters may be key parameters, or other parameters are key parameters, isolation parameters (such as session ID, DRB ID, QFI), freshness. Any one or more of the parameters.
  • This key production method is applicable not only to the handover scenario of the terminal but also to the scenario in which the base station produces the key.
  • the TgNB may generate a signaling plane protection key according to the signaling plane protection algorithm.
  • Step 606 The TgNB sends a handover request acknowledgement (HO request Ack) message to the SgNB, and accordingly, the SgNB receives the handover request acknowledgement message.
  • HO request Ack handover request acknowledgement
  • the handover request acknowledgement message includes a HO command message.
  • the handover command message includes an RRC connection reconfiguration message.
  • the RRC connection reconfiguration message is used to notify the terminal of the basic parameters of the target base station, such as the physical cell ID of the target base station, the frequency of the target base station, and the session resources.
  • the RRC connection reconfiguration message is used to deliver the first user plane protection algorithm determined by the TgNB.
  • it is also used to pass a signaling plane algorithm. If the user plane integrity protection algorithm is included in the first user plane protection algorithm determined in step 604, the user plane integrity protection key is generated in step 605 to perform integrity protection for the RRC connection reconfiguration message. If the signaling plane integrity protection algorithm is further determined in step 604, the integrity of the RRC connection reconfiguration message is performed using the signaling plane integrity key generated in step 605, regardless of whether the user plane integrity protection algorithm has been determined. protection.
  • an RRC connection reconfiguration message may include a correspondence between each group of user plane information and a security policy received by the TgNB.
  • the RRC connection reconfiguration message of the session 1 includes a first user plane protection algorithm determined by the TgNB for the session 1, and a session resource allocated for the session 1.
  • the session resource may be a DRB ID. If the DRB with the DRB ID of 1 in the user plane information and the security policy correspondence relationship is not used, the session 1 can still use the DRB. If it is already used, the TgNB re-creates a session 1 for the session 1. The DRB sends the DRB ID of the created DRB to the terminal. Optionally, if the DRB ID is not carried in the correspondence between the user information and the security policy, the TgNB re-creates a DRB for the session.
  • the RRC connection reconfiguration message of session 1 includes a user plane encryption algorithm 1, a DRB ID, and information for generating KgNB*.
  • the RRC connection reconfiguration message of Session 2 includes the user plane integrity protection algorithm 3, the DRB ID, and information for generating KgNB*.
  • the RRC reconfiguration message of the session 1 is not integrity protected because the security policy corresponding to the session 1 indicates that the user plane integrity protection is not enabled.
  • the security policy corresponding to session 2 indicates that user plane encryption protection is enabled. Therefore, the RRC connection reconfiguration message of session 2 can be encrypted by the user plane integrity protection key corresponding to the user plane integrity protection algorithm 3.
  • the TgNB can generate a random number Nounce-TgNB and use a user plane encryption algorithm 1 pair.
  • the Nounce-TgNB performs encryption, and the RRC reconfiguration message of the session 1 further includes the encrypted Nounce-TgNB and the unencrypted Nounce-TgNB.
  • the TgNB may perform integrity protection on the RRC connection reconfiguration message by using a signaling plane integrity protection key, or use a signaling plane encryption key pair.
  • Nounce-TgNB encrypts.
  • the RRC connection reconfiguration message further includes indication information, where the signaling plane protection algorithm is used to indicate that the signaling plane protection algorithm is the same as the first user plane protection algorithm, or is used to indicate the signaling plane protection algorithm identifier.
  • Step 607 The SgNB sends a handover command message to the terminal. Accordingly, the terminal receives a handover command message.
  • the SgNB forwards the handover command message in the handover request acknowledgement message to the terminal.
  • the SgNB may send the sequence number status information and the data to be sent to the terminal to the TgNB, so that the TgNB forwards the data to be sent to the terminal to the terminal after establishing the communication link with the terminal. .
  • Step 608 The terminal generates a user plane protection key.
  • the terminal After receiving the handover command message, the terminal acquires an RRC connection reconfiguration message from the handover command message. If the RRC connection reconfiguration message includes the user plane integrity protection algorithm, the user plane integrity is generated according to the user plane integrity protection algorithm. Protecting the key, and then performing integrity check on the RRC connection reconfiguration message by using the user plane integrity protection key. If the verification fails, disconnect the communication connection with the TgNB or perform step 609; And generating a user plane protection key corresponding to the user plane protection algorithm in the RRC connection reconfiguration message.
  • the terminal If the RRC connection reconfiguration message includes the encrypted Nounce-TgNB and the user plane encryption algorithm, the terminal generates a user plane encryption key according to the user plane encryption algorithm, and decrypts the encrypted Nounce-TgNB by using a user plane encryption algorithm, and Comparing the decrypted Nounce-TgNB with the Nounce-TgNB in the handover command message, if the same, the terminal generates a user plane protection key corresponding to the user plane protection algorithm in the RRC connection reconfiguration message; if different, disconnects A communication connection with the TgNB, or step 609.
  • the terminal generates a signaling plane protection key according to the signaling plane protection algorithm.
  • Step 609 The terminal accesses the TgNB.
  • the process of the terminal accessing the TgNB includes the terminal sending a synchronization request to the TgNB, and the TgNB allocates a time window to the terminal.
  • step 609 is not performed.
  • Step 610 The terminal sends a HO confirm message to the TgNB.
  • the handover confirmation message includes an RRC connection reconfiguration complete message, which is used to notify the TgNB terminal that the handover is successful.
  • the RRC connection reconfiguration complete message is used to notify the TgNB terminal that the handover fails, and the reason for the handover failure.
  • the terminal if the terminal generates the user plane encryption key in step 608, the RRC connection reconfiguration complete message is encrypted by using the user plane encryption key, and the user plane integrity protection key is generated. The integrity protection of the RRC connection reconfiguration complete message is performed by using the user plane integrity protection key. If the terminal generates both the user plane encryption key and the user plane integrity protection key, the terminal may The configuration message performs any one of the protections, or both the RRC connection reconfiguration complete message is encrypted by using the user plane encryption key, and the RRC connection reconfiguration complete message is integrity protected by using the user plane integrity protection key.
  • the signaling plane integrity protection key is used to perform integrity protection on the RRC connection reconfiguration complete message. If the signaling plane encryption key is generated, the signaling plane is used. The encryption key encrypts the RRC Connection Reconfiguration Complete message. If the terminal generates both the signaling plane encryption key and the signaling plane integrity protection key, the terminal may perform any one of the RRC connection reconfiguration messages, or use the signaling plane integrity protection key. The RRC connection reconfiguration complete message is integrity protected, and the RRC connection reconfiguration complete message is encrypted using the signaling plane encryption key.
  • the terminal may also generate a random number Nounce-UE, encrypt the Nounce-UE
  • the UE is carried in the RRC Connection Reconfiguration Complete message and sent to the TgNB.
  • the RRC connection reconfiguration complete message may also be protected by using the user plane protection key.
  • Step 611 The TgNB receives the handover confirmation message.
  • the TgNB receives the handover confirmation message, if the RRC connection reconfiguration complete message in the handover confirmation message is a ciphertext, the RRC connection reconfiguration complete message is decrypted by using the user plane encryption key, if the RRC connection is heavy
  • the configuration completion message is a message protected by the user plane integrity protection algorithm, and the TgNB performs integrity verification on the RRC connection reconfiguration complete message by using the user plane integrity protection key.
  • the TgNB decrypts the encrypted Nounce-UE
  • the Nounce-UE is obtained and compared with the plaintext Nounce-UE carried in the RRC connection reconfiguration complete message. If they are the same, the verification succeeds.
  • the TgNB uses the signaling plane protection key to decrypt or integrity check the RRC connection reconfiguration complete message.
  • step 612 is performed.
  • the TgNB fails to verify the RRC connection reconfiguration complete message, or the TgNB verifies the RRC connection reconfiguration complete message successfully, but the RRC connection reconfiguration complete message is used to notify the TgNB terminal that the handover fails, the TgNB disconnects from the terminal. The communication is connected, and the saved downlink data to be forwarded to the terminal is deleted.
  • Step 612 The TgNB sends downlink data to the terminal.
  • the TgNB does not determine the first user plane protection algorithm as the signaling plane protection algorithm, or the TgNB does not determine the signaling plane protection algorithm, when the TgNB needs to send the signaling plane message.
  • the signaling plane protection algorithm is determined. As shown in FIG. 7, the method includes: Steps 701-717.
  • Step 701 to step 712 may refer to related descriptions in steps 601 to 612. It should be noted that in step 701 to step 712, the TgNB does not determine the first user plane protection algorithm as a signaling plane protection algorithm, and does not generate a signaling plane. Protect the key.
  • the TgNB determines a signaling plane protection algorithm.
  • the signaling plane protection algorithm includes one or all of a signaling plane encryption algorithm and a signaling plane integrity protection algorithm.
  • step 713 The triggering time of step 713 has been explained in the above step 305, and details are not described herein again.
  • the TgNB generates a signaling plane protection key according to the signaling plane protection algorithm.
  • the signaling plane protection key includes one or all of a signaling plane encryption key and a signaling plane integrity protection key.
  • the signaling plane message can be protected by using a signaling plane protection key, and then the signaling plane message protected by the signaling plane protection key is sent.
  • the TgNB sends an access stratum security mode command (AS SMC) message to the terminal. Accordingly, the terminal receives the AS SMC message.
  • AS SMC access stratum security mode command
  • the AS SMC message carries the signaling plane protection algorithm identifier determined by the TgNB in step 713.
  • the AS SMC message sent by the TgNB to the terminal is a message that is protected by the signaling plane integrity.
  • the terminal generates a signaling plane protection key according to the signaling plane algorithm identifier carried in the AS SMC message.
  • the signaling plane protection key generated by the terminal includes one or all of a signaling plane encryption key and a signaling plane integrity protection key. If the AS SMC message carries only the signaling plane encryption algorithm identifier, the terminal generates a signaling plane encryption key according to the signaling plane encryption algorithm identifier; if the AS SMC message only carries the signaling plane integrity protection algorithm identifier, the terminal according to the The signaling plane integrity protection algorithm identifier generates a signaling plane integrity protection key; the AS SMC message carries a signaling plane encryption algorithm identifier and a signaling plane integrity protection algorithm identifier, and the terminal generates a signaling according to the signaling plane encryption algorithm identifier.
  • the face encryption key is generated according to the signaling plane integrity protection algorithm identifier to generate a signaling plane integrity protection key.
  • the terminal may perform integrity verification on the AS SMC message according to the generated signaling plane integrity protection key.
  • the terminal sends a security mode complete (SMP) message to the TgNB.
  • SMP security mode complete
  • the SMP message is a message that the terminal uses the signaling plane integrity protection key for integrity protection.
  • step 713 to step 717 may also be performed before step 710. If step 713 to step 717 are performed before step 710, in step 710, the terminal sends the signal plane integrity protection key protection to the TgNB. Switch the confirmation message.
  • the process of enabling the user plane protection is decoupled from the process of the signaling plane protection.
  • the signaling plane protection may not be enabled, which saves the network overhead of the TgNB.
  • the switching efficiency of the terminal can be improved, and after the terminal handover succeeds, if the signaling plane message needs to be transmitted, the signaling plane protection algorithm can also be determined and a signaling plane protection key is generated, and the signaling plane protection key pair signaling is used. The face message is securely protected and the signaling plane is also secured.
  • the TgNB receives the handover confirmation message
  • the handover process of the terminal is completed, and further, the security policy currently used by the TgNB may also be used.
  • the verification is performed.
  • the method is a specific description of the embodiment corresponding to FIG. 4, and the method includes: steps 801-810.
  • Step 801 The TgNB sends an N2 path switch message to the AMF node. Accordingly, the AMF node receives the N2 Path Switch message.
  • the N2 path switching message includes the correspondence between the user plane information and the security policy from the SgNB.
  • the N2 path switch message includes a default security policy and user plane information.
  • the N2 path switch message includes a session management (SM) container, where the SM container includes a correspondence between the user plane information and the security policy from the SgNB, or the SM container includes a default security policy and user plane information.
  • SM session management
  • Step 802 The AMF node verifies the security policy in the N2 path switch message.
  • step 803 is directly executed.
  • each user plane information and security policy stored in the AMF node is as shown in Table 3.
  • the NIA is a user plane integrity protection algorithm
  • the NEA is a user plane encryption algorithm
  • the algorithm identifier of the NIA1 representative user integrity protection algorithm is 1.
  • the "1111" replaces the location of the NEA and is used to indicate that the user plane encryption algorithm is not turned on.
  • the first user plane protection algorithm determined by the correspondence relationship with the security policy may perform step 806 to inform the TgNB of the verification result.
  • the first user plane protection algorithm determined by the correspondence between the user plane information and the security policy needs to update the currently used security policy to the security policy found by Table 3: NIA3, "1111", and then step 806 can be performed to notify the TgNB to verify. result.
  • each user plane information and the security policy stored in the AMF node may also be as shown in Table 4.
  • the verification fails, indicating that the TgNB
  • the first user plane protection algorithm determined according to the correspondence between the user plane information and the security policy may not be used.
  • Step 803 The AMF node sends a session information request (SM information request) message to the SMF node. Accordingly, the SMF node receives the SM Information Request message from the AMF node.
  • SM information request session information request
  • the SM information request message includes the identity information of the terminal, the correspondence between the user plane information from the SgNB and the security policy, or the identity information of the terminal, the user plane information, and the default security policy.
  • the AMF node may carry the SM container in the N2 path switch message in the SM information request and send the message to the SMF node.
  • Step 804 The SMF node verifies the security policy in the SM information request message.
  • the SMF node If the SM information request message carries the SM container, the SMF node reads the correspondence between the user plane information and the security policy from the SgNB, or the user plane information and the default security policy, from the SM container.
  • the SMF node stores a correspondence between each user plane information and a security policy, such as Table 3 or Table 4.
  • the method for verifying the security policy by the SMF node is basically the same as the method for verifying the security policy by the AMF node in step 802. The difference is that after the SMF node completes the verification of the security policy, the verification result is sent to the AMF node.
  • Step 805 The SMF node sends an SM information response message to the AMF node.
  • the SM information response message carries the verification result of the security policy of the SMF node in step 804, and specifically carries one or all of the security policy and the second indication information.
  • the security policy in the SM information response message is the security policy in the SM information response message, or the second indication information is used to indicate that the currently used security policy can continue to be used.
  • the security policy in the SM information response message is a security policy that the SMF node reselects according to the user information, or the second indication information is used to indicate that the currently used security policy cannot be used.
  • the security policy in the SM information response message may be NIA3, "1111".
  • the SM information response message may further carry user plane information corresponding to the security policy.
  • Step 806 The AMF node sends a path switch ack message to the TgNB. Accordingly, the TgNB receives the Path Switch Confirmation message.
  • the path switch confirmation message carries the verification result of the security policy of the AMF node in step 802, and specifically carries one or all of the security policy and the second indication information.
  • the security policy in the path switch confirmation message is the security policy in the SM information request message, or the second indication information is used to indicate that the currently used security policy can continue to be used.
  • the security policy in the path switch confirmation message is a security policy that the SMF node reselects according to the user information, or the second indication information is used to indicate that the currently used security policy cannot be used.
  • the security policy in the path switch confirmation message may be NIA3, "1111".
  • the path switch confirmation message may further carry user plane information corresponding to the security policy.
  • the path switch confirmation message includes the content in the SM information response message sent by the SMF node.
  • Step 807 The TgNB updates the user plane protection algorithm and the user plane protection key according to one or all of the received security policy and the second indication information.
  • the TgNB After receiving the security policy in the path switch confirmation message, the TgNB determines whether the received security policy is the same as the security policy from the SgNB. If the same, the TgNB does not need to update the user plane protection algorithm and the user plane protection key; if not, the user plane protection algorithm is reselected according to the security policy in the path switch confirmation message, and generated according to the replayed user plane protection algorithm. User side protection key.
  • the TgNB does not need to update the user plane protection algorithm and the user plane protection key;
  • the indication indicates that the currently used security policy cannot be used, the TgNB uses the default security policy, or the TgNB disconnects, or the TgNB disconnects after sending the downlink data.
  • the TgNB needs to send a signaling plane message to the terminal. If the signaling plane protection is not enabled at this time, perform step 713 to step 717 to open the message. Face protection.
  • Step 808 The TgNB sends an RRC connection reconfiguration message to the terminal. Accordingly, the terminal receives an RRC Connection Reconfiguration message from the TgNB.
  • the RRC connection reconfiguration message is a message protected by a signaling plane protection key, and the RRC connection reconfiguration message carries a TgNB updated user plane protection algorithm or third indication information, where the third indication information is used to indicate whether the terminal can continue Use the user plane protection algorithm currently used by the terminal.
  • Step 809 The terminal generates a user plane protection key according to the user plane protection algorithm in the RRC connection reconfiguration message.
  • the terminal can perform security check on the RRC connection reconfiguration message according to the signaling plane protection key.
  • the integrity check can be performed on the RRC connection reconfiguration message according to the signaling plane integrity protection key. If the verification succeeds, the user plane protection key may be generated according to the user plane protection algorithm in the RRC connection reconfiguration message, and the user plane protection key is used to encrypt or decrypt the user plane data.
  • Step 810 The terminal sends an RRC connection reconfiguration complete message to the TgNB. Accordingly, the TgNB receives the RRC Connection Reconfiguration Complete message.
  • the RgNB can determine that the user plane protection algorithm is successfully updated.
  • the handover process of the terminal is as shown in FIG. 9.
  • the method includes: Steps 901-909.
  • Step 901 The terminal sends a measurement report to the SgNB. Accordingly, the SgNB receives the measurement report.
  • Step 902 The SgNB determines, according to the measurement report, that the handover request message needs to be sent to the AMF node when the serving base station needs to be switched. Accordingly, the AMF node receives the handover request message.
  • the handover request message includes the correspondence between the user plane information and the security policy, and may also include the security capability of the terminal.
  • the switch request message may include an SM container, where the SM container includes a correspondence between the user plane information and the security policy or only the security policy, or the security policy is outside the SM container, or is included in the SM container and outside the SM container. security strategy.
  • the AMF node stores the correspondence between the user plane information and the security policy, for example, the AMF node stores the table 3.
  • the AMF node can determine whether the security policy corresponding to the user plane information in the handover request is the same as the security policy corresponding to the user plane information in Table 3.
  • the AMF node can directly send the security policy corresponding to the user plane information to the TgNB. If not, step 903 is performed.
  • step 903 is performed.
  • Step 903 The AMF node sends a session switch request message to the SMF node, where the session switch request message carries user plane information. Accordingly, the SMF node receives the session request message.
  • the session switching request message further includes a correspondence between the user plane information and the security policy, or further includes the SM container received in step 902.
  • Step 904 The SMF node determines a security policy corresponding to the user plane information in the session switch request message.
  • the SMF node may determine that the received user plane information corresponds to The security policy is the same as the security policy corresponding to the user plane information in Table 3. If they are the same, it is determined that the security policy from the SgNB can still be used in the subsequent terminal handover process. If not, the subsequent terminal handover is determined.
  • the security policy corresponding to the user plane information in Table 3 is used in the process.
  • the SMF node only receives the user plane information, or receives the SM container, and the SM container only contains the user plane information, and the SMF node needs to determine the security policy for the user plane information.
  • the SMF node receives the correspondence between the user plane information and the security policy, or receives the SM container, where the SM container includes the correspondence between the user plane information and the security policy, and the SMF node ignores the received security policy, according to the user.
  • the face information re-determines the security policy corresponding to the user face information.
  • the SMF node may determine the security policy corresponding to the user plane information through the correspondence between the user plane information and the security policy pre-configured in the SMF node or obtained from other network elements.
  • Step 905 The SMF node sends a session switch response message to the AMF node.
  • the session switching response message includes a security policy corresponding to the user plane information determined by the SMF node.
  • Step 906 The AMF node sends a handover request message to the TgNB. Accordingly, the TgNB receives the handover request message.
  • the handover request message includes a security policy corresponding to the user plane information and a security capability of the terminal.
  • the AMF node receives the SM container, the SM container needs to be forwarded to the TgNB.
  • the handover request message may not include the security policy corresponding to the user plane information, and the TgNB may temporarily use the SM container in the SM container only if the security policy corresponding to the user plane information from the SgNB is included in the SM container. Security policy.
  • the TgNB may request the AMF node or the SMF node to issue a new security policy in the subsequent PDU session, or the SMF sends the security policy to the TgNB when the terminal initiates the session establishment or the session modification request.
  • Step 907 The TgNB determines a first user plane protection algorithm, and generates a user plane protection key according to the first user plane protection algorithm.
  • step 907 is the same as the related description in step 604 and step 605, and details are not described herein again.
  • Step 908 The TgNB sends a handover request acknowledgement message to the AMF node. Accordingly, the AMF node receives a handover request acknowledgement message from the TgNB.
  • Step 909 The AMF node sends a handover command message to the TgNB. Accordingly, the TgNB receives a handover command message from the AMF node.
  • the solution provided by the embodiment of the present invention is mainly introduced from the perspective of interaction between different network elements.
  • the first access network device, the second access network device, the AMF node, the SMF node, and the terminal include corresponding hardware structures and/or software modules for performing the respective functions.
  • the embodiments of the present invention can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the technical solutions of the embodiments of the present invention.
  • the embodiments of the present invention may perform functional unit division on the first access network device, the second access network device, the AMF node, the SMF node, the terminal, and the like according to the foregoing method.
  • each functional unit may be divided according to each function.
  • Two or more functions can be integrated into one processing unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. It should be noted that the division of the unit in the embodiment of the present invention is schematic, and is only a logical function division, and the actual implementation may have another division manner.
  • FIG. 10 shows a schematic block diagram of an apparatus provided in an embodiment of the present invention.
  • the device may exist in the form of software, may be a first access network device, or may be a chip in the first access network device.
  • the apparatus 1000 includes a processing unit 1002 and a first communication unit 1003.
  • the processing unit 1002 is configured to perform control management on the action of the device 1000.
  • the processing unit 1002 is configured to support the device 1000 to perform the process 203 in FIG. 2, the processes 303 to 306 in FIG. 3, and the processes 403 and 404 in FIG. Processes 604, 605, and 611 in FIG. 6, processes 704, 705, 711, 713, 714 in FIG. 7, process 807 in FIG. 8, process 907 in FIG.
  • the first communication unit 1003 is configured to support communication between the device 1000 and other network elements (eg, second access network devices, AMF nodes, SMF nodes, etc.).
  • the device 1000 can also include a second communication unit 1004 for supporting communication between the device 1000 and the terminal.
  • the device 1000 may further include a storage unit 1001 for storing program codes and data of the device 1000.
  • the processing unit 1002 may be a processor or a controller, such as a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (Application-Specific). Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the first communication unit 1003 may be a communication interface, where the communication interface is a collective name.
  • the communication interface may include multiple interfaces, for example, may include: an interface between the access network device and the access network device, An interface and/or other interface between the access network device and the core network device.
  • the second communication unit 1004 may be a transceiver or a transceiver circuit or the like.
  • the storage unit 1001 may be a memory.
  • FIG. 11 shows a schematic block diagram of another apparatus provided in an embodiment of the present invention.
  • the device may exist in the form of software, may be a second access network device, or may be a chip in the second access network device.
  • the apparatus 1100 includes a processing unit 1102, a first communication unit 1103, and a second communication unit 1104.
  • the processing unit 1102 is configured to perform control management on the action of the device 1100.
  • the processing unit 1102 is configured to support the device 1100 to perform the process 201 in FIG. 2, the process 301 in FIG. 3, the process 602 in FIG. 6, and the process 602 in FIG. Process 702, and/or other processes for the techniques described herein.
  • the first communication unit 1103 is configured to support communication between the device 1100 and other access network devices or AMF nodes, SMF nodes.
  • the second communication unit 1104 is for supporting communication between the device 1100 and the terminal.
  • the device 1100 may further include a storage unit 1101 for storing program codes and data of the device 1100.
  • the processing unit 1102 can be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the first communication unit 1103 may be a communication interface, where the communication interface is a collective name.
  • the communication interface may include multiple interfaces, for example, may include: an interface between the access network device and the access network device, An interface and/or other interface between the access network device and the core network device.
  • the second communication unit 1104 may be a transceiver or a transceiver circuit or the like.
  • the storage unit 1101 may be a memory.
  • the structure of the apparatus 1000 according to the embodiment of the present invention may be as The structure of the access network device shown in FIG.
  • the processing unit 1102 is a processor
  • the first communication unit 1103 is a communication interface
  • the second communication unit 1104 is a transmitter/receiver
  • the storage unit 1101 is a memory
  • the structure of the device 1100 according to the embodiment of the present invention may also be The structure of the access network device as shown in FIG.
  • FIG. 12 is a schematic diagram showing a possible structure of an access network device according to an embodiment of the present invention.
  • Access network device 1200 includes a processor 1202 and a communication interface 1204.
  • the processor 1202 may also be a controller, and is represented as "controller/processor 1202" in FIG.
  • the communication interface 1204 is configured to support the access network device to communicate with other network elements (eg, other access network devices, AMF nodes, SMF nodes, etc.).
  • the access network device 1200 can also include a transmitter/receiver 1201.
  • the transmitter/receiver 1201 is configured to support transmission and reception of information between the access network device and the terminal in the foregoing embodiment, and to support radio communication between the terminal and other terminals.
  • the processor 1202 performs various functions for communicating with the terminal.
  • an uplink signal from the terminal is received via an antenna, demodulated by the receiver 1201 (e.g., demodulated into a baseband signal), and further processed by the processor 1202 to recover the terminal.
  • the traffic data and signaling messages are processed by the processor 1202 and modulated by the transmitter 1201 (e.g., modulating the baseband signal into a high frequency signal) to generate a downlink signal and transmitted to the terminal via the antenna.
  • the above demodulation or modulation function may also be completed by the processor 1202.
  • the processor 1202 when the access network device 1200 is the first access network device, the processor 1202 is further configured to perform a process involving the first access network device in the method shown in FIG. 2 to FIG. 9 and/or the present application. Other processes of the described technical solution; or, when the access network device 1200 is a second access network device, the processor 1202 is further configured to perform the methods shown in FIG. 2, FIG. 3, FIG. 6, FIG. 7, and FIG. The process of the second access network device and/or other processes of the technical solution described herein are involved.
  • the access network device 1200 may further include a memory 1203 for storing program codes and data of the access network device 1200.
  • Figure 12 only shows a simplified design of the access network device 1200.
  • the access network device 1200 may include any number of transmitters, receivers, processors, controllers, memories, communication units, etc., and all access network devices that can implement the embodiments of the present invention are in the present invention. Within the scope of protection of the embodiments.
  • FIG. 13 shows a possible exemplary block diagram of another apparatus involved in the embodiment of the present invention.
  • the apparatus 1300 may exist in the form of software or may be an AMF node. It can also be a chip in the AMF node.
  • the apparatus 1300 includes a processing unit 1302 and a communication unit 1303.
  • Processing unit 1302 is for controlling management of the actions of device 1300, for example, processing unit 1302 for supporting device 1300 to perform process 802 of FIG. 8, and/or other processes for the techniques described herein.
  • the communication unit 1303 is configured to support the communication of the device 1300 with other network entities (eg, access network devices, SMF nodes).
  • the apparatus 1300 may further include a storage unit 1301 for storing program codes and data of the apparatus 1300.
  • the processing unit 1302 may be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1303 may be a communication interface, a transceiver or a transceiver circuit, etc., wherein the communication interface is a collective name. In a specific implementation, the communication interface may include multiple interfaces, for example, may include: between an AMF node and an access network device. Interface and / or other interfaces.
  • the storage unit 1301 may be a memory.
  • the apparatus 1300 may be the AMF node shown in FIG.
  • the AMF node 1400 includes a processor 1402, a communication interface 1403, and a memory 1401.
  • the core network device 1400 may also include a bus 1404.
  • the communication interface 1403, the processor 1402, and the memory 1401 may be connected to each other through a bus 1404.
  • the bus 1404 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on.
  • the bus 1404 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 14, but it does not mean that there is only one bus or one type of bus.
  • FIG. 15 shows a possible exemplary block diagram of another apparatus involved in the embodiment of the present invention.
  • the apparatus 1500 may exist in the form of software or may be an SMF node. It can also be a chip in an SMF node.
  • the apparatus 1500 includes a processing unit 1502 and a communication unit 1503.
  • the processing unit 1502 is configured to control and manage the actions of the device 1500.
  • the processing unit 1502 is configured to support the device 1500 to perform the process 503 in FIG. 5, the process 804 in FIG. 8, the process 904 in FIG. 9, and/or Other processes of the techniques described herein.
  • Communication unit 1503 is used to support communication of device 1500 with other network entities (e.g., access network devices, SMF nodes).
  • the device 1500 can also include a storage unit 1501 for storing program codes and data of the device 1500.
  • the processing unit 1502 may be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1503 may be a communication interface, a transceiver or a transceiver circuit, etc., wherein the communication interface is a collective name. In a specific implementation, the communication interface may include multiple interfaces, for example, may include: between an SMF node and an access network device. Interface and / or other interfaces.
  • the storage unit 1501 may be a memory.
  • the apparatus 1500 involved in the embodiment of the present invention may be the SMF node shown in FIG.
  • the SMF node 1600 includes a processor 1602, a communication interface 1603, and a memory 1601.
  • the core network device 1600 can also include a bus 1604.
  • the communication interface 1603, the processor 1602, and the memory 1601 may be connected to each other through a bus 1604.
  • the bus 1604 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (abbreviated). EISA) bus and so on.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the bus 1604 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 16, but it does not mean that there is only one bus or one type of bus.
  • FIG. 17 shows a schematic block diagram of yet another apparatus provided in an embodiment of the present invention.
  • the device 1700 can exist in the form of software, can also be a terminal, and can also be a chip in the terminal.
  • the device 1700 includes a processing unit 1702 and a communication unit 1703.
  • the processing unit 1702 is configured to control and manage the actions of the device 1700.
  • the processing unit 1702 is configured to support the device 1700 to perform the process 308 in FIG. 3, the process 608 in FIG. 6, the process 708 in FIG. 7, and the process 708 in FIG. Process 809, and/or other processes for the techniques described herein.
  • Communication unit 1703 is used to support communication between device 1700 and other network elements, such as access network devices.
  • Apparatus 1700 can also include a storage unit 1701 for storing program code and data for apparatus 1700.
  • the processing unit 1702 may be a processor or a controller, such as a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure.
  • the processor may also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like.
  • the communication unit 1703 may be a transceiver, a transceiver circuit, a communication interface, or the like.
  • the storage unit 1701 may be a memory.
  • the terminal involved in the embodiment of the present invention may be the terminal shown in FIG. 18.
  • FIG. 18 is a simplified schematic diagram showing one possible design structure of a terminal involved in an embodiment of the present invention.
  • the terminal 1800 includes a transmitter 1801, a receiver 1802, and a processor 1803.
  • the processor 1803 may also be a controller, and is represented as "controller/processor 1803" in FIG.
  • the terminal 1800 may further include a modem processor 1805.
  • the modem processor 1805 may include an encoder 1807, a modulator 1807, a decoder 1808, and a demodulator 1809.
  • transmitter 1801 conditions (eg, analog transforms, filters, amplifies, upconverts, etc.) the output samples and generates an uplink signal that is transmitted via an antenna to the base station described in the above embodiments. .
  • the antenna receives the downlink signal transmitted by the base station in the above embodiment.
  • Receiver 1802 conditions (eg, filters, amplifies, downconverts, digitizes, etc.) the signals received from the antenna and provides input samples.
  • encoder 1807 receives the traffic data and signaling messages to be transmitted on the uplink and processes (e.g., formats, codes, and interleaves) the traffic data and signaling messages.
  • Modulator 1807 further processes (e.g., symbol maps and modulates) the encoded service data and signaling messages and provides output samples.
  • Demodulator 1809 processes (e.g., demodulates) the input samples and provides symbol estimates.
  • the decoder 1808 processes (e.g., deinterleaves and decodes) the symbol estimates and provides decoded data and signaling messages that are sent to the terminal 1800.
  • Encoder 1807, modulator 1807, demodulator 1809, and decoder 1808 may be implemented by a composite modem processor 1805. These units are processed according to the radio access technology employed by the radio access network (e.g., access technologies of LTE and other evolved systems). It should be noted that when the terminal 1800 does not include the modem processor 1805, the above functions of the modem processor 1805 may also be completed by the processor 1803.
  • the processor 1803 performs control management on the actions of the terminal 1800 for performing the processing performed by the terminal 1800 in the above embodiment of the present invention.
  • the processor 1803 is further configured to perform the processes related to the terminal in the method shown in FIG. 3 to FIG. 6 and/or other processes of the technical solutions described in the present application.
  • the terminal 1800 may further include a memory 1804 for storing program codes and data for the terminal 1800.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be composed of corresponding software modules, which may be stored in a random access memory (RAM), a flash memory, a read only memory (ROM), an erasable programmable read only memory ( Erasable Programmable ROM (EPROM), electrically erasable programmable read only memory (EEPROM), registers, hard disk, removable hard disk, compact disk read only (CD-ROM) or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in a core network interface device.
  • the processor and the storage medium may also exist as discrete components in the core network interface device.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network devices. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each functional unit may exist independently, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • the present application can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. .
  • the technical solution of the present application which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer.
  • a hard disk or optical disk, etc. includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present application.

Abstract

本申请涉及无线通信技术领域。本申请的实施例提供一种安全保护的方法、装置和系统，用以解决终端切换服务基站的效率低的问题。本申请的方法包括：第一接入网设备接收来自第二接入网设备的用户面信息和安全策略的对应关系；第一接入网设备根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法，第一用户面保护算法包括用户面加密算法和用户面完整性保护算法之一或全部。本申请适用于终端切换服务基站的流程中。

Description

一种安全保护的方法、装置和系统
本申请要求于2017年9月30日提交中国专利局、申请号为201710945254.4、发明名称为“一种安全保护的方法、装置和系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，尤其涉及一种安全保护的方法、装置和系统。
背景技术
在通信系统中，如果终端快速移出为自身服务的基站的服务范围时，为了保证终端的会话连续性(例如保证终端正在进行的业务不中断)，原基站会发起终端的切换流程，将终端的服务基站由原基站切换至目标基站，由目标基站继续支持终端正在进行的业务。
在终端的切换流程中，原基站向目标基站发送的切换请求包括终端的安全能力和终端切换过程中基站的密钥(kye in evloved NodeB，KeNB*)。目标基站可根据接收到的终端的安全能力和KeNB*，确定信令面加密算法、信令面完整性保护算法和用户面加密算法，并且目标基站分别生成信令面加密密钥、信令面完整性保护密钥和用户面加密密钥。然后目标基站通过原基站向终端发送切换命令消息，切换命令消息中携带目标基站确定的信令面加密算法、信令面完整性保护算法和用户面加密算法。接着终端根据切换命令消息中携带的算法分别生成信令面加密算法、信令面完整性保护算法以及用户面加密算法，进而终端使用信令面加密算法和信令面完整性保护算法对切换确认消息进行加密，并将加密后的切换确认消息发送给目标基站。
在终端的切换流程中，无论是否需要进行信令面安全保护和用户面安全保护，目标基站都会确定信令面加密算法，信令面完整性保护算法以及用户面加密算法，会增大目标基站的开销，并且会增加目标基站为终端切换作准备的时间，从而降低终端的切换效率。
发明内容
本申请的实施例提供一种安全保护的方法、装置和系统，可以解决终端切换服务基站的效率低的问题。
为了达到上述目的，本申请的实施例采用如下技术方案：
第一方面，本申请的实施例提供一种安全保护的方法，该方法包括：第一接入网设备接收来自第二接入网设备的用户面信息和安全策略的对应关系，然后第一接入网设备根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法，第一用户面保护算法包括用户面加密算法和用户面完整性保护算法之一或全部。本申请实施例的方案中，第一接入网设备可以只确定用户面保护算法，无需开启信令面保护，节省了网络开销。进一步的，若应用于终端切换的场景中，能够减少第一接入网设备为终端切换作准备的时间，从而提高了终端的切换效率。
其中，用户面信息可包括PDU会话标识，QoS参数和切片参数中的任意一项或多 项。
用户面信息和安全策略的对应关系的表现形式可以为具有一个对应关系的用户面信息和安全策略的组合。多种用户面信息可以通过一个对应关系对应多种安全策略，例如一组用户面信息和安全策略的对应关系中的用户面信息包括PDU会话标识和QoS参数，安全策略包括安全策略1和安全策略2。或者，一种用户面信息通过一个对应关系对应一种安全策略，例如一组用户面信息和安全策略的对应关系为一个QoS参数和一种安全策略的组合。
作为一个例子，用户面信息和安全策略的对应关系可以为{PDU session ID＝1，NIA＝1，NEA＝2}，表示PDU会话标识为1的会话，使用1号用户面完整性保护算法进行用户面完整性保护，使用2号用户面加密算法进行用户面加密保护。
可选地，本申请实施例的方案可以应用于终端切换服务基站的过程中，第一接入网设备可以为TgNB，第二接入网设备可以为SgNB,在终端切换服务基站的过程中，第一接入网设备可以只确定用户面保护算法，无需开启信令面保护，节省了网络开销，减少了第一接入网为终端切换作准备的时间，从而提高了终端的切换效率。
在一种可能的设计中，第一接入网设备确定第一用户面保护算法为信令面保护算法。
在另一种可能的设计中，第一接入网设备确定信令面保护算法，信令面保护算法包括信令面加密算法和信令面完整性保护算法之一或全部。
在一种可能的设计中，第一接入网设备通过第二接入网设备向终端发送第一指示信息，第一指示信息用于指示第一用户面保护算法与信令面保护算法相同；或者，第一指示信息用于指示第一接入网设备确定的信令面保护算法标识。
通过本申请实施例的方案，第一接入网设备在确定信令面保护算法之后，通知终端可用的信令面保护算法，以便终端及时开启信令面安全保护，对信令面消息进行安全保护，保证了信令面消息的安全性。
在一种可能的设计中，安全策略用于指示开启的安全保护类型，安全保护类型包括用户面加密保护和用户面完整性保护之一或全部；第一接入网设备根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法的方法为：第一接入网设备确定安全策略指示开启的安全保护类型对应的第一用户面保护算法。
其中，每个安全保护类型对应一个算法集合。其中一种实现方式为：第一接入网设备中存储了用户面加密算法集合，用户面完整性保护算法集合，第一接入网设备不区分用户面加密算法和信令面加密算法，也不区分用户面完整性保护算法和信令面完整性保护算法，即用户面加密算法集合也可作为信令面加密算法集合，用户面完整性保护算法集合也可作为信令面完整性保护算法集合。另一种实现方式为：第一接入网设备区分用户面加密算法和信令面加密算法，区分用户面完整性保护算法和信令面完整性保护算法，第一接入网设备存储了用户面加密算法集合，用户面完整性保护算法集合，信令面加密算法集合和信令面完整性保护算法集合。上述算法集合均可以以优先级列表的形式存在，优先级列表中的算法按照优先级从高到低的顺序排列。
在另一种可能的设计中，安全策略中包括用户面保护算法标识；所述第一接入网设备根据所述用户面信息和安全策略的对应关系确定用户面保护算法的方法具体为： 第一接入网设备确定用户面保护算法标识对应的第二用户面保护算法；若第一接入网设备和终端均支持第二用户面保护算法，则第一接入网设备确定第二用户面保护算法为第一用户面保护算法；或者，若第一接入网设备和终端中的任意一个不支持第二用户面保护算法，则第一接入网设备从第二用户面保护算法所属的安全保护类型对应的安全算法集合中，选择第一接入网设备和终端均支持的第一用户面保护算法。
可选地，安全保护类型对应的安全算法集合可以以优先级列表的形式存在，优先级列表中的算法按照优先级从高到低的顺序排列。
可选地，第一接入网设备还可以接收来自第二接入网设备的终端的安全能力，终端的安全能力中包括终端支持的用户面保护算法，第一接入网设备可从第二用户面保护算法所属的安全保护类型对应的安全算法集合中，选择终端支持的优先级最高的用户面保护算法。
在一种可能的设计中，第一接入网设备根据第一用户面保护算法生成用户面保护密钥，用户面保护密钥包括用户面加密密钥和用户面完整性保护密钥之一或全部。
在一种可能的设计中，第一接入网设备根据所述信令面保护算法生成信令面保护密钥，信令面保护密钥包括信令面加密密钥和信令面完整性保护密钥之一或全部。
在一种可能的设计中，第一接入网设备通过所述第二接入网设备向终端发送经过用户面完整性保护密钥或信令面完整性保护密钥保护的第一消息，第一消息中包括所述第一用户面保护算法。
可选地，若第一接入网设备已经确定了信令面保护算法，第一消息中还可携带信令面保护算法。
在一种可能的设计中，第一接入网设备接收来自终端的经过用户面保护密钥保护的或经过信令面保护密钥保护的第二消息，第二消息为第一消息的响应消息。
在一种可能的设计中，该方法还包括：第一接入网设备向接入和移动性管理功能AMF节点发送用户面信息和安全策略的对应关系，然后第一接入网设备接收来自AMF节点的第二指示信息和安全策略之一或全部，第二指示信息用于指示是否可以使用来自第二接入网设备的安全策略，若第一接入网设备接收到来自AMF节点的安全策略，且来自AMF节点的安全策略与来自第二接入网设备的安全策略不同，则根据来自AMF节点的安全策略重新确定第一用户面保护算法和用户面保护密钥；若第一接入网设备接收到来自AMF节点的第二指示信息，未接收到来自AMF节点的安全策略，且第二指示信息指示第一接入网设备不能使用来自第二接入网设备的安全策略，则第一接入网设备根据默认安全策略重新确定第一用户面保护算法和用户面保护密钥。
本申请实施例提供方案，第一接入网设备可对当前使用的安全策略进行验证，以获取适应第一接入网设备的资源情况的安全策略，如果第二接入网设备被攻击者攻破，并且发送了一个降低安全等级的安全策略给第一接入网设备，使得第一接入网设备根据该安全策略确定的的用户面保护算法的安全能级等级较低，使得使用该用户面保护算法保护的信息可以被轻易破解。因此第一接入网设备使用AMF节点下发的安全策略，可以避免这个漏洞，可以进一步提高安全性。
第二方面，本申请的实施例提供一种安全保护的方法，该方法包括：第二接入网设备获取用户面信息和安全策略的对应关系，第二接入网设备向第一接入网设备发送 用户面信息和安全策略的对应关系。
第三方面，本申请的实施例提供一种安全保护的方法，该方法包括：接入和移动性管理功能AMF节点接收来自第二接入网设备的用户面信息，然后AMF节点向会话管理功能SMF节点发送用户面信息，AMF节点接收来自SMF节点的用户面信息对应的安全策略，AMF节点向第一接入网设备发送用户面信息对应的安全策略。
通过本申请实施例的方案，在第二接入网设备与第一接入网设备之间不存在通信接口的情况下，可由第二接入网设备触发AMF节点和SMF节点为第二接入网设备提供用户面信息和安全策略的对应关系，使得终端可以切换至第二接入网设备。
第四方面，本申请的实施例提供一种安全保护的方法，该方法包括：会话管理功能SMF节点接收来自接入和移动性管理功能AMF节点的用户面信息，SMF节点确定所述用户面信息对应的安全策略，SMF节点通过所述AMF节点向第一接入网设备发送所述用户面信息对应的安全策略。
本申请实施例提供方案，SMF节点可通过AMF节点为第一接入网设备的资源情况的安全策略，如果第二接入网设备被攻击者攻破，并且发送了一个降低安全等级的安全策略给第一接入网设备，使得第一接入网设备根据该安全策略确定的的用户面保护算法的安全能级等级较低，使得使用该用户面保护算法保护的信息可以被轻易破解。因此第一接入网设备使用AMF节点下发的安全策略，可以避免这个漏洞，可以进一步提高安全性。
第五方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中第一接入网设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为第一接入网设备，或者可以为第一接入网设备中的芯片。
在一个可能的设计中，该装置为第一接入网设备，第一接入网设备包括处理器，所述处理器被配置为支持第一接入网设备执行上述方法中相应的功能。进一步的，第一接入网设备还可以包括通信接口，所述通信接口用于支持第一接入网设备与第二接入网设备或AMF节点的通信。进一步的，第一接入网设备还可以包括收发器，该收发器用于支持第一接入网设备与终端的通信。进一步的，第一接入网设备还可以包括存储器，所述存储器用于与处理器耦合，其保存第一接入网设备必要的程序指令和数据。
第五方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中第二接入网设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为第二接入网设备，或者可以为第二接入网设备中的芯片。
在一个可能的设计中，该装置为第二接入网设备，第二接入网设备包括处理器，所述处理器被配置为支持第二接入网设备执行上述方法中相应的功能。进一步的，第二接入网设备还可以包括通信接口、发射器和接收器，所述通信接口用于支持第二接入网设备与第一接入网或AMF节点的通信，所述发射器和接收器用于支持第二接入网设备与终端之间的通信。进一步的，第二接入网设备还可以包括收发器，该收发器用于支持该第二接入网设备与终端的通信。进一步的，第二接入网设备还可以包括存储器，所述存储器用于与处理器耦合，其保存第二接入网设备必要的程序指令和数据。
第六方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中AMF节点行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为AMF节点，或者可以为AMF节点中的芯片。
在一个可能的设计中，该装置为AMF节点，AMF节点包括处理器，所述处理器被配置为支持AMF节点执行上述方法中相应的功能。进一步的，AMF节点还可以包括通信接口，所述通信接口用于支持AMF节点与第一接入网设备、第二接入网设备或SMF节点之间的通信。进一步的，AMF节点还可以包括存储器，所述存储器用于与处理器耦合，其保存AMF节点必要的程序指令和数据。
第七方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中SMF节点行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为SMF节点，或者可以为SMF节点中的芯片。
在一个可能的设计中，该装置为SMF节点，SMF节点包括处理器，所述处理器被配置为支持SMF节点执行上述方法中相应的功能。进一步的，SMF节点还可以包括通信接口，所述通信接口用于支持SMF节点与AMF节点之间的通信。进一步的，SMF节点还可以包括存储器，所述存储器用于与处理器耦合，其保存SMF节点必要的程序指令和数据。
第八方面，本申请实施例提供一种装置，该装置具有实现上述方法设计中终端行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该装置可以为终端，或者可以为终端中的芯片。
在一个可能的设计中，该装置为终端，终端包括处理器，所述处理器被配置为支持终端执行上述方法中相应的功能。进一步地，终端还可以包括发射器和接收器，所述发射器和接收器用于支持终端与接入网设备之间的通信。进一步的，终端还可以包括存储器，所述存储器用于与处理器耦合，其保存终端必要的程序指令和数据。
第九方面，本申请实施例提供一种通信系统，该系统包括上述方面所述的第一接入网设备和第二接入网设备；或者，该系统包括上述方面所述的第一接入网设备、第二接入网设备和AMF节点；或者，该系统包括上述方面所述的第一接入网设备、第二接入网设备、AMF节点以及SMF节点；或者，该系统包括上述方面所述的第一接入网设备、第二接入网设备、AMF节点、SMF节点和终端。
第十方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于第一接入网设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第十一方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于第二接入网设备所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第十二方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于AMF节点所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第十三方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于SMF节点所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第十四方面，本申请实施例提供一种计算机存储介质，用于储存为上述用于终端所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
第十五方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第一方面所述的方法。
第十六方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第二方面所述的方法。
第十七方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第三方面所述的方法。
第十八方面，本申请的实施例提供一种包括指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如上述第四方面所述的方法。
第十九方面，本申请的实施例提供一种芯片系统，应用于第一接入网设备中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第一方面所述的方法中所述第一接入网设备的操作。
第二十方面，本申请的实施例提供一种芯片系统，应用于第二接入网设备中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第二方面所述的方法中所述第二接入网设备的操作。
第二十一方面，本申请的实施例提供一种芯片系统，应用于AMF节点中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第三方面所述的方法中所述AMF节点的操作。
第二十二方面，本申请的实施例提供一种芯片系统，应用于SMF节点中，所述芯片系统包括至少一个处理器，存储器和接口电路，所述存储器、所述收发器和所述至少一个处理器通过线路互联，所述至少一个存储器中存储有指令；所述指令被所述处理器执行，以执行上述第三方面所述的方法中所述SMF节点的操作。
相比于现有技术，本申请实施例的方案中，在终端切换的过程中，第一接入网设备可以只确定用户面保护算法，无需开启信令面保护，节省了网络开销，减少了第一接入网设备为终端切换作准备的时间，从而提高了终端的切换效率。
附图说明
图1为本申请的实施例提供的一种可能的网络架构的示意图；
图2为本申请的实施例提供的一种安全保护的方法的流程图；
图3为本申请的实施例提供的另一种安全保护的方法的流程图；
图4为本申请的实施例提供的另一种安全保护的方法的流程图；
图5为本申请的实施例提供的另一种安全保护的方法的流程图；
图6为本申请的实施例提供的另一种安全保护的方法的流程图；
图7为本申请的实施例提供的另一种安全保护的方法的流程图；
图8为本申请的实施例提供的另一种安全保护的方法的流程图；
图9为本申请的实施例提供的另一种安全保护的方法的流程图；
图10为本申请的实施例提供的一种装置的示意性框图；
图11为本申请的实施例提供的另一种装置的示意性框图；
图12为本申请的实施例提供的一种接入网设备的结构示意图；
图13为本申请的实施例提供的另一种装置的示意性框图；
图14为本申请的实施例提供的一种AMF节点的结构示意图；
图15为本申请的实施例提供的另一种装置的示意性框图；
图16为本申请的实施例提供的一种SMF节点的结构示意图；
图17为本申请的实施例提供的另一种装置的示意性框图；
图18为本申请的实施例提供的一种终端的结构示意图。
具体实施方式
下面下面将结合附图对本申请作进一步地详细描述。方法实施例中的具体操作方法也可以应用于装置实施例或系统实施例中。其中，在本申请的描述中，除非另有说明，“多个”的含义是两个或两个以上。
本申请描述的系统架构及业务场景是为了更加清楚的说明本申请的技术方案，并不构成对于本申请提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
本申请的实施例可以应用于下一代无线通信系统中，例如5G通信系统，如图1所示，图1示出了本申请的一种可能的网络架构示意图，该网络架构中包括：
接入和移动性管理(access and mobility management function，AMF)节点：为负责移动性管理的网元，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如合法监听，接入授权等功能。
会话管理功能(session management function，SMF)节点：用于为用户面分配会话资源。
鉴权服务功能(authentication server function，AUSF)节点：当AUSF对终端进行鉴权的时候，负责验证传递待认证参数和认证终端的真实性。主要功能包括：接收安全锚点功能(security anchor function，SEAF)节点发送的鉴权请求；选择鉴权方法。
SEAF节点：SEAF节点在现阶段属于AMF节点的一部分，主要负责向AUSF发起鉴权请求，在EPS-AKA*鉴权过程完成网络侧对终端的认证。
用户面功能(user plane function，UPF)节点：为用户面数据的出口，用于连接外部网络。
数据网络(Data Network，DN)：用于提供外部数据的网络，例如因特网(Internet)等。
(无线)接入网((radio)access network，(R)AN)节点：(R)RAN可以采用不同的接入技术。目前的无线接入技术有2种类型：第三代合作伙伴计划(3rd  generation partnership project，3GPP)接入技术(例如3G、4G或5G系统中采用的无线接入技术)和非第三代合作伙伴计划(none 3rd generation partnership project，non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网称为无线接入网(RAN)，其中，5G系统中的接入网设备称为下一代基站节点(next generation node basestation，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi接入点(access point，AP)为代表的空口技术。
终端：本申请所称的终端，是一种具有无线收发功能的设备，可以部署在陆地上，包括室内或室外、手持或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。该终端可以包括各种类型的用户设备(user equipment，UE)、手机(mobile phone)、平板电脑(pad)、带无线收发功能的电脑、无线数据卡、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、机器类型通信(machine type communication,MTC)的终端设备，工业控制(industrial control)中的终端设备、无人驾驶(self driving)中的终端设备、远程医疗(remote medical)中的终端设备、智能电网(smart grid)中的终端设备、运输安全(transportation safety)中的终端设备、智慧城市(smart city)中的终端设备，以及可穿戴设备(如智能手表，智能手环，计步器等)等等。在采用不同的无线接入技术的系统中，具备相类似无线通信功能的终端的名称可能会有所不同，仅为描述方便，本申请实施例中，上述具有无线收发通信功能的装置统称为终端。
具体地，本申请中的终端中存储有长期密钥和相关函数，终端在与核心网节点(如AMF节点、AUSF节点等)进行双向鉴权时，可使用长期密钥和相关函数对验证网络的真实性。
接入网设备：本申请实施例所涉及到的接入网设备是一种部署在无线接入网中用以为终端提供无线通信功能的装置。例如，接入网设备可以是基站(Base Station，BS)，所述基站可以包括各种形式的宏基站，微基站，中继站，接入点等等。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同，例如在5G系统中，称为下一代基站节点，在长期演进(Long Term Evolution，LTE)系统中，称为演进的节点B(evolved NodeB，eNB或eNodeB)，在第三代(3rd Generation，3G)通信系统中，称为节点B(Node B)等等。为方便描述，本发明实施例中，上述为终端提供无线通信功能的装置统称为接入网设备。
网络能力开放功能(network exposure function，NEF)节点：主要用于与第三方交互，使第三方可以间接与某些3GPP网络内部的网元进行交互。
网络功能存储(network function repository function，NRF)节点：用于网元间发现，维护网络功能(network function，NF)。
策略控制功能(policy control function，PCF)节点：PCF节点中存储有最新的服务质量(quality of service，QoS)规则，基站可根据SMF节点提供的QoS规则，为用户面传输通道分配合适的资源。
统一的数据管理(unified data management，UDM)节点：用于存储用户的签约 信息。
应用功能(application function，AF)节点：AF节点可以位于DN内部，属于部署在第三方的功能网元，此网元主要作用是告知PCF节点最新的第三方企业对于某个应用的业务要求。PCF节点可根据业务要求生成相应的QoS规则，确保网络提供的服务满足第三方所提出的要求。
在现有的流程中，终端在由原基站切换至目标基站的过程中，目标基站会确定信令面加密算法，信令面完整性保护以及用户面加密算法，即目标基站会同时开启用户面安全保护和信令面安全保护。即在终端切换服务基站的流程中，无论是否需要进行信令面安全保护，目标基站都会开启信令面安全保护，确定信令面加密算法以及信令面完整性保护算法，会增大网络开销，并且增加目标基站为终端切换作准备的时间，导致终端的切换效率较低。
为了解决上述问题，在本申请的实施例中，可以实现用户面安全保护的开启过程与信令面安全保护的开启过程之间的解耦，即可以先开启用户面安全保护算法，当需要进行信令面保护的时候再开启信令面安全保护，从而在终端的切换过程中省去了开启信令面安全保护的网络开销，从而能够提高终端的切换效率。
首先，对本申请实施例中涉及到的相关术语进行解释说明。
第一接入网设备，可以为RAN节点，例如可以为5G系统中的下一代基站节点。当本申请的实施例应用于终端切换服务基站的流程中时，第一接入网设备可以为目标下一代基站节点(target next generation node basestation，TgNB)。
第二接入网设备，可以为RAN节点，例如可以为5G系统中的下一代基站节点，当本申请的实施例应用于终端切换服务基站的流程中时，第二接入网设备可以为原下一代基站节点(source next generation node basestation，SgNB)。
以下对本申请提出的技术方案进行详细描述。
如图2所示，本申请的实施例提供一种安全保护的方法，该方法包括：步骤201-203。
步骤201、第二接入网设备获取用户面信息和安全策略的对应关系。
其中，用户面信息可以包括数据包单元(packet data unit，PDU)会话标识，服务质量(quality of service，QoS)参数(比如服务质量数据流标识符(quality of service flow identifier，QFI)),数据无线承载(data radio bearer，DRB)标识和切片参数(比如切片标识)中的任意一项或多项。
安全策略用于指示开启的用户面安全保护类型或者用于指示建议开启的用户面保护算法标识，安全保护类型包括用户面加密保护和用户面完整性保护之一或全部，用户面算法标识可以为用户面加密算法标识和用户面完整性保护算法标识之一或全部，具体地，安全策略中可以携带一个或多个用户面算法标识，例如可以携带至少一种用户面加密算法标识，或者携带至少一种完整性保护算法标识，或者携带至少一种用户面加密算法标识和至少一种用户面完整性保护算法标识。
具体地，用户面信息和安全策略的对应关系的表现形式可以为具有一个对应关系的用户面信息和安全策略的组合，可以将这样的一个组合称为一组用户面信息和安全策略的对应关系。可选地，用户面信息可以通过一个对应关系对应多种安全策略，例如一组用户面信息和安全策略的对应关系中的用户面信息包括PDU会话标识，安全策 略包括安全策略1和安全策略2，可以理解为一个PDU会话标识同时对应两个安全策略。再例如，一组用户面信息和安全策略的对应关系中的用户面信息包括DRB标识，安全策略包括安全策略1和安全策略2。或者，一种用户面信息通过一个对应关系对应一种安全策略，例如一组用户面信息和安全策略的对应关系为一个PDU会话标识和一种安全策略的组合。再例如一组用户面信息和安全策略的对应关系为一个DRB标识和一种安全策略的组合。
多组用户面信息和安全策略的对应关系即为多组对应关系，例如，其中一组为PDU会话标识和QoS参数和安全策略1和安全策略2的组合，另一组为QoS参数和安全策略3的组合。
具体地，第二接入网设备根据网络侧的配置信息确定获取一组还是获取多组用户面信息和安全策略的对应关系。比如，以用户面信息和安全策略的对应关系为PDU会话标识和安全策略的组合为例进行说明。若网络侧配置信息为只传输需要切换的会话的PDU会话标识，且当只有一个需要切换的会话时，第二接入网设备只获取一组PDU会话标识和安全策略的组合；当需要切换的会话有多个的时候，则第二接入网设备需要获取每个需要切换的PDU会话标识和安全策略的组合；或者，第二接入网设备根据网络侧配置信息，获取自身保存的所有的PDU会话标识和安全策略的组合。
可选地，第二接入网设备可以只获取一个安全策略，该安全策略适用于所有用户面信息。
可选地，可以用两个比特位信息来代表安全策略指示开启的安全保护类型，例如安全策略为“XY”，X＝0代表不开启用户面加密保护，X＝1代表开启用户面加密保护，Y＝0代表不开启用户面完整性保护，Y＝1代表开启用户面完整性保护。
比如，{PDU session ID＝1，11}表示PDU会话标识为1，该PDU会话标识对应的安全策略为用户面加密保护开启，用户面完整性保护开启。或者，{QFI＝1,11}表示QoS流标识为1的QoS流，该QoS流对应的安全策略为用户面加密保护开启，用户面完整性保护开启。或者，{DRB ID＝1，11}表示DRB标识为1，DRB标识为1的DRB对应的安全策略为用户面加密保护开启，用户面完整性保护开启。
再比如，{PDU session ID＝1，10，DRB ID＝1}表示PDU会话标识为1的会话，正在使用DRB标识为1的DRB，对应的安全策略为开启用户面加密保护，不开启用户面完整性保护。或者，{QFI＝1,10，DRB ID＝1}表示QoS流标识为1的QoS流，正在使用DRB标识为1的DRB，对应的安全策略为开启用户面加密保护，不开启用户面完整性保护。
再比如，{PDU session ID＝2,QFI＝1,01，DRB ID＝2}表示PDU会话标识为2的会话中QFI为1的QoS流，正在使用DRB标识为2的DRB，对应的安全策略为不开启用户面加密保护，开启用户面完整性保护。
再比如，{DRB ID＝1，DRB ID＝2,01}表示DRB标识为1的DRB和DRB标识为2的DRB对应的安全策略为不开启用户面加密保护，开启用户面完整性保护。
可选地，第二接入网设备可确定多组用户面安全信息和用户策略的对应关系，若在终端切换服务基站的流程中，第二接入网设备需获取每个需要切换的PDU会话的PDU会话标识与用户策略的对应关系。例如，多组用户面安全信息和用户策略的对应关系 可以为{{PDU session ID＝1，10，DRB ID＝1}，{PDU session ID＝2,QFI＝1,01，DRB ID＝2}}。
可选地，还可以用推荐的算法标识代表安全策略指示开启的用户面保护算法标识。示例性地，用户面信息和安全策略的对应关系可以为{PDU session ID＝1，NIA＝1，NEA＝2}，表示PDU会话标识为1的会话，使用1号用户面完整性保护算法进行用户面完整性保护，使用2号用户面加密算法进行用户面加密保护。可选地，若NIA＝0，则代表不开启用户面完整性保护，若NEA＝0，代表不开启用户面加密保护。在另一个示例中，{PDU session ID＝1，NIA＝1，NIA＝2，NEA＝2，NEA＝1}，表示PDU会话标识为1的会话，优先推荐使用1号用户面完整性保护算法进行用户面完整性保护，其次推荐使用2号用户面完整性保护算法进行用户面完整性保护，优先推荐使用2号用户面加密算法进行用户面加密保护，其次推荐使用1号用户面加密算法进行用户面加密保护。再例如，用户面信息和安全策略的对应关系可以为{DRB ID＝1，NIA＝1，NEA＝2}，表示DRB标识为1的会话，使用1号用户面完整性保护算法进行用户面完整性保护，使用2号用户面加密算法进行用户面加密保护。
可选地，用户面信息和安全策略的对应关系还可以为{PDU session ID＝1，“1111”，NEA＝2}，表示PDU会话标识为1的会话，不开启用户面完整性保护，使用2号用户面加密算法对用户面数据进行加密保护。
再例如，用户面信息和安全策略的对应关系为{PDU session ID＝1，NIA＝1，“1111”}，表示PDU会话标识为1的会话，使用1号用户面完整性保护算法进行用户面完整性保护，不开启用户面加密保护。
其中，“1111”为一种指示信息，用于指示不开启某种保护，若用户面信息和安全策略的对应关系中，应携带用户面加密算法标识的位置为“1111”，则代表不开启用户面加密算法，若应携带用户面完整性保护算法标识的位置为“1111”，则代表不开启用户面完整性保护算法。注意，本发明使用“1111”为示例性，其他类似功能的指示信息均在本发明保护范围内。
步骤202、第二接入网设备向第一接入网设备发送用户面信息和安全策略的对应关系。相应地，第一接入网设备接收来自第二接入网设备的用户面信息和安全策略的对应关系。
其中，第二接入网设备可将步骤201中获取的用户面信息和安全策略的对应关系发送给第一接入网设备。
可选地，第二接入网设备可将一组或多组用户面信息和安全策略的对应关系发送给第一接入网设备。具体地，第二接入网设备发送的用户面信息和安全策略的对应关系的组数和第二接入网设备在步骤201中获取的用户面信息和安全策略的对应关系的组数相同。
在一种可能的方式中，第二接入网设备可以只向第一接入网设备发送安全策略，该安全策略适用于与终端相关的所有用户面信息。
步骤203、第一接入网设备根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法。
其中，第一用户面保护算法包括用户面加密算法和用户面完整性保护算法之一或 全部。
可选地，若第一接入网设备接收到的用户面信息和安全策略的对应关系中的安全策略用于指示开启的安全保护类型，则第一接入网设备确定安全策略指示开启的各安全保护类型对应的第一用户面保护算法。
具体地，每个安全保护类型对应一个算法集合。其中一种实现方式为：第一接入网设备中存储了用户面加密算法集合，用户面完整性保护算法集合，第一接入网设备不区分用户面加密算法和信令面加密算法，也不区分用户面完整性保护算法和信令面完整性保护算法，即用户面加密算法集合也可作为信令面加密算法集合，用户面完整性保护算法集合也可作为信令面完整性保护算法集合。另一种实现方式为：第一接入网设备区分用户面加密算法和信令面加密算法，区分用户面完整性保护算法和信令面完整性保护算法，第一接入网设备存储了用户面加密算法集合，用户面完整性保护算法集合，信令面加密算法集合和信令面完整性保护算法集合。
需要说明的是，上述描述的每个算法集合均可以以优先级列表的形式存在，以用户面加密算法集合为例，用户面加密算法集合可以为一个优先级列表，该优先级列表中的用户面加密算法按照优先级从高到低的顺序排列。
若安全策略指示开启的安全保护类型为用户面加密保护，则第一接入网设备从用户面加密算法集合中选择一个加密算法，可选地，可以从用户面加密算法集合中选择终端支持的优先级最高的用户面加密算法，例如，终端支持用户面加密算法1和用户面加密算法3，在用户面加密算法集合中用户面加密算法1的优先级高于用户面加密算法3，则第一接入网设备选择用户面加密算法1。
若安全策略指示开启的安全保护类型为用户面完整性保护，则第一接入网设备从用户面完整性保护算法集合中选择一个用户面完整性保护算法，可选地，可以从用户面完整性算法集合中选择终端支持的优先级最高的用户面完整性保护算法，例如，终端支持用户面完整性保护算法1和用户面完整性保护算法3，在用户面完整性保护算法集合中用户面完整性保护算法1的优先级高于用户面完整性保护算法3，则第一接入网设备选择用户面完整性保护算法1。
若安全策略指示开启的安全保护类型为用户面加密保护和用户面完整性保护，则第一接入网设备从用户面加密算法集合中选择一个用户面加密算法，从用户面完整性保护集合中选择一个用户面完整性保护算法。
示例性地，若第一接入网设备接收到的用户面信息和安全策略的对应关系为{PDU session ID＝1，11}，则第一接入网设备确定需为PDU会话标识为1的会话开启用户面加密保护和用户面完整性保护，进而第一接入网设备从用户面加密算法集合中选择终端支持的优先级最高的用户面加密算法，从用户面完整性保护算法集合中选择终端支持的优先级最高的用户面完整性保护算法。
可选地，若第一接入网设备接收到的用户面信息和安全策略的对应关系中的安全策略包括推荐的用户面保护算法标识，则步骤203具体可以实现为：
第一接入网设备确定用户面保护算法标识对应的第二用户面保护算法；
若第一接入网设备和终端均支持第二用户面保护算法，则第一接入网设备确定第二用户面保护算法为第一用户面保护算法；或者，
若第一接入网设备和终端中的任意一个不支持第二用户面保护算法，则第一接入网设备从第二用户面保护算法所属的安全保护类型对应的安全算法集合中，选择终端支持的优先级最高的第一用户面保护算法。
若推荐的用户面保护算法标识不止一个，则重复上述步骤，分别根据每个推荐的用户面保护算法标识确定出第一用户面保护算法。
可以理解的是，由于安全策略中包括用户面保护算法标识，所以也隐含指示了开启的安全保护类型。
示例性地，第一接入网设备接收到的用户面信息和安全策略的对应关系为{PDU session ID＝1，NIA＝1，NEA＝2}，则第一接入网设备确定需要为PDU会话标识为1的会话开启用户面完整性保护和用户面加密保护。
然后第一接入网设备判断1号用户面完整性保护算法是否满足以下条件：
条件1：1号用户面完整性保护算法为第一接入网设备和终端均支持的的用户面完整性保护算法。
条件2：1号用户面完整性保护算法为第一接入网设备和终端均支持的用户面完整性保护算法，且1号用户面完整性保护算法为第一接入网设备的用户面完整性保护算法集合中，终端支持的优先级最高的用户面完整性保护算法。示例性地，若终端支持1号和3号用户面完整性保护算法,这两个算法均处于用户面完整性保护算法集合中，且在用户面完整性保护算法集合中1号用户面完整性保护算法的优先级高于3号用户面完整性保护算法的优先级，则认为1号用户面完整性保护算法满足条件2。
若1号用户面完整性保护算法满足条件1或满足条件2，则使用1号用户面完整性保护算法，若1号用户面完整性保护算法不满足条件1或不满足条件2，则第一接入网设备从用户面完整性保护算法集合中选择终端支持的优先级最高的用户面完整性算法。
第一接入网设备还可以判断2号用户面加密算法是否满足以下条件：
条件3：2号用户面加密算法为第一接入网设备和终端均支持的用户面加密算法。
条件4：2号用户面加密算法为第一接入网设备和终端均支持的用户面加密算法，且2号用户面加密算法为第一接入网设备的用户面加密算法集合中，终端支持的优先级最高的用户面加密算法。示例性地，若终端支持2号和3号用户面加密算法,这两个算法均处于用户面加密算法集合中，且在用户面加密算法集合中2号用户面加密算法的优先级高于3号用户面加密算法的优先级，则认为2号用户面加密算法满足条件2。
若2号用户面加密算法满足条件3或条件4，则使用2号用户面加密算法，若2号用户面加密算法不满足条件3或不满足条件4，则第一接入网设备从用户面加密算法集合中选择终端支持的优先级最高的用户面加密算法。
再例如，若第一接入网设备接收到的用户面信息和安全策略的对应关系为{PDU session ID＝1，“1111”，NEA＝2}，则第一接入网设备确定需要为PDU会话标识为1的会话开启用户面加密保护，无需开启用户面完整性保护。则第一接入网设备仅需按照上述方法确定用户面加密算法，无需确定用户面完整性保护算法。
可选地，作为本申请的实施例的一种可能的实现方式，第一接入网设备可以忽略接收到的安全策略的具体内容，第一接入网设备可根据预配置的安全策略确定开启的 安全保护类型。
示例性地，若第一接入网设备接收到的安全策略指示既不开启用户面加密保护，又不开启用户面完整性保护，预配置的安全策略指示开启用户面加密保护，不开启用户面完整性保护，则第一接入网设备根据预配置的安全策略开启用户面加密保护，从用户面加密算法集合中选择第一接入网设备和终端均支持的优先级最高的用户面加密算法。
需要说明的是，若第一接入网设备接收到多组用户面信息与安全策略的对应关系，则第一接入网设备需分别确定每组用户面信息对应的第一用户面保护算法。
本申请的实施例提供的安全保护的方法，第一接入网设备可以只确定用户面保护算法，无需开启信令面保护，节省了网络开销，从而提高了终端的切换效率。
在本申请实施例的一种可能的实现方式中，在上述步骤203中，第一接入网设备根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法，即在步骤203中，第一接入网设备只确定用户面的保护算法，不确定信令面的保护算法。
在本申请实施例的另一种可能的实现方式中，在上述步骤203中，第一接入网设备可根据用户面信息和安全策略的对应关系确定用户面信息对应的第一用户面保护算法，并确定第一用户面保护算法为信令面保护算法。即在步骤203中，第一接入网设备确定一套安全保护算法，既作为用户面保护算法又作为信令面保护算法。可选的，若第一用户面算法为用户面加密算法和用户面完整性保护算法之一，则将确定出的第一用户面算法作为信令面算法，并且进一步的确定出另一种信令面保护算法。比如，若第一用户面算法为用户面加密算法，则用户面加密算法作为信令面加密算法，还需要进一步确定出信令面完整性保护算法。确定方法为第一接入网设备根据终端的安全能力(即终端支持的信令面完整性保护算法)和第二接入网设备预配置的信令面完整性保护算法集合(具有优先级排序的用户面完整性保护算法列表)，确定出信令面完整性保护算法。
作为一种可能的实现方式，第一接入网设备可以在确定第一用户面保护算法之前确定信令面保护算法，即第一接入网设备可以先确定信令面保护算法，确定信令面保护算法之后再确定是否可以将信令面保护算法作为第一用户面保护算法。
在本申请实施例的另一种可能的实现方式中，第一接入网设备在发送信令面消息之前，可以确定信令面保护算法，如图3所示，图3以在确定第一用户面保护算法之后确定信令面保护算法为例进行说明，该方法包括：步骤301-309。
步骤301至步骤303可参考上述步骤201至步骤203中的相关描述，当然本申请不限于此。
可选地，在第一接入网设备确定第一用户面保护算法之后，为了对用户面数据进安全保护，还需生成用户面保护密钥，即需执行步骤304。
步骤304、第一接入网设备根据第一用户面保护算法生成用户面保护密钥。
其中，用户面保护密钥包括用户面加密密钥和用户面完整性保护密钥之一或全部。
若步骤303中，第一接入网设备只确定了用户面加密算法，则用户面保护密钥只包括用户面加密密钥；若第一接入网设备只确定了用户面完整性保护算法，则用户面 保护密钥只包括用户面完整性保护密钥；若第一接入网设备既确定了用户面加密算法，又确定了用户面完整性保护算法，则用户面保护密钥既包括用户面加密密钥，又包括用户面完整性保护密钥。
需要说明的是，本申请的实施例不限制步骤304一定在步骤305之前执行，在步骤303第一接入网设备确定第一用户面保护算法之后，可以在需要发送用户面数据时执行步骤304，生成用户面保护密钥，以对用户面数据进行安全保护。
步骤305、第一接入网设备确定信令面保护算法。
其中，信令面保护算法包括信令面加密算法和信令面完整性保护算法之一或全部。
可选地，步骤305的触发时机包括以下几种：
第一种、在第一接入网设备需要发送信令面消息时触发，例如在第一接入网设备需要发送配置消息给终端设备时触发。
第二种、若图2所示的方法应用于终端切换服务基站的过程中，则步骤304可在第一接入网设备发送完用户面数据后触发。
第三种、在第一接入网设备回到暂停(suspend)状态之前触发。
其中，suspend状态是指：在这种状态下，终端和基站保持部分AS上下文，比如生成的密钥和确定的算法。
第四种、在第一接入网设备接收到终端发送的上行信令面数据后触发，例如在终端发起PDU会话请求后触发。
步骤306、第一接入网设备根据信令面保护算法生成信令面保护密钥。
其中，信令面保护密钥包括信令面加密算法和信令面完整性保护算法之一或全部。
若步骤305中，可选地，第一接入网设备只确定了信令面加密算法，则信令面保护密钥只包括信令面加密密钥；可选地，若第一接入网设备只确定了信令面完整性保护算法，则信令面保护密钥只包括信令面完整性保护密钥；可选地，若第一接入网设备既确定了信令面加密算法，又确定了信令面完整性保护算法，则信令面保护密钥既包括信令面加密密钥，又包括信令面完整性保护密钥。
步骤307、第一接入网设备通过第二接入网设备向终端发送经过用户面完整性保护密钥保护的或经过信令面完整性保护密钥保护的第一消息。
其中，第一消息中包括第一用户面保护算法。可选地，第一消息还包括信令面保护算法。
需要说明的是，若第一消息使用用户面完整性保护密钥保护，则步骤307可在步骤305之前执行，本申请对步骤305、306与步骤307之间的执行顺序不作限制。
可选地，第一接入网设备可使用用户面完整性保护密钥对第一消息进行完整性保护；或者第一接入网设备可使用用户面完整性保护密钥对第一消息进行完整性保护；或者，若第一接入网设备既生成了用户面完整性保护密钥，又生成了信令面完整性保护密钥，第一接入网设备可优先使用信令面完整性保护密钥对第一消息进行完整性保护。
如果第一接入网设备未生成信令面完整性保护密钥，且第一接入网设备接收到的安全策略指示不开启用户面完整性保护，则可选地，不对第一消息进行用户面完整性保护，可选地，第一接入网设备可生成一个随机数，使用用户面加密密钥对这个随机 数进行加密，并将加密后的随机数携带在第一消息中发送给终端，同时将未加密的随机数发送给终端。可选地，若生成了信令面完整性保护密钥，且第一接入网设备接收到的安全策略指示不开启用户面完整性保护的情况下，则使用信令面完整性保护密钥对第一消息进行完整性保护。
或者，若第一接入网设备既生成了用户面完整性保护密钥，又生成了用户面加密密钥，则第一接入网设备可使用用户面完整性保护密钥对第一消息进行完整性保护，可选地，还可以生成随机数，将经过用户面加密密钥加密的随机数携带在第一消息中发送给终端，同时将未加密的随机数发送给终端。
可选地，第一消息中可携带第一指示信息，第一指示信息用于指示第一用户面保护算法与信令面保护算法相同，具体用于指示重用信令面保护算法为第一用户面保护算法；进一步地，第一接入网设备在收到用户面信息和安全策略的对应关系后，首先确定信令面加密算法和信令面完整性保护算法，再根据安全策略，决定重用哪种信令面保护算法为用户面保护算法。或者，
第一指示信息用于指示第一接入网设备确定的信令面保护算法标识。
可选地，第一指示信息可以不携带在第一消息中，第一接入网设备可通过第二接入网设备向终端发送一条专用消息，专用消息中携带第一指示信息。
可以理解的是，采用上述实施例中描述的任意一种确定信令面保护密钥的方法，第一接入网设备都需要向终端发送第一指示信息，以告知终端第一接入网设备使用的信令面保护算法，使得终端能够对经过信令面保护的消息进行解密。
步骤308、终端接收第一消息。
终端接收到第一消息后，可读取第一消息中的第一用户面保护算法，若第一用户面保护算法中包括用户面完整性保护算法，则终端根据用户面完整性保护算法生成用户面完整性保护密钥，使用用户面完整性保护密钥对第一消息进行用户面完整性验证，若验证不通过，则不再继续执行切换流程，或者执行步骤309。
若第一用户面保护算法中不包括用户面完整性保护算法，包括用户面加密保护算法，则终端可根据用户面加密算法生成用户面加密密钥，可选地，使用用户面加密密钥对第一消息中的随机数进行解密，将解密后的随机数与接收到的未加密的随机数进行对比，若对比结果为两个随机数不同，则不再继续执行切换流程，或者执行步骤309。
若第一消息携带了信令面保护算法，并且使用信令面完整性保护密钥进行完整性保护，则终端根据信令面完整性保护算法生产信令面完整性保护密钥，并使用信令面完整性保护密钥对第一消息进行信令面完整性验证。若验证不通过，则可选地，回复消息给第二接入网设备，指示信令面完整性验证失败，或不再继续执行切换流程。
步骤309、终端向第一接入网设备发送经过用户面保护密钥保护的或经过信令面保护密钥保护的第二消息。相应地，第一接入网设备接收第二消息。
其中，第二消息为第一消息的响应消息。
若步骤308中，终端对第一消息验证成功，则第二消息为第一消息的确认消息，可选地，终端使用第一消息同样的保护方法对第二消息进行保护。即，终端可以使用用户面完整性保护密钥对第二消息进行完整性保护，或者使用信令面完整性保护密钥对第二消息进行信令面完整性保护，或者再生成一个随机数，使用用户面加密密钥对 2个随机数进行加密，并将加密后的2个随机数和未加密的2个随机数放到第二消息中。若终端对第一消息验证失败，则第二消息为错误提示消息。采用本申请实施例提供的方法，第一接入网设备可以再终端的切换流程中只开启用户面保护，当需要发送信令面消息时，才确定信令面保护算法，既提高了终端的切换效率，又保证了信令面消息的安全。
可选地，在图3所示的流程之后，第一接入网设备还需对接收到的来自第二接入网设备的安全策略进行验证，如图4所示，该方法包括：步骤401-404。
步骤401、第一接入网设备向AMF节点发送用户面信息和安全策略的对应关系。相应地，AMF节点接收用户面信息和安全策略的对应关系。
步骤402、AMF节点向第一接入网设备发送第二指示信息和安全策略之一或全部。相应地，第一接入网设备接收第二指示信息和安全策略之一或全部。
第二指示信息用于指示第一接入网设备是否可以继续使用来自第二接入网设备的安全策略。
具体地，AMF节点接收到来自第一接入网设备的用户面信息和安全策略的对应关系后，可选的，首先判断自身是否存储了各用户面信息和安全策略的对应关系，若是，则判断接收到的用户面信息对应的安全策略，是否与自身存储的所述用户面信息对应的安全策略相同，若相同，则代表第一接入网设备可以继续使用来自第二接入网设备的安全策略，则AMF节点可向第一接入网设备发送第二指示信息，第二指示信息用于指示第一接入网设备可以使用来自第二接入网设备的安全策略，或者AMF节点向第一接入网设备发送安全策略，该安全策略和第一接入网设备向AMF节点发送的安全策略相同。
或者，若AMF节点接收到的用户面信息对应的安全策略与自身存储的所述用户面信息对应的安全策略不同，则代表第一接入网设备不可以继续使用来自第二接入网设备的安全策略，则AMF节点向第一接入网设备发送第二指示信息，第二指示信息用于指示第一接入网设备不可以使用来自第二接入网设备的安全策略，或者AMF节点向第一接入网设备发送安全策略，该安全策略为AMF节点中存储的所述用户面信息对应的安全策略。
可选地，若AMF节点未存储各用户面信息和安全策略的对应关系，则AMF节点可将接收到的来自第一接入网设备的用户面信息和安全策略的对应关系转发给SMF节点，由SMF节点判断第一接入网设备是否可以继续使用来自第二接入网设备的用户面信息和安全策略的对应关系，具体的判断方法与AMF节点的判断方法相同，然后AMF节点根据SMF节点的判断结果向第一接入网设备发送第二指示信息和安全策略之一或全部。
步骤403、若第一接入网设备接收到来自所述AMF节点的安全策略，且来自AMF节点的安全策略与来自第二接入网设备的安全策略不同，则根据来自AMF节点的安全策略重新确定第一用户面保护算法和用户面保护密钥。
可选地，若来自AMF节点的安全策略与来自第二接入网设备的安全策略相同，则AMF节点可继续使用来自第二接入网设备的安全策略，无需重新确定第一用户面保护算法和用户面保护密钥。
步骤404、若第一接入网设备接收到来自AMF节点的第二指示信息，未接收到来 自AMF节点的安全策略，且第二指示信息指示第一接入网设备不能使用来自第二接入网设备的安全策略，则第一接入网设备根据默认安全策略重新确定第一用户面保护算法和用户面保护密钥。
可选地，若第二指示信息指示第一接入网设备可以使用来自第二接入网设备的安全策略，则第一接入网设备可继续使用来自第二接入网设备的安全策略，无需重新确定第一用户面保护算法和用户面保护密钥。
本申请实施例提供的安全保护的方法，在完成随机接入过程之后，TgNB可对当前使用的安全策略进行验证，以获取适应TgNB的资源情况的安全策略，如果SgNB被攻击者攻破，并且发送了一个降低安全等级的安全策略给TgNB，使得TgNB根据该安全策略确定的的用户面保护算法的安全能级等级较低，使得使用该用户面保护算法保护的信息可以被轻易破解。因此TgNB使用AMF节点下发的安全策略，可以避免这个漏洞，可以进一步提高安全性。
可选地，在第二接入网设备无法直接与第一接入网设备通信的情况下，第二接入网设备可通过AMF节点来确定第一接入网设备，例如，若在终端切换服务基站的流程中，若SgNB与TgNB之间没有直接的通信接口，则SgNB可通过AMF节点来确定TgNB。如图5所示，该方法包括：步骤501-504。
步骤501、第二接入网设备向AMF节点发送用户面信息。相应地，AMF节点接收用户面信息。
步骤502、AMF节点向SMF节点发送所述用户面信息。相应地，SMF节点接收所述用户面信息。
步骤503、SMF节点确定所述用户面信息对应的安全策略。
可选地，SMF节点中存储了或者可以获取到各用户面信息与安全策略的对应关系，SMF接收到所述用户面策略后，可从各用户面信息与安全策略的对应关系中查找所述用户面信息对应的安全策略。
步骤504、SMF节点通过AMF节点向第一接入网设备发送用户面信息对应的安全策略。相应地，第一接入网设备接收用户面信息对应的安全策略。
需要说明的是，第一接入网设备接收到用户面信息对应的安全策略之后的处理流程可参考图2和图3对应的实施例中的处理流程，当然本申请不限于此。
需要说明的是，上述图2至图5对应的实施例描述的方法流程均可应用于终端切换服务基站的过程中，其中，第一接入网设备可以为TgNB，第二接入网设备可以为SgNB，如图6所示，图6以终端切换服务基站的场景对本申请的安全保护方法进行说明，该方法具体包括：步骤601-612。
步骤601、终端向SgNB发送测量报告。相应地，SgNB接收测量报告。
步骤602、SgNB根据测量报告确定需要为终端切换服务基站时，生成下一代基站的密钥(kye in next generation Node Basestation，KgNB*)。
步骤603、SgNB向TgNB发送切换请求(HO request)消息。相应地，TgNB接收切换请求消息。
其中，切换请求消息中包括用户面信息和安全策略的对应关系，还可以包括用户面安全相关参数。
用户面信息包括PDU会话标识、QFI、DRB ID、切片参数中的任意一项或多项。可选地，用户面信息中包括当前需要切换的会话的PDU会话标识，需要切换的会话的QFI，和需要切换的PDU会话中的任意一项或多项对应的DRB ID。或者用于面信息包括终端所有会话的PDU会话标识，并指示需要切换的会话的PDU会话标识。
示例性地，以用户面信息为PDU会话标识为例，每个PDU会话表示对应一个安全策略，安全策略用于指示自身对应的会话是否需要开启用户面加密保护和是否需要开启用户面完整性保护，可选地，安全策略中还可以包括用户面加密保护算法标识和用户面完整性保护算法标识之一或全部。
可选地，切换请求消息中可携带终端的所有PDU会话标识对应的安全策略，也可以只携带需要切换的PDU会话标识对应的安全策略。
示例性地，切换消息中携带的用户面信息和安全策略的对应关系为{{PDU session ID＝1，10，DRB ID＝1}，{PDU session ID＝2,QFI＝1,01，DRB ID＝2}}，表示有两个需要切换的会话，分别为会话1和会话2，会话1使用DRB ID为1的DRB，会话1开启用户面加密保护，不开启用户面完整性保护；会话2中QFI为1的QoS flow使用DRB ID为2的DRB，该QoS flow不开启用户面加密保护，开启用户面完整性保护。
再例如，切换消息中携带的用户面信息和安全策略的对应关系为{PDU session ID＝1，NIA＝1，NEA＝2}表示会话1需要进行切换，会话1使用1号用户面完整性保护算法进行用户面完整性保护，使用2号用户面加密算法进行用户面加密保护。
再例如，终端一共有3个用户面信息与安全策略的对应关系，切换消息中携带这3个用户面信息和安全策略的对应关系，并用1个比特位指示需要切换的用户面信息和安全策略的对应关系，activation bit＝0代表会话不需要切换，activation bit＝1代表会话需要切换，例如，{{PDU session ID＝1，10，DRB ID＝1,activation bit＝0}，{PDU session ID＝2,11,DRB ID＝1，activation bit＝1}，{PDU session ID＝3，01，DRB ID＝2,activation bit＝1}}，代表终端有会话1，会话2和会话3，其中会话2和会话3是需要切换的会话。
为了考虑终端的切换效率，切换请求消息中可以只携带需要切换的用户面信息对应的安全策略，在下文中，均以切换请求消息中只携带需要切换的用户面信息对应的安全策略为例进行说明。
用户面安全相关参数包括终端的安全能力和KgNB*，可选地，还可以包括用于生成密钥的新鲜性参数(例如，序列号，计数器值等)，用于标识当前使用的密钥的密钥标识符等信息。
其中，终端的安全能力包括终端支持的用户面保护算法标识，示例性地，终端的安全能力为终端支持1号用户面加密算法，2号用户面加密算法，3号用户面完整性保护算法，5号用户面完整性保护算法。
步骤604、TgNB确定第一用户面保护算法。
具体地，TgNB可根据用户面信息与安全策略的对应关系、终端的安全能力以及TgNB预配置的安全能力优先级列表确定第一用户面保护算法。
安全能力优先级列表为预配置的列表，信令面和用户面可以共用相同的安全能力 优先级列表，也可以分别使用不同的安全能力优先级列表。TgNB中至少包括两个安全能力列表，以用户面和信令面共用安全能力优先级列表为例，TgNB中包括一个加密算法的优先级列表和一个完整性保护算法的优先级列表。示例性地，加密算法的优先级列表为表1，完整性保护的优先级列表为表2，表格中的算法按照优先级从高到低的顺序排列。
表1
加密算法1
加密算法2
加密算法3
加密算法4
加密算法5
表2
完整性保护算法1
完整性保护算法2
完整性保护算法3
完整性保护算法4
完整性保护算法5
若安全策略用于指示开启的安全保护类型，则确定第一用户面保护算法的方法为：
示例性地，用户面信息和安全策略的对应关系为{{PDU session ID＝1，10，DRB ID＝1}，{PDU session ID＝2,QFI＝1,01，DRB ID＝2}}，终端的安全能力为终端支持用户面加密算法1，用户面加密算法2，用户面完整性保护算法3，用户面完整性保护算法5。
首先，TgNB确定会话1需开启用户面加密算法，不开启用户面完整性保护算法，然后根据终端的安全能力确定终端支持的用户面加密算法为用户面加密算法1和用户面加密算法2，进而根据表1确定，用户面加密算法1的优先级比用户面加密算法2的优先级高，即用户面加密算法1为终端和TgNB均支持的优先级最高的用户面加密算法，即TgNB为会话1确定的第一用户面保护算法为用户面加密算法1。
TgNB确定会话2不开启用户面加密算法，开启用户面完整性保护算法，然后根据终端的安全能力确定终端支持的用户面完整性保护算法为用户面完整性保护算法3和用户面完整性保护算法5，进而根据表2确定用户面完整性保护算法3为终端和TgNB均支持的优先级最高的用户面完整性保护算法，即TgNB为会话2确定的第一用户面保护算法为用户面完整性保护算法3。
若安全策略包括用户面保护算法标识，则确定第一用户面保护算法的方法为：
示例性地，用户面信息和安全策略的对应关系为{PDU session ID＝1，NIA＝1，NEA＝2}，
首先，TgNB根据安全策略确定会话1既需要开启用户面加密保护，又需要开启用户面完整性保护，安全策略指示开启的用户面加密算法为用户面加密算法2，安全策略指示开启的用户面完整性保护算法为用户面完整性保护算法1。然后根据终端的安全能力确定终端支持的用户面加密算法为用户面加密算法1和2，终端支持的用户面 完整性保护算法为用户面完整性保护算法3和5。可见终端和TgNB均支持安全策略指示的用户面加密算法2，但是终端不支持安全策略指示的用户面完整性保护算法1，所以TgNB需根据终端的安全能力和表2重新选择用户面完整性保护算法，根据表2可确定用户面完整性保护算法3为终端和TgNB均支持的优先级最高的用户面完整性保护算法。即TgNB为会话1确定的第一用户面保护算法为用户面加密算法2和用户面完整性保护算法3。
可选地，若安全策略指示既不开启用户面加密保护，也不开启用户面完整性保护，则可选的，TgNB可根据默认策略确定开启用户面加密保护或开启用户面完整性保护，或者既开启用户面加密保护又开启用户面完整性保护，并确定相应的用户面保护算法。
可选地，TgNB还可以直接忽略接收到的安全策略，根据默认策略确定用户面保护算法。
作为一种可能的实现方式，TgNB可确定一套算法，将这套算法既作为用户面安全算法，又作为控制面安全算法。即在步骤604中，TgNB确定的第一用户面保护算法也可作为信令面保护算法，或者TgNB确定的信令面保护算法也可作为第一用户面保护算法。
步骤605、TgNB根据第一用户面保护算法生成用户面保护密钥。
TgNB可为步骤604中确定的每个用户面保护算法生成用户面保护密钥，示例性地，若TgNB为会话1确定的第一用户面保护算法为用户面加密算法1，为会话2确定的第一用户面保护算法为用户面完整性保护算法3。则TgNB为会话1生成用户面加密算法1对应的用户面加密密钥，为会话2生成户面完整性保护算法3对应的用户面完整性保护密钥。
其中，TgNB可根据密钥衍生函数(key derive function，KDF)、算法ID和KgNB*生成密钥。密钥的生成方法为：密钥＝KDF(算法ID，KgNB*)，或者密钥＝KDF(算法ID，密钥1，其他参数)，或者密钥＝伪随机函数(算法ID，其他参数)，其中，其他参数可以为1个参数，也可以为多个参数，比如其他参数可以为密钥参数，或者其他参数为密钥参数，隔离参数(如会话ID，DRB ID，QFI)，新鲜性参数中的任意一项或多项。此密钥生产方法，不仅适用于终端的切换场景，还适用于任何基站生产密钥的场景。
可选地，若步骤604中TgNB确定了信令面保护算法，则TgNB可根据信令面保护算法生成信令面保护密钥。
步骤606、TgNB向SgNB发送切换请求确认(HO request Ack)消息，相应地，SgNB接收切换请求确认消息。
其中，切换请求确认消息中包括切换命令(HO command)消息，可选的，切换命令消息中包括RRC连接重配置(RRC connection reconfiguration)消息。RRC连接重配置消息用于通知终端目标基站的基本参数，比如目标基站的物理小区ID、目标基站的频率、会话资源等信息。在本申请的实施例中，RRC连接重配置消息用于传递TgNB确定的第一用户面保护算法。可选的，还用于传递信令面算法。且若步骤604中确定的第一用户面保护算法中包括用户面完整性保护算法，则需使用步骤605中生成用户面完整性保护密钥为RRC连接重配置消息进行完整性保护。若步骤604中还确定了信 令面完整性保护算法，则无论是否已经确定用户面完整性保护算法，均使用步骤605中生成的信令面完整性密钥为RRC连接重配置消息进行完整性保护。
可选地，一个RRC连接重配置消息中，可包含TgNB接收到的每组用户面信息与安全策略的对应关系，例如，TgNB接收到的用户面信息和安全策略的对应关系为{{PDU session ID＝1，10，DRB ID＝1}，{PDU session ID＝2,QFI＝1,01，DRB ID＝2}}，则TgNB的RRC连接重配置消息中包括会话1和会话2的用户面信息和安全策略的对应关系。
会话1的RRC连接重配置消息中包括TgNB为会话1确定的第一用户面保护算法，以及为会话1分配的会话资源。会话资源可以为DRB ID，若用户面信息和安全策略对应关系中的DRB ID为1的DRB没有被使用，则会话1仍可以使用该DRB，若已经被使用，则TgNB重新为会话1创建一个DRB，并将创建的DRB的DRB标识发送给终端。可选地，若用户信息和安全策略的对应关系中未携带DRB ID，则TgNB重新为会话创建一个DRB。结合步骤604中确定的第一用户面安全算法，会话1的RRC连接重配置消息中包括用户面加密算法1，DRB ID和用于生成KgNB*的信息。同理，会话2的RRC连接重配置消息中包括用户面完整性保护算法3，DRB ID和用于生成KgNB*的信息。
其中，由于会话1对应的安全策略指示不开启用户面完整性保护，则不对会话1的RRC重配置消息进行完整性保护。会话2对应的安全策略指示开启用户面加密保护，所以会话2的RRC连接重配置消息可通过用户面完整性保护算法3对应的用户面完整性保护密钥进行加密。
可选地，TgNB可生成一个随机数Nounce-TgNB，并使用用户面加密算法1对
Nounce-TgNB进行加密，会话1的RRC重配置消息中还包括加密后的Nounce-TgNB和未加密的Nounce-TgNB。
可选地，若步骤604中TgNB确定了信令面保护算法，则TgNB可采用信令面完整性保护密钥对RRC连接重配置消息进行完整性保护，或使用信令面加密密钥对
Nounce-TgNB进行加密。
可选地，RRC连接重配置消息中还包括指示信息，用于指示信令面保护算法与第一用户面保护算法相同，或者用于指示信令面保护算法标识。
步骤607、SgNB向终端发送切换命令消息。相应地，终端接收切换命令消息。
可以理解的是，SgNB接收到切换请求确认消息后，将切换请求确认消息中的切换命令消息转发给终端。
可选地，SgNB接收到切换请求确认消息后，可以向TgNB发送序列号状态信息和待发送给终端的数据，以便于TgNB在建立与终端的通信链路之后向终端转发待发送给终端的数据。
步骤608、终端生成用户面保护密钥。
其中，终端接收到切换命令消息后，从切换命令消息中获取RRC连接重配置消息,若RRC连接重配置消息中包括用户面完整性保护算法，则根据用户面完整性保护算法生成用户面完整性保护密钥，然后使用用户面完整性保护密钥对RRC连接重配置消息进行完整性校验，若校验不通过，则断开与TgNB之间的通信连接或执行步骤609；若校验通过，则生成RRC连接重配置消息中的用户面保护算法对应的用户面保护密钥。
若RRC连接重配置消息中包括加密后的Nounce-TgNB和用户面加密算法，则终端根据用户面加密算法生成用户面加密密钥，使用用户面加密算法对加密后的Nounce-TgNB进行解密，并将解密得到的Nounce-TgNB与切换命令消息中的Nounce-TgNB进行对比，若相同，则终端生成RRC连接重配置消息中的用户面保护算法对应的用户面保护密钥；若不同，则断开与TgNB之间的通信连接，或执行步骤609。
可选地，若RRC连接重配置消息中包括信令面保护算法，则终端根据信令面保护算法生成信令面保护密钥。
步骤609、终端接入TgNB。
其中，终端接入TgNB的过程包括终端向TgNB发送同步请求，TgNB为终端分配时间窗，具体的实现方式可参考现有流程，此处不再赘述。
需要说明的是，若步骤608中终端校验未通过，则不执行步骤609。
步骤610、终端向TgNB发送切换确认(HO confirm)消息。
其中，切换确认消息中包括RRC连接重配置完成(RRC connection reconfiguration complete)消息，该消息用于告知TgNB终端切换成功。
可选地，若步骤608中终端对RRC连接重配置消息校验失败，RRC连接重配置完成消息用于告知TgNB终端切换失败，以及切换失败的原因。
需要说明的是，可选的，若终端在步骤608中生成了用户面加密密钥，则使用用户面加密密钥对RRC连接重配置完成消息进行加密，若生成了用户面完整性保护密钥，则使用用户面完整性保护密钥对RRC连接重配置完成消息进行完整性保护，若终端既生成了用户面加密密钥又生成了用户面完整性保护密钥，则终端可以对RRC连接重配置消息进行其中任意一种保护，或者既使用用户面加密密钥对RRC连接重配置完成消息进行加密，又使用用户面完整性保护密钥对RRC连接重配置完成消息进行完整性保护。
若终端生成了信令面完整性保护密钥，则使用信令面完整性保护密钥对RRC连接重配置完成消息进行完整性保护，若生成了信令面加密密钥，则使用信令面加密密钥对RRC连接重配置完成消息进行加密。若终端既生成了信令面加密密钥又生成了信令面完整性保护密钥，则终端可以对RRC连接重配置消息进行其中任意一种保护，或者既使用信令面完整性保护密钥对RRC连接重配置完成消息进行完整性保护，又使用信令面加密密钥对RRC连接重配置完成消息进行加密。
可选地，终端也可以生成一个随机数Nounce-UE，使用用户面加密密钥对Nounce-UE||Nounce-TgNB进行加密，将加密后的Nounce-UE||Nounce-TgNB和未加密的Nounce-UE携带在RRC连接重配置完成消息中发送给TgNB。
可选地，若终端生成了用户面保护密钥，也可使用用户面保护密钥对RRC连接重配置完成消息进行保护。
步骤611、TgNB接收切换确认消息。
可以理解的是，TgNB接收到切换确认消息后，若切换确认消息中的RRC连接重配置完成消息为密文，则使用用户面加密密钥对RRC连接重配置完成消息进行解密，若RRC连接重配置完成消息为经过用户面完整性保护算法保护的消息，则TgNB使用用户面完整性保护密钥对RRC连接重配置完成消息进行完整性校验。
可选地，若RRC连接重配置完成消息中携带了加密后的Nounce-UE||Nounce-TgNB，则TgNB使用用户面加密密钥对加密后的Nounce-UE||Nounce-TgNB进行解密，从中获取Nounce-UE，并将其与RRC连接重配置完成消息中携带的明文Nounce-UE进行对比，若相同则校验成功。
可选地，若TgNB已经告知了终端信令面保护算法，则TgNB使用信令面保护密钥对RRC连接重配置完成消息进行解密或者完整性校验。
若TgNB对RRC连接重配置完成消息校验成功，且RRC连接重配置完成消息用于告知TgNB终端切换成功，则执行步骤612。
若TgNB对RRC连接重配置完成消息校验失败，或者TgNB对RRC连接重配置完成消息校验成功，但RRC连接重配置完成消息用于告知TgNB终端切换失败，则TgNB断开与终端之间的通信连接，并删除保存的待转发给终端的下行数据。
步骤612、TgNB向终端发送下行数据。
可选地，在上述步骤604中，若TgNB没有将第一用户面保护算法确定为信令面保护算法，或者TgNB没有确定信令面保护算法，则当TgNB需要发送信令面消息时，需确定信令面保护算法，如图7所示，该方法包括：步骤701-717。
步骤701至步骤712可参考步骤601至步骤612中的相关描述，需要说明的是步骤701至步骤712中TgNB未将第一用户面保护算法确定为信令面保护算法，也未生成信令面保护密钥。
713、TgNB确定信令面保护算法。
其中，信令面保护算法包括信令面加密算法和信令面完整性保护算法之一或全部。
步骤713的触发时机已在上述步骤305中说明，此处不再赘述。
714、TgNB根据信令面保护算法生成信令面保护密钥。
信令面保护密钥包括信令面加密密钥和信令面完整性保护密钥之一或全部。
可以理解的是，当TgNB发送信令面消息时，可以使用信令面保护密钥对信令面消息进行保护，进而发送使用信令面保护密钥保护的信令面消息。
715、TgNB向终端发送接入层安全模式命令(access stratum security mode command，AS SMC)消息。相应地，终端接收AS SMC消息。
其中，AS SMC消息中携带步骤713中TgNB确定的信令面保护算法标识。
若步骤714中TgNB生成了信令面完整性保护密钥，则TgNB向终端发送的AS SMC消息为经过信令面完整性保护的消息。
716、终端根据AS SMC消息中携带的信令面算法标识生成信令面保护密钥。
其中，终端生成的信令面保护密钥包括信令面加密密钥和信令面完整性保护密钥之一或全部。若AS SMC消息中只携带信令面加密算法标识，则终端根据信令面加密算法标识生成信令面加密密钥；若AS SMC消息中只携带信令面完整性保护算法标识，则终端根据信令面完整性保护算法标识生成信令面完整性保护密钥；AS SMC消息中携带信令面加密算法标识和信令面完整性保护算法标识，则终端根据信令面加密算法标识生成信令面加密密钥，根据信令面完整性保护算法标识生成信令面完整性保护密钥。
可选地，若AS SMC消息中携带信令面完整性保护算法标识，终端可根据生成的信令面完整性保护密钥对AS SMC消息进行完整性验证。
717、终端向TgNB发送安全模式完成(security mode complete，SMP)消息。
可选地，SMP消息为终端使用信令面完整性保护密钥进行完整性保护的消息。
可选地，步骤713至步骤717还可以在步骤710之前执行，若步骤713至步骤717在步骤710之前执行，则在步骤710中，终端向TgNB发送经过信令面完整性保护密钥保护的切换确认消息。
采用本实施例，可以实现用户面保护开启的过程与信令面保护开启的过程解耦，在TgNB不需要发送信令面消息的时候，可以不开启信令面保护，节省了TgNB的网络开销，可以提高终端的切换效率，且在终端切换成功后，若需要传输信令面消息，也可以确定信令面保护算法并生成信令面保护密钥，使用信令面保护密钥对信令面消息进行安全保护，也保证了信令面的安全。
可选地，在本申请实施例的一种可能的实现方式中，在上述步骤611、TgNB接收切换确认消息之后，即完成了终端的切换过程，进一步地，还可以对TgNB当前使用的安全策略进行验证，如图8所示，该方法为对图4对应的实施例的具体说明，该方法包括：步骤801-810。
步骤801、TgNB向AMF节点发送N2路径切换(N2 path switch)消息。相应地，AMF节点接收N2路径切换消息。
其中，N2路径切换消息中包括来自SgNB的用户面信息和安全策略的对应关系。
可选地，若TgNB在确定第一用户面保护算法时未使用用户面信息和安全策略的对应关系，而是使用的默认安全策略，则N2路径切换消息中包括默认安全策略和用户面信息。
可选地，N2路径切换消息中包括会话管理(session management，SM)容器，SM容器中包括来自SgNB的用户面信息和安全策略的对应关系，或者SM容器中包括默认安全策略和用户面信息。其中，只有SMF节点可以读取SM容器中的信息。
步骤802、AMF节点对N2路径切换消息中的安全策略进行验证。
其中，在N2路径切换消息中不携带SM容器，或者SM容器外也包括用户面信息和安全策略的情况下，若AMF节点确定自身存储了各用户面信息和安全策略的对应关系，才会执行步骤802，否则直接执行步骤803。
示例性地，AMF节点中存储的各用户面信息和安全策略的对应关系如表3所示。
表3
用户面信息 安全策略
PDU session ID＝1 NIA1，NEA2
PDU session ID＝2 NIA3，“1111”
PDU session ID＝3 NIA2，NEA1
其中，NIA为用户面完整性保护算法，NEA为用户面加密算法，示例性地，NIA1代表用户完整性保护算法的算法标识为1。其中，“1111”替代了NEA的位置，用于表示不开启用户面加密算法。
若N2路径切换消息中的用户面信息和安全策略的对应关系为{PDU session ID＝1，NIA＝1，NEA＝2}，则AMF节点从表3中查找PDU session ID＝1的安全策略，参考表3，查找到的安全策略为NIA1，NEA2，与{PDU session ID＝1，NIA＝1，NEA＝2} 中的安全策略相同，则验证通过，说明TgNB可继续使用根据该用户面信息和安全策略的对应关系确定的第一用户面保护算法，可执行步骤806告知TgNB验证结果。
若N2路径切换消息中的用户面信息和安全策略的对应关系为{PDU session ID＝2，NIA＝2，NEA＝2}，则AMF节点从表3中查找PDU session ID＝1的安全策略，参考表3，查找到的安全策略为NIA3，“1111”，与{PDU session ID＝2，NIA＝2，NEA＝2}中的安全策略不同，则验证未通过，说明TgNB不可继续使用根据该用户面信息和安全策略的对应关系确定的第一用户面保护算法，需将当前使用的安全策略更新为通过表3查找到的安全策略：NIA3，“1111”，进而可执行步骤806告知TgNB验证结果。
示例性地，AMF节点中存储的各用户面信息和安全策略的对应关系还可以如表4所示。
表4
用户面信息 安全策略
PDU session ID＝1 01
PDU session ID＝2 10
PDU session ID＝3 11
其中，01代表不开启用户面加密保护，开启用户面完整性保护；10代表开启用户面加密保护，不开启用户面完整性保护；11代表开启用户面加密保护，开启用户面完整性保护。
若N2路径切换消息中的用户面信息和安全策略的对应关系为{PDU session ID＝1，11}，而表3中PDU session ID＝1对应的安全策略为01，则验证未通过，说明TgNB不可继续使用根据该用户面信息和安全策略的对应关系确定的第一用户面保护算法，AMF节点需通过步骤806将表3中PDU session ID＝1对应的安全策略01告知TgNB。
步骤803、AMF节点向SMF节点发送会话管理信息请求(SM information request)消息。相应地，SMF节点接收来自AMF节点的SM信息请求消息。
SM信息请求消息中包括终端的身份信息和来自SgNB的用户面信息和安全策略的对应关系，或者包括终端的身份信息，用户面信息和默认安全策略。
可选地，AMF节点可将N2路径切换消息中的SM容器携带在SM信息请求中发送给SMF节点。
步骤804、SMF节点对SM信息请求消息中的安全策略进行验证。
若SM信息请求消息中携带SM容器，则SMF节点从SM容器中读取来自SgNB的用户面信息和安全策略的对应关系，或者用户面信息和默认安全策略。
可选地，SMF节点中存储了各用户面信息和安全策略的对应关系，例如表3或表4。SMF节点对安全策略进行验证的方法与步骤802中AMF节点对安全策略进行验证的方法基本相同，不同之处为SMF节点完成对安全策略的验证之后，将验证结果发送给AMF节点。
步骤805、SMF节点向AMF节点发送SM信息响应(SM information response)消息。
SM信息响应消息中携带步骤804中SMF节点对安全策略的验证结果，具体携带安全策略和第二指示信息之一或全部。
其中，若步骤804中验证成功，则SM信息响应消息中的安全策略为SM信息响应消息中的安全策略，或者，第二指示信息用于指示可以继续使用当前使用的安全策略。示例性地，SM信息响应消息中的安全策略可以为{PDU session ID＝1，NIA＝1，NEA＝2}中的NIA＝1，NEA＝2。
若步骤804中验证失败，则SM信息响应消息中的安全策略为SMF节点根据用户信息重新选取的安全策略，或者第二指示信息用于指示不可以继续使用当前使用的安全策略。示例性地，SM信息响应消息中的安全策略可以为NIA3，“1111”。
可选地，SM信息响应消息中还可以携带安全策略对应的用户面信息。
步骤806、AMF节点向TgNB发送路径切换确认(path switch ack)消息。相应地，TgNB接收路径切换确认消息。
若执行了步骤802，则路径切换确认消息中携带步骤802中AMF节点对安全策略的验证结果，具体携带安全策略和第二指示信息之一或全部。
其中，若步骤802中验证成功，则路径切换确认消息中的安全策略为SM信息请求消息中的安全策略，或者，第二指示信息用于指示可以继续使用当前使用的安全策略。示例性地，路径切换确认消息中的安全策略可以为{PDU session ID＝1，NIA＝1，NEA＝2}中的NIA＝1，NEA＝2。
若步骤802中验证失败，则路径切换确认消息中的安全策略为SMF节点根据用户信息重新选取的安全策略，或者第二指示信息用于指示不可以继续使用当前使用的安全策略。示例性地，路径切换确认消息中的安全策略可以为NIA3，“1111”。
可选地，路径切换确认消息中还可以携带安全策略对应的用户面信息。
若未执行步骤802，则路径切换确认消息中包括SMF节点发送的SM信息响应消息中的内容。
步骤807、TgNB根据接收到的安全策略和第二指示信息之一或全部更新用户面保护算法和用户面保护密钥。
TgNB接收到路径切换确认消息中的安全策略后，判断接收到的安全策略与来自SgNB的安全策略是否相同。若相同，则TgNB无需更新用户面保护算法和用户面保护密钥；若不相同，则根据路径切换确认消息中的安全策略重新选择用户面保护算法，并根据重现选择的用户面保护算法生成用户面保护密钥。
若路径切换确认消息中不携带安全策略，携带第二指示信息，且第二指示信息指示可以继续使用当前使用的安全策略，则TgNB无需更新用户面保护算法和用户面保护密钥；若第二指示信息指示不可以继续使用当前使用的安全策略，则TgNB使用默认安全策略，或者TgNB断开连接，或者TgNB在发送完下行数据后，断开连接。
可选地，TgNB更新用户面保护算法和用户面保护密钥后，需向终端发送信令面消息，若此时还未开启信令面保护，则执行上述步骤713至步骤717，以开启信令面保护。
步骤808、TgNB向终端发送RRC连接重配置消息。相应地，终端接收来自TgNB的RRC连接重配置消息。
其中，RRC连接重配置消息为通过信令面保护密钥保护的消息，RRC连接重配置消息中携带TgNB更新的用户面保护算法或第三指示信息，第三指示信息用于指示终端是 否可以继续使用终端目前使用的用户面保护算法。
步骤809、终端根据RRC连接重配置消息中的用户面保护算法生成用户面保护密钥。
可以理解的是，终端可根据信令面保护密钥对RRC连接重配置消息进行安全校验，例如，可根据信令面完整性保护密钥对RRC连接重配置消息进行完整性校验，若校验成功，则可根据RRC连接重配置消息中的用户面保护算法生成用户面保护密钥，后续使用该用户面保护密钥对用户面数据进行加密或解密。
步骤810、终端向TgNB发送RRC连接重配置完成消息。相应地，TgNB接收RRC连接重配置完成消息。
可以理解的是，RgNB接收到RRC连接重配置完成消息，则可确定用户面保护算法更新成功。
可选地，在终端切换的流程中，若SgNB与TgNB没有通信接口，则终端的切换流程如图9所示，该方法包括：步骤901-909。
步骤901、终端向SgNB发送测量报告。相应地，SgNB接收测量报告。
步骤902、SgNB根据测量报告确定需要为终端切换服务基站时，向AMF节点发送切换请求消息。相应地，AMF节点接收切换请求消息。
切换请求消息中包括用户面信息和安全策略的对应关系，还可以包括终端的安全能力。
可选地，切换请求消息中可包括SM容器，SM容器中包括用户面信息和安全策略的对应关系或者只包括安全策略，或者安全策略处于SM容器外，或者SM容器内和SM容器外都包括安全策略。
可选地，若切换请求消息中的SM容器外包括用户面信息和安全策略的对应关系，且AMF节点中存储了各用户面信息和安全策略的对应关系，例如AMF节点中存储了表3，则AMF节点可判断切换请求中的用户面信息对应的安全策略，是否与表3中该用户面信息对应的安全策略相同，则AMF节点可直接将用户面信息对应的安全策略发送给TgNB，若不同，则执行步骤903。
可选地，若切换请求消息中的SM容器外不包括用户面信息和安全策略的对应关系，则执行步骤903。
步骤903、AMF节点向SMF节点发送会话切换请求消息，会话切换请求消息中携带用户面信息。相应地，SMF节点接收会话请求消息。
可选地，会话切换请求消息中还包括用户面信息和安全策略的对应关系，或者还包括步骤902中接收到的SM容器。
步骤904、SMF节点确定会话切换请求消息中的用户面信息对应的安全策略。
SMF节点中存储了，或者可获取各用户面信息和安全策略的对应关系，示例性地，可参考表3或表4，以表3为例，若会话切换请求消息中的用户面信息为PDU session ID＝1，则SMF节点可确定安全策略为NIA1，NEA2(使用用户面完整性保护算法1，使用用户面加密算法2)。
可选地，若SMF节点接收到了用户面信息和安全策略的对应关系，或者接收到了SM容器，SM容器内包含用户面信息和安全策略的对应关系，SMF节点可判断接收到的 用户面信息对应的安全策略，是否与表3中的该用户面信息对应的安全策略相同，若相同，则确定后续的终端切换流程中仍可使用来自SgNB中的安全策略，若不同，则确定后续的终端切换流程中使用表3中该用户面信息对应的安全策略。
可选地，SMF节点只接收到了用户面信息，或者接收到了SM容器，SM容器内只包含用户面信息，则SMF节点需要为用户面信息确定安全策略。
可选地，SMF节点收到了用户面信息和安全策略的对应关系，或者接收到了SM容器，SM容器内包含用户面信息和安全策略的对应关系，则SMF节点忽略接收到的安全策略，根据用户面信息重新确定用户面信息对应的安全策略。具体地，SMF节点可通过SMF节点中预配置的或者从其他网元中获取的各用户面信息和安全策略的对应关系确定用户面信息对应的安全策略。
步骤905、SMF节点向AMF节点发送会话切换响应消息。
其中，会话切换响应消息中包括SMF节点确定的用户面信息对应的安全策略。
步骤906、AMF节点向TgNB发送切换请求消息。相应地，TgNB接收切换请求消息。
切换请求消息中包括用户面信息对应的安全策略和终端的安全能力。可选地，若AMF节点接收到了SM容器，还需将SM容器转发给TgNB。
可选地，为了提高终端的切换效率，切换请求消息中可以不包括用户面信息对应的安全策略，只有SM容器中包括来自SgNB的用户面信息对应的安全策略，则TgNB可以暂时使用SM容器中的安全策略。在终端完成切换流程之后，TgNB可在后续的PDU会话流程中请求AMF节点或SMF节点下发新的安全策略，或者在终端发起会话建立或会话修改请求时，SMF为TgNB下发安全策略。
步骤907、TgNB确定第一用户面保护算法，根据第一用户面保护算法生成用户面保护密钥。
需要说明的是，步骤907的具体实现方法与上述步骤604和步骤605中的相关描述相同，此处不再赘述。
步骤908、TgNB向AMF节点发送切换请求确认消息。相应地，AMF节点接收来自TgNB的切换请求确认消息。
步骤909、AMF节点向TgNB发送切换命令消息。相应地，TgNB接收来自AMF节点的切换命令消息。
后续的流程可参考608至步骤612中的相关描述，当然本申请不限于此。
上述主要从不同网元之间交互的角度对本发明实施例提供的方案进行了介绍。可以理解的是，第一接入网设备、第二接入网设备、AMF节点、SMF节点、终端为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。结合本发明中所公开的实施例描述的各示例的单元及算法步骤，本发明实施例能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以对每个特定的应用来使用不同的方法来实现所描述的功能，但是这种实现不应认为超出本发明实施例的技术方案的范围。
本发明实施例可以根据上述方法示例对第一接入网设备、第二接入网设备、AMF节点、SMF节点、终端等进行功能单元的划分，例如，可以对应各个功能划分各个功 能单元，也可以将两个或两个以上的功能集成在一个处理单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。需要说明的是，本发明实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，图10示出了本发明实施例中提供的一种装置的示意性框图。该装置可以以软件的形式存在，也可以为第一接入网设备，还可以为第一接入网设备中的芯片。该装置1000包括：处理单元1002和第一通信单元1003。处理单元1002用于对装置1000的动作进行控制管理，例如，处理单元1002用于支持装置1000执行图2中的过程203，图3中的过程303至306，图4中的过程403和404，图6中的过程604、605和611，图7中的过程704、705、711、713、714，图8中的过程807，图9中的过程907，和/或用于本文所描述的技术的其它过程。第一通信单元1003用于支持装置1000和其他网元(例如第二接入网设备、AMF节点、SMF节点等)之间的通信。装置1000还可以包括第二通信单元1004，用于支持装置1000与终端之间的通信。装置1000还可以包括存储单元1001，用于存储装置1000的程序代码和数据。
其中，处理单元1002可以是处理器或控制器，例如可以是中央处理器(Central Processing Unit，CPU)，通用处理器，数字信号处理器(Digital Signal Processor，DSP)，专用集成电路(Application-Specific Integrated Circuit，ASIC)，现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。第一通信单元1003可以是通信接口，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，例如可以包括：接入网设备与接入网设备之间的接口、接入网设备与核心网设备之间的接口和/或其他接口。第二通信单元1004可以是收发器或收发电路等。存储单元1001可以是存储器。
在采用集成的单元的情况下，图11示出了本发明实施例中提供的另一种装置的示意性框图。该装置可以以软件的形式存在，也可以为第二接入网设备，也可以为第二接入网设备中的芯片。装置1100包括：处理单元1102、第一通信单元1103和第二通信单元1104。处理单元1102用于对装置1100的动作进行控制管理，例如，处理单元1102用于支持装置1100执行图2中的过程201，图3中行的过程301，图6中的过程602，图7中的过程702，和/或用于本文所描述的技术的其它过程。第一通信单元1103用于支持装置1100和其他接入网设备或AMF节点，SMF节点之间的通信。第二通信单元1104用于支持装置1100与终端之间的通信。装置1100还可以包括存储单元1101，用于存储装置1100的程序代码和数据。
其中，处理单元1102可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP 和微处理器的组合等等。第一通信单元1103可以是通信接口，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，例如可以包括：接入网设备与接入网设备之间的接口、接入网设备与核心网设备之间的接口和/或其他接口。第二通信单元1104可以是收发器或收发电路等。存储单元1101可以是存储器。
当处理单元1002为处理器，第一通信单元1003为通信接口，第二通信单元1004为发射器/接收器，存储单元1001为存储器时，本发明实施例所涉及的装置1000的结构可以是如图12所示的接入网设备的结构。当处理单元1102为处理器，第一通信单元1103为通信接口，第二通信单元1104为发射器/接收器，存储单元1101为存储器时，本发明实施例所涉及的装置1100的结构也可以是如图12所示的接入网设备的结构。
图12示出了本发明实施例提供的接入网设备的一种可能的结构示意图。
接入网设备1200包括处理器1202和通信接口1204。其中，处理器1202也可以为控制器，图12中表示为“控制器/处理器1202”。通信接口1204用于支持接入网设备与其他网元(例如其它接入网设备、AMF节点、SMF节点等)进行通信。进一步的，接入网设备1200还可以包括发射器/接收器1201。所述发射器/接收器1201用于支持接入网设备与上述实施例中的所述终端之间收发信息，以及支持所述终端与其他终端之间进行无线电通信。所述处理器1202执行各种用于与终端通信的功能。在上行链路，来自所述终端的上行链路信号经由天线接收，由接收器1201进行解调(例如将高频信号解调为基带信号)，并进一步由处理器1202进行处理来恢复终端所发送到业务数据和信令信息。在下行链路上，业务数据和信令消息由处理器1202进行处理，并由发射器1201进行调制(例如将基带信号调制为高频信号)来产生下行链路信号，并经由天线发射给终端。需要说明的是，上述解调或调制的功能也可以由处理器1202完成。
例如，当该接入网设备1200为第一接入网设备时，处理器1202还用于执行图2至图9所示方法中涉及第一接入网设备的处理过程和/或本申请所描述的技术方案的其他过程；或者，当该接入网设备1200为第二接入网设备时，处理器1202还用于执行图2、图3、图6、图7和图9所示方法中涉及第二接入网设备的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，接入网设备1200还可以包括存储器1203，存储器1203用于存储接入网设备1200的程序代码和数据。
可以理解的是，图12仅仅示出了接入网设备1200的简化设计。在实际应用中，接入网设备1200可以包含任意数量的发射器，接收器，处理器，控制器，存储器，通信单元等，而所有可以实现本发明实施例的接入网设备都在本发明实施例的保护范围之内。
在采用集成的单元的情况下，图13示出了本发明实施例中所涉及的另一种装置的一种可能的示例性框图，该装置1300可以以软件的形式存在，也可以为AMF节点，还可以为AMF节点中的芯片。装置1300包括：处理单元1302和通信单元1303。处理单元1302用于对装置1300的动作进行控制管理，例如，处理单元1302用于支持装置1300执行图8中的过程802，和/或用于本文所描述的技术的其它过程。通信单元1303用于支持装置1300与其他网络实体(例如接入网设备、SMF节点)的通信。装置1300 还可以包括存储单元1301，用于存储装置1300的程序代码和数据。
其中，处理单元1302可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1303可以是通信接口、收发器或收发电路等，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，例如可以包括：AMF节点和接入网设备之间的接口和/或其他接口。存储单元1301可以是存储器。
当处理单元1302为处理器，通信单元1303为通信接口，存储单元1301为存储器时，本发明实施例所涉及的装置1300可以为图14所示的AMF节点。
参阅图14所示，该AMF节点1400包括：处理器1402、通信接口1403、存储器1401。可选的，核心网设备1400还可以包括总线1404。其中，通信接口1403、处理器1402以及存储器1401可以通过总线1404相互连接；总线1404可以是外设部件互连标准(Peripheral Component Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。所述总线1404可以分为地址总线、数据总线、控制总线等。为便于表示，图14中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在采用集成的单元的情况下，图15示出了本发明实施例中所涉及的另一种装置的一种可能的示例性框图，该装置1500可以以软件的形式存在，也可以为SMF节点，还可以为SMF节点中的芯片。装置1500包括：处理单元1502和通信单元1503。处理单元1502用于对装置1500的动作进行控制管理，例如，处理单元1502用于支持装置1500执行图5中的过程503，图8中的过程804，图9中的过程904，和/或用于本文所描述的技术的其它过程。通信单元1503用于支持装置1500与其他网络实体(例如接入网设备、SMF节点)的通信。装置1500还可以包括存储单元1501，用于存储装置1500的程序代码和数据。
其中，处理单元1502可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1503可以是通信接口、收发器或收发电路等，其中，该通信接口是统称，在具体实现中，该通信接口可以包括多个接口，例如可以包括：SMF节点和接入网设备之间的接口和/或其他接口。存储单元1501可以是存储器。
当处理单元1502为处理器，通信单元1503为通信接口，存储单元1501为存储器时，本发明实施例所涉及的装置1500可以为图16所示的SMF节点。
参阅图16所示，该SMF节点1600包括：处理器1602、通信接口1603、存储器1601。可选的，核心网设备1600还可以包括总线1604。其中，通信接口1603、处理器1602以及存储器1601可以通过总线1604相互连接；总线1604可以是外设部件互连标准(Peripheral Component Interconnect，简称PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，简称EISA)总线等。所述总线1604 可以分为地址总线、数据总线、控制总线等。为便于表示，图16中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
在采用集成的单元的情况下，图17示出了本发明实施例中提供的又一种装置的示意性框图。该装置1700可以以软件的形式存在，也可以为终端，还可以为终端中的芯片。装置1700包括：处理单元1702和通信单元1703。处理单元1702用于对装置1700的动作进行控制管理，例如，处理单元1702用于支持装置1700执行图3中的过程308，图6中的过程608，图7中的过程708，图8中的过程809，和/或用于本文所描述的技术的其它过程。通信单元1703用于支持装置1700和其他网元(例如接入网设备)之间的通信。装置1700还可以包括存储单元1701，用于存储装置1700的程序代码和数据。
其中，处理单元1702可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本发明公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1703可以是收发器、收发电路或通信接口等。存储单元1701可以是存储器。
当处理单元1702为处理器，通信单元1703为收发器，存储单元1701为存储器时，本发明实施例所涉及的终端可以为图18所示的终端。
图18示出了本发明实施例中所涉及的终端的一种可能的设计结构的简化示意图。所述终端1800包括发射器1801，接收器1802和处理器1803。其中，处理器1803也可以为控制器，图18中表示为“控制器/处理器1803”。可选的，所述终端1800还可以包括调制解调处理器1805，其中，调制解调处理器1805可以包括编码器1807、调制器1807、解码器1808和解调器1809。
在一个示例中，发射器1801调节(例如，模拟转换、滤波、放大和上变频等)该输出采样并生成上行链路信号，该上行链路信号经由天线发射给上述实施例中所述的基站。在下行链路上，天线接收上述实施例中基站发射的下行链路信号。接收器1802调节(例如，滤波、放大、下变频以及数字化等)从天线接收的信号并提供输入采样。在调制解调处理器1805中，编码器1807接收要在上行链路上发送的业务数据和信令消息，并对业务数据和信令消息进行处理(例如，格式化、编码和交织)。调制器1807进一步处理(例如，符号映射和调制)编码后的业务数据和信令消息并提供输出采样。解调器1809处理(例如，解调)该输入采样并提供符号估计。解码器1808处理(例如，解交织和解码)该符号估计并提供发送给终端1800的已解码的数据和信令消息。编码器1807、调制器1807、解调器1809和解码器1808可以由合成的调制解调处理器1805来实现。这些单元根据无线接入网采用的无线接入技术(例如，LTE及其他演进系统的接入技术)来进行处理。需要说明的是，当终端1800不包括调制解调处理器1805时，调制解调处理器1805的上述功能也可以由处理器1803完成。
处理器1803对终端1800的动作进行控制管理，用于执行上述本发明实施例中由终端1800进行的处理过程。例如，处理器1803还用于执行图3至图6所示方法中涉及终端的处理过程和/或本申请所描述的技术方案的其他过程。
进一步的，终端1800还可以包括存储器1804，存储器1804用于存储用于终端1800的程序代码和数据。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read Only Memory，ROM)、可擦除可编程只读存储器(Erasable Programmable ROM，EPROM)、电可擦可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于核心网接口设备中。当然，处理器和存储介质也可以作为分立组件存在于核心网接口设备中。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络设备上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个功能单元独立存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到本申请可借助软件加必需的通用硬件的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在可读取的存储介质中，如计算机的软盘，硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (41)

  1. 一种安全保护的方法，其特征在于，包括：
    第一接入网设备接收来自第二接入网设备的用户面信息和安全策略的对应关系；
    所述第一接入网设备根据所述用户面信息和安全策略的对应关系确定所述用户面信息对应的第一用户面保护算法，所述第一用户面保护算法包括用户面加密算法和用户面完整性保护算法之一或全部。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备确定所述第一用户面保护算法为信令面保护算法。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备确定信令面保护算法，所述信令面保护算法包括信令面加密算法和信令面完整性保护算法之一或全部。
  4. 根据权利要求2或3所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备通过所述第二接入网设备向终端发送第一指示信息，所述第一指示信息用于指示所述第一用户面保护算法与所述信令面保护算法相同；或者，所述第一指示信息用于指示所述第一接入网设备确定的所述信令面保护算法标识。
  5. 根据权利要求1-4中任一项所述的方法，其特征在于，所述安全策略用于指示开启的安全保护类型，所述安全保护类型包括用户面加密保护和用户面完整性保护之一或全部；所述第一接入网设备根据所述用户面信息和安全策略的对应关系确定所述用户面信息对应的第一用户面保护算法，包括：
    所述第一接入网设备确定所述安全策略指示开启的安全保护类型对应的第一用户面保护算法。
  6. 根据权利要求2或3所述的方法，其特征在于，所述安全策略中包括用户面保护算法标识；所述第一接入网设备根据所述用户面信息和安全策略的对应关系确定所述用户面信息对应的第一用户面保护算法，包括：
    所述第一接入网设备确定所述用户面保护算法标识对应的第二用户面保护算法；
    若所述第一接入网设备和终端均支持所述第二用户面保护算法，则所述第一接入网设备确定所述第二用户面保护算法为所述第一用户面保护算法；或者，
    若所述第一接入网设备和终端中的任意一个不支持所述第二用户面保护算法，则所述第一接入网设备从所述第二用户面保护算法所属的安全保护类型对应的安全算法集合中，选择所述第一接入网设备和所述终端均支持的第一用户面保护算法。
  7. 根据权利要求1-6中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备根据所述第一用户面保护算法生成用户面保护密钥，所述用户面保护密钥包括用户面加密密钥和用户面完整性保护密钥之一或全部。
  8. 根据权利要求2或3所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备根据所述信令面保护算法生成信令面保护密钥，所述信令面保护密钥包括信令面加密密钥和信令面完整性保护密钥之一或全部。
  9. 根据权利要求7或8所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备通过所述第二接入网设备向终端发送经过所述用户面完整性保护密钥或所述信令面完整性保护密钥保护的第一消息，所述第一消息中包括所述第 一用户面保护算法。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备接收来自终端的经过所述用户面保护密钥保护的或所述信令面保护密钥保护的第二消息，所述第二消息为所述第一消息的响应消息。
  11. 根据权利要求1-10中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备向接入和移动性管理功能AMF节点发送所述用户面信息和安全策略的对应关系；
    若所述第一接入网设备接收到来自所述AMF节点的安全策略，且来自所述AMF节点的安全策略与来自所述第二接入网设备的安全策略不同，则所述第一接入网设备根据来自所述AMF节点的安全策略重新确定第一用户面保护算法和用户面保护密钥。
  12. 根据权利要求1-10中任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备向接入和移动性管理功能AMF节点发送所述用户面信息和安全策略的对应关系；
    若所述第一接入网设备接收到来自所述AMF节点的第二指示信息，未接收到来自所述AMF节点的安全策略，且所述第二指示信息指示所述第一接入网设备不能使用来自所述第二接入网设备的安全策略，则所述第一接入网设备根据默认安全策略重新确定第一用户面保护算法和用户面保护密钥。
  13. 一种安全保护的方法，其特征在于，包括：
    第二接入网设备获取用户面信息和安全策略的对应关系；
    所述第二接入网设备向第一接入网设备发送所述用户面信息和安全策略的对应关系。
  14. 一种安全保护的方法，其特征在于，包括：
    接入和移动性管理功能AMF节点接收来自目标接入网设备的用户面信息和安全策略的对应关系；
    所述AMF节点向会话管理功能SMF节点发送所述用户面信息和安全策略的对应关系；
    所述AMF节点接收来自所述SMF节点的所述SMF节点根据所述用户面信息重新选取的安全策略或者指示信息，所述指示信息用于指示所述目标接入网继续使用当前使用的安全策略；
    所述AMF节点向所述目标接入网设备发送所述重新选取的安全策略或者所述指示信息。
  15. 一种安全保护的方法，其特征在于，包括：
    会话管理功能SMF节点接收来自接入和移动性管理功能AMF节点的用户面信息和安全策略的对应关系；
    所述SMF节点判断接收到的用户面信息对应的安全策略，是否与自身存储的所述用户面信息对应的安全策略相同；
    若SMF节点接收到的用户面信息对应的安全策略与自身存储的所述用户面信息对应的安全策略不同，则所述SMF节点将自身存储的所述用户面信息对应的安全策略发送给所述AMF节点。
  16. 根据权利要求15所述的方法，其特征在于，若SMF节点接收到的用户面信息对应的安全策略与自身存储的所述用户面信息对应的安全策略相同，则所述SMF节点向所述AMF节点发送第二指示信息，所述第二指示信息用于指示继续使用当前使用的安全策略。
  17. 一种装置，其特征在于，包括：第一通信单元和处理单元；
    所述第一通信单元，用于接收来自第二接入网设备的用户面信息和安全策略的对应关系；
    所述处理单元，用于根据所述第一通信单元接收到的所述用户面信息和安全策略的对应关系确定所述用户面信息对应的第一用户面保护算法，所述第一用户面保护算法包括用户面加密算法和用户面完整性保护算法之一或全部。
  18. 根据权利要求17所述的装置，其特征在于，所述处理单元还用于确定所述第一用户面保护算法为信令面保护算法。
  19. 根据权利要求17所述的装置，其特征在于，所述处理单元还用于确定信令面保护算法，所述信令面保护算法包括信令面加密算法和信令面完整性保护算法之一或全部。
  20. 根据权利要求18或19所述的装置，其特征在于，所述第一通信单元还用于通过所述第二接入网设备向终端发送第一指示信息，所述第一指示信息用于指示所述第一用户面保护算法与所述信令面保护算法相同；或者，所述第一指示信息用于指示所述第一接入网设备确定的所述信令面保护算法标识。
  21. 根据权利要求17-20中任一项所述的装置，其特征在于，所述安全策略用于指示开启的安全保护类型，所述安全保护类型包括用户面加密保护和用户面完整性保护之一或全部；所述处理单元具体用于确定所述安全策略指示开启的安全保护类型对应的第一用户面保护算法。
  22. 根据权利要求18或19中任一项所述的装置，其特征在于，所述安全策略中包括用户面保护算法标识；所述处理单元具体用于确定所述用户面保护算法标识对应的第二用户面保护算法；若所述装置和终端均支持所述第二用户面保护算法，则所述处理单元确定所述第二用户面保护算法为所述第一用户面保护算法；或者，若所述装置和终端中的任意一个不支持所述第二用户面保护算法，则所述处理单元从所述第二用户面保护算法所属的安全保护类型对应的安全算法集合中，选择所述第一接入网设备和所述终端均支持的第一用户面保护算法。
  23. 根据权利要求17-22中任一项所述的装置，其特征在于，所述处理单元还用于根据所述第一用户面保护算法生成用户面保护密钥，所述用户面保护密钥包括用户面加密密钥和用户面完整性保护密钥之一或全部。
  24. 根据权利要求18或19所述的装置，其特征在于，所述处理单元还用于根据所述信令面保护算法生成信令面保护密钥，所述信令面保护密钥包括信令面加密密钥和信令面完整性保护密钥之一或全部。
  25. 根据权利要求23或24所述的装置，其特征在于，所述第一通信单元，用于通过所述第二接入网设备向终端发送经过所述用户面完整性保护密钥或所述信令面完整性保护密钥保护的第一消息，所述第一消息中包括所述第一用户面保护算法。
  26. 根据权利要求25所述的装置，其特征在于，所述装置还包括：第二通信单元；
    所述第二通信单元，用于接收来自终端的经过所述用户面保护密钥保护的或所述信令面保护密钥保护的第二消息，所述第二消息为所述第一消息的响应消息。
  27. 根据权利要求17-26中任一项所述的装置，其特征在于，所述第一通信单元还用于向接入和移动性管理功能AMF节点发送所述第一通信单元接收到的所述用户面信息和安全策略的对应关系；
    所述处理单元还用于，若所述第一通信单元接收到来自所述AMF节点的安全策略，且来自所述AMF节点的安全策略与来自所述第二接入网设备的安全策略不同，则根据来自所述AMF节点的安全策略重新确定第一用户面保护算法和用户面保护密钥。
  28. 根据权利要求17-26中任一项所述的装置，其特征在于，所述处理单元还用于，若所述第一通信单元接收到来自所述AMF节点的第二指示信息，未接收到来自所述AMF节点的安全策略，且所述第二指示信息指示所述第一接入网设备不能使用来自所述第二接入网设备的安全策略，则根据默认安全策略重新确定第一用户面保护算法和用户面保护密钥。
  29. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述处理单元，用于获取用户面信息和安全策略的对应关系；
    所述通信单元，用于向第一接入网设备发送所述处理单元获取的所述用户面信息和安全策略的对应关系。
  30. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述处理单元，用于通过所述通信单元接收来自目标接入网设备的用户面信息和安全策略的对应关系；通过所述通信单元向会话管理功能SMF节点发送所述用户面信息和安全策略的对应关系；通过所述通信单元接收来自所述SMF节点的所述SMF节点根据所述用户面信息重新选取的安全策略或者指示信息，所述指示信息用于指示所述目标接入网设备继续使用当前使用的安全策略；通过所述通信单元向所述目标接入网设备发送所述重新选取的安全策略或者所述指示信息。
  31. 一种装置，其特征在于，包括：处理单元和通信单元；
    所述通信单元，用于接收来自接入和移动性管理功能AMF节点的用户面信息和安全策略的对应关系；
    所述处理单元，用于判断接收到的用户面信息对应的安全策略，是否与自身存储的所述用户面信息对应的安全策略相同；
    所述通信单元，还用于若所述通信单元接收到的用户面信息对应的安全策略与自身存储的所述用户面信息对应的安全策略不同，则将自身存储的所述用户面信息对应的安全策略发送给所述AMF节点。
  32. 根据权利要求31所述的装置，其特征在于，所述通信单元，还用于若所述通信单元接收到的用户面信息对应的安全策略与自身存储的所述用户面信息对应的安全策略相同，则向所述AMF节点发送指示信息，所述指示信息用于指示继续使用当前使用的安全策略。
  33. 一种通信系统，其特征在于，包括如权利要求17至28中任一项所述的装置和如权利要求29所述的装置；或者，包括如权利要求17至28中任一项所述的装置、 如权利要求29所述的装置、如权利要求30所述的装置和如权利要求31或32所述的装置。
  34. 一种接入设备，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述接入设备执行上述权利要求1-12所述的方法。
  35. 一种接入设备，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述接入设备执行上述权利要求13所述的方法。
  36. 一种接入和移动性管理功能AMF节点，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述接入设备执行上述权利要求14所述的方法。
  37. 一种会话管理功能SMF节点，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述接入设备执行上述权利要求15或16所述的方法。
  38. 一种计算机存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行如权利要求1-12任意一项所述的方法。
  39. 一种计算机存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行如权利要求13所述的方法。
  40. 一种计算机存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行如权利要求14所述的方法。
  41. 一种计算机存储介质，其特征在于，包括指令，当其在计算机上运行时，使得计算机执行如权利要求15或16所述的方法。
PCT/CN2018/108904 2017-09-30 2018-09-29 一种安全保护的方法、装置和系统 WO2019062996A1 (zh)

Priority Applications (9)

Application Number Priority Date Filing Date Title
AU2018339744A AU2018339744B2 (en) 2017-09-30 2018-09-29 Method, apparatus, and system for security protection
JP2020518431A JP7074847B2 (ja) 2017-09-30 2018-09-29 セキュリティ保護方法、装置及びシステム
KR1020207012357A KR102347524B1 (ko) 2017-09-30 2018-09-29 보안 보호를 위한 방법, 장치 및 시스템
EP22211583.4A EP4221082A3 (en) 2017-09-30 2018-09-29 Security protection method, apparatus, and system
BR112020006242-1A BR112020006242A2 (pt) 2017-09-30 2018-09-29 método de proteção de segurança, aparelho, e sistema
EP18860710.5A EP3684024B1 (en) 2017-09-30 2018-09-29 Method, apparatus, and system for security protection
US16/731,994 US10952106B2 (en) 2017-09-30 2019-12-31 Security protection method, apparatus, and system
US17/190,740 US11589274B2 (en) 2017-09-30 2021-03-03 Security protection method, apparatus, and system
US18/171,198 US20230284103A1 (en) 2017-09-30 2023-02-17 Security protection method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710945254.4 2017-09-30
CN201710945254.4A CN109600803B (zh) 2017-09-30 2017-09-30 一种安全保护的方法、装置和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/731,994 Continuation US10952106B2 (en) 2017-09-30 2019-12-31 Security protection method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2019062996A1 true WO2019062996A1 (zh) 2019-04-04

Family

ID=65344890

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/108904 WO2019062996A1 (zh) 2017-09-30 2018-09-29 一种安全保护的方法、装置和系统

Country Status (8)

Country Link
US (3) US10952106B2 (zh)
EP (2) EP4221082A3 (zh)
JP (1) JP7074847B2 (zh)
KR (1) KR102347524B1 (zh)
CN (3) CN109600803B (zh)
AU (1) AU2018339744B2 (zh)
BR (1) BR112020006242A2 (zh)
WO (1) WO2019062996A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021063978A1 (en) * 2019-10-03 2021-04-08 Telefonaktiebolaget Lm Ericsson (Publ) Security settings for user plane data sent over different accesses of a network
CN114158041A (zh) * 2021-11-29 2022-03-08 北京航空航天大学 实现5g网络数据机密性和完整性多级安全的方法

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2019074334A1 (ko) * 2017-10-13 2019-04-18 삼성전자 주식회사 무선 통신 시스템에서의 데이터 송수신 방법 및 장치
CN111641944A (zh) * 2019-03-01 2020-09-08 华为技术有限公司 一种通信方法及设备
CN111641582B (zh) * 2019-03-01 2021-11-09 华为技术有限公司 一种安全保护方法及装置
CN111866857B (zh) 2019-04-28 2022-03-08 华为技术有限公司 通信方法及其装置
CN111417117B (zh) 2019-04-29 2021-03-02 华为技术有限公司 切换的处理方法和装置
US11937140B2 (en) 2019-10-02 2024-03-19 Apple Inc. Quality of service handling procedures
CN113381966B (zh) * 2020-03-09 2023-09-26 维沃移动通信有限公司 信息上报方法、信息接收方法、终端及网络侧设备
WO2021196167A1 (zh) * 2020-04-03 2021-10-07 Oppo广东移动通信有限公司 信息处理方法、装置、设备及存储介质
CN113676907B (zh) * 2020-04-30 2023-08-04 华为技术有限公司 一种确定服务质量流的方法，装置，设备及计算机可读存储介质
CN114079915A (zh) * 2020-08-06 2022-02-22 华为技术有限公司 确定用户面安全算法的方法、系统及装置
WO2022032461A1 (zh) * 2020-08-10 2022-02-17 华为技术有限公司 一种通信的方法及装置
CN116325845A (zh) * 2020-10-01 2023-06-23 华为技术有限公司 一种安全通信方法、装置及系统
WO2022147777A1 (zh) * 2021-01-08 2022-07-14 华为技术有限公司 安全策略处理方法以及通信设备
CN114760623A (zh) * 2021-01-10 2022-07-15 华为技术有限公司 安全策略处理方法以及通信设备
US20230422104A1 (en) * 2021-01-11 2023-12-28 Telefonaktiebolaget Lm Ericsson (Publ) User plane encryption policy at interworking handover from eps and 5gs
CN115884170A (zh) * 2021-09-29 2023-03-31 华为技术有限公司 通信方法及装置
US20230403538A1 (en) * 2022-06-10 2023-12-14 Qualcomm Incorporated Managing group configurations in wireless communications systems
CN115119200B (zh) * 2022-08-29 2022-11-22 深圳慧城智联科技有限公司 一种用于5g通信环境的信息传递方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072092A (zh) * 2006-05-11 2007-11-14 华为技术有限公司 一种实现控制面和用户面密钥同步的方法
CN101262337A (zh) * 2008-02-05 2008-09-10 中兴通讯股份有限公司 安全功能控制方法和系统
KR20090044316A (ko) * 2007-10-31 2009-05-07 주식회사 케이티프리텔 네트워크에서 개시되는 위치 기반 서비스 제공 방법
CN107079023A (zh) * 2014-10-29 2017-08-18 高通股份有限公司 用于下一代蜂窝网络的用户面安全

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2815418B1 (fr) * 2000-10-16 2003-05-16 Cit Alcatel Fibre pour la compensation de dispersion chromatique d'une fibre nz-dsf a dispersion chromatique positive
GB2454204A (en) * 2007-10-31 2009-05-06 Nec Corp Core network selecting security algorithms for use between a base station and a user device
KR101488015B1 (ko) * 2008-01-25 2015-01-29 엘지전자 주식회사 핸드오버 수행방법 및 데이터 생성방법
CN101715188B (zh) * 2010-01-14 2015-11-25 中兴通讯股份有限公司 一种空口密钥的更新方法及系统
CN102137400B (zh) * 2010-01-23 2015-04-01 中兴通讯股份有限公司 一种rrc连接重建立时的安全处理方法和系统
CN102264064A (zh) * 2010-05-27 2011-11-30 中兴通讯股份有限公司 一种实现接入层安全算法同步的方法及系统
US8683424B2 (en) * 2011-10-10 2014-03-25 Telefonaktiebolaget L M Ericsson (Publ) Bridging the gap between high level user requirements and availability management framework configurations
RU2667150C2 (ru) * 2014-06-12 2018-09-17 Хуавэй Текнолоджиз Ко., Лтд. Устройство управления и способ управления передачей обслуживания по однонаправленному каналу
EP3500048B1 (en) * 2016-08-10 2021-11-03 Nec Corporation Radio access network node, wireless terminal, core network node, and methods for these
CN106851856B (zh) * 2016-12-23 2019-04-09 电信科学技术研究院有限公司 一种基于移动中继的无线通信建立方法及网络设备
US11558745B2 (en) * 2017-01-30 2023-01-17 Telefonaktiebolaget Lm Ericsson (Publ) Methods for integrity protection of user plane data
KR102178000B1 (ko) * 2017-03-17 2020-11-12 텔레호낙티에볼라게트 엘엠 에릭슨(피유비엘) 통신 네트워크에서 사용하기 위한 네트워크 노드, 통신 디바이스 및 이를 동작시키는 방법들
CN107018542A (zh) * 2017-03-27 2017-08-04 中兴通讯股份有限公司 网络系统中状态信息的处理方法、装置及存储介质
EP3646558A1 (en) * 2017-06-26 2020-05-06 Telefonaktiebolaget LM Ericsson (PUBL) Refreshing a security context for a mobile device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101072092A (zh) * 2006-05-11 2007-11-14 华为技术有限公司 一种实现控制面和用户面密钥同步的方法
KR20090044316A (ko) * 2007-10-31 2009-05-07 주식회사 케이티프리텔 네트워크에서 개시되는 위치 기반 서비스 제공 방법
CN101262337A (zh) * 2008-02-05 2008-09-10 中兴通讯股份有限公司 安全功能控制方法和系统
CN107079023A (zh) * 2014-10-29 2017-08-18 高通股份有限公司 用于下一代蜂窝网络的用户面安全

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021063978A1 (en) * 2019-10-03 2021-04-08 Telefonaktiebolaget Lm Ericsson (Publ) Security settings for user plane data sent over different accesses of a network
US20220345889A1 (en) * 2019-10-03 2022-10-27 Telefonaktiebolaget Lm Ericsson (Publ) Security settings for user plane data sent over different accesses of a network
CN114158041A (zh) * 2021-11-29 2022-03-08 北京航空航天大学 实现5g网络数据机密性和完整性多级安全的方法
CN114158041B (zh) * 2021-11-29 2023-12-08 北京航空航天大学 实现5g网络数据机密性和完整性多级安全的方法

Also Published As

Publication number Publication date
KR20200060477A (ko) 2020-05-29
AU2018339744B2 (en) 2021-10-07
AU2018339744A1 (en) 2020-05-14
KR102347524B1 (ko) 2022-01-04
US20210266799A1 (en) 2021-08-26
US11589274B2 (en) 2023-02-21
JP7074847B2 (ja) 2022-05-24
BR112020006242A2 (pt) 2020-10-27
CN109362108B (zh) 2019-11-01
EP4221082A3 (en) 2023-08-30
CN109600803A (zh) 2019-04-09
JP2020536424A (ja) 2020-12-10
EP3684024B1 (en) 2022-12-07
US10952106B2 (en) 2021-03-16
EP3684024A1 (en) 2020-07-22
CN109362108A (zh) 2019-02-19
EP4221082A2 (en) 2023-08-02
US20230284103A1 (en) 2023-09-07
CN109600803B (zh) 2024-01-30
EP3684024A4 (en) 2020-10-14
CN109600804B (zh) 2021-04-02
US20200137643A1 (en) 2020-04-30
CN109600804A (zh) 2019-04-09

Similar Documents

Publication Publication Date Title
US11589274B2 (en) Security protection method, apparatus, and system
EP3576446B1 (en) Key derivation method
CN110365470B (zh) 一种密钥生成方法和相关装置
US10904764B2 (en) Security protection method and apparatus
US20170359719A1 (en) Key generation method, device, and system
WO2020248624A1 (zh) 一种通信方法、网络设备、用户设备和接入网设备
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
CN110830996B (zh) 一种密钥更新方法、网络设备及终端
WO2015064475A1 (ja) 通信制御方法、認証サーバ及びユーザ端末

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18860710

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020518431

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018860710

Country of ref document: EP

Effective date: 20200414

ENP Entry into the national phase

Ref document number: 20207012357

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018339744

Country of ref document: AU

Date of ref document: 20180929

Kind code of ref document: A

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112020006242

Country of ref document: BR

ENP Entry into the national phase

Ref document number: 112020006242

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20200327