WO2019137194A1 - 一种用户面数据安全保护方法及装置 - Google Patents

一种用户面数据安全保护方法及装置 Download PDF

Info

Publication number
WO2019137194A1
WO2019137194A1 PCT/CN2018/123231 CN2018123231W WO2019137194A1 WO 2019137194 A1 WO2019137194 A1 WO 2019137194A1 CN 2018123231 W CN2018123231 W CN 2018123231W WO 2019137194 A1 WO2019137194 A1 WO 2019137194A1
Authority
WO
WIPO (PCT)
Prior art keywords
integrity protection
request message
network element
information
management network
Prior art date
Application number
PCT/CN2018/123231
Other languages
English (en)
French (fr)
Inventor
毕晓宇
刘佳敏
刘爱娟
郭雅莉
Original Assignee
电信科学技术研究院有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 电信科学技术研究院有限公司 filed Critical 电信科学技术研究院有限公司
Publication of WO2019137194A1 publication Critical patent/WO2019137194A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/04—Arrangements for maintaining operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the present application relates to the field of wireless communication technologies, and in particular, to a user plane data security protection method and apparatus.
  • radio bearer In terms of radio bearer, the type and establishment procedure of the radio bearer in the 5G system is similar to the type and establishment procedure of the radio bearer in the long term evolution (LTE) system. Specifically, there are two types of radio bearers in the LTE system: a signaling radio bearer and a data radio bearer (DRB), and the DRB mainly transmits user plane data. Through these bearers, the underlying protocol can be served to the upper layer protocol.
  • LTE long term evolution
  • RRC radio resource control
  • the 5G system is a service-oriented converged system, which has a wider application scenario than the LTE system.
  • 5G systems support ultra-reliable, low-latency communications for applications including industrial automation (remote) control systems, as well as support for a large number of efficient, cost-effective, high-density IoT devices.
  • remote industrial automation
  • the embodiment of the present application provides a user plane data security protection method and device, so as to implement integrity protection on user plane data.
  • the first aspect provides a user plane data security protection method, including:
  • the access network node receives a request message from the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is enabled for the specified data flow;
  • the access network node establishes a data radio bearer DRB corresponding to the specified data flow according to the request message, and starts integrity protection on the DRB.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries quality of service QoS configuration information of the data flow, and the QoS configuration information includes the Integrity protection is turned on.
  • the integrity protection indication information is further used to indicate an integrity protection algorithm used by the access network node
  • the access network node establishes a DRB corresponding to the data flow according to the request message, and starts integrity protection for the DRB, including:
  • the request message carries multiple integrity protection indication information, and an integrity protection indication information is used to indicate that integrity protection is turned on for one data flow;
  • the access network node establishes, according to the multiple integrity protection indication information, a DRB corresponding to the multiple data flows for the multiple data flows indicated by the multiple integrity protection indication information.
  • the request message is one of the following messages:
  • the reference node request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a service request initiated by the terminal Sending the session update request;
  • the first PDU session request message is sent by the access and mobility management network element according to a session establishment request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session establishment request sends the session establishment request
  • the second PDU session request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session modification request sends the session update request.
  • the second aspect provides a user plane data security protection method, including:
  • the session management network element determines integrity protection for the specified data stream
  • the session management network element sends a request message to the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is turned on for the data flow.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries QoS configuration information of the data flow, and the QoS configuration information includes the integrity Protect the open logo.
  • the method further includes: the session management network element determining an integrity protection algorithm used for integrity protection of the data stream;
  • the request message further carries the indication information of the integrity protection algorithm used by the terminal and the access network node determined by the session management network element, or the integrity protection indication information carried by the request message is further used for An integrity protection algorithm used by the terminal and the access network node is indicated.
  • the session management network element determines integrity protection for the specified data flow, including:
  • the session management network element determines, according to the service request initiated by the terminal, integrity protection on the data flow corresponding to the service request; or the session management network element determines the PDU according to the PDU session establishment request initiated by the terminal.
  • the data flow corresponding to the session establishment request is integrity protected; or the session management network element determines to perform integrity protection on the data flow corresponding to the PDU session modification request according to the PDU session modification request initiated by the terminal.
  • an access network node including:
  • a receiving module configured to receive a request message from the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is enabled for the specified data flow;
  • a processing module configured to establish, according to the request message, a data radio bearer DRB corresponding to the specified data flow, and enable integrity protection on the DRB.
  • a fourth aspect provides a session management network element, including:
  • a sending module configured to send a request message to the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is turned on for the data flow.
  • a fifth aspect provides an access network node, including: a processor, a memory, and a transceiver, wherein the processor, the memory, and the transceiver are connected by a bus; and the processor is configured to read a program in the memory and execute :
  • the transceiver Receiving, by the transceiver, a request message from an access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is enabled for a specified data flow. ;
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries quality of service QoS configuration information of the data flow, and the QoS configuration information includes the Integrity protection is turned on.
  • the request message further carries indication information of the integrity protection algorithm used by the terminal and the access network node;
  • the processor is specifically configured to: determine whether the access network node supports an integrity protection algorithm indicated by the indication information of the integrity protection algorithm, and if yes, establish the data flow according to the request message. Corresponding DRB, and according to the indication information of the integrity protection algorithm, turn on integrity protection for the DRB.
  • the integrity protection indication information is further used to indicate an integrity protection algorithm used by the access network node
  • the processor is specifically configured to: determine whether the access network node supports the integrity protection algorithm indicated by the integrity protection indication information, and if yes, establish a corresponding data flow according to the request message.
  • the DRB and according to the integrity protection algorithm indicated by the integrity protection indication information, turns on integrity protection for the DRB.
  • the request message carries multiple integrity protection indication information, and an integrity protection indication information is used to indicate that integrity protection is turned on for one data flow;
  • the processor is specifically configured to: establish, according to the request message, a DRB corresponding to the multiple data flows for the multiple data flows indicated by the multiple integrity protection indication information.
  • the request message is one of the following messages:
  • the reference node request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a service request initiated by the terminal Sending the session update request;
  • the first PDU session request message is sent by the access and mobility management network element according to a session establishment request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session establishment request sends the session establishment request
  • the second PDU session request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session modification request sends the session update request.
  • a sixth aspect provides a session management network element, including: a processor, a memory, and a transceiver, wherein the processor, the memory, and the transceiver are connected by a bus; and the processor is configured to read a program in the memory and execute :
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries QoS configuration information of the data flow, and the QoS configuration information includes the integrity Protect the open logo.
  • the processor is further configured to: determine an integrity protection algorithm used for integrity protection of the data stream;
  • the request message further carries the indication information of the integrity protection algorithm used by the terminal and the access network node determined by the session management network element, or the integrity protection indication information carried by the request message is further used for An integrity protection algorithm used by the terminal and the access network node is indicated.
  • the session management network element determines integrity protection for the specified data flow, including:
  • the session management network element determines, according to the service request initiated by the terminal, integrity protection on the data flow corresponding to the service request; or the session management network element determines the PDU according to the PDU session establishment request initiated by the terminal.
  • the data flow corresponding to the session establishment request is integrity protected; or the session management network element determines to perform integrity protection on the data flow corresponding to the PDU session modification request according to the PDU session modification request initiated by the terminal.
  • a seventh aspect a computer storage medium storing computer executable instructions for causing the computer to perform the method of any of the above first aspects, method.
  • a computer storage medium in an eighth aspect, storing computer executable instructions for causing the computer to perform the method of any of the second aspects above method.
  • the access network node receives the request message from the access and mobility management network element, and the access network node establishes the data radio bearer corresponding to the specified data flow according to the request message. DRB and turn on integrity protection for the DRB.
  • the integrity protection indication information is used to indicate that the integrity protection is enabled for the specified data flow, so that the access network node can be enabled to open according to the integrity protection indication information. Integrity protection of user plane data between terminals.
  • the embodiment of the present application further provides a user plane data security protection method and device.
  • the ninth aspect provides a user plane data security protection method, including:
  • the access network node receives a request message sent by the access and mobility management network element, where the request message carries the quality of service QoS information of the data stream;
  • the access network node determines whether to perform integrity protection on the data flow according to the QoS information of the data flow and the integrity protection configuration information, where the integrity protection configuration information is used to indicate whether the The data flow corresponding to the QoS information is integrity protected;
  • the access network node establishes a data radio bearer DRB corresponding to the data flow according to the request message, and starts integrity protection on the DRB.
  • the integrity protection configuration information includes a service type corresponding to a data flow that needs integrity protection
  • the access network node determines whether to perform integrity protection on the data flow according to the QoS information of the data flow and the integrity protection configuration information, including:
  • the access network node determines to perform integrity protection on the data flow.
  • the access network node establishes the DRB corresponding to the data flow according to the request message, including:
  • the access network node determines to perform integrity protection on the multiple data flows, the access network node establishes a DRB corresponding to the multiple data flows according to the multiple integrity protection indication information.
  • the request message is one of the following messages:
  • the reference node request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a service request initiated by the terminal Sending the session update request;
  • the first PDU session request message is sent by the access and mobility management network element according to a session establishment request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session establishment request sends the session establishment request
  • the second PDU session request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session modification request sends the session update request.
  • an access network node including:
  • a receiving module configured to receive a request message sent by the access and mobility management network element, where the request message carries quality of service QoS information of the data stream;
  • a determining module configured to determine whether to perform integrity protection on the data flow according to the QoS information of the data flow and the integrity protection configuration information, where the integrity protection configuration information is used to indicate whether the QoS is required The data flow corresponding to the information is integrity protected;
  • a processing module configured to establish, according to the request message, a data radio bearer DRB corresponding to the data flow, and enable integrity protection for the DRB, if the determination is yes.
  • an access network node including: a processor, a memory, a transceiver, the processor, the memory, and the transceiver are connected by a bus; the processor is configured to read a program in the memory, carried out:
  • the data radio bearer DRB corresponding to the data flow is established according to the request message, and integrity protection for the DRB is turned on.
  • the integrity protection configuration information includes a service type corresponding to a data flow that needs to be integrity protected
  • the processor is specifically configured to:
  • the processor is specifically configured to:
  • the DRB corresponding to the plurality of data streams is established according to the plurality of data streams.
  • the request message is one of the following messages:
  • the reference node request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a service request initiated by the terminal Sending the session update request;
  • the first PDU session request message is sent by the access and mobility management network element according to a session establishment request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session establishment request sends the session establishment request
  • the second PDU session request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a terminal
  • the initiated PDU session modification request sends the session update request.
  • a twelfth aspect a computer storage medium storing computer executable instructions for causing the computer to perform the method of any of the above ninth aspects Methods.
  • the access network node receives the request message sent by the access and mobility management network element, and determines whether to complete the data flow according to the QoS information of the data flow and the integrity protection configuration information. If the determination is yes, the DRB corresponding to the data flow is established according to the request message, and integrity protection for the DRB is started.
  • the access network node can determine whether to perform integrity protection on the data flow, because the request message carries the QoS information of the data flow, and the access network node is configured with the integrity protection configuration information based on the QoS information.
  • the access network node is enabled to open the integrity protection of the user plane data with the terminal.
  • FIG. 1 is a schematic structural diagram of a system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a user plane data security protection process provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a user plane data security protection process according to another embodiment of the present application.
  • FIG. 4 is a schematic diagram of signaling interaction of a service request process according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of signaling interaction of a service request process according to another embodiment of the present disclosure.
  • FIG. 6 is a schematic diagram of signaling interaction of a session management process according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram of signaling interaction of a PDU session modification process according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of an access network node according to an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a session management network element according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of an access network node according to another embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of an access network node according to another embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a session management network element provided by another embodiment of the present application.
  • the RAN device which may also be referred to as a RAN node, is used to connect the terminal to the wireless network, including but not limited to: Next Generation Node B (NG Node B, gNB), Evolved Node B (evolved node B, eNB), radio network controller (RNC), node B (node B, NB), base station controller (BSC), base transceiver station (BTS), home base station (for example , home evolved NodeB, or home Node B, HNB), baseband unit (BBU), wireless fidelity (WIFI), access point (AP), transmission point (transmission and receiver point) , TRP or transmission point, TP), base station based on new access technology, and the like.
  • NG Node B, gNB Next Generation Node B
  • Evolved Node B evolved node B, eNB
  • RNC radio network controller
  • node B node B
  • BSC base station controller
  • BTS base transceiver station
  • a terminal is a device that provides voice and/or data connectivity to a user, including a wired terminal and a wireless terminal.
  • the wireless terminal can be a handheld device with wireless connectivity, or other processing device connected to a wireless modem, and a mobile terminal that communicates with one or more core networks via a wireless access network.
  • the wireless terminal can be a mobile phone, a computer, a tablet, a personal digital assistant (PDA), a mobile internet device (MID), a wearable device, and an e-book reader. Wait.
  • the wireless terminal can also be a portable, pocket, handheld, computer built-in or in-vehicle mobile device.
  • the wireless terminal can be a mobile station or an access point.
  • the interaction in this application refers to the process in which the two parties exchange information with each other, and the information transmitted here may be the same or different.
  • the two parties are the base station 1 and the base station 2, and the base station 1 may request information from the base station 2, and the base station 2 provides the base station 1 with the information requested by the base station 1.
  • the base station 1 and the base station 2 may request information from each other, and the information requested here may be the same or different.
  • Multiple means two or more. "and/or” describes the association relationship of the associated objects, indicating that there may be three relationships, for example, A and/or B, which may indicate that there are three cases where A exists separately, A and B exist at the same time, and B exists separately.
  • the character "/" generally indicates that the contextual object is an "or" relationship.
  • the "request message” in the embodiment of the present application is only an exemplary message naming manner, and may be replaced by other message names such as a "reference node request message” and a "PDU request message”. Specific restrictions.
  • FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • the system architecture can implement user plane data security protection.
  • the system shown in FIG. 1 includes: a session management network element 101, an access and mobility management network element. 102. Access network node 103.
  • User plane network element 104 can also be included.
  • Terminal 105 can communicate with access network node 103.
  • the dotted line "---" in FIG. 1 may indicate a control plane connection between network elements, and the solid line “-" may indicate a user plane connection between network elements.
  • the session management network element 101 is an independent logical function entity, and may be an independent network device or integrated in other network devices.
  • the access and mobility management network element 102 can be an independent network device or integrated in other network devices.
  • the access network node 103 can be an independent network device or integrated in other network devices.
  • the session management network element 101 may be a SMF (session management function) network element in the 5G system.
  • the SMF network element may be enhanced to implement the functions provided by the embodiments of the present application.
  • the access and mobility management network element 102 may be an AMF (access and mobility management function) network element in the 5G system, and the access network node 103 may be an NG RAN node in the 5G system.
  • the user plane network element may be a UPF (user plane fanction) in a 5G system.
  • the number of access network nodes 103 may be plural, and FIG. 1 only takes one access network node as an example.
  • FIG. 2 is a schematic diagram of a user plane data security protection process provided by an embodiment of the present application.
  • the user plane data security protection process provided by the embodiment of the present application may include:
  • the session management network element sends a first request message to the access and mobility management network element, where the first request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that the data flow is started. Integrity protection.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • This data stream is a data stream that requires integrity protection to be turned on.
  • the information of the data stream may be an identifier of the data stream.
  • the first request message includes a session management information element for carrying session management related information.
  • an information unit may be added to the session management information unit, which is referred to as a first information unit, where the first information unit carries an identifier of a data flow that needs to be turned on for integrity protection, and an integrity protection open identifier. .
  • the first request message includes a second information unit, where the second information unit carries quality of service (QoS) configuration information of the data stream.
  • QoS quality of service
  • the number of second information units may be one or more, and each second information unit corresponds to one data stream.
  • the integrity protection open identifier may be set to a second information unit corresponding to the data flow that needs to be turned on for integrity protection.
  • the session management network element may first determine integrity protection for the specified data stream.
  • the session management network element can determine integrity protection for the specified data stream based on the following conditions:
  • Case 1 The session management network element determines, according to the service request initiated by the terminal, integrity protection on the data flow corresponding to the service request, and further sends a first request message to the access and mobility management network element, where the complete request message is carried.
  • Sexual protection indication information to indicate that integrity protection is turned on for the data stream;
  • Case 2 The session management network element determines, according to the PDU session establishment request initiated by the terminal, integrity protection on the data flow corresponding to the PDU session establishment request, and further sends a first request message to the access and mobility management network element, Carrying integrity protection indication information to indicate that integrity protection is turned on for the data flow;
  • Case 3 The session management network element determines, according to the PDU session modification request initiated by the terminal, integrity protection on the data flow corresponding to the PDU session modification request, and further sends a first request message to the access and mobility management network element.
  • the integrity protection indication information is carried to indicate that integrity protection is turned on for the data flow.
  • the access and mobility management network element sends a second request message to the access network node, where the second request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that the specified data flow is started. Integrity protection.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data stream may be an identifier of the data stream.
  • the second request message includes a session management information element for carrying session management related information.
  • an information unit may be added to the session management information unit, which is referred to as a first information unit, where the first information unit carries an identifier of a data flow that needs to be turned on for integrity protection, and an integrity protection open identifier. .
  • the second request message includes a second information unit, where the second information unit carries QoS configuration information of the data stream.
  • the number of second information units may be one or more, and each second information unit corresponds to one data stream.
  • the integrity protection open identifier may be set to a second information unit corresponding to the data flow that needs to be turned on for integrity protection.
  • the access network node establishes a DRB corresponding to the specified data flow according to the second request message, and starts integrity protection on the DRB.
  • the second request message carries multiple integrity protection indication information, and an integrity protection indication information is used to indicate that integrity protection is turned on for one data flow.
  • the access network node may establish, according to the request message, a DRB corresponding to the multiple data flows for the multiple data flows indicated by the multiple integrity protection indication information. That is, the access network node can establish a DRB for multiple data flows that need integrity protection, and turn on integrity protection for the DRB.
  • the first request message and the second request message further carry indication information of an integrity protection algorithm used by the terminal and the access network node.
  • the access network node determines whether the access network node supports the integrity protection algorithm indicated by the indication information of the integrity protection algorithm, and if the determination is yes, the data flow corresponding to the request message is established.
  • the DRB and according to the indication information of the integrity protection algorithm, turns on the integrity protection of the DRB.
  • the integrity protection indication information is further used to indicate an integrity protection algorithm used by the access network node.
  • the access network node determines whether the access network node supports the integrity protection algorithm indicated by the integrity protection indication information. If the determination is yes, the DRB corresponding to the data flow is established according to the request message. And opening integrity protection for the DRB according to the integrity protection algorithm indicated by the integrity protection indication information.
  • the access network node receives the request message from the access and mobility management network element, and the access network node establishes the data radio bearer corresponding to the specified data flow according to the request message. DRB and turn on integrity protection for the DRB.
  • the integrity protection indication information is used to indicate that the integrity protection is enabled for the specified data flow, so that the access network node can be enabled to open according to the integrity protection indication information. Integrity protection of user plane data between terminals.
  • the above process can be implemented in different scenarios.
  • the foregoing integrity protection indication process may be implemented in a service request process initiated by the terminal (as shown in FIG. 4), or the integrity protection indication process may be implemented in a session management process scenario (as shown in FIG. 6), or The above integrity protection indication process is implemented in the PDU session update scenario (as shown in FIG. 7).
  • the session management network element sends a session update request (corresponding to the first request message) to the access and mobility management network element based on the service request initiated by the terminal.
  • the access and mobility management network element after receiving the message, sends a reference node request message (corresponding to the second request message) to the access network node.
  • the session management network element sends a session establishment request to the access and mobility management network element based on the terminal initiated PDU session establishment request (corresponding to the first The request message); in S201, after receiving the message, the access and mobility management network element sends a PDU request message (corresponding to the second request message) to the access network node.
  • the session management network element sends a session update request to the access and mobility management network element based on the terminal-initiated PDU session modification request (corresponding to the first The request message); in S201, after receiving the message, the access and mobility management network element sends a PDU request message (corresponding to the second request message) to the access network node.
  • FIG. 3 is a schematic diagram of a user plane data security protection process provided by another embodiment of the present application.
  • the user plane data security protection process provided by the embodiment of the present application may include:
  • S300 The session management network element sends a first request message to the access and mobility management network element.
  • the first request message may include QoS information of the data flow.
  • the QoS information for each data stream or each data stream is identified using a corresponding identifier.
  • the QoS information of a data stream includes QoS parameters of the data stream.
  • the QoS parameters may include: 5G QoS Identifier (5QI) and An Allocation and Retention Priority (ARP).
  • the 5QI value may indicate that the data stream already has QoS characteristics.
  • the 5G QoS feature identified by the 5QI may include a Resource Type, a Priority Level, a Packet Delay Budget, a Packet Error Rate, and an Averaging window.
  • the resource types are classified into Guaranteed Bit Rate (GBR), Delay Critical GBR (Delay Critical GBR), and Non-guaranteed Bit Rate (Non-GBR).
  • GRR Guaranteed Bit Rate
  • Delay Critical GBR Delay Critical GBR
  • Non-GBR Non-guaranteed Bit Rate
  • 5QI is a reference scalar for 5G QoS characteristics.
  • the 5QI value is in one-to-one correspondence with the standardized combination of the specified 5G QoS characteristics.
  • the AN pre-configures the 5G QoS characteristics of the pre-configured 5QI value.
  • the QoS for ensuring the bit rate of the traffic also includes the Guaranteed Flow Bit Rate (GFBR) of the uplink and the downlink and the Maximum Flow Bit Rate (MFBR); the QoS for the bit rate of the non-guaranteed traffic is also It can include a Reflective QoS Attribute (RQA).
  • the QoS information of each data stream has a corresponding QoS Flow Identifier (QFI), but it is not included in the QoS information itself of each data stream.
  • the access and mobility management network element sends a second request message to the access network node, where the request message carries QoS information of the data flow.
  • the access network node determines whether to perform integrity protection on the data flow according to the QoS information of the data flow and the integrity protection configuration information.
  • the integrity protection configuration information may be pre-configured in the access network node.
  • the integrity ambiguity configuration information is used to indicate whether integrity protection is needed for the data stream corresponding to the QoS information.
  • the integrity protection configuration information includes a service type corresponding to a data flow that needs to be integrity-protected, such as a service type list, where the service type included in the list is usually a service type with a higher priority, and the service type is The user plane data corresponding to the type needs to be integrity protected.
  • the access network node determines the service type corresponding to the data flow according to the QoS information of the data flow, and if the service type corresponding to the data flow matches the service type included in the integrity protection configuration information, The access network node then determines integrity protection for the data stream.
  • the access network node determines to perform integrity protection on the multiple data flows, the access network node establishes a DRB corresponding to the multiple data flows according to the multiple data flows. That is, the access network node can establish a DRB for multiple data flows that need integrity protection, and turn on integrity protection for the DRB.
  • the access network node receives the request message sent by the access and mobility management network element, and determines whether to complete the data flow according to the QoS information of the data flow and the integrity protection configuration information. If the determination is yes, the DRB corresponding to the data flow is established according to the request message, and integrity protection for the DRB is started.
  • the access network node can determine whether to perform integrity protection on the data flow, because the request message carries the QoS information of the data flow, and the access network node is configured with the integrity protection configuration information based on the QoS information.
  • the access network node is enabled to open the integrity protection of the user plane data with the terminal.
  • the above process can be implemented in different scenarios.
  • the integrity protection indication process (shown in FIG. 5) may be implemented in a service request process initiated by the terminal, or the integrity protection indication process may be implemented in a session management process scenario (as shown in FIG. 6), or In the PDU session update scenario (as shown in FIG. 7), the above integrity protection indication process is implemented.
  • the session management network element sends a session update request (corresponding to the first request message) to the access and mobility management network element based on the service request initiated by the terminal.
  • the access and mobility management network element after receiving the message, sends a reference node request message (corresponding to the second request message) to the access network node.
  • the session management network element sends a session establishment request to the access and mobility management network element based on the terminal initiated PDU session establishment request (corresponding to the first The request message); in S201, after receiving the message, the access and mobility management network element sends a PDU request message (corresponding to the second request message) to the access network node.
  • the session management network element sends a session update request to the access and mobility management network element based on the terminal-initiated PDU session modification request (corresponding to the first The request message); in S201, after receiving the message, the access and mobility management network element sends a PDU request message (corresponding to the second request message) to the access network node.
  • FIG. 4 is a schematic diagram of a signaling interaction of a service request process provided by an embodiment of the present application.
  • the core network informs the access network node (for example, gNB) whether to establish integrity protection when establishing a DRB of a data stream.
  • the core network sends an N2 message to the access network node (gNB), where the N2 message contains the QoS information of the data stream.
  • the 1 bit integrity protection indication information is added to the message of the interaction to indicate whether the integrity protection needs to be enabled.
  • the gNB configures the air interface DRB to complete the integrity when configuring and mapping the DRB. The need for protection. Specific steps are as follows:
  • the UE initiates a NAS service request to the gNB, and the PDU session is activated.
  • gNB forwards the service request to AMF.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the AMF sends a PDU Session Context Update Request (Nsmf_PDUSession_UpdateSMContext Request) to the SMF, which contains the ID of the PDU session and the current location of the UE.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the SMF generates N2 SM information and sends a PDU Session Context Response (Nsmf_PDUSession_UpdateSMContext Response) to the AMF to establish a user plane for the PDU session.
  • This message corresponds to the "first request message" in FIG. 2.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the SMF knows that gNB supports UP integrity protection.
  • the N2 SM information includes a PDU Session ID, a QoS profile, a CN N3 Tunnel Info, and an S-NSSAI.
  • the SMF may carry an information element in the N2 SM information (1 flag is turned on, or 0 is not turned on), and the data stream ID and the integrity of the information unit may be added in the information unit.
  • the AMF sends an N2 request message to the gNB, which includes the N2 SM information (CN N3 Tunnel Info) received from the SMF, and the N2 SM information includes an indication of whether the integrity protection needs to be turned on.
  • This message corresponds to the "second request message" in FIG. 2.
  • the message may include a data flow ID and an MM NAS Service Accept.
  • the gNB detects whether the local security configuration is supported. If it is supported, the integrity protection is enabled in the process of establishing the DRB through the RRC connection reconfiguration with the UE.
  • the gNB learns through the integrity protection indication information which data flows need to perform integrity protection.
  • the RRC connection reconfiguration sends an integrity protection algorithm to indicate that the integrity protection is enabled.
  • FIG. 5 is a schematic diagram of a service request flow signaling interaction provided by another embodiment of the present application.
  • the gNB does not directly obtain the integrity indication information from the core network, but indirectly determines whether the data flow is integrity protection by the 5QI speculative service type.
  • the process can include:
  • the UE initiates a NAS service request to the gNB, and the PDU session is triggered.
  • gNB forwards the service request message to the AMF.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the AMF sends a PDU Session Context Update Request to the SMF containing the ID of the PDU Session and the current location of the UE.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the SMF generates N2 SM information and sends a PDU session context response to the AMF to establish a user plane for the PDU session.
  • This message corresponds to the "first request message" in FIG.
  • the N2 SM information includes the PDU Session ID, QoS profile, CN N3 Tunnel Info, and S-NSSAI.
  • the message includes not only the security capabilities of the UE, but also the security capabilities of the gNB, including the supported integrity algorithms.
  • the SMF knows that gNB supports UP integrity protection. Different from the solution shown in FIG. 4, the message does not include an indication of turning on integrity protection, but carries QoS information of a data stream necessary in the original message.
  • the AMF sends an N2 request message to the gNB, which contains the N2 SM information received from the SMF, and the MM NAS Service Accept.
  • N2 SM information includes QoS profile, CN N3 Tunnel Info. This message corresponds to the "second request message" in FIG. Different from the scheme shown in FIG. 4, whether the integrity protection indication information is included in the message is not included. Based on the QoS information and local configuration of the received data stream, the gNB needs to determine whether the DRB integrity protection is enabled.
  • the gNB establishes a DRB with the UE according to the received indication of whether the integrity protection is turned on. Specifically, after receiving the message, the gNB knows which data flows need to perform integrity protection. In the process of establishing the DRB, the RRC connection reconfiguration sends an integrity protection algorithm to indicate that the integrity protection is enabled. Some data flows with integrity protection turned on are placed in the same DRB.
  • the gNB may forward to the core network security capability, if the gNB is configured with an out-of-band manner, an algorithm for configuring current and future configurable integrity protection is achievable.
  • the gNB may not send the supported algorithm to the core network.
  • the main conflict between the core network and the access network is the limitation of the rate.
  • the indication based on the small-grained data stream can better solve the problem. That is, when the gNB rate is limited, the core network identifies the most important and most needs to be complete. Sexually protected data flow and direct it to gNB.
  • FIG. 6 is a schematic diagram of signaling interaction of a session management process provided by an embodiment of the present application.
  • the UE sends a NAS message to the AMF.
  • the message contains S-NSSAI(s), DNN, PDU session ID, request type, old PDU session ID, N1 SM container.
  • the PDU session establishment request is included in the N1 SM container.
  • the UE In order to establish a new PDU session, the UE generates a new PDU session ID.
  • the UE initiates a UE request PDU session establishment procedure by using a NAS message, and the NAS includes a PDU session establishment request in the N1 SM container.
  • the PDU session establishment request may include a PDU type, an SSC mode, and a protocol configuration option.
  • the NAS message sent by the UE is compressed into the N2 message by the AN and sent to the AMF, including user location information and access technology type information.
  • the AMF decides that the message of the request type "Initial Request" triggers a new PDU session.
  • the NAS message does not contain S-NAASI information, and the AMF can assign a default S-NSSAI or allocate it based on the operator policy.
  • the AMF selects an SMF, which stores the PDU session ID and SMF ID.
  • Nsmf_PDUSession_CreateSMContext request including SUPI or PEI, DNN, S-NSSAI, PDU session ID, AMF ID, request type, N1 SM container, user location information, access type, PEI, GPSI, user location information, access type, RAT type, PEI or Nsmf_PDUSession_UpdateSMContext request.
  • the PDU session establishment request is included in the N1 SM container.
  • PEI is used for subscription of PDU session status notifications.
  • the Nsmf_PDUSession_UpdateSMContext request includes SUPI, DNN, S-NSSAI, PDU session ID, AMF ID, and request type. If the SMF is not yet registered and the subscription data is not available, the SMF registers with the Universal Data Model (UDM) to retrieve notifications of changes in the subscription data and subscription data changes.
  • UDM Universal Data Model
  • Nsmf_PDUSession_CreateSMContext response or Nsmf_PDUSession_UpdateSMContext response.
  • the reason for generating the Nsmf_PDUSession_CreateSMContext response is that the SM Context ID or the PDU Session Establishment Request in the N1 SM Container is rejected. If the SMF receives the Nsmf_PDUSession_CreateSMContext request in step S403 and the SMF is able to process the PDU session establishment request, the SMF creates the SM context and responds to the AMF by providing the SMContext identifier.
  • the response includes a PDU session ID, an access type, N2 SM information, and an N1 SM container.
  • the N2 SM information includes PDU session ID, QFI, QoS profile, CN channel information, S-NSSAI, session AMBR, PDU session type.
  • the N1 SM container includes a PDU session establishment request including a QoS rule, a selected SSC mode, an S-NSSAI, an assigned IPv4 address, an interface identifier, a session AMBR, and a selected PDU session type.
  • the CN tunnel information contains tunnel information related to terminating the UPF of N3.
  • the N2 SM information carries information that the AMF should forward to the (R)AN, including:
  • the -CN tunnel information corresponds to the core network address of the N3 tunnel corresponding to the PDU session.
  • the (R)AN may be provided with one or more QoS profiles and corresponding QFIs QoS Flow Identifiers and an indication of whether integrity protection is to be performed.
  • the SMF may carry an IE in the N2 SM information in the Namf_Communication_N1N2MessageTransfer (1 flag is enabled, or 0 is not enabled), and the ID of the Flow may be added to the IE information.
  • a flag of integrity protection by which indicates whether the DRB of the PDU session has full protection enabled; or includes an indication of whether integrity protection is turned on in the QoS profile; or includes the indication in other IEs in the N2 SM information.
  • An indication of integrity protection may also be carried in the QoS rules in the N1 SM container.
  • Namf_Communication_N1N2MessageTransfer further contains a PDU session ID and information that allows the AMF to know which access to use for the UE.
  • the N2 PDU session request includes N2 SM information, NAS message.
  • the NAS message includes a PDU session ID, an N1 SM content package.
  • the N1 SM content package includes PDU session establishment acceptance.
  • the (R)AN forwards the NAS message provided in S412 to the UE.
  • the above-mentioned process shown in FIG. 6 is described by taking the integrity protection indication information in the message exchanged in the steps 11 to 12 as an example.
  • the messages in the foregoing steps 11 to 12 may not carry the integrity protection.
  • the RAN node determines whether the data flow needs to be turned on for integrity protection according to the QoS information of the data flow in the message.
  • FIG. 7 is a schematic diagram of signaling interaction of a PDU session modification process provided by an embodiment of the present application, where the process includes:
  • the UE sends a NAS message, and the NAS message includes a PDU SM session modification request.
  • the NAS message initiates a PDU session modification process.
  • the NAS message is forwarded by the (R)AN to the AMF and indicates the user location information.
  • the AMF calls Nsmf_PDUSession_UpdateSMContext and sends it to the SMF.
  • the Nsmf_PDUSession_UpdateSMContext includes a PDU session ID, an N1 SM container, and the N1 SM container includes a PDU session modification request.
  • the SMF sends a response through the Nsmf_PDUSession_UpdateSMContext, N1 SM container.
  • the Nsmf_PDUSession_UpdateSMContext includes N2 SM information, and the N2 SM information includes a PDU session ID, a QFI, a QoS profile, and a session AMBR.
  • the N1 SM container includes a PDU session modification command, and the PDU session modification command includes a PDU session ID, a QoS rule, a QoS rule operation, and a session AMBR.
  • the N2 SM information carries information that the AMF should provide to the (R)AN. It may include a QoS profile and a corresponding QFI to inform the (R)AN of one or more added, deleted or modified QoS flows. It may also include only QFI to inform the (R) AN that one or more QoS flows have been removed. If the network wishes to modify the information of the flow integrity protection, it can transmit an indication via this information.
  • the N1 SM container carries the PDU session modification command provided by the AMF to the UE.
  • QoS rules and corresponding QoS rule operations may be included to inform the UE that one or more QoS rules are added, deleted or modified. If the carrying indication information in S703a may be included in the N2 SM and N1 SM or carried in the IE included in both.
  • the SMF triggers the Namf_Communication_N1N2MessageTransfer message, which contains the N2 SM information and the N1 SM container.
  • the N2 SM information includes a PDU Session ID, a QFI(s), a QoS Profile(s), and a Session-AMBR.
  • the N1 SM container includes a PDU Session Modification Command, and the PDU Session Modification Command includes a PDU Session ID, a QoS rule(s), and a QoS rule. Operation, Session-AMBR. If the indication information is carried in s703b, it may also be included in the N2 SM and N1 SM or carried in the IE included in both.
  • the above-mentioned process shown in FIG. 7 is described by taking the integrity protection indication information in the message exchanged in the steps 3a to 3b as an example, and the message exchanged in the foregoing steps 3a to 3b may not carry the integrity protection. Instructing the information, the RAN node determines whether the data flow needs to be turned on for integrity protection according to the QoS information of the data flow in the message.
  • the embodiment of the present application further provides an access network node, which can implement the functions implemented by the access network node in the foregoing process shown in FIG. 2 .
  • the access network node may include: a receiving module 801 and a processing module 802.
  • the receiving module 801 is configured to receive a request message from the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is enabled for the specified data flow. ;
  • the processing module 802 is configured to establish a data radio bearer DRB corresponding to the specified data flow according to the request message, and turn on integrity protection for the DRB.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries quality of service QoS configuration information of the data flow, and the QoS configuration information includes the Integrity protection is turned on.
  • the request message further carries indication information of the integrity protection algorithm used by the terminal and the access network node.
  • the processing module 802 is specifically configured to: determine whether the access network node supports an integrity protection algorithm indicated by the indication information of the integrity protection algorithm, and if the determination is yes, establish the data flow corresponding according to the request message.
  • the DRB and according to the indication information of the integrity protection algorithm, turns on the integrity protection of the DRB.
  • the integrity protection indication information is further used to indicate an integrity protection algorithm used by the access network node.
  • the processing module 802 is specifically configured to: determine whether the access network node supports the integrity protection algorithm indicated by the integrity protection indication information, and if yes, establish a DRB corresponding to the data flow according to the request message. And opening integrity protection for the DRB according to the integrity protection algorithm indicated by the integrity protection indication information.
  • the request message carries multiple integrity protection indication information, and an integrity protection indication information is used to indicate that integrity protection is turned on for one data flow;
  • the processor is specifically configured to: establish, according to the request message, a DRB corresponding to the multiple data flows for the multiple data flows indicated by the multiple integrity protection indication information.
  • the request message is one of the following messages:
  • the reference node request message is sent by the access and mobility management network element according to a session update request from a session management network element, wherein the session management network element is based on a service request initiated by the terminal Sending the session update request;
  • the first PDU request message is sent by the access and mobility management network element according to a session establishment request from a session management network element, where the session management network element is based on a terminal initiated Sending the session establishment request by the PDU session establishment request;
  • the second PDU request message is sent by the access and mobility management network element according to a session update request from a session management network element, where the session management network element is based on a terminal initiated
  • the PDU session modification request sends the session update request.
  • the embodiment of the present application further provides a session management network element, and the session management network element can implement the functions implemented by the session management network element in the foregoing process shown in FIG. 2 .
  • the session management network element may include: a determining module 901 and a sending module 902.
  • the determining module 901 is configured to determine integrity protection for the specified data stream
  • the sending module 902 is configured to send a request message to the access and mobility management network element, where the request message carries integrity protection indication information, where the integrity protection indication information is used to indicate that integrity protection is turned on for the data flow.
  • the integrity protection indication information includes information of the data flow and an integrity protection open identifier corresponding to the information of the data flow.
  • the information of the data flow is an identifier of the data flow
  • the request message includes a session management information unit, where the session management information unit includes a first information unit, where the first information unit carries the data An identifier of the flow and the integrity protection open identifier; or the request message includes a second information unit, the second information unit carries QoS configuration information of the data flow, and the QoS configuration information includes the integrity Protect the open logo.
  • the determining module 901 is further configured to determine an integrity protection algorithm used for integrity protection of the data stream.
  • the request message further carries the indication information of the integrity protection algorithm used by the terminal and the access network node determined by the session management network element, or the integrity protection indication information carried by the request message is further used for An integrity protection algorithm used by the terminal and the access network node is indicated.
  • the session management network element determines integrity protection for the specified data flow, including:
  • the session management network element determines, according to the service request initiated by the terminal, integrity protection on the data flow corresponding to the service request; or the session management network element determines the PDU according to the PDU session establishment request initiated by the terminal.
  • the data flow corresponding to the session establishment request is integrity protected; or the session management network element determines to perform integrity protection on the data flow corresponding to the PDU session modification request according to the PDU session modification request initiated by the terminal.
  • the embodiment of the present application further provides an access network node, which can implement the function of the access network node in FIG.
  • the access network node may include: a receiving module 1001, a determining module 1002, and a processing module 1003.
  • the receiving module 1001 is configured to receive a request message sent by the access and mobility management network element, where the request message carries quality of service QoS information of the data stream;
  • the determining module 1002 is configured to determine whether to perform integrity protection on the data flow according to the QoS information of the data flow and the integrity protection configuration information, where the integrity protection configuration information is used to indicate whether the QoS is required The data flow corresponding to the information is integrity protected;
  • the processing module 1003 is configured to: when the determination is yes, establish a data radio bearer DRB corresponding to the data flow according to the request message, and enable integrity protection for the DRB.
  • the integrity protection configuration information includes a service type corresponding to a data flow that needs to be integrity protected.
  • the determining module 1002 is specifically configured to: determine, according to the QoS information of the data stream, a service type corresponding to the data flow; if the service type corresponding to the data flow matches the service type included in the integrity protection configuration information, Determining integrity protection of the data stream.
  • the embodiment of the present application further provides an access network node.
  • the access network node can implement the functions of any of the access network nodes in the foregoing embodiments.
  • the access network node includes a processor 1101, a memory 1102, a transceiver 1103, and a bus interface.
  • the processor 1101 is responsible for managing the bus architecture and general processing, and the memory 1102 can store data used by the processor 1101 when performing operations.
  • the transceiver 1103 is configured to receive and transmit data under the control of the processor 1101.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 1101 and various circuits of memory represented by memory 1102.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • the processor 1101 is responsible for managing the bus architecture and general processing, and the memory 1102 can store data used by the processor 1101 when performing operations.
  • the flow disclosed in the embodiment of the present application may be applied to the processor 1101 or implemented by the processor 1101.
  • each step of the signal processing flow may be completed by an integrated logic circuit of hardware in the processor 1101 or an instruction in the form of software.
  • the processor 1101 can be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component, which can be implemented or executed in the embodiment of the present application.
  • a general purpose processor can be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1102, and the processor 1101 reads the information in the memory 1102 and completes the steps of the signal processing flow in conjunction with its hardware.
  • the processor 1101 is configured to read a program in the memory 1102 and execute the flow performed by the access network node described in the foregoing embodiment.
  • the embodiment of the present application further provides a session management network element, and the session management network element can implement the functions implemented by any session management network element in the foregoing embodiment.
  • the session management network element includes a processor 1201, a memory 1202, a transceiver 1203, and a bus interface.
  • the processor 1201 is responsible for managing the bus architecture and general processing, and the memory 1202 can store data used by the processor 1201 in performing operations.
  • the transceiver 1203 is configured to receive and transmit data under the control of the processor 1201.
  • the bus architecture may include any number of interconnected buses and bridges, specifically linked by one or more processors represented by processor 1201 and various circuits of memory represented by memory 1202.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • the processor 1201 is responsible for managing the bus architecture and general processing, and the memory 1202 can store data used by the processor 1201 in performing operations.
  • the flow disclosed in the embodiment of the present application may be applied to the processor 1201 or implemented by the processor 1201.
  • each step of the signal processing flow may be completed by an integrated logic circuit of hardware in the processor 1201 or an instruction in a form of software.
  • the processor 1201 may be a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or a transistor logic device, and a discrete hardware component, which may be implemented or executed in the embodiment of the present application.
  • a general purpose processor can be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 1202, and the processor 1201 reads the information in the memory 1202 and completes the steps of the signal processing flow in conjunction with its hardware.
  • the processor 1201 is configured to read a program in the memory 1202 and execute the process performed by the access network node described in the foregoing embodiment.
  • the embodiment of the present application further provides a computer storage medium.
  • the computer readable storage medium stores computer executable instructions for causing the computer to perform the processes performed by the access network interface of the previous embodiments.
  • the embodiment of the present application further provides a computer storage medium.
  • the computer readable storage medium stores computer executable instructions for causing the computer to perform the processes performed by the session management network element in the previous embodiments.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种用户面数据安全保护方法及装置。本申请的一种方法中，接入网节点接收来自于接入及移动性管理网元的请求消息，根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护；其中，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护。本申请的另一方法中，会话管理网元确定对指定的数据流进行完整性保护；所述会话管理网元向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。

Description

一种用户面数据安全保护方法及装置
本申请要求在2018年01月11日提交中国专利局、申请号为201810027509.3、申请名称为“一种用户面数据安全保护方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信技术领域，特别涉及一种用户面数据安全保护方法及装置。
背景技术
在无线承载方面，5G系统中无线承载的类型及建立流程与长期演进(long term evolution，LTE)系统中无线承载的类型及建立流程相似。具体的，在LTE系统中无线承载的类型主要有两种：信令无线承载和数据无线承载(Data Radio Bearer，DRB)，DRB主要传输用户面数据。通过这些承载可以使得下层协议向上层协议提供服务。
在LTE系统中，在无线资源控制(radio resource control，RRC)连接建立过程完成之后启用安全保护，大部分的信令消息都开启加密和完整性保护。由于考虑安全处理效率等因素，基站与终端之间对于用户面数据只启用了加密保护，未启用用户面数据的完整性保护。
5G系统是一种面向服务的融合系统，相比LTE系统具有更加广泛的应用场景。例如，5G系统支持用于包括工业自动化(远程)控制系统在内的应用的超可靠、低延迟通信，还可支持大量高效、高成本、高密度的物联网设备。在上述场景中，由于用户面数据涉及关键的执行指令等不可更改信息，需要在空口对这些用户面数据进行完整性保护。
发明内容
本申请实施例提供一种用户面数据安全保护方法及装置，以实现对用户面数据进行完整性保护。
第一方面，提供一种用户面数据安全保护方法，包括：
接入网节点接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
所述接入网节点根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的服务质量QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法；
所述接入网节点根据所述请求消息建立所述数据流对应的DRB，并开启对所述DRB的完整性保护，包括：
所述接入网节点判断所述接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
可选地，所述请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护；
所述接入网节点根据所述请求消息建立所述指定的数据流对应的DRB， 包括：
所述接入网节点根据所述多个完整性保护指示信息，为所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。
可选地，所述请求消息为以下消息中的一种：
参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
第二方面，提供一种用户面数据安全保护方法，包括：
会话管理网元确定对指定的数据流进行完整性保护；
所述会话管理网元向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，所述方法还包括：所述会话管理网元确定对所述数据流进行完整性保护所使用的完整性保护算法；
所述请求消息还携带所述会话管理网元确定出的所述终端和所述接入网节点使用的完整性保护算法的指示信息，或者所述请求消息携带的完整性保护指示信息还用于指示所述终端和所述接入网节点使用的完整性保护算法。
可选地，所述会话管理网元确定对指定的数据流进行完整性保护，包括：
所述会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护。
第三方面，提供一种接入网节点，包括：
接收模块，用于来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
处理模块，用于根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
第四方面，提供一种会话管理网元，包括：
确定模块，用于确定对指定的数据流进行完整性保护；
发送模块，用于向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
第五方面，提供一种接入网节点，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器中的程序，执行：
通过所述收发机接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并 开启对所述DRB的完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的服务质量QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，所述请求消息还携带终端和所述接入网节点使用的完整性保护算法的指示信息；
所述处理器具体用于：判断所述接入网节点是否支持所述完整性保护算法的指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护算法的指示信息，开启对所述DRB的完整性保护。
可选地，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法；
所述处理器具体用于：判断所述接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
可选地，所述请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护；
所述处理器具体用于：根据所述请求消息，针对所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。
可选地，所述请求消息为以下消息中的一种：
参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网 元基于终端发起的服务请求发送所述会话更新请求；
第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
第六方面，提供一种会话管理网元，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器中的程序，执行：
确定对指定的数据流进行完整性保护；
通过所述收发机向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，所述处理器还用于：确定对所述数据流进行完整性保护所使用的完整性保护算法；
所述请求消息还携带所述会话管理网元确定出的所述终端和所述接入网节点使用的完整性保护算法的指示信息，或者所述请求消息携带的完整性保护指示信息还用于指示所述终端和所述接入网节点使用的完整性保护算法。
可选地，所述会话管理网元确定对指定的数据流进行完整性保护，包括：
所述会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护。
第七方面，提供一种计算机存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如上述第一方面中任一项所述的方法。
第八方面，提供一种计算机存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如上述第二方面中任一项所述的方法。
本申请的上述实施例中，接入网节点接收来自于接入及移动性管理网元的请求消息，所述接入网节点根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。其中，由于所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护，因此可以使得接入网节点根据该完整性保护指示信息开启与终端之间的用户面数据的完整性保护。
本申请实施例还提供了一种用户面数据安全保护方法及装置。
第九方面，提供一种用户面数据安全保护方法，包括：
接入网节点接收来自于接入及移动性管理网元发送的请求消息，所述请求消息携带数据流的服务质量QoS信息；
所述接入网节点根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
若确定为是，则所述接入网节点根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
可选地，所述完整性保护配置信息包括需要进行完整性保护的数据流所 对应的业务类型；
所述接入网节点根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护，包括：
所述接入网节点根据所述数据流的QoS信息确定所述数据流对应的业务类型；
若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则所述接入网节点确定对所述数据流进行完整性保护。
可选地，所述接入网节点根据所述请求消息建立所述数据流对应的DRB，包括：
若所述接入网节点确定对多个数据流进行完整性保护，则所述接入网节点根据所述多个完整性保护指示信息，建立所述多个数据流对应的DRB。
可选地，所述请求消息为以下消息中的一种：
参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
第十方面，提供一种接入网节点，包括：
接收模块，用于接收接入及移动性管理网元发送的请求消息，所述请求消息携带数据流的服务质量QoS信息；
确定模块，用于根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
处理模块，用于在确定为是的情况下，根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
第十一方面，提供一种接入网节点，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器中的程序，执行：
通过所述收发机接收接入及移动性管理网元发送的请求消息，所述请求消息携带数据流的服务质量QoS信息；
根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
若确定为是，则根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
可选地，所述完整性保护配置信息包括需要进行完整性保护的数据流所对应的业务类型；
所述处理器具体用于：
根据所述数据流的QoS信息确定所述数据流对应的业务类型；
若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则确定对所述数据流进行完整性保护。
可选地，所述处理器具体用于：
若确定对多个数据流进行完整性保护，则根据针对所述多个数据流，建立所述多个数据流对应的DRB。
可选地，所述请求消息为以下消息中的一种：
参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述 会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
第十二方面，提供一种计算机存储介质，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如上述第九方面中任一项所述的方法。
本申请的上述实施例中，接入网节点接收接入及移动性管理网元发送的请求消息，根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护，若确定为是，则根据所述请求消息建立所述数据流对应的DRB，并开启对所述DRB的完整性保护。其中，由于请求消息携带数据流的QoS信息，并且接入网节点中设置有基于QoS信息的完整性保护配置信息，因此接入网节点可以确定出是否对所述数据流进行完整性保护，从而使得接入网节点能够开启与终端之间的用户面数据的完整性保护。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的系统架构示意图；
图2为本申请实施例提供的用户面数据安全保护流程示意图；
图3为本申请另一实施例提供的用户面数据安全保护流程示意图；
图4为本申请实施例提供的服务请求流程信令交互示意图；
图5为本申请另一实施例提供的服务请求流程信令交互示意图；
图6为本申请实施例提供的会话管理流程信令交互示意图；
图7为本申请实施例提供的PDU会话修改流程信令交互示意图；
图8为本申请实施例提供的接入网节点结构示意图；
图9为本申请实施例提供的会话管理网元的结构示意图；
图10为本申请另外的实施例提供的接入网节点结构示意图；
图11为本申请另外的实施例提供的接入网节点的结构示意图；
图12为本申请另外的实施例提供的会话管理网元的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例进行描述。
首先，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)RAN设备，也可以称之为RAN节点，用于将终端接入到无线网络，包括但不限于：下一代节点B(NG Node B，gNB)，演进型节点B(evolved node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)、无线保真(wireless fidelity，WIFI)、接入点(access point，AP)、传输点(transmission and receiver point，TRP或者transmission point，TP)、基于新接入技术的基站等。
(2)终端，是一种向用户提供语音和/或数据连通性的设备，包括有线终端和无线终端。无线终端可以是具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备，经无线接入网与一个或多个核心网进行通信的移动终端。例如，无线终端可以为移动电话、计算机、平板电脑、个人数码助理(personal digital assistant，PDA)、移动互联网设备(mobile Internet device，MID)、可穿戴设备和电子书阅读器(e-book reader)等。又如，无线终端也可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动设备。再如，无线终端可以为移动站(mobile station)、接入点(access point)。
(3)交互，本申请中的交互是指交互双方彼此向对方传递信息的过程，这里传递的信息可以相同，也可以不同。例如，交互双方为基站1和基站2， 可以是基站1向基站2请求信息，基站2向基站1提供基站1请求的信息。当然，也可以基站1和基站2彼此向对方请求信息，这里请求的信息可以相同，也可以不同。
(4)“多个”是指两个或两个以上。“和/或”描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本申请实施例中的“请求消息”仅为一种示例性的消息命名方式，比如也可用“参考节点请求消息”“PDU请求消息”等其他消息名称替代，本申请实施例对消息命名方式不作具体限制。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
图1示出了本申请实施例提供的系统架构示意图，该系统架构可实现用户面数据安全保护，如图1所示的系统中包括：会话管理网元101、接入及移动性管理网元102、接入网节点103。还可以包括用户面网元104。终端105可以与接入网节点103通信。
其中，图1中虚线“---”可以表示网元之间的控制面连接，实线“—”可以表示网元之间的用户面连接。
其中，会话管理网元101作为一个独立的逻辑功能实体，可以是独立的网络设备，也可以集成在其他网络设备中。接入及移动性管理网元102作为一个独立的逻辑功能实体，可以是独立的网络设备，也可以集成在其他网络设备中。接入网节点103作为一个独立的逻辑功能实体，可以是独立的网络设备，也可以集成在其他网络设备中。
当上述通信系统应用于5G时，会话管理网元101可以是5G系统中的SMF(session management function)网元，例如，可以通过对SMF网元进行增强以实现本申请实施例提供的功能。接入及移动性管理网元102可以是5G系统中的AMF(access and mobility management function)网元，接入网节点103 可以是5G系统中的NG RAN节点。用户面网元可以是5G系统中的UPF(user plane fanction)。
图1所示的通信系统中，接入网节点103的数量可以是多个，图1仅以一个接入网节点作为示例。
图2示出了本申请实施例提供的用户面数据安全保护流程示意图，如图2所示，本申请实施例提供的用户面数据安全保护流程可包括：
S200：会话管理网元向接入及移动性管理网元发送第一请求消息，所述第一请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
可选地，所述完整性保护指示信息包括数据流的信息以及与该数据流的信息对应的完整性保护开启标识。该数据流为需要开启完整性保护的数据流。
其中，所述数据流的信息可以是该数据流的标识。
在一些实施例中，第一请求消息中包含会话管理信息单元，用于承载会话管理相关信息。本申请实施例中，可在会话管理信息单元中新增一个信息单元，这里称为第一信息单元，该第一信息单元携带需要开启完整性保护的数据流的标识，以及完整性保护开启标识。
在另一些实施例中，第一请求消息中包含第二信息单元，所述第二信息单元中携带数据流的服务质量(quality of service，QoS)配置信息。第二信息单元的数量可以是一个或多个，每个第二信息单元对应一个数据流。本申请实施例中，可将完整性保护开启标识设置与需要开启完整性保护的数据流所对应的第二信息单元。
可选地，会话管理网元可首先确定对指定的数据流进行完整性保护。举例来说，会话管理网元可基于以下情况，确定对指定的数据流进行完整性保护：
情况1：会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护，并进一步向接入及移动性管理网元发送第一请求消息，其中携带完整性保护指示信息，以指示针对该数据流开启完整性 保护；
情况2：会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护，并进一步向接入及移动性管理网元发送第一请求消息，其中携带完整性保护指示信息，以指示针对该数据流开启完整性保护；
情况3：会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护，并进一步向接入及移动性管理网元发送第一请求消息，其中携带完整性保护指示信息，以指示针对该数据流开启完整性保护。
S201：接入及移动性管理网元向接入网节点发送第二请求消息，所述第二请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。其中，所述数据流的信息可以是该数据流的标识。
在一些实施例中，第二请求消息中包含会话管理信息单元，用于承载会话管理相关信息。本申请实施例中，可在会话管理信息单元中新增一个信息单元，这里称为第一信息单元，该第一信息单元携带需要开启完整性保护的数据流的标识，以及完整性保护开启标识。
在另一些实施例中，第二请求消息中包含第二信息单元，所述第二信息单元中携带数据流的QoS配置信息。第二信息单元的数量可以是一个或多个，每个第二信息单元对应一个数据流。本申请实施例中，可将完整性保护开启标识设置与需要开启完整性保护的数据流所对应的第二信息单元。
S202：接入网节点根据所述第二请求消息建立所述指定的数据流对应的DRB，并开启对所述DRB的完整性保护。
可选地，所述第二请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护。接入网节点可根据 所述请求消息，针对所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。即，接入网节点可针对需要进行完整性保护的多个数据流建立一个DRB，并对该DRB开启完整性保护。
可选地，上述流程中，所述第一请求消息和所述第二请求消息还携带终端和接入网节点使用的完整性保护算法的指示信息。在S202中，接入网节点判断该接入网节点是否支持所述完整性保护算法的指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护算法的指示信息，开启对所述DRB的完整性保护。
可选地，上述流程中，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法。在S202中，接入网节点判断该接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
本申请的上述实施例中，接入网节点接收来自于接入及移动性管理网元的请求消息，所述接入网节点根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。其中，由于所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护，因此可以使得接入网节点根据该完整性保护指示信息开启与终端之间的用户面数据的完整性保护。
可选地，可以在不同的场景中实现上述流程。比如，可以在终端发起的服务请求过程中实现上述完整性保护指示过程(如图4所示)，也可在会话管理过程场景中(如图6所示)实现上述完整性保护指示过程，或在PDU会话更新场景中(如图7所示)实现上述完整性保护指示过程。
举例来说，在终端发起的服务请求过程中，在S200中，会话管理网元基于终端发起的服务请求，向接入及移动性管理网元发送会话更新请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送参考节点请求消息(对应于上述第二请求消息)。
举例来说，在终端发起的PDU会话建立过程中，在S200中，会话管理网元基于终端发起的PDU会话建立请求，向接入及移动性管理网元发送会话建立请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送PDU请求消息(对应于上述第二请求消息)。
举例来说，在终端发起的PDU会话修改过程中，在S200中，会话管理网元基于终端发起的PDU会话修改请求，向接入及移动性管理网元发送会话更新请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送PDU请求消息(对应于上述第二请求消息)。
图3示出了本申请另一实施例提供的用户面数据安全保护流程示意图。
如图3所示，本申请实施例提供的用户面数据安全保护流程可包括：
S300：会话管理网元向接入及移动性管理网元发送第一请求消息。
其中，第一请求消息中可包括数据流的QoS信息。
每个数据流或每个数据流的QoS信息使用对应的标识符进行标识。一个数据流的QoS信息包含该数据流的QoS参数，举例来说，QoS参数可包括：5G QoS标识(5G QoS Identifier，5QI)和分配与预留优先权(An Allocation and Retention Priority,ARP)。
其中，5QI值可以指示数据流已经具有QoS特性。5QI所标识的5G QoS特性可包含资源类型(Resource Type)、优先级(Priority level)、分组延迟预算(Packet Delay Budget)、分组错误率(Packet Error Rate)、平均窗口(Averaging window)。资源类型分为保证比特速率(Guaranteed Bit Rate，GBR)、延迟关键的GBR(delay critical GBR)、非保证比特速率(Non-GBR)。5QI是5G QoS特性的参考的标量，5QI值与规定的5G QoS特性的标准化组合一一对应，AN中会预配置预先配置5QI值的5G QoS特性。
此外对于保证流量的比特率的QoS还包含上下行的保证流量比特率(Guaranteed Flow Bit Rate,GFBR)以及最大流量比特率(Maximum Flow Bit  Rate，MFBR)；对于非保证流量的比特率的QoS还可包含反射QoS属性(Reflective QoS Attribute，RQA)。每个数据流的QoS信息具有一个对应的QoS流标识符(QFI)，但其不包含在每个数据流的QoS信息本身中。
S301：接入及移动性管理网元向接入网节点发送第二请求消息，所述请求消息携带数据流的QoS信息。
S302：接入网节点根据数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护。
其中，所述完整性保护配置信息可预先配置在接入网节点中。所述完整性裱糊配置信息用于指示是否需要对QoS信息对应的数据流进行完整性保护。
可选地，所述完整性保护配置信息包括需要进行完整性保护的数据流所对应的业务类型，比如业务类型列表，该列表中包含的业务类型通常为优先级较高的业务类型，这些业务类型所对应的用户面数据需要进行完整性保护。在S302中，接入网节点根据所述数据流的QoS信息确定所述数据流对应的业务类型，若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则所述接入网节点确定对所述数据流进行完整性保护。
S303：若确定为是，则所述接入网节点根据所述请求消息建立所述数据流对应的DRB，并开启对所述DRB的完整性保护。
可选地，若接入网节点确定对多个数据流进行完整性保护，则接入网节点根据针对所述多个数据流，建立所述多个数据流对应的DRB。即，接入网节点可针对需要进行完整性保护的多个数据流建立一个DRB，并对该DRB开启完整性保护。
本申请的上述实施例中，接入网节点接收接入及移动性管理网元发送的请求消息，根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护，若确定为是，则根据所述请求消息建立所述数据流对应的DRB，并开启对所述DRB的完整性保护。其中，由于请求消息携带数据流的QoS信息，并且接入网节点中设置有基于QoS信息的完整性保 护配置信息，因此接入网节点可以确定出是否对所述数据流进行完整性保护，从而使得接入网节点能够开启与终端之间的用户面数据的完整性保护。
可选地，可以在不同的场景中实现上述流程。比如，可以在终端发起的服务请求过程中实现上述完整性保护指示过程(如图5所示)，也可在会话管理过程场景中(如图6所示)实现上述完整性保护指示过程，或在PDU会话更新场景中(如图7所示)，实现上述完整性保护指示过程。
举例来说，在终端发起的服务请求过程中，在S200中，会话管理网元基于终端发起的服务请求，向接入及移动性管理网元发送会话更新请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送参考节点请求消息(对应于上述第二请求消息)。
举例来说，在终端发起的PDU会话建立过程中，在S200中，会话管理网元基于终端发起的PDU会话建立请求，向接入及移动性管理网元发送会话建立请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送PDU请求消息(对应于上述第二请求消息)。
举例来说，在终端发起的PDU会话修改过程中，在S200中，会话管理网元基于终端发起的PDU会话修改请求，向接入及移动性管理网元发送会话更新请求(对应于上述第一请求消息)；在S201中，接入及移动性管理网元接收到该消息后，向接入网节点发送PDU请求消息(对应于上述第二请求消息)。
图4以5G系统为例，示出了本申请实施例提供的服务请求流程信令交互示意图。
该流程中，核心网(例如AMF或SMF)告知接入网网络节点(例如gNB)建立一个数据流的DRB时是否需要开启完整性保护。对于一个数据流，核心网发送N2消息给接入网网络节点(gNB)，其中N2消息中包含数据流的QoS信息。此外，本实施例中在交互的消息中增加1bit完整性保护指示信息，用于指示是否需要开启完整性保护，gNB收到N2消息后，在配置和映射DRB 时，配置空口DRB以满足完整性保护的需求。具体步骤如下：
1.UE向gNB发起NAS服务请求，PDU会话被激活。
2.gNB向AMF转发服务请求。该消息中不仅包含了UE的安全能力，还可以包含gNB的安全能力，具体包括支持的完整性算法。
3.AMF向SMF发送PDU会话上下文更新请求(Nsmf_PDUSession_UpdateSMContext Request)，其中包含了PDU会话的ID以及UE当前的位置。该消息中不仅包含了UE的安全能力，还可以包含gNB的安全能力，具体包括支持的完整性算法。
4.SMF生成N2 SM信息，并向AMF发送PDU会话上下文响应(Nsmf_PDUSession_UpdateSMContext Response)，从而为PDU会话建立用户面。该消息对应于图2中的“第一请求消息”。该消息中不仅包含了UE的安全能力，还可以包含gNB的安全能力，具体包括支持的完整性算法。SMF获知gNB支持UP完整性保护。N2 SM信息中包含了PDU会话标识(PDU Session ID),QoS配置信息(QoS profile),核心网N3参考点隧道信息(CN N3 Tunnel Info),S-NSSAI。
具体的，为了携带开启完整性保护的指示，SMF可以在N2 SM信息中携带一个信息单元(1标志开启，或者0代表不开启)，该信息单元中可以增加数据流ID以及开启的是完整性保护的标志，以表示该PDU会话的DRB是否开启完整保护；或者在QoS配置信息(Qos profile)中包含是否开启完整性保护的指示；或者在N2 SM信息中的其他信息单元中包含该指示。
5.AMF发送N2请求消息给gNB，其中包含了从SMF接收到的N2 SM information(QoS profile,CN N3 Tunnel Info)，N2 SM information其中包含了是否需要开启完整性保护的指示。该消息对应于图2中的“第二请求消息”。可选的，该消息中可以包含数据流ID以及MM NAS Service Accept。gNB收到完整性保护指示信息后，检测本地安全配置是否支持，如果支持，则通过与UE的RRC连接重配，建立DRB的过程中开启完整性保护。
6.gNB收到消息后通过完整性保护指示信息得知哪些数据流需要执行完 整性保护，则在建立DRB的过程中通过RRC连接重配发送完整性保护算法指示开启完整性保护。
图5以5G系统为例，示出了本申请另一实施例提供的服务请求流程信令交互示意图。
该流程中，gNB不直接从核心网获得的完整性指示信息，而是间接通过5QI推测服务类型而确定该数据流是否开启完整性保护。
该流程可包括：
1.UE向gNB发起NAS服务请求，PDU会话被触发。
2.gNB向AMF转发服务请求消息。该消息中不仅包含了UE的安全能力，还可以包含gNB的安全能力，具体包括支持的完整性算法。
3.AMF向SMF发送PDU会话上下文更新请求，其中包含了PDU会话的ID以及UE当前的位置。该消息中不仅包含了UE的安全能力，还可以包含gNB的安全能力，具体包括支持的完整性算法。
4.SMF产生N2 SM信息，并向AMF发送PDU会话上下文响应，从而为PDU会话建立用户面。该消息对应于图3中的“第一请求消息”。N2 SM信息中包含了PDU Session ID,QoS profile,CN N3 Tunnel Info,S-NSSAI。该消息中不仅包含了UE的安全能力，还包含gNB的安全能力，具体包括支持的完整性算法。SMF获知gNB支持UP完整性保护。与图4所示的方案不同的是，该消息中不包含开启完整性保护的指示，但携带原消息中必要的数据流的QoS信息。
5.AMF发送N2请求消息给gNB，其中包含了从SMF接收到的N2 SM information，以及MM NAS Service Accept。N2 SM information包含QoS profile,CN N3 Tunnel Info。该消息对应于图3中的“第二请求消息”。与图4所示的方案不同的是该消息中不包含是否完整性保护指示信息。gNB根据接收的数据流的Qos信息及本地配置得知对应的数据流需要决策是否开启DRB的完整性保护。
6.gNB与UE根据收到的是否开启完整性保护的指示配置建立DRB。具 体的，gNB收到消息后通过指示得知哪些数据流需要执行完整性保护，则在建立DRB的过程中通过RRC连接重配发送完整性保护算法指示开启完整性保护，实现时可能的场景是一些开启完整性保护的数据流放在同一个DRB中。
需要说明的是，上述图4或图5中，对于gNB转发给核心网安全能力，如果gNB基于带外的方式配置了目前及将来可配置的完整性保护的算法是可以实现的，这种情况下，gNB可以不发送支持的算法给核心网。核心网和接入网的主要冲突问题在于速率的限制，基于小粒度的数据流的指示可以较好的解决这个问题，即在gNB速率有限的情况下，核心网识别出最重要，最需要完整性保护的数据流，并将其指示给gNB。
图6示出了本申请实施例提供的会话管理流程信令交互示意图。
1：UE向AMF发送NAS消息。该消息包含S-NSSAI(s)、DNN、PDU会话ID、请求类型、旧的PDU会话ID、N1 SM容器。N1 SM容器中包括PDU会话建立请求。为了建立新的PDU会话，UE生成新的PDU会话ID。UE通过NAS消息启动UE请求PDU会话建立流程，NAS包含N1 SM容器内的PDU会话建立请求。PDU会话建立请求可以包括PDU类型、SSC mode、协议配置选项。UE发送的NAS消息被AN压缩进N2消息，发送给AMF，包括用户位置信息和接入技术类型信息。
2：AMF决定请求类型为“初始请求”的消息触发一个新的PDU会话。NAS消息不包含S-NAASI信息，AMF可以分配一个缺省S-NSSAI，或者基于运营商策略进行分配。AMF选择一个SMF，AMF存储PDU会话ID和SMF ID。
3a：从AMF到SMF网元：发送Nsmf_PDUSession_CreateSMContext请求，该请求包括SUPI或PEI、DNN、S-NSSAI、PDU会话ID、AMF ID、请求类型、N1 SM容器、用户位置信息、接入类型、PEI、GPSI、用户位置信息、接入类型、RAT类型、PEI或Nsmf_PDUSession_UpdateSMContext请求。N1 SM容器中包括PDU会话建立请求。PEI用于PDU会话状态通知的订阅。Nsmf_PDUSession_UpdateSMContext请求包括SUPI、DNN、S-NSSAI、PDU 会话ID、AMF ID、请求类型。如果SMF还未注册，签约数据也不可用，那么SMF去通用数据模型(Universal Data Model，UDM)处注册，取回订阅数据和订阅数据发生变化时的变化通知。
5：从SMF到AMF：生成Nsmf_PDUSession_CreateSMContext响应或Nsmf_PDUSession_UpdateSMContext响应。生成Nsmf_PDUSession_CreateSMContext响应的原因是SM上下文ID或N1 SM容器中的PDU会话建立请求被拒绝。如果SMF在步骤S403中接收到Nsmf_PDUSession_CreateSMContext请求并且SMF能够处理PDU会话建立请求，则SMF创建SM上下文并且通过提供SMContext标识符来响应AMF。
11：从SMF到AMF：生成Namf_Communication_N1N2MessageTransfer响应。该响应包括PDU会话ID、接入类型、N2 SM信息、N1 SM容器。N2 SM信息包括PDU会话ID，QFI，QoS配置文件，CN通道信息，S-NSSAI，会话AMBR，PDU会话类型。N1 SM容器包括PDU会话建立请求，PDU会话建立请求包括QoS规则、选定的SSC模式、S-NSSAI、分配的IPv4地址、接口标识符、会话AMBR、选择的PDU会话类型。在PDU会话中使用多个UPF的情况下，CN隧道信息包含与终止N3的UPF相关的隧道信息。
N2 SM信息携带AMF应转发给(R)AN的信息，包括：
-CN隧道信息对应于PDU会话对应的N3隧道的核心网地址。
-可以向(R)AN提供一个或多个QoS配置文件和相应的QFIs QoS流标识符以及是否进行完整性保护的指示。具体的，为了携带开启完整性保护的指示，SMF可以在Namf_Communication_N1N2MessageTransfer中的N2 SM信息中携带一个IE(1标志开启，或者0代表不开启)，该IE信息中可以增加Flow的ID以及开启的是完整性保护的标志，通过这个表示该PDU会话的DRB是否开启完整保护；或者在QoS profile中包含是否开启完整性保护的指示；或者在N2 SM信息中的其他IE中包含该指示。也可以在N1 SM container中的QoS规则中携带完整性保护的指示。
多个QoS规则和QoS配置文件可以被包括在N1SM内的PDU会话建立 接受中以及N2MM信息中。Namf_Communication_N1N2MessageTransfer进一步包含PDU会话ID和允许AMF知道对UE使用哪个接入的信息。
12：从AMF到无线接入网(radio access network，RAN)：发送N2 PDU会话请求。N2 PDU会话请求包括N2 SM信息、NAS消息。NAS消息包括PDU会话ID，N1 SM内容包。N1 SM内容包包括PDU会话建立接受。
13：(R)AN将在S412中提供的NAS消息转发给UE。
上述图6所示的流程中，是以在步骤11至步骤12中交互的消息中携带完整性保护指示信息为例描述的，上述步骤11至步骤12交互的消息中也可以不携带完整性保护指示信息，而是有RAN节点根据消息中的数据流的QoS信息判断该数据流是否需要开启完整性保护。
图7示出了本申请实施例提供的PDU会话修改流程信令交互示意图，该流程包括：
1a：UE通过发送NAS消息，NAS消息包括PDU SM会话修改请求。NAS消息发起PDU会话修改过程。根据接入的类型，如果UE处于CM-IDLE状态，则在该SM-NAS消息之前是服务请求过程。NAS消息由(R)AN转发给AMF，并指示用户位置信息。AMF调用Nsmf_PDUSession_UpdateSMContext发给SMF。Nsmf_PDUSession_UpdateSMContext中包括PDU会话ID、N1 SM容器，N1 SM容器包括PDU会话修改请求。
3a:对于UE或AN发起的修改，SMF通过Nsmf_PDUSession_UpdateSMContext、N1 SM容器发送响应。Nsmf_PDUSession_UpdateSMContext包括N2 SM信息，N2 SM信息包括PDU会话ID、QFI、QoS配置文件、会话AMBR。N1 SM容器包括PDU会话修改命令，PDU会话修改命令包括PDU会话ID，QoS规则，QoS规则操作，会话AMBR。
N2 SM信息携带AMF应提供给(R)AN的信息。它可以包括QoS配置文件和对应的QFI，以通知(R)AN一个或多个添加，删除或修改的QoS流。它也可以仅包括QFI以通知(R)AN一个或多个QoS流被移除。如果网络希 望修改flow完整性保护的信息可以通过该信息传送指示。
N1 SM容器携带AMF提供给UE的PDU会话修改命令。可以包括QoS规则和相应的QoS规则操作，以通知UE一个或多个QoS规则被添加，删除或修改。如果在S703a中携带指示信息可以包含在N2 SM和N1 SM中或者在两者包含的IE中携带。
3b:对SMF请求的修改，SMF触发Namf_Communication_N1N2MessageTransfer消息，其中包含N2 SM information和N1 SM容器。其中N2 SM information包括PDU Session ID、QFI(s)、QoS Profile(s)、Session-AMBR，N1 SM容器包括PDU Session Modification Command，PDU Session Modification Command包括PDU Session ID、QoS rule(s)、QoS rule operation、Session-AMBR。如果在s703b中携带指示信息也可以包含在N2 SM和N1 SM中或者在两者包含的IE中携带。
上述图7所示的流程中，是以在步骤3a至步骤3b中交互的消息中携带完整性保护指示信息为例描述的，上述步骤3a至步骤3b交互的消息中也可以不携带完整性保护指示信息，而是有RAN节点根据消息中的数据流的QoS信息判断该数据流是否需要开启完整性保护。
基于相同的技术构思，本申请实施例还提供了一种接入网节点，该接入网节点可以实现前述图2所示流程中接入网节点实现的功能。
如图8所示，该接入网节点可包括：接收模块801、处理模块802。
接收模块801用于接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
处理模块802用于根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会 话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的服务质量QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，所述请求消息还携带终端和所述接入网节点使用的完整性保护算法的指示信息。处理模块802具体用于：判断所述接入网节点是否支持所述完整性保护算法的指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护算法的指示信息，开启对所述DRB的完整性保护。
可选地，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法。处理模块802具体用于：判断所述接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
可选地，所述请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护；
所述处理器具体用于：根据所述请求消息，针对所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。
可选地，所述请求消息为以下消息中的一种：
参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
第一PDU请求消息，所述第一PDU请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
第二PDU请求消息，所述第二PDU请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理 网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
基于相同的技术构思，本申请实施例还提供了一种会话管理网元，该会话管理网元可以实现前述图2所示流程中会话管理网元实现的功能。
如图9所示，该会话管理网元可包括：确定模块901和发送模块902。
确定模块901用于确定对指定的数据流进行完整性保护；
发送模块902用于向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
可选地，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
可选地，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
可选地，确定模块901还用于确定对所述数据流进行完整性保护所使用的完整性保护算法。所述请求消息还携带所述会话管理网元确定出的所述终端和所述接入网节点使用的完整性保护算法的指示信息，或者所述请求消息携带的完整性保护指示信息还用于指示所述终端和所述接入网节点使用的完整性保护算法。
可选地，所述会话管理网元确定对指定的数据流进行完整性保护，包括：
所述会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护；或者所述会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护。
基于相同的技术构思，本申请实施例还提供了一种接入网节点，该接入 网节点可实现图3中接入网节点的功能。
如图10所示，该接入网节点可包括：接收模块1001、确定模块1002、处理模块1003。
接收模块1001用于接收接入及移动性管理网元发送的请求消息，所述请求消息携带数据流的服务质量QoS信息；
确定模块1002用于根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
处理模块1003用于在确定为是的情况下，根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
可选地，所述完整性保护配置信息包括需要进行完整性保护的数据流所对应的业务类型。确定模块1002具体用于：根据所述数据流的QoS信息确定所述数据流对应的业务类型；若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则确定对所述数据流进行完整性保护。
基于相同的技术构思，本申请实施例还提供了一种接入网节点。该接入网节点可实现前述实施例中任一接入网节点的功能。
如图11所示，该接入网节点包括：处理器1101、存储器1102、收发机1103以及总线接口。
处理器1101负责管理总线架构和通常的处理，存储器1102可以存储处理器1101在执行操作时所使用的数据。收发机1103用于在处理器1101的控制下接收和发送数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器1101代表的一个或多个处理器和存储器1102代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。处理器1101负责管理总线架构和通常的处理，存储器1102可以存储处理器1101在执行操作时所使用的数据。
本申请实施例揭示的流程，可以应用于处理器1101中，或者由处理器1101实现。在实现过程中，信号处理流程的各步骤可以通过处理器1101中的硬件的集成逻辑电路或者软件形式的指令完成。处理器1101可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1102，处理器1101读取存储器1102中的信息，结合其硬件完成信号处理流程的步骤。
具体地，处理器1101，用于读取存储器1102中的程序并执行前述实施例描述的由接入网节点执行的流程。
基于相同的技术构思，本申请实施例还提供了一种会话管理网元，该会话管理网元可实现前述实施例中任一会话管理网元实现的功能。
如图12所示，该会话管理网元包括：处理器1201、存储器1202、收发机1203以及总线接口。
处理器1201负责管理总线架构和通常的处理，存储器1202可以存储处理器1201在执行操作时所使用的数据。收发机1203用于在处理器1201的控制下接收和发送数据。
总线架构可以包括任意数量的互联的总线和桥，具体由处理器1201代表的一个或多个处理器和存储器1202代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。处理器1201负责管理总线架构和通常的处理，存储器1202可以存储处理器1201在执行操作时所使用的数据。
本申请实施例揭示的流程，可以应用于处理器1201中，或者由处理器1201实现。在实现过程中，信号处理流程的各步骤可以通过处理器1201中的硬件的集成逻辑电路或者软件形式的指令完成。处理器1201可以是通用处理器、数字信号处理器、专用集成电路、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器1202，处理器1201读取存储器1202中的信息，结合其硬件完成信号处理流程的步骤。
具体地，处理器1201，用于读取存储器1202中的程序并执行前述实施例描述的由接入网节点执行的流程。
基于相同的技术构思，本申请实施例还提供了一种计算机存储介质。所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行前述实施例中接入网接口所执行的流程。
基于相同的技术构思，本申请实施例还提供了一种计算机存储介质。所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行前述实施例中会话管理网元所执行的流程。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的 装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (36)

  1. 一种用户面数据安全保护方法，其特征在于，包括：
    接入网节点接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
    所述接入网节点根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  2. 如权利要求1所述的方法，其特征在于，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
  3. 如权利要求2所述的方法，其特征在于，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，
    所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的服务质量QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
  4. 如权利要求1所述的方法，其特征在于，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法；
    所述接入网节点根据所述请求消息建立所述数据流对应的DRB，并开启对所述DRB的完整性保护，包括：
    所述接入网节点判断所述接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
  5. 如权利要求1所述的方法，其特征在于，所述请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护；
    所述接入网节点根据所述请求消息建立所述指定的数据流对应的DRB，包括：
    所述接入网节点根据所述多个完整性保护指示信息，为所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。
  6. 如权利要求1至4中任一项所述的方法，其特征在于，所述请求消息为以下消息中的一种：
    参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
    第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
    第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
  7. 一种用户面数据安全保护方法，其特征在于，包括：
    会话管理网元确定对指定的数据流进行完整性保护；
    所述会话管理网元向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
  8. 如权利要求7所述的方法，其特征在于，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
  9. 如权利要求8所述的方法，其特征在于，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，
    所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的 QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
  10. 如权利要求7所述的方法，其特征在于：
    所述方法还包括：所述会话管理网元确定对所述数据流进行完整性保护所使用的完整性保护算法；
    所述请求消息还携带所述会话管理网元确定出的所述终端和所述接入网节点使用的完整性保护算法的指示信息，或者所述请求消息携带的完整性保护指示信息还用于指示所述终端和所述接入网节点使用的完整性保护算法。
  11. 如权利要求7至10中任一项所述的方法，其特征在于，所述会话管理网元确定对指定的数据流进行完整性保护，包括：
    所述会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护；或者
    所述会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护；或者
    所述会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护。
  12. 一种用户面数据安全保护方法，其特征在于，包括：
    接入网节点接收来自于接入及移动性管理网元的请求消息，所述请求消息携带数据流的服务质量QoS信息；
    所述接入网节点根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
    若确定为是，则所述接入网节点根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  13. 如权利要求12所述的方法，其特征在于，所述完整性保护配置信息包括需要进行完整性保护的数据流所对应的业务类型；
    所述接入网节点根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护，包括：
    所述接入网节点根据所述数据流的QoS信息确定所述数据流对应的业务类型；
    若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则所述接入网节点确定对所述数据流进行完整性保护。
  14. 如权利要求12所述的方法，其特征在于，所述接入网节点根据所述请求消息建立所述数据流对应的DRB，包括：
    若所述接入网节点确定对多个数据流进行完整性保护，则所述接入网节点根据所述多个完整性保护指示信息，建立所述多个数据流对应的DRB。
  15. 如权利要求12至14中任一项所述的方法，其特征在于，所述请求消息为以下消息中的一种：
    参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
    第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
    第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
  16. 一种接入网节点，其特征在于，包括：
    接收模块，用于接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
    处理模块，用于根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  17. 一种会话管理网元，其特征在于，包括：
    确定模块，用于确定对指定的数据流进行完整性保护；
    发送模块，用于向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
  18. 一种接入网节点，其特征在于，包括：
    接收模块，用于接收来自于接入及移动性管理网元的请求消息，所述请求消息携带数据流的服务质量QoS信息；
    确定模块，用于根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
    处理模块，用于在确定为是的情况下，根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  19. 一种接入网节点，其特征在于，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器中的程序，执行：
    通过所述收发机接收来自于接入及移动性管理网元的请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对指定的数据流开启完整性保护；
    根据所述请求消息建立所述指定的数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  20. 如权利要求19所述的接入网节点，其特征在于，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
  21. 如权利要求20所述的接入网节点，其特征在于，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，
    所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的 服务质量QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
  22. 如权利要求19所述的接入网节点，其特征在于，所述完整性保护指示信息还用于指示所述接入网节点使用的完整性保护算法；
    所述处理器具体用于：判断所述接入网节点是否支持所述完整性保护指示信息所指示的完整性保护算法，若判定为是，则根据所述请求消息建立所述数据流对应的DRB，并根据所述完整性保护指示信息所指示的完整性保护算法，开启对所述DRB的完整性保护。
  23. 如权利要求19所述的接入网节点，其特征在于，所述请求消息携带多个完整性保护指示信息，一个完整性保护指示信息用于指示针对一个数据流开启完整性保护；
    所述处理器具体用于：根据所述多个完整性保护指示信息，为所述多个完整性保护指示信息指示的多个数据流，建立所述多个数据流对应的DRB。
  24. 如权利要求19至23中任一项所述的接入网节点，其特征在于，所述请求消息为以下消息中的一种：
    参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
    第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
    第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
  25. 一种会话管理网元，其特征在于，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器中的程序，执行：
    确定对指定的数据流进行完整性保护；
    通过所述收发机向接入及移动性管理网元发送请求消息，所述请求消息携带完整性保护指示信息，所述完整性保护指示信息用于指示针对所述数据流开启完整性保护。
  26. 如权利要求25所述的会话管理网元，其特征在于，所述完整性保护指示信息包括所述数据流的信息以及与所述数据流的信息对应的完整性保护开启标识。
  27. 如权利要求26所述的会话管理网元，其特征在于，所述数据流的信息为所述数据流的标识，所述请求消息包含会话管理信息单元，所述会话管理信息单元包含第一信息单元，所述第一信息单元携带所述数据流的标识以及所述完整性保护开启标识；或者，
    所述请求消息包含第二信息单元，所述第二信息单元携带所述数据流的QoS配置信息，所述QoS配置信息包含所述完整性保护开启标识。
  28. 如权利要求25所述的会话管理网元，其特征在于，所述处理器还用于：确定对所述数据流进行完整性保护所使用的完整性保护算法；
    所述请求消息还携带所述会话管理网元确定出的所述终端和所述接入网节点使用的完整性保护算法的指示信息，或者所述请求消息携带的完整性保护指示信息还用于指示所述终端和所述接入网节点使用的完整性保护算法。
  29. 如权利要求25至28中任一项所述的会话管理网元，其特征在于，所述会话管理网元确定对指定的数据流进行完整性保护，包括：
    所述会话管理网元根据终端发起的服务请求，确定对所述服务请求所对应的数据流进行完整性保护；或者
    所述会话管理网元根据终端发起的PDU会话建立请求，确定对所述PDU会话建立请求对应的数据流进行完整性保护；或者
    所述会话管理网元根据终端发起的PDU会话修改请求，确定对所述PDU会话修改请求对应的数据流进行完整性保护。
  30. 一种接入网节点，其特征在于，包括：处理器、存储器、收发机，所述处理器、存储器和收发机通过总线连接；所述处理器，用于读取存储器 中的程序，执行：
    通过所述收发机接收来自于接入及移动性管理网元的请求消息，所述请求消息携带数据流的服务质量QoS信息；
    根据所述数据流的QoS信息以及完整性保护配置信息，确定是否对所述数据流进行完整性保护；其中，所述完整性保护配置信息用于指示是否需要对所述QoS信息对应的数据流进行完整性保护；
    若确定为是，则根据所述请求消息建立所述数据流对应的数据无线承载DRB，并开启对所述DRB的完整性保护。
  31. 如权利要求30所述的接入网节点，其特征在于，所述完整性保护配置信息包括需要进行完整性保护的数据流所对应的业务类型；
    所述处理器具体用于：
    根据所述数据流的QoS信息确定所述数据流对应的业务类型；
    若所述数据流对应的业务类型与所述完整性保护配置信息包括的业务类型相匹配，则确定对所述数据流进行完整性保护。
  32. 如权利要求30所述的接入网节点，其特征在于，所述处理器具体用于：
    若确定对多个数据流进行完整性保护，则根据针对所述多个数据流，建立所述多个数据流对应的DRB。
  33. 如权利要求30至32中任一项所述的接入网节点，其特征在于，所述请求消息为以下消息中的一种：
    参考节点请求消息，所述参考节点请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的服务请求发送所述会话更新请求；
    第一PDU会话请求消息，所述第一PDU会话请求消息是所述接入及移动性管理网元根据来自于会话管理网元的会话建立请求发送的，其中，所述会话管理网元基于终端发起的PDU会话建立请求发送所述会话建立请求；
    第二PDU会话请求消息，所述第二PDU会话请求消息是所述接入及移 动性管理网元根据来自于会话管理网元的会话更新请求发送的，其中，所述会话管理网元基于终端发起的PDU会话修改请求发送所述会话更新请求。
  34. 一种计算机存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如权利要1至6任一项所述的方法。
  35. 一种计算机存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如权利要求7至11中任一项所述的方法。
  36. 一种计算机存储介质，其特征在于，所述计算机可读存储介质存储有计算机可执行指令，所述计算机可执行指令用于使所述计算机执行如权利要求12至15中任一项所述的方法。
PCT/CN2018/123231 2018-01-11 2018-12-24 一种用户面数据安全保护方法及装置 WO2019137194A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810027509.3A CN110035437B (zh) 2018-01-11 2018-01-11 一种用户面数据安全保护方法及装置
CN201810027509.3 2018-01-11

Publications (1)

Publication Number Publication Date
WO2019137194A1 true WO2019137194A1 (zh) 2019-07-18

Family

ID=67218495

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/123231 WO2019137194A1 (zh) 2018-01-11 2018-12-24 一种用户面数据安全保护方法及装置

Country Status (2)

Country Link
CN (1) CN110035437B (zh)
WO (1) WO2019137194A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112804137A (zh) * 2019-11-14 2021-05-14 中兴通讯股份有限公司 信息处理方法、装置及计算机可读存储介质
CN114071574A (zh) * 2020-07-31 2022-02-18 华为技术有限公司 QoS流控制方法及通信装置
CN114513319A (zh) * 2020-10-28 2022-05-17 展讯半导体(南京)有限公司 数据处理方法及装置

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111163471B (zh) * 2019-12-26 2021-02-19 北京微智信业科技有限公司 业务数据完整性保护方法、装置、设备及存储介质
CN113596843A (zh) * 2020-04-14 2021-11-02 中国移动通信有限公司研究院 完整性保护的处理方法、装置、相关设备及存储介质
CN113660665A (zh) * 2020-04-30 2021-11-16 华为技术有限公司 一种通信方法及装置
CN112291788B (zh) * 2020-11-13 2023-01-10 Oppo广东移动通信有限公司 数据处理方法、装置、存储介质、终端及网络接入点设备

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102098676A (zh) * 2010-01-04 2011-06-15 大唐移动通信设备有限公司 一种实现完整性保护的方法、装置和系统
WO2017104980A1 (ko) * 2015-12-14 2017-06-22 엘지전자 주식회사 무선 통신 시스템에서 단말의 잠재적인 오동작을 방지하기 위한 동작 방법 및 이를 위한 장치

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110261747A1 (en) * 2010-04-02 2011-10-27 Interdigital Patent Holdings, Inc. Method and apparatus for supporting communication via a relay node
CN103222331B (zh) * 2012-12-05 2016-09-28 华为技术有限公司 承载处理方法及装置、系统
CN113473567A (zh) * 2016-06-23 2021-10-01 北京三星通信技术研究有限公司 支持数据传输的方法和设备
US10952051B2 (en) * 2016-07-01 2021-03-16 Qualcomm Incorporated Core network connectionless small data transfer

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102098676A (zh) * 2010-01-04 2011-06-15 大唐移动通信设备有限公司 一种实现完整性保护的方法、装置和系统
WO2017104980A1 (ko) * 2015-12-14 2017-06-22 엘지전자 주식회사 무선 통신 시스템에서 단말의 잠재적인 오동작을 방지하기 위한 동작 방법 및 이를 위한 장치

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
"3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Study on the security aspects of the next generation system (Release 14", 3GPP TR 33. 899 VI. 3. 0, 31 August 2017 (2017-08-31), XP051336126 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112804137A (zh) * 2019-11-14 2021-05-14 中兴通讯股份有限公司 信息处理方法、装置及计算机可读存储介质
CN114071574A (zh) * 2020-07-31 2022-02-18 华为技术有限公司 QoS流控制方法及通信装置
CN114071574B (zh) * 2020-07-31 2023-12-15 华为技术有限公司 QoS流控制方法及通信装置
CN114513319A (zh) * 2020-10-28 2022-05-17 展讯半导体(南京)有限公司 数据处理方法及装置
CN114513319B (zh) * 2020-10-28 2023-11-07 展讯半导体(南京)有限公司 数据处理方法及装置

Also Published As

Publication number Publication date
CN110035437A (zh) 2019-07-19
CN110035437B (zh) 2021-02-23

Similar Documents

Publication Publication Date Title
WO2019137194A1 (zh) 一种用户面数据安全保护方法及装置
EP3641396B1 (en) Session management method, method for interworking between heterogeneous systems, and network device
CA3062906C (en) Method and apparatus for moving between communications systems
US20190246282A1 (en) Communication Method and Related Apparatus
US11533610B2 (en) Key generation method and related apparatus
WO2018059268A1 (zh) 网络切片的建立方法和装置
US20190357294A1 (en) Traffic distribution method through multi-access network in a network and network entity performing the same
US20190357082A1 (en) Traffic distribution method through multi-access network in a network and network entity performing the same
US11178194B2 (en) Packet data unit session establishment method and network entity performing the same
WO2019184651A1 (zh) 一种通信方法及装置
WO2016191963A1 (zh) 一种建立承载的方法、用户设备及基站
KR20210024160A (ko) 통신 방법 및 장치
CN109845389B (zh) 一种通信方法及装置
WO2019223702A1 (zh) 管理pdu会话的方法、装置和系统
US20230254922A1 (en) Multipath transmission method and communication apparatus
CN114830818A (zh) 管理QoS的方法、中继终端、PCF网元、SMF网元及远程终端
CN110831244B (zh) 分配ebi的方法和装置
KR20220044341A (ko) 보안 보호 모드 결정 방법 및 장치
JP6985415B2 (ja) サービスデータ伝送方法、第１通信ノード、及び基地局
WO2021147672A1 (zh) 会话处理方法及通信装置
JP6886521B2 (ja) 無線通信ネットワークにおける制御プレーンレイテンシ低減
WO2020142884A1 (zh) 切换传输路径的方法及装置
WO2020057497A1 (zh) 通信方法和装置
WO2019153210A1 (zh) 用于上行和下行的数据传输的方法和装置
WO2021142669A1 (zh) 业务传输的方法和设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18899755

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18899755

Country of ref document: EP

Kind code of ref document: A1