WO2019157930A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2019157930A1
WO2019157930A1 PCT/CN2019/073227 CN2019073227W WO2019157930A1 WO 2019157930 A1 WO2019157930 A1 WO 2019157930A1 CN 2019073227 W CN2019073227 W CN 2019073227W WO 2019157930 A1 WO2019157930 A1 WO 2019157930A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
terminal
base station
area
key area
Prior art date
Application number
PCT/CN2019/073227
Other languages
English (en)
French (fr)
Inventor
应江威
于峰
蔺波
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19754286.3A priority Critical patent/EP3745755A4/en
Publication of WO2019157930A1 publication Critical patent/WO2019157930A1/zh
Priority to US16/991,378 priority patent/US20200374139A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H04L9/3268—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/12—Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/10—Access restriction or access information delivery, e.g. discovery data delivery using broadcasted information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery
    • H04W48/12—Access restriction or access information delivery, e.g. discovery data delivery using downlink control channel
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W56/00—Synchronisation arrangements
    • H04W56/001—Synchronization between nodes
    • H04W56/0015—Synchronization between nodes one node acting as a reference for the others
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/27—Transitions between radio resource control [RRC] states
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0055—Transmission or use of information for re-establishing the radio link
    • H04W36/0072—Transmission or use of information for re-establishing the radio link of resource information of target access point
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W56/00—Synchronisation arrangements
    • H04W56/001—Synchronization between nodes

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a communication method and apparatus.
  • a base station is used as a time synchronization source of a terminal, and time information for synchronization between terminals is broadcasted, so that all terminals in the service range of the base station are Synchronize with the base station to achieve synchronization between the terminals.
  • the time information has a security risk.
  • the time information may be forged by the attacker.
  • the pseudo base station broadcasts the pseudo time information, causing the terminals to be out of synchronization.
  • the controller sends control signaling to the actuator, which executes the command at the exact time. If the actuator is out of sync with the controller, it will cause the actuator to execute the command at the wrong time, causing the task to be executed and may cause conflict with another actuator.
  • the application provides a communication method and apparatus to implement secure transmission of time information.
  • a communication method comprising: receiving, by a terminal, a first system information block from a first base station, the first system information block including encrypted time information, where the time information is used by the terminal
  • the terminal in the key area synchronizes; the terminal decrypts the encrypted time information according to the key of the key area in which the terminal is located.
  • the base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time information according to the key of the key area where the terminal is located, thereby realizing the secure transmission of the time information.
  • the method further includes: acquiring, by the terminal, a key of a key area in which the terminal is located.
  • the acquiring, by the terminal, a key of a key area in which the terminal is located includes: Determining, by the first system information block, a key of a key area in which the terminal is located; or, when the terminal moves from the first key area to the second key area, the terminal acquires the second secret Key of the key area; or, the terminal receives the second system information block carrying the key related information from the first base station, and acquires the key area where the terminal is located according to the key related information. Key.
  • the terminal may acquire the key of the key area where the terminal is located; when the key area update occurs, the terminal re-acquires the key of the key area where the terminal is located; The terminal may also acquire a key of a key area in which the terminal is located according to the key related information.
  • the terminal acquires a secret of a key area in which the terminal is located according to the first system information block
  • the key includes: when the first system information block further includes key related information, and the terminal stores the key corresponding to the key related information, the terminal acquires the stored key related The key corresponding to the information; or, when the first system information block further includes the key related information, and the terminal does not store the key corresponding to the key related information, the terminal acquires the terminal The key of the key area; or, when the terminal fails to decrypt the encrypted time information according to the key stored by the terminal, the terminal acquires a key of the key area in which the terminal is located.
  • the terminal determines, according to the key related information, whether the terminal has a key corresponding to the storage key related information; acquires a key of the key area where the terminal is located according to the key related information; and determines the stored information according to the key related information. Whether the key can decrypt the encrypted time information.
  • the acquiring, by the terminal, a key of a key area in which the terminal is located includes: moving the terminal to the mobile terminal
  • the non-access stratum request message is sent by the sexual management network element, and receives a non-access stratum response message from the mobility management network element, where the non-access stratum response message includes the key; or the terminal
  • the base station sends a first radio resource control RRC message, and receives a second RRC message from the base station, where the second RRC message includes the key.
  • the key of the key zone where the terminal is located may be obtained from the mobility management network element by using the NAS request message, or the terminal may be acquired from the base station by using the RRC message.
  • the key of the key zone may be obtained from the mobility management network element by using the NAS request message, or the terminal may be acquired from the base station by using the RRC message.
  • the acquiring, by the terminal, a key of a key area in which the terminal is located includes: The base station sends an RRC connection setup request message, where the RRC connection setup request message includes a non-access stratum request message; the terminal receives an RRC connection reconfiguration message from the base station, where the RRC connection reconfiguration message includes the secret The key, or the RRC connection reconfiguration message includes a non-access stratum response message, and the non-access stratum response message includes the key.
  • the acquiring, by the terminal, a key of a key area in which the terminal is located includes: The base station sends an RRC request message, the RRC request message does not include a non-access stratum request message, and receives an RRC response message from the base station, where the RRC response message includes the key.
  • the terminal when the terminal moves from the first key area to the second key area, the terminal acquires The key of the second key area includes: when the terminal reselects a cell in the first key area to a cell in the second key area, the terminal acquires the a key of the second key zone; or, when the terminal switches from a source base station in the first key zone to a target base station in the second key zone, the terminal acquires the second key a key of the key zone; or, when the terminal moves from the radio access network notification area RNA in the first key area to the RNA in the second key area, the terminal acquires the The key of the second key zone.
  • the terminal when cell reselection, base station handover, or RNA change occurs, the terminal acquires a key for reacquiring the key zone in which the terminal is located.
  • the terminal when the terminal reselects from a cell in the first key area to the When the cell in the second key zone acquires the key of the second key zone, the terminal includes: sending, by the terminal, a non-access stratum request message to the mobility management network element, and receiving the mobility from the mobility Managing a non-access stratum response message of the network element, where the non-access stratum response message includes a key of the second key zone; or, the terminal corresponds to the cell in the second key zone
  • the second base station sends a first RRC message and receives a second RRC message from the second base station, where the second RRC message includes a key of the second key zone.
  • the terminal in a ninth possible implementation manner of the first aspect, is in a connected state, and when the terminal is from a source in the first key area When the base station switches to the target base station in the second key area, the terminal acquires the key of the second key area, including: the terminal receives an RRC message from the source base station, and the RRC message A key including the second key zone.
  • the terminal in an inactive state, and when the terminal is from the first key area
  • the terminal acquires the key of the second key area, including: when the terminal moves from the RNA in the first key area to the a third base station in the RNA in the second key area, the terminal transmitting an RRC connection recovery request message to the third base station; the terminal receiving an RRC connection release message from the third base station, the RRC The connection release message includes a key of the second key zone.
  • the first system information block is a system information block that is signed by a certificate
  • the method further includes: the terminal receiving the certificate from the mobility management network element or the first base station; The certificate verifies the signature of the first system information block.
  • the first system information block is signed by using the certificate, and the terminal verifies the first system information block of the signature, which can further ensure the secure transmission of the time information.
  • the method further includes: the terminal receiving a third system information block from the first base station, the third system information block including indication information, the indication information indicating time information for carrying the encryption And the first system information block; the terminal acquiring the encrypted time information according to the first system information block indicated by the indication information.
  • the terminal can be instructed to carry the system information block of the encrypted time information, so that the terminal can accurately obtain the encrypted time information on the system information block.
  • the method further includes: the terminal receiving a key of an adjacent key area of a key area in which the terminal is located. In this implementation manner, the terminal acquires the key of the adjacent key area in advance, so that the terminal can directly acquire the key stored by the terminal and decrypt the time information when the cell reselection, the base station handover, or the RNA change occurs.
  • a second aspect provides a communication method, including: a first base station obtains encrypted time information according to time information and a key of a key area in which the first base station is located, where the time information is used for the key The terminal in the area performs synchronization; the first base station transmits a first system information block, and the first system information block includes the encrypted time information.
  • the base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time information according to the key of the key area where the terminal is located, thereby realizing the secure transmission of the time information.
  • the method further includes: the first base station sending the key to a terminal.
  • the sending, by the first base station, the key to the terminal includes: the first base station receiving the mobility The authorization indication information of the management network element, the authorization indication information is used to indicate that the terminal is authorized to use the time synchronization service, and the first base station sends the key to the terminal according to the authorization indication information.
  • the base station sends a key to the terminal according to the authorization indication of the mobility management network element, and the terminal authorized to use the time synchronization service can acquire the key, thereby decrypting the received time information, thereby effectively managing the usage time.
  • the first base station is a target base station in a second key area
  • the terminal is from the first The source base station of the key area switches to the target base station, and the first base station sends the key to the terminal, the first base station receives a handover request message from the source base station, and sends a handover to the source base station.
  • the handover command includes the key, the key is a key of the second key zone; or the first base station receives a handover request message from a mobility management network element, and The mobility management network element sends a handover request response message, where the handover request response message includes the key, and the key is a key of the second key zone.
  • the key area changes, and the terminal reacquires the key of the key zone.
  • the terminal moves from the radio access network notification area of the first key area to the second secret
  • the first base station in the RNA in the key area, the first base station transmitting the key to the terminal includes: the first base station receiving an RRC connection recovery request message from the terminal;
  • the RRC connection recovery request message sends an RRC connection release message to the terminal, where the RRC connection release message includes the key, and the key is a key of the second key area.
  • the RNA is updated, the key area is changed, and the terminal reacquires the key of the key area.
  • the method further includes: the first base station receiving a certificate from an operation management maintenance entity or a mobility management network element; the first base station signatures the first system information block by using the certificate.
  • the first system information block is signed by using the certificate, and the terminal verifies the first system information block of the signature, which can further ensure the secure transmission of the time information.
  • the method further includes: the first base station transmitting a second system information block, the second system information block including indication information, the indication information indicating the first system for carrying the encrypted time information The information block; or, the first base station sends a third system information block, the third system information block includes key related information, and the key related information is used to acquire the key.
  • the terminal may be instructed to carry the system information block of the encrypted time information, so that the terminal can accurately obtain the encrypted time information on the system information block; the base station sends the key related information, The terminal can acquire the key of the key zone where the terminal is located according to the key related information.
  • the method further includes: the first base station receiving a key of a neighboring key zone of a key zone in which the first base station is located from a mobility management network element, a neighboring base station, or an operation management and maintenance entity; The first base station sends a key of the adjacent key zone.
  • the base station sends the key of the adjacent key area to the terminal in advance, so that the terminal can directly acquire the key stored by the terminal and decrypt the time information when the cell reselection, the base station handover, or the RNA change occurs.
  • the method further includes:
  • the first base station receives the key from a security function entity, an operation management maintenance entity, or a mobility management network element.
  • a third aspect provides a communication method, including: a mobility management network element receives a non-access stratum request message from a terminal; the mobility management network element sends a non-access stratum response message to the terminal, The non-access stratum response message includes a key of the key zone in which the terminal is located.
  • the mobility management network element sends the key of the key area in which the terminal is located to the terminal, and the terminal decrypts the received encrypted time information according to the acquired key, thereby implementing secure transmission of the time information.
  • the method further includes: the mobility management network element acquiring the subscription information of the terminal according to the non-access stratum request message; When the mobility management network element determines, according to the subscription information, that the terminal is authorized to use the time synchronization service, the mobility management network element encapsulates the key of the key zone in which the terminal is located in the non-contact In the layer response message. In this implementation manner, the mobility management network element sends a key to the terminal according to the subscription information of the terminal, and the terminal authorized to use the time synchronization service can acquire the key, thereby decrypting the received time information, thereby effectively managing the usage time.
  • the method further includes: the mobility management network element receiving the first base station, Or operate the key of the management maintenance entity.
  • a fourth aspect provides a communication method, including: a mobility management network element receiving a non-access stratum request message from a terminal; the mobility management network element acquiring the terminal according to the non-access stratum request message
  • the authorization indication information is sent to the first base station, where the authorization indication information is used to indicate that the terminal is Authorize the use of the time synchronization service.
  • the mobility management network element sends a key to the terminal according to the subscription information of the terminal, and the terminal authorized to use the time synchronization service can acquire the key, thereby decrypting the received time information, thereby effectively managing the usage time synchronization.
  • Business terminal is a mobile device receiving a non-access stratum request message from a terminal; the mobility management network element acquiring the terminal according to the non-access stratum request message
  • the authorization indication information is sent to the first base station, where the authorization indication information is used to indicate that the terminal is Authorize the use of the time synchronization service.
  • the mobility management network element sends a key to the terminal according to the subscription information
  • a fifth aspect provides a communication method, including: a mobility management network element receiving a handover request message from a source base station; the mobility management network element transmitting the handover request message to a target base station; the mobility management network Receiving, by the element, a handover request response message from the target base station, where the handover request response message includes a key of a key zone in which the target base station is located; the mobility management network element sends a handover command message to the source base station, The handover command message includes a key of a key zone in which the target base station is located.
  • the key area changes, and the terminal reacquires the key of the key zone.
  • a communication method including: acquiring, by a source base station, a key of a key area in which the target base station is located; and the source base station transmitting, to the terminal, a key of a key area in which the target base station is located.
  • the key area changes, and the terminal reacquires the key of the key area.
  • the acquiring, by the source base station, a key of a key area in which the target base station is located includes: sending, by the source base station, a handover request message to the target base station The source base station receives a handover command from the target base station, the handover command including a key of a key zone in which the target base station is located.
  • the source base station acquires a key of a key area in which the target base station is located, and the method includes: the source base station sends a handover request to the mobility management network element. a message; the source base station receives a handover command from the mobility management network element, the handover command including a key of a key zone in which the target base station is located.
  • the method further includes The source base station receives a key of a neighboring key area of a key area in which the target base station is located; the source base station sends, to the terminal, an adjacent key area of a key area where the target base station is located Key.
  • the base station sends the key of the adjacent key area to the terminal in advance, so that the terminal can directly acquire the key stored by the terminal and decrypt the time information when the cell reselection, the base station handover, or the RNA change occurs.
  • a communication apparatus comprising a processor coupled to a memory, a memory for storing a program, and a processor invoking a memory stored program to perform the method of the above first aspect.
  • the communication device can be a terminal or can be at least one processing element or chip.
  • a communication apparatus comprising a processor coupled to a memory, a memory for storing a program, and a processor calling a program stored in the memory to perform the method of the second aspect above.
  • the communication device can be a first base station or at least one processing element or chip.
  • a ninth aspect a communication device comprising a processor, a processor coupled to a memory, a memory for storing a program, and a processor calling a program stored in the memory to perform any of the above third to fifth aspects method.
  • the communication device may be a mobility management network element or may be at least one processing element or chip.
  • a communication apparatus comprising a processor coupled to a memory, a memory for storing a program, and a processor calling a program stored in the memory to perform the method of the sixth aspect above.
  • the communication device can be a source base station or at least one processing element or chip.
  • a communication device comprising means or means for performing the various steps of the method of the above first aspect.
  • the communication device can be a terminal or can be at least one processing element or chip.
  • a communication device comprising means or means for performing the various steps of the method of the above second aspect.
  • the communication device can be a first base station or at least one processing element or chip.
  • a communication device comprising means or means for performing the various steps of the method of any of the third to fifth aspects above.
  • the communication device may be a mobility management network element or may be at least one processing element or chip.
  • a communication device comprising means or means for performing the various steps of the method of the above sixth aspect.
  • the communication device can be a source base station or at least one processing element or chip.
  • a computer readable storage medium having instructions stored therein that, when executed on a computer, cause the computer to perform the methods described in the above aspects.
  • a program when executed by a processor, for performing the method of any one of the first to sixth aspects, or any one of the embodiments.
  • FIG. 1 is a schematic diagram of realizing synchronization between a terminal and a terminal through a base station
  • 2 is a schematic diagram of a pseudo base station transmitting pseudo time information
  • FIG. 3 is a schematic diagram of a communication system according to an embodiment of the present application.
  • 4a is a schematic diagram of a 4G communication system architecture
  • 4b is a schematic diagram of a 5G communication system architecture
  • FIG. 5 is a schematic diagram of an interaction process of a communication method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of an interaction process of an example communication method according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of an interaction process of another example communication method according to an embodiment of the present disclosure.
  • FIG. 7b is a schematic diagram of an interaction process of still another example communication method according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of an interaction process of still another example communication method according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of an interaction process of still another example communication method according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic diagram of an interaction process of still another example communication method according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic diagram of an interaction process of still another example communication method according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another module of a communication device according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of another module of a communication device according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of another module of a communication device according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic structural diagram of another module of a communication device according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic structural diagram of another module of a communication device according to an embodiment of the present disclosure.
  • FIG. 18 is a schematic structural diagram of hardware of a communication apparatus according to an embodiment of the present disclosure.
  • FIG. 19 is a schematic structural diagram of hardware of another communication apparatus according to an embodiment of the present disclosure.
  • FIG. 20 is a schematic structural diagram of hardware of still another communication apparatus according to an embodiment of the present application.
  • a communication method and apparatus provided by an embodiment of the present application can be applied to a communication system as shown in FIG. 3.
  • the communication system can include a terminal 100, a base station 200, and a mobility management network element 300.
  • the terminal 100 can communicate with the base station 200, and the terminal 100 can also communicate with the mobility management network element 300 via the base station 200.
  • the mobility management network element 300 can be used for access management of the terminal.
  • a mobility management entity MME in a 4G communication system
  • an access and mobility management function AMF in a 5G communication system.
  • the base station 200 can be used to manage radio resources and provide access services for the terminal.
  • the base station 200 may be an access network (AN) or a radio access network (RAN) in a 4G or 5G communication system, for example, an NG-RAN in a 5G communication system, or a 4G communication system.
  • AN access network
  • RAN radio access network
  • eNB Evolved Node B
  • the terminal 100 is a device with wireless transceiving function that can be deployed on land, and can include indoor or outdoor, handheld, wearable or on-board; it can also be deployed on the water surface (such as a ship, etc.); it can also be deployed in the air (for example, an airplane). , balloons and satellites, etc.).
  • the terminal may be a mobile phone, a tablet, a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, industrial control (industrial control) Wireless terminal, wireless terminal in self driving, wireless terminal in remote medical, wireless terminal in smart grid, wireless terminal in transportation safety, A wireless terminal in a smart city, a wireless terminal in a smart home, and the like.
  • a terminal may also be referred to as a user equipment (UE), an access terminal, a UE unit, a UE station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a UE terminal, a wireless communication device, a UE agent, or UE device, etc.
  • UE user equipment
  • the mobility management network element is only a name, and the name itself does not limit the entity.
  • the mobility management network element may also be replaced with a "mobility management function" or other name.
  • the mobility management network element may be an independent physical device or a functional module on a physical device, and is not limited.
  • the base station 200 carries the encrypted time information in the system information block, and the terminal 100 decrypts the encrypted time information according to the key of the key area in which the terminal is located, thereby implementing secure transmission of the time information.
  • the time information can be used for synchronization of terminals in the key zone where the base station is located.
  • the time information can be a specific time value.
  • the key area may be divided into multiple granularity manners, and may include a base station, a control unit (CU), a tracking area (TA), or a public land mobile network (PLMN). Division and so on.
  • CU control unit
  • T tracking area
  • PLMN public land mobile network
  • the key area in which the base station is located may be the signal coverage area of the base station, in other words, may be the signal coverage range of all the cells of the base station, and at this time, the keys of different base stations. Can be different or the same. It is assumed that the key area is divided by a larger granularity than the base station, for example, the TA, and the key area in which the base station is located may be the TA where the base station is located. In this case, the keys of all the base stations in the TA may be the same.
  • the terminal 100 can be used to perform the actions of the terminal in the method embodiments of the present application.
  • the base station 200 can be used to indicate the action of the first base station in the embodiment shown in FIG. 5 of the present application, or in FIG. 6 to FIG. 7b.
  • the mobility management network element 300 can be used to indicate the actions of the mobility management network element in the method embodiments of the present application.
  • the manner in which the terminal 100 acquires the key may include the following manner: the terminal 100 acquires the key of the key zone where the terminal 100 is located from the mobility management network element 300, or is authorized by the mobility management network element 300 to instruct the base station 200 to The terminal 100 transmits the key, or the mobility management network element 300 transmits the key of the key area in which the target base station is located, which is acquired by the target base station, to the source base station, and the source base station transmits the key to the terminal.
  • embodiments of the present application can be applied to a 4G or 5G communication system, and the 4G and 5G communication systems are briefly introduced below.
  • the communication system can include a terminal, an eNB, and an MME. It may also include other functional entities, such as a home subscriber server (HSS), a serving gateway (SGW), and a PDN gateway (PGW) in the core network.
  • HSS home subscriber server
  • SGW serving gateway
  • PGW PDN gateway
  • the entities are connected by an Sx interface (for example, S1-MME, S1-U, etc. in the figure).
  • the HSS is used to manage user subscription information.
  • the SGW provides user plane functionality for user data forwarding.
  • the PGW is a border gateway of the EPC network and provides functions such as session management and bearer control, data forwarding, IP address allocation, and non-3GPP user access.
  • FIG. 4b is a schematic diagram of a 5G communication system architecture.
  • the communication system can include a terminal, NG-RAN, and AMF.
  • Other functional entities may also be included, for example, unified data management (UDM), user plane function (UPF), and session management function (SMF), etc. Only a few functional entities involved in this application are highlighted here.
  • the entities are connected by an Nx interface (for example, N1, N2, etc. in the figure).
  • UDM is used to manage user subscription information.
  • UPF is mainly responsible for packet data forwarding, quality of service (QoS) control, accounting information statistics, etc.; SMF is responsible for unified session management.
  • QoS quality of service
  • any one of the functional entities or network elements in the foregoing system shown in FIG. 3, FIG. 4a, or FIG. 4b may be implemented by one physical device or may be implemented by multiple physical devices. No specific limitation. That is, it can be understood that any one of the foregoing functional entities or network elements may be a logical functional module in the physical device, or may be a logical functional module composed of multiple physical devices. This example does not specifically limit this.
  • system and “network” in the embodiments of the present application may be used interchangeably.
  • Multiple means two or more.
  • a plurality can also be understood as “at least two” in the embodiment of the present application.
  • the character "/” unless otherwise specified, generally indicates that the contextual object is an "or" relationship.
  • the words “first”, “second”, and the like are used to distinguish the same items or similar items whose functions and functions are substantially the same. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the number and execution order, and the words “first”, “second” and the like are not necessarily limited.
  • the embodiment of the present application can be applied not only to the above 4G or 5G communication system but also to the subsequent evolved communication system, and is not limited.
  • FIG. 5 is a schematic diagram of an interaction process of a communication method according to an embodiment of the present disclosure, where the method may include the following steps:
  • the first base station obtains encrypted time information according to the time information and a key of the key area where the first base station is located.
  • the time information can be used for synchronization of terminals in the key area where the first base station is located.
  • the time information can be a time value.
  • the first base station can encrypt the time information using an existing encryption algorithm.
  • the encryption algorithm may be a 128-EEA (EPS encryption algorithm) 1 algorithm based on SNOW 3G, or a 128-EEA2 algorithm based on advanced encryption standard (AES), or 128 based on Zu Chongzhi (ZUC). -EEA3 algorithm.
  • EPS encryption algorithm 128-EEA 1 algorithm based on SNOW 3G
  • AES advanced encryption standard
  • ZUC Zu Chongzhi
  • the first base station sends a first system information block (SIB), where the first system information block includes encrypted time information.
  • SIB system information block
  • the first base station may send the first system information block in a broadcast manner, so that the terminal in the coverage of the first base station can receive the first system information block.
  • the first system information block may be a system information block of any one of SIB1 to SIB100.
  • the terminal receives the first system information block from the first base station.
  • the terminal can receive the first system information block sent by the first base station, and the terminal can be understood to be in the same key area as the first base station. At this time, the key of the key area where the terminal is located is compared with the first base station. The key in the key area is the same. Therefore, the above time information can also be referred to as time information for the terminal in the key zone in which the terminal is located to synchronize.
  • the terminal decrypts the encrypted time information according to a key of the key area where the terminal is located.
  • the terminal can obtain the decrypted time information, and the terminal can synchronize with other terminals of the key area according to the decrypted time information. For example, each terminal performing the time synchronization service adjusts its own time to the time value included in the received first system information block.
  • the base station encrypts the time information and sends the encrypted time information to the terminal, and the terminal decrypts and obtains the time information according to the key in the key area where the terminal is located, thereby realizing the secure transmission of the time information, thereby enabling
  • the terminals can be synchronized.
  • the controller and each actuator obtain encrypted time information, according to which the respective actuators can synchronize with the controller and other actuators to accurately execute the controller. Instructions.
  • the terminal that does not acquire the key cannot decrypt the time information, and therefore, the operator can charge for the time synchronization service.
  • the foregoing method further includes: the base station generating or obtaining time information.
  • the base station can obtain time information from other devices, modules, or networks.
  • the time information can be obtained from a GPS module disposed on the base station, or through a 1588 protocol or a network time protocol between the base station and the time server.
  • Time protocol, NTP Get time information.
  • the base station can directly send the obtained time information to the terminal in the first system information block.
  • the base station may also generate time information by using the time information obtained by the base station according to the foregoing implementation manner, and send the generated time information to the terminal.
  • the time information carried by the first system information block may be related to the physical layer frame structure of the base station, and the first system information block may be sent at a certain time reference point, where the first system information block carries the base station from other devices, modules, or Time information obtained by the network.
  • the terminal determines time information for the terminal to synchronize according to the time reference point and the time information carried in the first system information block.
  • the method further includes: obtaining, by the base station, a key of a key zone in which the base station is located.
  • the base station receives a key from a key zone in which the base station of the operation administration and maintenance (OAM) entity is located. For example, when the base station is powered on, the base station establishes a connection with the OAM entity, the base station acquires the key of the key area where the base station is located from the OAM entity, or the OAM entity actively sends the key of the key area where the base station is located to the base station. Further, after the base station establishes an S1 interface connection with the mobility management network element, the base station may further send the key of the key zone where the base station is located to the mobility management network element.
  • OAM operation administration and maintenance
  • the security function entity may generate a key of the key zone in which the base station is located in step S101, and send the generated key to the OAM entity.
  • the security function entity is used to generate and maintain a key.
  • the security function entity may be an independent physical device (for example, an existing network element, such as an authentication server function (AUSF) entity). Or UDM; it can also be a new security network element, such as a time synchronization security server or a time synchronization security function entity, or a function module in a physical device (for example, an OAM entity).
  • the base station may directly acquire the key from the security function entity, or the security function entity actively sends the key to the base station.
  • the key of the key zone in which the base station is located in step S101 may also be referred to as an encryption key of the key zone in which the base station is located.
  • the security function entity or the OAM entity may further send the key of the key zone in which the base station is located to the mobility management network element, and then send the key to the base station by the mobility management network element.
  • the mobility management network element when the mobility management network element is powered on, a connection is established with the OAM entity. Then, the mobility management network element requests the OAM entity for the key of the key area where the base station is located, and the OAM entity sends the key of the key area where the base station is located to the mobility management network element; or the OAM entity actively activates the base station.
  • the key of the key zone is sent to the mobility management network element.
  • the base station When the base station is powered on, the base station establishes an S1 interface connection with the mobility management network element, and the mobility management network element sends the key of the key area where the base station is located to the base station.
  • the method further includes: the base station protecting the time information or the first system information block by using an integrity protection algorithm.
  • the first system information block may carry the time information or the integrity check value of the first system information block, and after receiving the first system information block, the terminal checks the integrity check value to determine Whether the received time information or the first system information block is complete.
  • the integrity protection algorithm may be the 128-EIA (EPS integrity algorithm) 1 algorithm of SNOW 3G, or the 128-EEA2 algorithm of AES (advanced encryption standard), or the 128-EEA3 algorithm based on ZUC (Zu Chongzhi).
  • the base station may also acquire an integrity protection parameter of the key zone in which the base station is located, for example, an integrity protection key, or an integrity protection algorithm.
  • the integrity protection key may be generated by the security function entity, or may be generated by the OAM entity and sent to the base station, similar to the manner in which the base station obtains the key of the key area in which the base station is located in the first implementation scenario. No longer.
  • the method further includes: the base station signatures the time information or the first system information block by using a certificate.
  • the base station may further obtain a certificate for signing the time information or the first system information block in the key area where the base station is located.
  • the security function entity generates a certificate for signing the time information or the first system information block, and sends the certificate to the base station
  • the OAM entity or the mobility management network element obtains the certificate from the security function entity and sends the certificate to the base station, and
  • the manner in which the base station obtains the key of the key zone in which the base station is located is similar, and details are not described herein.
  • the base station may also obtain a certificate from a third-party certificate authority (CA).
  • CA third-party certificate authority
  • the method further includes: acquiring, by the terminal, a key of a key area in which the terminal is located, and implementing the following manners:
  • the terminal acquires a key of a key area in which the terminal is located according to the first system information block.
  • Mode 2 When the terminal moves from the first key area to the second key area, the terminal acquires a key of the second key area.
  • the second key area may be a key area in which the terminal is located.
  • Manner 3 The terminal receives a second system information block carrying key related information from the base station, and acquires a key of a key area where the terminal is located according to the key related information.
  • the terminal in the foregoing manner 1 obtains the key of the key area in which the terminal is located according to the first system information block, and may be implemented in the following manner:
  • Mode 1.1 When the first system information block further includes the key related information, and the terminal stores the key corresponding to the key related information, the terminal acquires the stored key corresponding to the key related information.
  • the key related information may be used to obtain a key.
  • the key related information may include an identifier of the key or an identifier of the key area.
  • the identification of the key can be used to uniquely identify the key, and the identification of the key area can be used to uniquely identify the key area, and multiple different key areas can use the same key or different keys.
  • the terminal may use the key corresponding to the key related information stored by the terminal as the key of the key area where the terminal is located.
  • the terminal may acquire the key of the key area in advance, and store the correspondence between the key of the key area and the key related information, for example, the key of the key area and the identifier of the key area.
  • the terminal may obtain the key corresponding to the key related information according to the key related information in the first system information block and the stored correspondence.
  • the key for obtaining the key area in advance by the terminal may be obtained by the terminal by receiving a key of the adjacent key area. For example, when the terminal is in the key area A, the terminal may receive and store the key area. The key of the adjacent key area B of A, and then the terminal moves to the key area B, and the key of the key area B stored therein can be obtained as the key of the key area in which the terminal is located, to decrypt the encrypted Time information.
  • Mode 1.2 When the first system information block further includes the key related information, and the terminal does not store the key corresponding to the key related information, the terminal acquires the key of the key area where the terminal is located.
  • the terminal in the mode 1.2 obtains the key of the key area in which the terminal is located, and the terminal may obtain the key corresponding to the key related information from the base station, the mobility management network element, or the security function entity, as shown in the following example. .
  • the terminal sends a non-access stratum (NAS) request message to the mobility management network element, receives the NAS request message from the terminal, and sends a NAS response message to the terminal according to the NAS request message.
  • the NAS response message includes a key of the key area in which the terminal is located.
  • the terminal receives the NAS response message from the mobility management network element, and acquires a key of the key area in which the terminal is located in the NAS response message. .
  • the NAS request may be used to request to obtain a key of a key area in which the terminal is located.
  • the NAS request message includes an attach request, a tracking area updated (TAU) request, a registration request, or other NAS signaling.
  • TAU tracking area updated
  • the mobility management network element may obtain the key from the OAM entity or the base station. For details, refer to the related description, and details are not described herein.
  • the mobility management network element may send the key of the key area where the terminal is located to the terminal through the NAS response message under a preset condition. For example, the mobility management network element receives the NAS request message from the terminal, and acquires the subscription information of the terminal according to the NAS request message. When the mobility management network element determines, according to the subscription information, that the terminal is authorized to use the time synchronization service, the mobility management network element carries the key of the key zone in which the terminal is located in the NAS response message. If the mobility management network element determines that the terminal is not authorized to use the time synchronization service according to the subscription information, the mobility management network element sends a NAS response message to the terminal, and the NAS response message does not carry the key. Optionally, the NAS response message carries a failure cause value, where the failure cause value is used to indicate that the terminal is not authorized to use the time synchronization service.
  • the mobility management network element may obtain the subscription information of the terminal according to the identifier of the terminal carried in the NAS request message. If the mobility management network element has obtained the subscription information of the terminal and the subscription information of the terminal is stored locally, the mobility management network element may obtain the subscription information of the terminal locally, or may obtain the subscription information of the terminal from the HSS. , wherein the HSS uniformly manages the subscription information of the terminal.
  • the terminal sends a first radio resource control (RRC) message to the base station, and the base station receives the first RRC message, and sends a second RRC message to the terminal according to the first RRC message, where the terminal receives The second RRC message.
  • the second RRC message includes a key of a key area in which the terminal is located.
  • the RRC message names that the terminal interacts with the base station may be different in different communication scenarios or in different states in which the terminal is located.
  • the first RRC message when the terminal is in the idle state, the first RRC message may be an RRC connection setup request message, and the second RRC message may be an RRC connection reconfiguration message; when the terminal is in the connected state, the first RRC message may be RRC.
  • a request message, the second RRC message may be an RRC response message.
  • the terminal sends an RRC connection setup request message to the base station, where the RRC connection setup request message includes a non-access stratum request message, and the non-access stratum request message is used to request the subscription information of the terminal.
  • the base station receives the RRC Connection Setup Request message and sends a Non-Access Stratum Request message to the mobility management network element.
  • the mobility management network element After receiving the non-access stratum request message, acquires the subscription information of the terminal according to the non-access stratum request message, and when determining, according to the subscription information, that the terminal is authorized to use the time synchronization service, in the NAS
  • the key of the key zone in which the terminal is located is encapsulated in the response message.
  • the mobility management network element sends the NAS response message to the base station, and the base station receives the NAS response message and sends an RRC connection reconfiguration message to the terminal.
  • the RRC connection reconfiguration message includes the NAS response message.
  • the terminal receives the RRC connection reconfiguration message, acquires the NAS response message therein, and obtains the key in the NAS response message.
  • the terminal sends an RRC request message to the base station, and the RRC request message does not include the non-access stratum request message.
  • the base station receives the RRC request message, and sends an RRC response message to the terminal according to the RRC request message, where the RRC response message includes a key of the key zone in which the terminal is located.
  • the terminal receives the RRC response message, and obtains a key of the key zone where the terminal is located from the RRC response message.
  • the terminal may be in a connected state, and the terminal may request, by using an RRC request message, the key of the key area where the terminal is located, and the base station saves the key of the key area, and the base station may carry the RRC response message. Key.
  • Mode 1.3 When the terminal fails to decrypt the encrypted time information according to the key stored by the terminal, the terminal acquires a key of the key area where the terminal is located.
  • the terminal may use the stored key to decrypt the time information in the first system information block. If the decryption succeeds, it indicates that the key of the key area where the terminal is located has not changed; if the decryption fails, the terminal acquires the change. Key.
  • the key change may include multiple situations. For example, the key of the key area in which the terminal is located is updated. At this time, the terminal may obtain the changed key from the base station or the mobility management network element; for example, The key area in which the terminal is located is changed, that is, the terminal moves from the source base station in the first key area to the target base station in the second key area. At this time, the terminal can obtain the terminal by using the method provided in mode 2.
  • the key of the key zone is not limited.
  • the terminal in the mode of obtaining the key of the key area in which the terminal is located may be referred to in the related description in the mode 1.2, and details are not described herein.
  • Method 1.4 The terminal compares the key related information in the first system information block with the key related information corresponding to the key stored by the terminal. When the two are the same, the terminal uses the stored key as the terminal. Key of the key zone; when the two are different, the terminal acquires the key of the key zone in which the terminal is located.
  • the method of the first system information block triggers the terminal to acquire the key of the key area in which the terminal is located, that is, the first system information block is used as a trigger message, and triggers the terminal to perform an action of acquiring a key of the key area in which the terminal is located.
  • the terminal in the mode 1.5 obtains the key of the key area in which the terminal is located.
  • the key of the key area in which the terminal is located in the above manners 1.2 to 1.5 can be implemented by using the related implementation manner of the foregoing mode 2, that is, the implementation manners of the mode 1 and the mode 2 can be combined with each other, and are not limited.
  • the terminal when the terminal moves from the first key area to the second key area, the terminal acquires the key of the second key area, which may be implemented in the following manner.
  • the base station in step S101 may be referred to as a first base station.
  • Mode 2.1 When the terminal reselects from the cell (Cell A) in the first key zone to the cell (Cell B) in the second key zone, the terminal acquires the key of the second key zone.
  • the terminal sends a non-access stratum request message to the mobility management network element and receives a non-access stratum response message from the mobility management network element, the non-access stratum response message including the second key The key of the zone.
  • the terminal sends a first RRC message to the second base station corresponding to the cell (cell B) in the second key area, and receives a second RRC message from the second base station, where the second RRC message includes The key of the second key zone.
  • the RRC message names that the terminal interacts with the base station may be different in different communication scenarios or in different states in which the terminal is located.
  • the first RRC message when the terminal is in the idle state, the first RRC message may be an RRC connection setup request message, and the second RRC message may be an RRC connection reconfiguration message; when the terminal is in the connected state, the first RRC message may be RRC.
  • a request message, the second RRC message may be an RRC response message.
  • the second base station may be the same as the first base station; or may be different from the first base station, but the two base stations are located in the same key area, and are not limited.
  • Mode 2.2 When the terminal switches from the source base station in the first key area to the target base station in the second key area, the terminal acquires the key of the second key area.
  • the terminal may be in a connected state, the terminal receiving an RRC message from the source base station, the RRC message including a key of the second key zone.
  • the target base station may be the same as the first base station; or may be different from the first base station, but the two base stations are located in the same key area, and are not limited.
  • a terminal switches from a source base station to a target base station through an X2 interface between base stations.
  • the source base station sends a handover request message to the target base station.
  • the target base station receives the handover request message and sends a handover command to the source base station, where the handover command includes a key of the second key zone in which the target base station is located.
  • the source base station receives the handover command from the target base station and sends an RRC message to the terminal, where the RRC message includes a key of the second key zone in which the target base station is located. Accordingly, the terminal receives the RRC message.
  • the terminal switches from the source base station to the target base station through the S1 interface.
  • the source base station sends a handover request message to the mobility management network element.
  • the mobility management network element receives the handover request message and sends a handover request message to the target base station.
  • the target base station receives the handover request message and sends a handover request response message to the mobility management network element.
  • the handover request response message includes a key of a second key zone where the target base station is located.
  • the mobility management network element receives the handover request response message and sends a handover command message to the source base station.
  • the handover command message includes a key of a key zone in which the target base station is located.
  • the source base station receives the handover command and sends an RRC message to the terminal.
  • the RRC message includes a key of a second key zone where the target base station is located.
  • the terminal receives the RRC message, and obtains, from the RRC message, a key of the second key area where the target base station is located, that is, a key of the key area where the terminal is located.
  • RNA radio access network notification area
  • the terminal may be in an inactive state, and the terminal moves from the RNA in the first key area to a certain base station in the RNA in the second key area (which may be referred to as a third base station), then the terminal may And transmitting an RRC connection recovery request message to the third base station, and receiving an RRC connection release message or an RRC connection recovery message from the third base station, where the RRC connection release message or the RRC connection recovery message includes a key of the second key zone.
  • the third base station may be the same as the first base station; or may be different from the first base station, but the two base stations are located in the same key area, and are not limited.
  • the method further includes: sending, by the base station, a key of the key zone where the base station is located to the terminal, where the following three manners are used.
  • the base station receives the authorization indication information from the mobility management network element, where the authorization indication information is used to indicate that the terminal is authorized to use the time synchronization service; and the base station sends, according to the authorization indication information, the key area where the base station is located according to the authorization indication information. Key.
  • the terminal sends a NAS request message to the mobility management network element
  • the mobility management network element receives the NAS request message, acquires the subscription information of the terminal, and determines, according to the subscription information, whether the terminal is authorized to use the time synchronization service, and if so, Then, the mobility management network element sends the authorization indication information to the base station.
  • the base station receives the authorization indication information, and sends the key to the terminal according to the authorization indication information.
  • the NAS request message includes an attach request, a TAU request, a registration request, or other NAS signaling, and is not limited.
  • the NAS request message may be carried in the first RRC message, and after receiving the first RRC message, the base station sends the NAS request message to the mobility management network element, and further, the base station may receive the received message.
  • the authorization indication information is carried in the RRC message and sent to the terminal.
  • the base station may obtain the key from the mobility management network element or the OAM entity in advance, and is not limited.
  • the base station is a target base station in the second key area, and the terminal switches from the source base station of the first key area to the target base station, and the sending, by the base station, the key of the key area in which the base station is located to the terminal may include:
  • the target base station receives the handover request message from the source base station, and sends a handover command to the source base station, where the handover command includes the key of the second key zone;
  • the target base station receives the handover request message from the mobility management network element, and sends a handover request response message to the mobility management network element, where the handover request response message includes a key of the second key zone.
  • a terminal switches from a source base station to a target base station through an X2 interface between base stations.
  • the source base station sends a handover request message to the target base station.
  • the target base station receives the handover request message and sends a handover command to the source base station, where the handover command includes a key of the second key zone in which the target base station is located.
  • the source base station receives the handover command from the target base station and sends an RRC message to the terminal, where the RRC message includes a key of the second key zone in which the target base station is located.
  • the terminal receives the RRC message, and obtains, from the RRC message, a key of the second key area where the target base station is located, that is, a key of the key area where the terminal is located.
  • the terminal switches from the source base station to the target base station through the S1 interface.
  • the source base station sends a handover request message to the mobility management network element.
  • the mobility management network element receives the handover request message and sends the handover request message to the target base station.
  • the target base station receives the handover request message and sends a handover request response message to the mobility management network element.
  • the handover request response message includes a key of a second key zone where the target base station is located.
  • the mobility management network element receives the handover request response message and sends a handover command message to the source base station, where the handover command message includes a key of a key zone in which the target base station is located.
  • the source base station receives the handover command and sends an RRC message to the terminal, where the RRC message includes a key of the second key zone where the target base station is located.
  • the terminal receives the RRC message, and obtains, from the RRC message, a key of the second key area where the target base station is located, that is, a key of the key area where the terminal is located.
  • the terminal moves from the RNA in the first key area to the base station in the RNA in the second key area, and the sending, by the base station, the key of the key area in which the base station is located to the terminal may include:
  • the base station receives an RRC connection recovery request message from the terminal;
  • the foregoing base station sends an RRC connection release message or an RRC connection recovery message to the terminal according to the RRC connection recovery request message, where the RRC connection release message or the RRC connection recovery message includes a key of the second key zone.
  • the method provided by the foregoing fifth implementation scenario may be independent of the steps S101-104, that is, may be an independent method, and the method is used to implement a key for the base station to send a key zone to the terminal.
  • the method further includes: the base station sending the third system information block. Accordingly, the terminal receives a third system information block from the base station.
  • the third system information block may include indication information, where the indication information may be used to indicate a first system information block for carrying the encrypted time information.
  • the terminal may obtain the encrypted time information from the first system information block indicated by the indication information.
  • the third system information block may be SIB1, and the first system information block may be other SIBs than SIB1.
  • a base station broadcasts SIB1 and other SIBs (which may be referred to as SIBx).
  • SIBx which may be referred to as SIBx).
  • the base station carries indication information in SIB1, and the indication information may indicate an SIBx for carrying the encrypted time information.
  • the terminal listens to the SIB1 and receives the indication information in the SIB1.
  • the first system information block carrying the encrypted time information may be determined.
  • third system information block and the second system information block may be the same or different, and are not limited.
  • the foregoing method further includes:
  • the base station receives a key from a mobility management network element, a neighboring base station, or an adjacent key area of a key area in which the base station is located in the operation management and maintenance entity; the base station transmits a key of the adjacent key area.
  • the method may further include: receiving, by the terminal, a key of an adjacent key area of the key area in which the terminal is located.
  • the base station can transmit the key of the neighboring key zone in a broadcast manner. Further, after receiving the key of the adjacent key area, the base station may encrypt the key of the adjacent key area by using the key of the key area where the base station is located, and then send the key to the terminal, and the terminal uses the secret of the base station. The key of the key zone is decrypted to obtain the key of the decrypted adjacent key zone.
  • the base station may also use a certificate to sign a message for transmitting a key of the adjacent key area, or may use an integrity protection key to perform integrity protection on a message for sending a key of the adjacent key area.
  • the base station may also transmit the key of the adjacent key zone in a unicast manner. Further, after receiving the key of the adjacent key area, the base station may use the AS layer security key negotiated between the base station and the terminal, and securely protect the key of the adjacent key area and send the key to the terminal. After receiving the key of the adjacent key zone, the terminal decrypts the key of the adjacent key zone by using the corresponding AS layer security key.
  • the base station sends the key of the adjacent key area in a unicast manner, and can be applied in the process of base station handover.
  • the source base station can send the key of the adjacent key area of the key area where the target base station is located to the terminal.
  • the source base station receives the key of the adjacent key area of the key area where the target base station is located, and sends the key of the adjacent key area of the key area where the target base station is located, and the terminal receives the target base station.
  • the key of the adjacent key zone of the key zone is a unicast manner, and can be applied in the process of base station handover.
  • the source base station can send the key of the adjacent key area of the key area where the target base station is located to the terminal.
  • the source base station receives the key of the adjacent key area of the key area where the target base station is located, and sends the key of the adjacent key area of the key area where the target base station is located, and the terminal receives the target base station.
  • An example communication scenario is a terminal initial access network, and the terminal acquires a key from the mobility management network element through NAS signaling.
  • the network may be an operator network, and may include an access network and a core network.
  • the core network may include AMF, SMF, etc. in the 5G system, and is not limited.
  • FIG. 6 is a schematic diagram of an interaction process of an example communication method according to an embodiment of the present disclosure, where the method may include the following steps:
  • the terminal sends a NAS request message to the mobility management network element.
  • the mobility management network element receives the NAS request message.
  • the NAS request message is used to request to obtain a key of a key area in which the terminal is located.
  • the NAS request message may include an attach request, a TAU request, a registration request, or other NAS signaling.
  • the mobility management network element acquires subscription information of the terminal according to the NAS request message.
  • the mobility management network element may obtain the subscription information of the terminal locally; if the mobility management network element The privilege information of the terminal is not included in the context information of the terminal, or the circumstance information of the terminal does not include the subscription information of the terminal.
  • the mobility management network element can obtain the subscription information of the terminal from the HSS or the UDM according to the identifier of the terminal carried in the NAS request message.
  • the mobility management network element determines, according to the subscription information of the terminal, whether the terminal is authorized to use the time synchronization service.
  • the subscription information of the terminal includes whether the terminal has subscribed to the time synchronization service.
  • the mobility management network element determines that the terminal has subscribed to the time synchronization service according to the subscription information, it indicates that the terminal is authorized to use the time synchronization service, and the mobility management network element can carry the key of the key zone where the terminal is located in the NAS response message.
  • the mobility management network element determines that the terminal does not subscribe to the time synchronization service according to the subscription information, it indicates that the terminal is not authorized to use the time synchronization service, and the mobility management network element sends the NAS response message to the terminal.
  • the NAS response message may fail to carry.
  • the cause value, the failure cause value can be used to indicate that the terminal is not authorized to use the time synchronization service.
  • S202 and S203 are optional steps.
  • the mobility management network element sends a NAS response message to the terminal, where the NAS response message includes a key of a key area where the terminal is located.
  • the terminal receives the NAS response message, and the terminal can acquire and store the key from the NAS response message.
  • the base station sends a second system information block to the terminal.
  • the terminal receives the second system information block.
  • step S205 is an optional step.
  • the second system information block includes: key related information.
  • the terminal may receive the second system information block carrying the key related information from the base station, and obtain the key of the key area in which the terminal is located according to the key related information. For details, refer to the related description in the embodiment of FIG. ,No longer.
  • the second system information block includes indication information indicating a first system information block for carrying the encrypted time information.
  • the terminal may obtain the encrypted time information from the first system information block indicated by the indication information according to the indication information.
  • the base station obtains encrypted time information according to the time information and a key of the key area where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the obtained key.
  • the base station carries the encrypted time information in the system information block, and the terminal acquires the key from the mobility management network element through the NAS signaling, and decrypts the encrypted time information according to the key, thereby realizing Secure transmission of time information.
  • FIG. 7a is a schematic diagram of an interaction process of another example communication method according to an embodiment of the present disclosure, and FIG. 7a is a case where AS signaling includes a NAS message.
  • the method can include the following steps:
  • the base station receiving terminal sends an AS request message, and sends a NAS request message in the AS request message to the mobility management network element.
  • the mobility management network element receives the NAS request message.
  • the AS request message may be an RRC connection setup request message, and the NAS request message may be an attach request, a TAU request, or a registration request.
  • the mobility management network element acquires subscription information of the terminal according to the NAS request message.
  • the mobility management network element determines, according to the subscription information, whether the terminal is authorized to use the time synchronization service.
  • the mobility management network element sends an initial context setup request message to the base station.
  • the initial context setup request message includes authorization indication information.
  • the authorization indication information can be used to indicate that the terminal is authorized to use the time synchronization service.
  • the base station sends an RRC connection reconfiguration message to the terminal.
  • the RRC connection reconfiguration message includes a key of a key area in which the terminal is located.
  • the base station determines to send the key to the terminal according to the authorization indication information, and the base station carries the key of the key area where the terminal is located in the RRC connection reconfiguration message and sends the key to the terminal.
  • the terminal receives the RRC connection reconfiguration message, and acquires and stores the key.
  • the base station sends the second system information block to the terminal.
  • the terminal receives the second system information block.
  • the base station obtains encrypted time information according to the time information and the key of the key zone where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the key.
  • the base station carries the encrypted time information in the system information block, and the terminal acquires the key through the AS signaling, where the AS signaling includes the NAS request message, and the mobility management network element authorization indication
  • the base station sends a key to the terminal, and the terminal receives the key and decrypts the encrypted time information according to the key, thereby implementing secure transmission of time information.
  • FIG. 7b is a schematic diagram of an interaction process of another example communication method according to an embodiment of the present disclosure, where the method may include the following steps:
  • S301b The terminal sends an RRC request message to the base station.
  • the RRC request message is used to request to acquire a key for a key zone in which the terminal is located.
  • the base station determines, according to the context information of the terminal, that the terminal is authorized to use the time synchronization service.
  • the base station may send the key of the key zone where the terminal is located to the terminal.
  • the base station sends an RRC response message to the terminal, where the RRC response message includes a key of the key zone where the terminal is located.
  • the base station sends the second system information block to the terminal.
  • the terminal receives the second system information block.
  • step S304b For the implementation of this step S304b, reference may be made to S205 in the embodiment shown in FIG. 6.
  • the base station obtains encrypted time information according to the time information and the key of the key zone where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the key.
  • a base station carries encrypted time information in a system information block, and the terminal acquires a key through AS signaling, and decrypts the encrypted time information according to the key, thereby implementing time information. Safe transmission.
  • FIG. 8 is a schematic diagram of an interaction process of still another exemplary communication method according to an embodiment of the present disclosure, where the method may include the following steps:
  • the terminal After performing cell reselection in an idle state, the terminal selects a cell that camps under the base station 2.
  • the key area where the terminal is located is the key area where the base station 2 is located.
  • the terminal determines whether the key of the key area where the base station 2 is located is obtained in advance.
  • this step is an optional step.
  • the base station 1 receives the key of the adjacent key zone of the key zone where the base station 1 of the mobility management network element, the neighboring base station, or the operation management and maintenance entity is located
  • the base station 1 transmits the key of the adjacent key zone.
  • the terminal receives the key of the adjacent key zone.
  • the key of the adjacent key zone includes the key of the key zone in which the base station 2 is located.
  • the key area can be identified by the identity of the key area.
  • the terminal determines that the key area where the terminal is located is the key area where the base station 2 is located, and the terminal searches for the stored key of the adjacent key area according to the identifier of the key area.
  • the implementation of this step may refer to steps S201-S204 of the embodiment shown in FIG. 6.
  • the key of the key zone where the base station 2 is located is obtained by acquiring the key from the base station 2 or the mobility management network element by using the AS signaling.
  • the implementation of this step may refer to steps S301-S305 of the embodiment shown in FIG.
  • the base station obtains encrypted time information according to the key and time information of the key area where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • step S405 For the implementation of this step S405, reference may be made to S102 in the embodiment shown in FIG.
  • the terminal decrypts the encrypted time information according to the key.
  • the base station carries the encrypted time information in the system information block, and after the cell performs the cell reselection, the terminal obtains the key from the base station where the reselected cell is located through the AS signaling, or passes the NAS.
  • the signaling obtains a key from the mobility management network element, and decrypts the encrypted time information according to the key, thereby implementing secure transmission of time information.
  • FIG. 9 is a schematic diagram of an interaction process of another specific example communication method provided by an embodiment of the present application, where the method may include the following steps:
  • the source base station sends a handover request message to the target base station.
  • the target base station receives the handover request message.
  • the target base station sends a handover command to the source base station, where the handover command includes a key of a key zone where the target base station is located.
  • the source base station receives the handover command.
  • the source base station sends an RRC message to the terminal, where the RRC message includes a key of a key area where the target base station is located.
  • the terminal receives the RRC message.
  • the RRC message may be an RRC connection reconfiguration message, which is not limited.
  • the base station obtains encrypted time information according to the key and time information of the key zone where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the key.
  • the base station carries the encrypted time information in the system information block, and the base station corresponding to the terminal switches, and the terminal acquires the key of the key area where the target base station is located, according to the density of the target base station.
  • the key of the key zone decrypts the encrypted time information, thereby realizing the secure transmission of time information.
  • FIG. 10 is a schematic diagram of an interaction process of another specific example communication method provided by the embodiment of the present application, and the method may include the following steps:
  • the source base station sends a handover request message to the mobility management network element.
  • the mobility management network element receives the handover request message.
  • the mobility management network element sends a handover request message to the target base station.
  • the target base station receives the handover request message.
  • the target base station sends a handover response message to the mobility management network element.
  • the mobility management network element receives the handover response message.
  • the handover response message includes a key of a key zone in which the target base station is located.
  • the mobility management network element sends a handover command to the source base station.
  • the source base station receives the handover command.
  • the handover command includes a key of a key zone in which the target base station is located.
  • the source base station sends an RRC message to the terminal, where the RRC message includes a key of a key area where the target base station is located.
  • the terminal receives the RRC message.
  • the RRC message may be an RRC connection reconfiguration message, which is not limited.
  • the base station obtains encrypted time information according to the key and time information of the key zone where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the key.
  • the base station carries the encrypted time information in the system information block, and the base station corresponding to the terminal switches, and the terminal acquires the key of the key area where the target base station is located, according to the density of the target base station.
  • the key of the key zone decrypts the encrypted time information, thereby realizing the secure transmission of time information.
  • the communication scenario is that the terminal is in an inactive state, that is, the terminal establishes an RRC connection with the base station 1 and enters an RRC inactive state, that is, the base station 1 is an anchor base station (anchor-RAN) of the terminal; At the same time, base station 1 will assign an RNA, such as RNA1, to the terminal.
  • RNA1 an anchor base station
  • the terminal requests the base station 2 to resume the RRC connection, the base station 2 restores the RRC connection for the terminal, and the base station 2 allocates a new RNA, such as RNA2, to the terminal.
  • FIG. 11 is a schematic diagram of an interaction process of another specific example communication method according to an embodiment of the present disclosure, where the method may include the following steps:
  • the terminal sends an RRC connection recovery request to the base station 2.
  • the base station 2 receives the RRC connection recovery request.
  • the RRC connection recovery request may carry the identity of the terminal.
  • the base station 2 acquires the context of the terminal from the base station 1.
  • base station 1 maintains the context of the terminal.
  • the base station 2 sends a context acquisition request message to the base station 1, and the context acquisition request message includes an identifier of the terminal.
  • the base station 1 acquires the context of the terminal according to the identifier of the terminal, and sends it to the base station 2.
  • the base station 2 performs a path switching process with the mobility management network element.
  • the base station 2 sends an RRC connection release message to the terminal.
  • the base station 2 determines that the terminal sends an RRC connection recovery request because the terminal has moved out of the RNA trigger, that is, the cause value carried in the RRC connection recovery request is a RAN notification area update, and the base station determines that there is no need to send the RAN notification area update.
  • the downlink data of the terminal the base station 2 sends an RRC connection release message to the terminal.
  • the terminal receives the RRC Connection Release message.
  • the RRC Connection Release message may include a key of the second key zone.
  • base station 2 may send an RRC Connection Recovery message to the terminal.
  • the base station 2 determines that the terminal sends an RRC connection recovery request because the terminal has moved out of the RNA, that is, the reason value carried in the RRC connection recovery request is the RAN notification area update, and the base station determines that there is downlink data that needs to be sent to the terminal, Then, the base station 2 sends an RRC recovery message to the terminal. The terminal receives the RRC connection recovery message.
  • the RRC connection recovery message may include a key of the second key zone.
  • the base station 2 finds that there is no data that needs to be transmitted to the terminal (for example, the base station 2 sets a timer 1, if there is no data of the terminal to be transmitted before the expiration of the timer 1), the base station sends an RRC connection. Release the message to the terminal. The terminal receives the RRC Connection Release message.
  • the RRC Connection Release message may include a key of the second key zone.
  • the base station obtains encrypted time information according to the key and time information of the key area where the base station is located.
  • the base station sends a first system information block, where the first system information block includes encrypted time information.
  • the terminal receives the first system information block.
  • the terminal decrypts the encrypted time information according to the key.
  • the base station carries the encrypted time information in the system information block, and the RAN of the terminal is changed, and the terminal acquires the key of the changed key area through the RRC connection recovery process, according to the acquisition.
  • the key decrypts the encrypted time information, thereby achieving secure transmission of time information.
  • each of the foregoing network elements includes a hardware structure and/or a software module corresponding to each function.
  • the present application can be implemented in a combination of hardware or hardware and computer software in combination with the elements and algorithm steps of the various examples described in the embodiments disclosed herein. Whether a function is implemented in hardware or computer software to drive hardware depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present application.
  • the embodiment of the present application further provides a communication system, including the terminal and the base station in the foregoing embodiment (the first base station in the embodiment shown in FIG. 5, or the base station in any of the embodiments in FIG. 6 to FIG. 7b, or The source base station or the target base station in any of the embodiments of FIG. 9 to FIG. 10, or the base station 1 or the base station 2) in any of the embodiments of FIG. 8 and FIG. 11, and the mobility management network element in the foregoing embodiment.
  • the base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time information according to the key of the key area where the terminal is located, thereby realizing the secure transmission of the time information.
  • FIG. 12 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1200 may be the foregoing terminal.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the communication unit 121 is configured to receive a first system information block from the first base station, where the first system information block includes encrypted time information, where the time information is used in a communication device in a key area where the communication device is located Synchronize;
  • the processing unit 122 is configured to decrypt the encrypted time information according to a key of the key area in which the communication device is located.
  • the processing unit 122 is further configured to acquire a key of a key area in which the terminal is located.
  • processing unit 122 is configured to:
  • processing unit 122 is configured to:
  • the communication device stores the key corresponding to the key related information, acquiring the stored key corresponding to the key related information;
  • the communication device does not store the key corresponding to the key related information, acquiring a key of the key area in which the terminal is located;
  • the communication device fails to decrypt the encrypted time information according to the key stored by the communication device, the key of the key area in which the terminal is located is acquired.
  • the communication unit 121 is configured to:
  • the communication device moves from the radio access network notification area RNA in the first key area to the RNA in the second key area, the key of the second key area is acquired.
  • the communication unit 121 is configured to:
  • the communication device is in a connected state, and when the communication device switches from a source base station in the first key zone to a target base station in the second key zone
  • the communication unit 121 is configured to:
  • the RRC message including a key of the second key zone.
  • the communication device is in an inactive state, and when the communication device moves from RNA in the first key area to RNA in the second key area,
  • the communication unit 121 is configured to:
  • the RRC Connection Release message including a key of the second key zone.
  • the first system information block is a system information block that is signed by a certificate
  • the communication unit 121 is further configured to receive the certificate from the mobility management network element or the first base station;
  • the processing unit 122 is further configured to verify the signature of the first system information block by using the certificate.
  • the communication device may be the terminal, where the base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time according to the key of the key area where the terminal is located. Information enables secure transmission of time information.
  • FIG. 13 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1300 may be the first base station.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the processing unit 131 is configured to obtain encrypted time information according to the time information and a key of the key area where the communication device is located, where the time information is used for synchronization of the terminal in the key area;
  • the communication unit 132 is configured to send a first system information block, where the first system information block includes the encrypted time information.
  • the communication unit 132 is further configured to send the key to the terminal.
  • the communication unit 132 is configured to receive authorization indication information from a mobility management network element, where the authorization indication information is used to indicate that the terminal is authorized to use a time synchronization service; And transmitting the key to the terminal according to the authorization indication information.
  • the communication device is a target base station in a second key area, and the terminal switches from a source base station in the first key area to the target base station;
  • the communication unit 132 is configured to receive a handover request message from the source base station, and send a handover command to the source base station, where the handover command includes the key, and the key is the second key zone. Key; or,
  • the communication unit 132 is configured to receive a handover request message from the mobility management network element, and send a handover request response message to the mobility management network element, where the handover request response message includes the key, the key Is the key of the second key zone.
  • the terminal moves from the radio access network in the first key area to notify the area RNA to move to the communication device in the RNA in the second key area;
  • the communication unit 132 is configured to receive an RRC connection recovery request message from the terminal;
  • the communication unit 132 is further configured to send an RRC connection release message to the terminal according to the RRC connection recovery request message, where the RRC connection release message includes the key, and the key is the second secret The key of the key zone.
  • the communication unit 132 is further configured to receive a certificate from an operation management maintenance entity or a mobility management network element; and the processing unit 131 is further configured to adopt the certificate to the A system information block is signed.
  • the communication device may be the first base station, where the first base station carries the encrypted time information in the system information block, and the terminal decrypts according to the key of the key area where the terminal is located.
  • the encrypted time information realizes the secure transmission of time information.
  • FIG. 14 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1400 may be the mobility management network element described above.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the communication unit 141 is configured to receive a non-access stratum request message from the terminal;
  • the communication unit 141 is further configured to send a non-access stratum response message to the terminal, where the non-access stratum response message includes a key of a key zone in which the terminal is located.
  • the communication device further includes: a processing unit 142;
  • the processing unit 142 is configured to acquire subscription information of the terminal according to the non-access stratum request message
  • the mobility management network element encapsulates a key of the key zone in which the terminal is located in the non-access stratum response message.
  • the mobility management network element sends a key to the terminal according to the subscription information of the terminal, and the terminal authorized to use the time synchronization service can acquire the key, thereby decrypting the received time information, thereby effectively managing the usage time.
  • the communication unit 141 is further configured to receive the key from the first base station, or an operation management and maintenance entity.
  • a communication device may be the mobility management network element, where the mobility management network element sends a key of a key area in which the terminal is located to the terminal, and the terminal obtains the key according to the obtained key.
  • the decrypted received time information is encrypted, and the secure transmission of time information is realized.
  • FIG. 15 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1500 may be the mobility management network element.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the communication unit 151 is configured to receive a non-access stratum request message from the terminal;
  • the processing unit 152 is configured to acquire subscription information of the terminal according to the non-access stratum request message.
  • the communication unit 151 is further configured to send authorization indication information to the first base station, where the authorization indication information is used to indicate The terminal is authorized to use the time synchronization service.
  • the communication device may be the mobility management network element, and the mobility management network element sends a key to the terminal according to the subscription information of the terminal, and is authorized to use the time synchronization service terminal.
  • the key can be acquired to decrypt the received time information, so that the terminal using the time synchronization service can be effectively managed.
  • FIG. 16 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1600 may be the mobility management network element.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the communication unit 161 is configured to receive a handover request message from the source base station;
  • the communication unit 161 is further configured to send the handover request message to a target base station;
  • the communication unit 161 is further configured to receive a handover request response message from the target base station, where the handover request response message includes a key of a key zone in which the target base station is located;
  • the communication unit 161 is further configured to send a handover command message to the source base station, where the handover command message includes a key of a key zone in which the target base station is located.
  • the communication device may be the mobility management network element, following the handover of the base station, the key area is changed, and the terminal re-acquires the key of the key zone, and the terminal according to the The key decrypts the received time information to achieve secure transmission of time information.
  • FIG. 17 is a schematic structural diagram of a module of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus 1700 may be the source base station.
  • the communication device can be used to perform the communication method described above.
  • the communication device can include:
  • the processing unit 171 is configured to acquire a key of a key area where the target base station is located;
  • the communication unit 172 is configured to send, to the terminal, a key of the key zone where the target base station is located.
  • the communication unit 172 is configured to send a handover request message to the target base station; and the communication unit 172 is further configured to receive a handover command from the target base station, where the handover command includes The key of the key zone in which the target base station is located.
  • the communication unit 172 is configured to send a handover request message to the mobility management network element; and the communication unit 172 is further configured to receive a handover command from the mobility management network element,
  • the handover command includes a key of a key zone in which the target base station is located.
  • the communication unit 172 is further configured to receive a key of an adjacent key area of a key area in which the target base station is located; and the communication unit 172 is further configured to The terminal transmits a key of an adjacent key area of a key area in which the target base station is located.
  • the base station sends the key of the adjacent key area to the terminal in advance, so that the terminal can directly acquire the key stored by the terminal and decrypt the time information when the cell reselection, the base station handover, or the RNA change occurs.
  • the communication device may be the source base station, and the base station switches, the key area changes, and the terminal re-acquires the key of the key area.
  • FIG. 18 is a schematic diagram of a simplified structure of a communication device according to an embodiment of the present invention.
  • the communication device may be the foregoing terminal.
  • the communication device can be used to perform the communication method described above.
  • the terminal device uses a mobile phone as an example.
  • the terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and an input/output device.
  • the processor is mainly used for processing communication protocols and communication data, and controlling terminal devices, executing software programs, processing data of software programs, and the like.
  • Memory is primarily used to store software programs and data.
  • the RF circuit is mainly used for the conversion of the baseband signal and the RF signal and the processing of the RF signal.
  • the antenna is mainly used to transmit and receive RF signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, keyboards, etc., are primarily used to receive user input data and output data to the user. It should be noted that some types of terminal devices may not have input and output devices.
  • the processor When the data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal, and then sends the radio frequency signal to the outside through the antenna in the form of electromagnetic waves.
  • the RF circuit receives the RF signal through the antenna, converts the RF signal into a baseband signal, and outputs the baseband signal to the processor, which converts the baseband signal into data and processes the data.
  • the memory may also be referred to as a storage medium or a storage device or the like.
  • the memory may be independent of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.
  • an antenna and a radio frequency circuit having a transceiving function can be regarded as a receiving unit and a transmitting unit (also collectively referred to as a transceiving unit) of the terminal device, and a processor having a processing function is regarded as a processing unit of the terminal device.
  • the terminal device includes a receiving unit 181, a processing unit 182, and a transmitting unit 183.
  • the receiving unit 181 may also be referred to as a receiver, a receiver, a receiving circuit, etc.
  • the transmitting unit 183 may also be referred to as a transmitter, a transmitter, a transmitting circuit, or the like.
  • Processing unit 182 may also be referred to as a processor, processing a board, processing module, processing device, or the like.
  • the receiving unit 181 and the transmitting unit 183 may also be collectively referred to as a communication unit.
  • the receiving unit 181 is configured to perform step S302 of the embodiment shown in FIG. 5, and receive a first system information block sent by the first base station, where the first system information block includes encrypted time information.
  • the processing unit 182 is configured to perform step S103 of the embodiment shown in FIG. 5, and decrypt the encrypted time information according to the key of the key area where the terminal is located.
  • the base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time information according to the key of the key area where the terminal is located, thereby realizing the secure transmission of the time information.
  • FIG. 19 is a schematic structural diagram of a communication apparatus according to an embodiment of the present invention.
  • the communication apparatus may be the first base station.
  • the communication device includes a radio frequency signal transceiving and converting portion and a 192 portion.
  • the radio frequency signal transceiving and converting portion further includes a receiving unit 191 portion and a transmitting unit 193 portion (also collectively referred to as a communication unit).
  • the RF signal transmission and reception and conversion part is mainly used for transmitting and receiving RF signals and converting RF signals and baseband signals; the 192 part is mainly used for baseband processing, and controls the first base station.
  • the receiving unit 191 may also be referred to as a receiver, a receiver, a receiving circuit, etc.
  • the transmitting unit 193 may also be referred to as a transmitter, a transmitter, a transmitter, a transmitting circuit, or the like.
  • the portion 192 is typically the control center of the first base station and may be generally referred to as a processing unit for controlling the first base station to perform the steps described above with respect to the first base station in FIG. For details, please refer to the description of the relevant part above.
  • the 192 portion may include one or more boards, each of which may include one or more processors and one or more memories for reading and executing programs in the memory to implement baseband processing functions and to the first Base station control. If multiple boards exist, the boards can be interconnected to increase processing power. As an optional implementation manner, multiple boards share one or more processors, or multiple boards share one or more memories, or multiple boards share one or more processes at the same time. Device.
  • portion 192 is used to perform step S101 in the embodiment shown in FIG. 5; and transmitting unit 193 is used to perform step S102 in the embodiment shown in FIG.
  • the first base station carries the encrypted time information in the system information block, and the terminal decrypts the encrypted time information according to the key of the key area where the terminal is located, and implements the time information. Secure transmission.
  • FIG. 20 is a schematic diagram of a hardware architecture of a communication device according to an embodiment of the present invention.
  • the communication device 2000 may be the mobility management network element.
  • the communication device can be used to perform the communication method described above.
  • the communication device may include a receiver 201, a transmitter 202, a processor 203, and a memory 204, and the receiver 201, the transmitter 202, the processor 203, and the memory 204 are connected to each other through a communication line.
  • the memory includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read only memory (EPROM), or a portable A compact disc read-only memory (CD-ROM) for use in related instructions and data.
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read only memory
  • CD-ROM portable A compact disc read-only memory
  • the receiver is for receiving data and/or signals
  • the transmitter is for transmitting data and/or signals.
  • the transmitter and receiver can be stand-alone devices or a single device.
  • the processor may include one or more processors, for example, including one or more central processing units (CPUs).
  • CPUs central processing units
  • the CPU may be a single-core CPU or may be Multi-core CPU.
  • related functions implemented by processing unit 142 in FIG. 14 may be implemented by one or more processors, and related functions implemented by communication unit 141 may be implemented by a receiver and a transmitter.
  • the receiver 201 is configured to receive a non-access stratum request message from the terminal, and is further configured to send a non-access stratum response message to the terminal, where the processor 203 is configured to obtain, according to the non-access stratum request message, the The subscription information of the terminal; and when determining, according to the subscription information, that the terminal is authorized to use the time synchronization service, the mobility management network element encapsulates a key of the key area where the terminal is located in the non-contact In the layer response message.
  • the related functions implemented by the communication unit 151 in FIG. 15 may be implemented by a receiver and a transmitter, and the related functions implemented by the processing unit 152 in FIG. 15 may be performed by one or more processors.
  • the receiver 201 is configured to receive a non-access stratum request message from the terminal.
  • the processor 203 is configured to acquire subscription information of the terminal according to the non-access stratum request message.
  • the transmitter 202 is configured to: when the mobility management network element determines, according to the subscription information, that the terminal is authorized to use the time synchronization service, send the authorization indication information to the first base station.
  • the related functions implemented by the communication unit 161 of FIG. 16 may be implemented by a receiver and a transmitter.
  • the receiver 201 is configured to receive a handover request message from the source base station
  • the transmitter 202 is configured to send the handover request message to the target base station
  • the receiver 201 is further configured to receive a handover request response message from the target base station, where the handover is performed.
  • the request response message includes a key of a key area in which the target base station is located
  • the transmitter 202 is further configured to send a handover command message to the source base station, where the handover command message includes a secret of a key area in which the target base station is located. key.
  • a mobility management network element sends an authorization indication to a base station according to the subscription information of the terminal, and the base station sends a key of the key area in which the terminal is located to the terminal according to the authorization indication, and the terminal according to the secret
  • the key decrypts the time information, thereby achieving secure transmission of time information.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present invention are generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in or transmitted by a computer readable storage medium.
  • the computer instructions may be from a website site, computer, server or data center via a wired (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.) Another website site, computer, server, or data center for transmission.
  • the computer readable storage medium can be any available media that can be accessed by a computer or a data storage device such as a server, data center, or the like that includes one or more available media.
  • the usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)). )Wait.
  • the foregoing storage medium includes: a read-only memory (ROM) or a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种通信方法及装置。其中的方法包括：终端接收来自基站的第一系统信息块，所述第一系统信息块包括加密的时间信息，所述时间信息用于所述终端所处密钥区内的终端进行同步；所述终端根据所述终端所处密钥区的密钥，解密所述加密的时间信息。本申请还公开了相应的装置。基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。

Description

通信方法及装置
本申请要求于2018年2月13日提交中国专利局、申请号为201810149663.8、发明名称为“通信方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种通信方法及装置。
背景技术
在第四代(4 th generation，4G)移动通信或第五代(5 th generation，5G)移动通信的某些工业通信场景下，要求终端之间进行时间同步。为了实现终端之间的同步，如图1所示，现有技术中将基站作为终端的时间同步源，广播用于终端之间同步的时间信息，从而让该基站服务范围内的所有的终端都与基站保持同步，进而实现终端之间的同步。
上述现有技术中，时间信息存在安全隐患，例如，时间信息可能是被攻击者伪造的，如图2所示，通过伪基站广播伪时间信息，造成终端之间的不同步。例如，在工业控制场景中，控制器和执行器这两个终端之间需要保持时间同步，以便控制器给执行器发送控制信令，执行器在准确的时间执行命令。若执行器与控制器不同步，会导致执行器在错误的时间执行命令，导致任务执行失，而且可能导致与另外的执行器冲突。
发明内容
本申请提供一种通信方法及装置，以实现时间信息的安全传输。
第一方面，提供了一种通信方法，包括：终端接收来自第一基站的第一系统信息块，所述第一系统信息块包括加密的时间信息，所述时间信息用于所述终端所处密钥区内的终端进行同步；所述终端根据所述终端所处密钥区的密钥，解密所述加密的时间信息。在该方面中，基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
结合第一方面，在第一方面的第一种可能的实现方式中，所述方法还包括：所述终端获取所述终端所处密钥区的密钥。
结合第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述终端获取所述终端所处密钥区的密钥，包括：所述终端根据所述第一系统信息块，获取所述终端所处密钥区的密钥；或者，当所述终端从第一密钥区移动到第二密钥区时，所述终端获取所述第二密钥区的密钥；或者，所述终端接收来自所述第一基站的携带有密钥相关信息的第二系统信息块，并根据所述密钥相关信息获取所述终端所处密钥区的密钥。在该实现方式中，终端可以在接收到第一系统信息块后，获取终端所处密钥区的密钥；在发生密钥区更新时，终端重新获取终端所处密钥区的密钥；终端还可以根据密钥相关信息获取终端所处密钥区的密钥。
结合第一方面的第二种可能的实现方式，在第一方面的第三种可能的实现方式中，所述终端根据所述第一系统信息块，获取所述终端所处密钥区的密钥，包括：当所述第一系 统信息块还包括密钥相关信息，且所述终端存储有所述密钥相关信息对应的密钥时，所述终端获取所述存储的所述密钥相关信息对应的密钥；或者，当所述第一系统信息块还包括密钥相关信息，且所述终端未存储有所述密钥相关信息对应的密钥时，所述终端获取所述终端所处密钥区的密钥；或者，当所述终端根据所述终端存储的密钥解密所述加密的时间信息失败时，所述终端获取所述终端所处密钥区的密钥。在该实现方式中，终端根据密钥相关信息判断终端是否有存储密钥相关信息对应的密钥；根据密钥相关信息获取终端所处密钥区的密钥；根据密钥相关信息判断存储的密钥是否能解密加密的时间信息。
结合第一方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述终端获取所述终端所处密钥区的密钥，包括：所述终端向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，所述非接入层响应消息包括所述密钥；或所述终端向所述基站发送第一无线资源控制RRC消息，并接收来自所述基站的第二RRC消息，所述第二RRC消息包括所述密钥。在该实现方式中，终端初始接入网络或进行小区重选时，可以通过NAS请求消息从移动性管理网元获取终端所处密钥区的密钥，也可以通过RRC消息从基站获取终端所处密钥区的密钥。
结合第一方面的第三种可能的实现方式，在第一方面的第五种可能的实现方式中，所述终端获取所述终端所处密钥区的密钥，包括：所述终端向所述基站发送RRC连接建立请求消息，所述RRC连接建立请求消息包括非接入层请求消息；所述终端接收来自所述基站的RRC连接重配置消息，所述RRC连接重配置消息包括所述密钥，或，所述RRC连接重配置消息包括非接入层响应消息，所述非接入层响应消息包括所述密钥。
结合第一方面的第三种可能的实现方式，在第一方面的第六种可能的实现方式中，所述终端获取所述终端所处密钥区的密钥，包括：所述终端向所述基站发送RRC请求消息，所述RRC请求消息不包括非接入层请求消息，并接收来自所述基站的RRC响应消息，所述RRC响应消息包括所述密钥。
结合第一方面的第二种可能的实现方式，在第一方面的第七种可能的实现方式中，当所述终端从第一密钥区移动到第二密钥区时，所述终端获取所述第二密钥区的密钥，包括：当所述终端从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，所述终端获取所述第二密钥区的密钥；或者，当所述终端从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述终端获取所述第二密钥区的密钥；或者，当所述终端从所述第一密钥区内的无线接入网通知区RNA移动到所述第二密钥区内的RNA时，所述终端获取所述第二密钥区的密钥。在该实现方式中，当发生小区重选、基站切换或RNA变更，终端获取重新获取终端所处密钥区的密钥。
结合第一方面的第七种可能的实现方式，在第一方面的第八种可能的实现方式中，所述当所述终端从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，所述终端获取所述第二密钥区的密钥，包括：所述终端向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，所述非接入层响应消息包括所述第二密钥区的密钥；或，所述终端向所述第二密钥区内的所述小区对应的第二基站发送第一RRC消息，并接收来自所述第二基站的第二RRC消息，所述第二RRC消息包括所述第二密钥区的密钥。
结合第一方面的第七种可能的实现方式，在第一方面的第九种可能的实现方式中，所述终端处于连接态，且当所述终端从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述终端获取所述第二密钥区的密钥，包括：所述终端接收来自所述源基站的RRC消息，所述RRC消息包括所述第二密钥区的密钥。
结合第一方面的第七种可能的实现方式，在第一方面的第十种可能的实现方式中，所述终端处于非激活态，且当所述终端从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA时，所述终端获取所述第二密钥区的密钥，包括：当所述终端从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA内的第三基站，所述终端向所述第三基站发送RRC连接恢复请求消息；所述终端接收来自所述第三基站的RRC连接释放消息，所述RRC连接释放消息包括所述第二密钥区的密钥。
结合第一方面、或第一方面的第一种可能的实现方式至第一方面的第十种可能的实现方式中的任一方面，在第一方面的第十一种可能的实现方式中，所述第一系统信息块为采用证书签名后的系统信息块，所述方法还包括：所述终端接收来自所述移动性管理网元或所述第一基站的所述证书；所述终端采用所述证书验证所述第一系统信息块的签名。在该实现方式中，采用证书对第一系统信息块签名，终端对签名的第一系统信息块进行验证，可以进一步保证时间信息的安全传输。
结合第一方面、或第一方面的第一种可能的实现方式至第一方面的第十一种可能的实现方式中的任一方面，在第一方面的第十二种可能的实现方式中，所述方法还包括：所述终端接收来自所述第一基站的第三系统信息块，所述第三系统信息块包括指示信息，所述指示信息指示用于携带所述加密的时间信息的所述第一系统信息块；所述终端根据所述指示信息所指示的所述第一系统信息块中，获取所述加密的时间信息。在该实现方式中，通过预先发送指示信息，可以指示终端携带加密的时间信息的系统信息块，这样，终端可以准确地在该系统信息块上获取加密的时间信息。
结合第一方面、或第一方面的第一种可能的实现方式至第一方面的第十二种可能的实现方式中的任一方面，在第一方面的第十三种可能的实现方式中，所述方法还包括：所述终端接收所述终端所处密钥区的相邻密钥区的密钥。在该实现方式中，终端预先获取相邻密钥区的密钥，使得终端在发生上述小区重选、基站切换或RNA变更时，可以直接获取终端存储的密钥，解密时间信息。
第二方面，提供了一种通信方法，包括：第一基站根据时间信息和所述第一基站所处密钥区的密钥，获得加密的时间信息，所述时间信息用于所述密钥区内的终端进行同步；所述第一基站发送第一系统信息块，所述第一系统信息块包括所述加密的时间信息。在该方面中，基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
结合第二方面，在第二方面的第一种可能的实现方式中，所述方法还包括：所述第一基站向终端发送所述密钥。
结合第二方面的第一种可能的实现方式，在第二方面的第二种可能的实现方式中，所述第一基站向终端发送所述密钥包括：所述第一基站接收来自移动性管理网元的授权指示信息，所述授权指示信息用于指示所述终端被授权使用时间同步业务；所述第一基站根据 所述授权指示信息，向所述终端发送所述密钥。在该实现方式中，基站根据移动性管理网元的授权指示发送密钥给终端，被授权使用时间同步业务的终端可以获取密钥，从而解密接收到的时间信息，从而可以有效地管理使用时间同步业务的终端。
结合第二方面的第一种可能的实现方式，在第二方面的第三种可能的实现方式中，所述第一基站为第二密钥区内的目标基站，所述终端从第一密钥区的源基站切换到所述目标基站，所述第一基站向终端发送所述密钥包括：所述第一基站接收来自所述源基站的切换请求消息，并向所述源基站发送切换命令，所述切换命令包括所述密钥，所述密钥为所述第二密钥区的密钥；或者，所述第一基站接收来自移动性管理网元的切换请求消息，并向所述移动性管理网元发送切换请求响应消息，所述切换请求响应消息包括所述密钥，所述密钥为所述第二密钥区的密钥。在该实现方式中，跟随基站切换，密钥区发生变化，终端重新获取所处密钥区的密钥。
结合第二方面的第一种可能的实现方式，在第二方面的第四种可能的实现方式中，所述终端从第一密钥区内的无线接入网通知区RNA移动到第二密钥区内的RNA内的所述第一基站，所述第一基站向终端发送所述密钥包括：所述第一基站接收来自所述终端的RRC连接恢复请求消息；所述第一基站根据所述RRC连接恢复请求消息，向所述终端发送RRC连接释放消息，所述RRC连接释放消息包括所述密钥，所述密钥为所述第二密钥区的密钥。在该实现方式中，RNA发生更新，密钥区发生变化，终端重新获取所处密钥区的密钥。
结合第二方面、或第二方面的第一种可能的实现方式至第二方面的第四种可能的实现方式中的任一种实现方式，在第二方面的第五种可能的实现方式中，所述方法还包括：所述第一基站接收来自操作管理维护实体或移动性管理网元的证书；所述第一基站采用所述证书对所述第一系统信息块进行签名。在该实现方式中，采用证书对第一系统信息块签名，终端对签名的第一系统信息块进行验证，可以进一步保证时间信息的安全传输。
结合第二方面、或第二方面的第一种可能的实现方式至第二方面的第五种可能的实现方式中的任一种实现方式，在第二方面的第六种可能的实现方式中，所述方法还包括：所述第一基站发送第二系统信息块，所述第二系统信息块包括指示信息，所述指示信息指示用于携带所述加密的时间信息的所述第一系统信息块；或者，所述第一基站发送第三系统信息块，所述第三系统信息块包括密钥相关信息，所述密钥相关信息用于获取所述密钥。在该实现方式中，通过预先发送指示信息，可以指示终端携带加密的时间信息的系统信息块，这样，终端可以准确地在该系统信息块上获取加密的时间信息；基站发送密钥相关信息，终端可以根据密钥相关信息获取终端所处密钥区的密钥。
结合第二方面、或第二方面的第一种可能的实现方式至第二方面的第六种可能的实现方式中的任一种实现方式，在第二方面的第七种可能的实现方式中，所述方法还包括：所述第一基站接收来自移动性管理网元、相邻基站、或操作管理维护实体的所述第一基站所处密钥区的相邻密钥区的密钥；所述第一基站发送所述相邻密钥区的密钥。在该实现方式中，基站预先发送相邻密钥区的密钥给终端，使得终端在发生上述小区重选、基站切换或RNA变更时，可以直接获取终端存储的密钥，解密时间信息。
结合第二方面、或第二方面的第一种可能的实现方式至第二方面的第七种可能的实现方式中的任一种实现方式，在第二方面的第八种可能的实现方式中，所述方法还包括：
所述第一基站接收来自安全功能实体、操作管理维护实体或移动性管理网元的所述密钥。
第三方面，提供了一种通信方法，包括：移动性管理网元接收来自终端的非接入层请求消息；所述移动性管理网元向所述终端发送非接入层响应消息，所述非接入层响应消息包括所述终端所处密钥区的密钥。在该方面中，移动性管理网元发送终端所处密钥区的密钥给终端，终端根据获取的密钥，解密接收到的加密的时间信息，实现了时间信息的安全传输。
结合第三方面，在第三方面的第一种可能的实现方式中，所述方法还包括：所述移动性管理网元根据所述非接入层请求消息，获取所述终端的签约信息；当所述移动性管理网元根据所述签约信息确定所述终端被授权使用时间同步业务时，所述移动性管理网元将所述终端所处密钥区的密钥封装在所述非接入层响应消息中。在该实现方式中，移动性管理网元根据终端的签约信息发送密钥给终端，被授权使用时间同步业务的终端可以获取密钥，从而解密接收到的时间信息，从而可以有效地管理使用时间同步业务的终端。
结合第三方面或第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述方法还包括：所述移动性管理网元接收来自第一基站、或操作管理维护实体的所述密钥。
第四方面，提供了一种通信方法，包括：移动性管理网元接收来自终端的非接入层请求消息；所述移动性管理网元根据所述非接入层请求消息，获取所述终端的签约信息；当所述移动性管理网元根据所述签约信息确定所述终端被授权使用时间同步业务时，向第一基站发送授权指示信息，所述授权指示信息用于指示所述终端被授权使用所述时间同步业务。在该方面中，移动性管理网元根据终端的签约信息发送密钥给终端，被授权使用时间同步业务的终端可以获取密钥，从而解密接收到的时间信息，从而可以有效地管理使用时间同步业务的终端。
第五方面，提供了一种通信方法，包括：移动性管理网元接收来自源基站的切换请求消息；所述移动性管理网元向目标基站发送所述切换请求消息；所述移动性管理网元接收来自所述目标基站的切换请求响应消息，所述切换请求响应消息包括所述目标基站所处密钥区的密钥；所述移动性管理网元向所述源基站发送切换命令消息，所述切换命令消息包括所述目标基站所处密钥区的密钥。在该实现方式中，跟随基站切换，密钥区发生变化，终端重新获取所处密钥区的密钥。
第六方面，提供了一种通信方法，包括：源基站获取目标基站所处密钥区的密钥；所述源基站向终端发送所述目标基站所处密钥区的密钥。在该方面中，跟随基站切换，密钥区发生变化，终端重新获取所处密钥区的密钥。
结合第六方面，在第六方面的第一种可能的实现方式中，所述源基站获取目标基站所处密钥区的密钥，包括：所述源基站向所述目标基站发送切换请求消息；所述源基站接收来自所述目标基站的切换命令，所述切换命令包括所述目标基站所处密钥区的密钥。
结合第六方面，在第六方面的第二种可能的实现方式中，所述源基站获取目标基站所处密钥区的密钥，包括：所述源基站向移动性管理网元发送切换请求消息；所述源基站接收来自所述移动性管理网元的切换命令，所述切换命令包括所述目标基站所处密钥区的密 钥。
结合第六方面、或第六方面的第一种可能的实现方式、或第六方面的第二种可能的实现方式，在第六方面的第三种可能的实现方式中，所述方法还包括：所述源基站接收来所述目标基站所处密钥区的相邻密钥区的密钥；所述源基站向所述终端发送所述目标基站所处密钥区的相邻密钥区的密钥。在该实现方式中，基站预先发送相邻密钥区的密钥给终端，使得终端在发生上述小区重选、基站切换或RNA变更时，可以直接获取终端存储的密钥，解密时间信息。
第七方面，提供了一种通信装置，包括处理器，处理器与存储器耦合，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第一方面的方法。该通信装置可以是终端，也可以是至少一个处理元件或芯片。
第八方面，提供了一种通信装置，包括处理器，处理器与存储器耦合，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第二方面的方法。该通信装置可以是第一基站，也可以是至少一个处理元件或芯片。
第九方面，提供了一种通信装置，包括处理器，处理器与存储器耦合，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第三方面至第五方面中任一方面的方法。该通信装置可以是移动性管理网元，也可以是至少一个处理元件或芯片。
第十方面，提供了一种通信装置，包括处理器，处理器与存储器耦合，存储器用于存储程序，处理器调用存储器存储的程序，以执行以上第六方面的方法。该通信装置可以是源基站，也可以是至少一个处理元件或芯片。
第十一方面，提供了一种通信装置，包括用于执行以上第一方面的方法中各个步骤的单元或者手段(means)。该通信装置可以是终端，也可以是至少一个处理元件或芯片。
第十二方面，提供了一种通信装置，包括用于执行以上第二方面的方法中各个步骤的单元或者手段(means)。该通信装置可以是第一基站，也可以是至少一个处理元件或芯片。
第十三方面，提供了一种通信装置，包括用于执行以上第三方面至第五方面中任一方面的方法中各个步骤的单元或者手段(means)。该通信装置可以是移动性管理网元，也可以是至少一个处理元件或芯片。
第十四方面，提供了一种通信装置，包括用于执行以上第六方面的方法中各个步骤的单元或者手段(means)。该通信装置可以是源基站，也可以是至少一个处理元件或芯片。
第十五方面，提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
第十六方面，提供了一种程序，该程序在被处理器执行时用于执行以上第一方面至第六方面中的任一方面或任一方面的任一种实施方式中的方法。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为通过基站实现终端与终端之间同步的示意图；
图2为伪基站发送伪时间信息的示意图；
图3为本申请实施例提供的一种通信系统的示意图；
图4a为一种4G通信系统架构示意图；
图4b为一种的5G通信系统架构示意图；
图5为本申请实施例提供的一种通信方法的交互流程示意图；
图6为本申请实施例提供的一个示例的通信方法的交互流程示意图；
图7a为本申请实施例提供的另一个示例的通信方法的交互流程示意图；
图7b为本申请实施例提供的又一个示例的通信方法的交互流程示意图；
图8为本申请实施例提供的又一个示例的通信方法的交互流程示意图；
图9为本申请实施例提供的又一个示例的通信方法的交互流程示意图；
图10为本申请实施例提供的又一个示例的通信方法的交互流程示意图；
图11为本申请实施例提供的又一个示例的通信方法的交互流程示意图；
图12为本申请实施例提供的一种通信装置的模块结构示意图；
图13为本申请实施例提供的另一种通信装置的模块结构示意图；
图14为本申请实施例提供的又一种通信装置的模块结构示意图；
图15为本申请实施例提供的又一种通信装置的模块结构示意图；
图16为本申请实施例提供的又一种通信装置的模块结构示意图；
图17为本申请实施例提供的又一种通信装置的模块结构示意图；
图18为本申请实施例提供的一种通信装置的硬件结构示意图；
图19为本申请实施例提供的另一种通信装置的硬件结构示意图；
图20为本申请实施例提供的又一种通信装置的硬件结构示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。
本申请实施例提供的一种通信方法及装置可应用于如图3所示的通信系统中。如图3所示，该通信系统可以包括终端100、基站200和移动性管理网元300。终端100可以与基站200进行通信，终端100还可以通过基站200与移动性管理网元300进行通信。
其中，该移动性管理网元300，可以用于终端的接入管理。例如，4G通信系统中的移动性管理功能实体(mobility management entity，MME)，或5G通信系统中的移动性管理功能实体(access and mobility management function，AMF)。
基站200，可以用于管理无线资源，为终端提供接入服务。基站200可以是4G或5G通信系统中的接入网设备(access network，AN)或无线接入网设备(radio access network，RAN)，例如，5G通信系统中的NG-RAN，或4G通信系统中的演进型基站(evolved Node B，eNB)。
终端100，是一种具有无线收发功能的设备可以部署在陆地上，可以包括室内或室外、手持、穿戴或车载；也可以部署在水面上(如轮船等)；还可以部署在空中(例如飞机、气球和卫星上等)。所述终端可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程 医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请的实施例对应用场景不做限定。终端有时也可以称为用户设备(user equipment，UE)、接入终端、UE单元、UE站、移动站、移动台、远方站、远程终端、移动设备、UE终端、无线通信设备、UE代理或UE装置等。
需要说明的是，移动性管理网元仅是一个名字，名字本身对实体不构成限定。例如，该移动性管理网元也有可能被替换为“移动性管理功能”或其它名字。
此外，该移动性管理网元可以是一个独立的物理设备，也可以是一个物理设备上的功能模块，不予限制。
在本申请实施例中，基站200在系统信息块中携带加密的时间信息，终端100根据该终端所处密钥区的密钥解密该加密的时间信息，从而实现了时间信息的安全传输。时间信息可以用于基站所处密钥区内的终端进行同步。例如，该时间信息可以是具体的时刻值。
其中，密钥区可以有多种粒度划分方式，可以包括以基站、控制单元(control unit，CU)、跟踪区域(tracking area，TA)或公共陆地移动网络(public land mobile network，PLMN)为粒度划分等。
例如，假设密钥区以基站粒度划分，则基站所处的密钥区可以是该基站的信号覆盖区域，换言之，可以是该基站的所有小区的信号覆盖范围，此时，不同基站的密钥可以不同或相同。假设密钥区以比基站更大的粒度划分，例如，TA，则基站所处的密钥区可以是该基站所处的TA，此时，该TA内所有基站的密钥可以相同。
需要指出的是，终端100可以用于执行本申请各方法实施例中终端的动作，基站200可以用于指示本申请图5所示实施例中第一基站的动作、或图6～图7b中任一实施例中基站的动作、或图9～图10中任一实施例中源基站或目标基站的动作、或图8、图11中任一实施例中基站1或基站2的动作，移动性管理网元300可以用于指示本申请各方法实施例中移动性管理网元的动作。
示例性地，终端100获取密钥的方式可以包括以下方式：终端100从移动性管理网元300获取终端100所处密钥区的密钥，或者由移动性管理网元300授权指示基站200向终端100发送该密钥，或者移动性管理网元300将从目标基站获取的目标基站所处密钥区的密钥发送给源基站，再由源基站发送该密钥给终端。
此外，本申请实施例可以应用于4G或5G通信系统，下面对4G和5G通信系统进行简单介绍。
图4a为一种4G通信系统架构示意图。该通信系统可包括终端、eNB和MME。还可包括其它的功能实体，例如核心网中的归属签约用户服务器(home subscriber server，HSS)、服务网关(serving gateway，SGW)和PDN网关(PDN gateway，PGW)等，在这里仅重点描述本申请涉及的几个功能实体。各实体之间通过Sx接口连接(例如图中的S1-MME、S1-U等)。HSS用于管理用户签约信息。SGW提供用户数据转发的用户面功能。PGW为EPC网络的边界网关，提供用户的会话管理和承载控制、数据转发、IP地址分配以及非3GPP用户接入等功能。
图4b为一种5G通信系统架构示意图。该通信系统可包括终端、NG-RAN和AMF。 还可包括其它的功能实体，例如，统一数据管理网元(unified data management，UDM)、用户面功能网元(user plane function，UPF)和会话管理网元(session management function，SMF)等，在这里仅重点描述本申请涉及的几个功能实体。各实体之间通过Nx接口连接(例如图中的N1、N2等)。UDM用于管理用户签约信息。UPF主要负责分组数据包的转发、服务质量(quality of service，QoS)控制、计费信息统计等；SMF负责进行统一的会话管理。
上述图3、图4a或图4b所示系统中的任意一种功能实体或网元，具体实现中，可能由一个物理设备实现，也可能由多个物理设备共同实现，本申请实施例对此不作具体限定。即，可以理解的是，上述系统中的任意一种功能实体或者网元，都可能是实体设备内的一个逻辑功能模块，也可能是由多个实体设备组成的一个逻辑功能模块，本申请实施例对此不作具体限定。
需要说明的是，本申请实施例中的术语“系统”和“网络”可被互换使用。“多个”是指两个或两个以上，鉴于此，本申请实施例中也可以将“多个”理解为“至少两个”。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，字符“/”，如无特殊说明，一般表示前后关联对象是一种“或”的关系。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。本申请实施例不但可以应用在上述4G或5G通信系统中，还可以应用于其后的演进通信系统，不予限制。
图5为本申请实施例提供的一种通信方法的交互流程示意图，该方法可包括以下步骤：
S101、第一基站根据时间信息和第一基站所处密钥区的密钥，获得加密的时间信息。
其中，时间信息可以用于第一基站所处密钥区内的终端进行同步。例如，该时间信息可以是时刻值。
在一个示例中，第一基站可以采用现有的加密算法对时间信息进行加密。例如，加密算法可以是基于SNOW 3G的128-EEA(EPS encryption algorithm)1算法，或者基于高级加密标准(advanced encryption standard，AES)的128-EEA2算法，或者基于祖冲之(Zu Chongzhi，ZUC)的128-EEA3算法。
S102、第一基站发送第一系统信息块(system information block，SIB)，该第一系统信息块包括加密的时间信息。
其中，第一基站可以采用广播的方式发送该第一系统信息块，以便处于第一基站覆盖范围内的终端都可以接收到该第一系统信息块。
其中，该第一系统信息块可以为SIB1～SIB100中的任一的系统信息块。
相应地，终端接收来自第一基站的该第一系统信息块。
其中，由于终端可以接收到第一基站发送的第一系统信息块，可以理解为终端与第一基站处于同一个密钥区，此时，终端所处密钥区的密钥与第一基站所处密钥区的密钥相同。因此，上述时间信息也可以称之用于终端所处密钥区内的终端进行同步的时间信息。
S103、终端根据该终端所处密钥区的密钥，解密该加密的时间信息。
通过步骤S103，终端可以得到解密的时间信息，进而终端可以根据解密的时间信息，与该密钥区的其它终端进行同步。例如，进行时间同步业务的各个终端将自身的时间均调整到接收到的第一系统信息块中包括的时刻值。
本实施例提供的方法，基站通过加密时间信息，并向终端发送该加密的时间信息，终端根据该终端所处密钥区的密钥解密获得时间信息，实现了时间信息的安全传输，进而使得终端之间可以同步。这样，在背景技术提及的工业场景中，控制器和各个执行器获得加密的时间信息，根据该时间信息，各个执行器便可实现与控制器以及其它执行器的同步，准确地执行控制器的指令。通过对时间信息进行加密，没有获取密钥的终端无法解密获得该时间信息，因此，运营商可以针对该时间同步业务进行收费。
可选地，在S101之前，上述方法还包括：基站生成或获得时间信息。
一个实现方式为，基站可以从其它设备、模块或网络获得时间信息，例如，可以从设置于基站上的GPS模块获取时间信息，或者通过基站与时间服务器之间的1588协议或网络时间协议(network time protocol，NTP)获取时间信息。基站可以直接在第一系统信息块中发送获得的时间信息给终端。
另一个实现方式为，基站也可以将基站通过以上实现方式中获得的时间信息结合自身的策略生成时间信息，将生成的时间信息发送给终端。例如，第一系统信息块携带的时间信息可以与基站的物理层帧结构相关，可以在某一个时间参考点发送该第一系统信息块，该第一系统信息块携带基站从其它设备、模块或网络获得的时间信息。终端根据该时间参考点和第一系统信息块中携带的时间信息确定终端进行同步的时间信息。
可选地，在上述实施例的第一种实施场景下，上述方法还包括：基站获得该基站所处密钥区的密钥。
在一个实现方式中，基站接收来自操作管理维护(operation administration and maintenance，OAM)实体的该基站所处密钥区的密钥。例如，基站上电启用时，基站与OAM实体建立连接，基站从OAM实体获取该基站所处密钥区的密钥，或OAM实体主动将该基站所处密钥区的密钥发送给基站。进一步地，基站与移动性管理网元建立S1接口连接后，基站还可以将该基站所处密钥区的密钥发送给移动性管理网元。
进一步地，安全功能实体可以生成步骤S101中的基站所处密钥区的密钥，并将生成的密钥发送给OAM实体。其中，该安全功能实体用于生成和维护密钥，该安全功能实体可以是一个独立的物理设备(例如，可以是现有的网元，如鉴权服务器功能实体(authentication server function，AUSF)实体或UDM；也可以是新的安全网元，例如时间同步安全服务器或时间同步安全功能实体)，也可以是某一个物理设备(例如，OAM实体)中的一个功能模块。
进一步地，基站上电启用时，基站可以直接从安全功能实体获取该密钥，或安全功能实体主动将该密钥发送给基站。
需要说明的是，步骤S101中的基站所处密钥区的密钥也可以称之为基站所处密钥区的加密密钥。
在另一个实现方式中，安全功能实体或OAM实体还可以将该基站所处密钥区的密钥 发送给移动性管理网元，再由移动性管理网元发送给基站。例如，在移动性管理网元上电启用时，与OAM实体建立连接。然后，移动性管理网元向OAM实体请求该基站所处密钥区的密钥，OAM实体将该基站所处密钥区的密钥发送给移动性管理网元；或者OAM实体主动将该基站所处密钥区的密钥发送给移动性管理网元。在基站上电启用时，基站与移动性管理网元建立S1接口连接，移动性管理网元将该基站所处密钥区的密钥发送给基站。
可选地，在上述实施例的第二种实施场景下，上述方法还包括：基站将时间信息或第一系统信息块通过完整性保护算法进行保护。
具体地，在第一系统信息块中可以携带时间信息或第一系统信息块的完整性校验值，终端接收到第一系统信息块后，对该完整性校验值进行校验，以确定接收到的时间信息或第一系统信息块是否完整。例如，完整性保护算法可以是SNOW 3G的128-EIA(EPS integrity algorithm)1算法，或者AES(advanced encryption standard)的128-EEA2算法，或者基于ZUC(Zu Chongzhi，祖冲之)的128-EEA3算法。
进一步地，基站还可以获取该基站所处密钥区的完整性保护参数，例如，完整性保护密钥，或完整性保护算法等。其中，完整性保护密钥可以由安全功能实体生成，也可以由OAM实体生成，并发送给基站，与上述第一种实施场景中基站获得该基站所处密钥区的密钥的方式相似，不再赘述。
可选地，在上述实施例的第三种实施场景下，上述方法还包括：基站采用证书对时间信息或第一系统信息块进行签名。
进一步地，基站还可以获取该基站所处密钥区的用于对时间信息或第一系统信息块进行签名的证书。例如，安全功能实体生成用于对时间信息或第一系统信息块进行签名的证书，并发送给基站，或者OAM实体或移动性管理网元从安全功能实体获取该证书，并发送给基站，与上述第一种实施场景中基站获得该基站所处密钥区的密钥的方式相似，不再赘述。
进一步地，基站也可以从第三方证书权威机构(certificate authority，CA)获取证书。
可选地，在上述实施例的第四种实施场景下，上述方法还包括：终端获取该终端所处密钥区的密钥，可以采用如下实现方式：
方式1、终端根据第一系统信息块，获取该终端所处密钥区的密钥。
方式2、当终端从第一密钥区移动到第二密钥区时，终端获取第二密钥区的密钥。
其中，第二密钥区可以为该终端所处的密钥区。
方式3、终端接收来自该基站的携带有密钥相关信息的第二系统信息块，并根据该密钥相关信息获取该终端所处密钥区的密钥。
其中，上述方式1中终端根据第一系统信息块，获取终端所处密钥区的密钥，具体可以采用如下方式实现：
方式1.1、当第一系统信息块还包括密钥相关信息，且终端存储有该密钥相关信息对应的密钥时，终端获取存储的该密钥相关信息对应的密钥。
其中，密钥相关信息可以用于获取密钥，例如，该密钥相关信息可以包括密钥的标识或密钥区的标识。密钥的标识可以用于唯一标识密钥，密钥区的标识可以用于唯一标识密钥区，多个不同的密钥区可使用相同的密钥，也可以使用不同的密钥。
具体地，终端可以将该终端存储的该密钥相关信息对应的密钥作为该终端所处密钥区的密钥。
示例性地，终端可以预先获取该密钥区的密钥，并存储该密钥区的密钥与密钥相关信息的对应关系，例如，该密钥区的密钥与该密钥区的标识之间的对应关系；终端在接收到第一系统信息块后，可以根据第一系统信息块中的密钥相关信息以及存储的上述对应关系，获取该密钥相关信息对应的密钥。
其中，终端预先获取该密钥区的密钥可以由该终端通过接收相邻密钥区的密钥的方式来获取，例如，当终端处于密钥区A时，终端可以接收并存储密钥区A的相邻密钥区B的密钥，然后，终端移动到密钥区B，可以获取其存储的密钥区B的密钥作为该终端所处密钥区的密钥，以解密加密的时间信息。
方式1.2、当第一系统信息块还包括密钥相关信息，且终端未存储有该密钥相关信息对应的密钥时，终端获取该终端所处密钥区的密钥。
具体地，方式1.2中的终端获取该终端所处密钥区的密钥可以为终端可以从基站、移动性管理网元或安全功能实体获取该密钥相关信息对应的密钥，可以参见如下示例。
在一个示例中，终端向移动性管理网元发送非接入层(non-access stratum，NAS)请求消息，接收来自终端的NAS请求消息，并根据该NAS请求消息，向终端发送NAS响应消息，该NAS响应消息包括该终端所处密钥区的密钥，相应地，终端接收来自移动性管理网元的该NAS响应消息，获取该NAS响应消息中的该终端所处密钥区的密钥。
其中，该NAS请求可以用于请求获取终端所处密钥区的密钥。例如，该NAS请求消息包括附着请求(attach request)，跟踪区更新(tracking area updated，TAU)请求，注册(registration)请求，或其它NAS信令。
其中，移动性管理网元可以从OAM实体或基站获取该密钥，可以参见前述相关描述，不再赘述。
需要说明的是，移动性管理网元可以在预设条件下通过NAS响应消息向终端发送终端所处密钥区的密钥。例如，移动性管理网元接收来自终端的NAS请求消息，并根据NAS请求消息，获取该终端的签约信息。当移动性管理网元根据该签约信息确定该终端被授权使用时间同步业务时，移动性管理网元将该终端所处密钥区的密钥携带在NAS响应消息中。若移动性管理网元根据签约信息确定该终端未被授权使用时间同步业务时，移动性管理网元发送NAS响应消息给终端，该NAS响应消息不携带上述密钥。可选的，该NAS响应消息携带失败原因值，该失败原因值用于指示该终端未被授权使用时间同步业务。
其中，移动性管理网元可以根据NAS请求消息中携带的终端的标识，获取终端的签约信息。若移动性管理网元已获取终端的签约信息，在本地存储了该终端的签约信息，则移动性管理网元可从本地获取该终端的签约信息；或者，也可以从HSS获取终端的签约信息，其中，HSS统一管理终端的签约信息。
在另一个示例中，终端向基站发送第一无线资源控制(radio resource control，RRC)消息，基站接收该第一RRC消息，并根据该第一RRC消息，向终端发送第二RRC消息，终端接收该第二RRC消息。其中，该第二RRC消息包括终端所处密钥区的密钥。
需要指出的是，不同的通信场景中或终端所处的不同状态下，终端与基站交互的RRC 消息名称可以不同。例如，当终端处于空闲态时，该第一RRC消息可以是RRC连接建立请求消息，该第二RRC消息可以是RRC连接重配置消息；当终端处于连接态时，该第一RRC消息可以是RRC请求消息，该第二RRC消息可以是RRC响应消息。下面分别进行描述：
在一个通信场景中，终端向基站发送RRC连接建立请求消息，RRC连接建立请求消息包括非接入层请求消息，该非接入层请求消息用于请求终端的签约信息。基站接收该RRC连接建立请求消息，并向移动性管理网元发送非接入层请求消息。移动性管理网元在接收到该非接入层请求消息后，根据所述非接入层请求消息获取终端的签约信息，并当根据该签约信息确定终端被授权使用时间同步业务时，在NAS响应消息中封装该终端所处密钥区的密钥。然后，移动性管理网元向基站发送该NAS响应消息，基站接收该NAS响应消息，并向终端发送RRC连接重配置消息。其中，该RRC连接重配置消息包括该NAS响应消息。相应地，终端接收该RRC连接重配置消息，获取其中的NAS响应消息，并获得NAS响应消息中的密钥。
在另一个通信场景中，终端向基站发送RRC请求消息，RRC请求消息不包括非接入层请求消息。基站接收该RRC请求消息，并根据该RRC请求消息，发送RRC响应消息给终端，该RRC响应消息包括终端所处密钥区的密钥。终端接收该RRC响应消息，从该RRC响应消息中获得终端所处密钥区的密钥。在该通信场景中，终端可以处于连接态，终端可以通过RRC请求消息向基站请求终端所处密钥区的密钥，基站保存了该密钥区的密钥，基站可以在RRC响应消息中携带密钥。
方式1.3、当终端根据该终端存储的密钥解密该加密的时间信息失败时，终端获取该终端所处密钥区的密钥。
示例性地，终端可以采用存储的密钥解密第一系统信息块中的时间信息，若解密成功，则表明终端所处密钥区的密钥未发生改变；若解密失败，则终端获取改变后的密钥。
其中，密钥发生改变可以包含多种情况，例如，终端所处密钥区的密钥发生了更新，此时，终端可以从该基站或移动性管理网元获取改变后的密钥；再例如，终端所处的密钥区发生了改变，即终端从第一密钥区的源基站移动到第二密钥区的目标基站，此时，终端可以采用方式2中提供的方法来获取该终端所处密钥区的密钥，不予限制。
需要说明的是，方式1.3中的终端获取该终端所处密钥区的密钥可以参见方式1.2中的相关描述，不再赘述。
方式1.4、终端比较第一系统信息块中密钥相关信息与该终端存储的密钥所对应的密钥相关信息，当两者相同时，该终端将该存储的密钥作为该终端所处密钥区的密钥；当两者不同时，终端获取终端所处密钥区的密钥。
需要说明的是，方式1.4中的终端获取该终端所处密钥区的密钥可以参见方式1.2中的相关描述，不再赘述。
方式1.5、第一系统信息块触发终端获取该终端所处密钥区的密钥，即第一系统信息块作为触发消息，触发终端执行获取该终端所处密钥区的密钥的动作。
需要说明的是，方式1.5中的终端获取该终端所处密钥区的密钥可以参见方式1.2中的相关描述，不再赘述。此外，上述方式1.2至1.5中的终端获取终端所处密钥区的密钥还可 以采用上述方式2的相关实现方式来实现，即方式1和方式2的实现方式可以相互结合，不予限制。
其中，上述方式2中当终端从第一密钥区移动到第二密钥区时，终端获取所述第二密钥区的密钥，具体可以采用如下方式实现。为了便于描述方式2中的技术方案，可以将步骤S101中的基站称之为第一基站。
方式2.1、当终端从第一密钥区内的小区(小区A)重选到第二密钥区内的小区(小区B)时，终端获取第二密钥区的密钥。
在一个示例中，终端向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，该非接入层响应消息包括第二密钥区的密钥。
该示例的获取密钥的过程可参考上述方式1.2中终端通过NAS请求消息获取密钥的过程。
在另一个示例中，终端向第二密钥区内的该小区(小区B)对应的第二基站发送第一RRC消息，并接收来自该第二基站的第二RRC消息，第二RRC消息包括第二密钥区的密钥。
需要指出的是，不同的通信场景中或终端所处的不同状态下，终端与基站交互的RRC消息名称可以不同。例如，当终端处于空闲态时，该第一RRC消息可以是RRC连接建立请求消息，该第二RRC消息可以是RRC连接重配置消息；当终端处于连接态时，该第一RRC消息可以是RRC请求消息，该第二RRC消息可以是RRC响应消息。具体可参考上述方式1.2。
需要指出的是，该第二基站可以与第一基站相同；也可以与第一基站不同，但两个基站位于同一个密钥区，不予限制。
方式2.2、当终端从第一密钥区内的源基站切换到第二密钥区内的目标基站时，终端获取第二密钥区的密钥。
示例性地，终端可以处于连接态，终端接收来自源基站的RRC消息，所述RRC消息包括所述第二密钥区的密钥。
需要指出的是，该目标基站可以与第一基站相同；也可以与第一基站不同，但两个基站位于同一个密钥区，不予限制。
在一个通信场景中，终端通过基站之间的X2接口从源基站切换到目标基站。源基站向目标基站发送切换请求消息。目标基站接收该切换请求消息，并向源基站发送切换命令，其中，切换命令包括所述目标基站所处第二密钥区的密钥。源基站接收来自目标基站的切换命令，并发送RRC消息给终端，其中，该RRC消息包括目标基站所处第二密钥区的密钥。相应地，终端接收该RRC消息。
在另一个通信场景中，终端通过S1接口从源基站切换到目标基站。源基站向移动性管理网元发送切换请求消息。移动性管理网元接收该切换请求消息，并向目标基站发送切换请求消息。目标基站接收该切换请求消息，并向所述移动性管理网元发送切换请求响应消息。其中，该切换请求响应消息包括目标基站所处第二密钥区的密钥。相应地，移动性管理网元接收该切换请求响应消息，并向源基站发送切换命令消息。其中，该切换命令消息包括目标基站所处密钥区的密钥。源基站接收该切换命令，并发送RRC消息给终端。其中， 该RRC消息包括目标基站所处第二密钥区的密钥。终端接收该RRC消息，并从该RRC消息中获得目标基站所处第二密钥区的密钥，即该终端所处密钥区的密钥。
方式2.3、当终端从第一密钥区内的无线接入网通知区(radio access network notification area，RNA)移动到第二密钥区内的RNA时，终端获取第二密钥区的密钥。
示例性地，终端可以处于非激活态，该终端从第一密钥区内的RNA移动到第二密钥区内的RNA内的某个基站(可以称之为第三基站)，那么终端可以向第三基站发送RRC连接恢复请求消息，并接收来自第三基站的RRC连接释放消息或RRC连接恢复消息，该RRC连接释放消息或RRC连接恢复消息包括第二密钥区的密钥。
需要指出的是，该第三基站可以与第一基站相同；也可以与第一基站不同，但两个基站位于同一个密钥区，不予限制。
可选地，在上述实施例的第五种实施场景下，上述方法还包括：基站向终端发送该基站所处密钥区的密钥，可以采用以下三种方式。
方式1、该基站接收来自移动性管理网元的授权指示信息，授权指示信息用于指示该终端被授权使用时间同步业务；该基站根据授权指示信息，向该终端发送基站所处密钥区的密钥。
示例性地，终端向移动性管理网元发送NAS请求消息，移动性管理网元接收该NAS请求消息，获取终端的签约信息，并根据该签约信息确定终端是否被授权使用时间同步业务，若是，则移动性管理网元向基站发送授权指示信息。相应地，基站接收授权指示信息，并根据授权指示信息，向终端发送所述密钥。
其中，该NAS请求消息包括attach request，TAU请求，注册请求，或其它NAS信令，不予限制。具体地，该NAS请求消息可以携带在第一RRC消息中，基站在接收到该第一RRC消息后，将该NAS请求消息发送给移动性管理网元，进一步地，基站可以将接收到到的授权指示信息携带在RRC消息中发给终端。
在上述示例中，基站可以预先从移动性管理网元或OAM实体获取到了该密钥，不予限制。
方式2、该基站为第二密钥区内的目标基站，终端从第一密钥区的源基站切换到该目标基站，上述基站向终端发送该基站所处密钥区的密钥可以包括：
目标基站接收来自源基站的切换请求消息，并向源基站发送切换命令，切换命令包括第二密钥区的密钥；或者，
目标基站接收来自移动性管理网元的切换请求消息，并向移动性管理网元发送切换请求响应消息，切换请求响应消息包括第二密钥区的密钥。
示例性地，在一个通信场景中，终端通过基站之间的X2接口从源基站切换到目标基站。源基站向目标基站发送切换请求消息。目标基站接收该切换请求消息，并向源基站发送切换命令，其中，切换命令包括所述目标基站所处第二密钥区的密钥。源基站接收来自目标基站的切换命令，并发送RRC消息给终端，其中，该RRC消息包括目标基站所处第二密钥区的密钥。终端接收该RRC消息，并从该RRC消息中获得目标基站所处第二密钥区的密钥，即终端所处密钥区的密钥。
在另一个通信场景中，终端通过S1接口从源基站切换到目标基站。源基站向移动性管 理网元发送切换请求消息。移动性管理网元接收该切换请求消息，并向目标基站发送所述切换请求消息。目标基站接收该切换请求消息，并向移动性管理网元发送切换请求响应消息。其中，该切换请求响应消息包括目标基站所处第二密钥区的密钥。移动性管理网元接收该切换请求响应消息，并向源基站发送切换命令消息，其中，该切换命令消息包括目标基站所处密钥区的密钥。源基站接收该切换命令，并发送RRC消息给终端，其中，该RRC消息包括目标基站所处第二密钥区的密钥。相应地，终端接收该RRC消息，并从该RRC消息中获得目标基站所处第二密钥区的密钥，即终端所处密钥区的密钥。
方式3、终端从第一密钥区内的RNA移动到第二密钥区内的RNA内的上述基站，上述基站向终端发送上述基站所处密钥区的密钥可以包括：
上述基站接收来自终端的RRC连接恢复请求消息；
上述基站根据RRC连接恢复请求消息，向终端发送RRC连接释放消息或RRC连接恢复消息，该RRC连接释放消息或RRC连接恢复消息包括第二密钥区的密钥。
需要指出的是，上述第五种实施场景提供的方法可以独立于步骤S101-104，即可以是一个独立的方法，该方法用于实现基站向终端发送密钥区的密钥。
可选地，在上述实施例的第六种实施场景下，上述方法还包括：基站发送第三系统信息块。相应地，终端接收来自基站的第三系统信息块。
其中，第三系统信息块可以包括指示信息，该指示信息可以用于指示用于携带加密的时间信息的第一系统信息块。
进一步地，终端可以从指示信息所指示的第一系统信息块中，获取加密的时间信息。
例如，该第三系统信息块可以是SIB1，则第一系统信息块可以是除SIB1外的其它SIB。当然不限于此。通常情况下，基站广播SIB1和其它SIB(可称为SIBx)。基站在SIB1中携带指示信息，该指示信息可以指示用于携带加密的时间信息的SIBx。则终端侦听SIB1并接收SIB1中的指示信息，根据该指示信息，可以确定携带加密的时间信息的第一系统信息块。
需要说明的是，第三系统信息块与第二系统信息块可以相同，也可以不同，不予限制。
可选地，在上述实施例的第七种实施场景下，上述方法还包括：
基站接收来自移动性管理网元、相邻基站、或操作管理维护实体的所述基站所处密钥区的相邻密钥区的密钥；基站发送所述相邻密钥区的密钥。
相应地，上述方法还可以包括：终端接收该终端所处密钥区的相邻密钥区的密钥。
在一个示例中，基站可以采用广播的方式发送该相邻密钥区的密钥。进一步地，基站在接收到相邻密钥区的密钥后，可以使用基站所处密钥区的密钥加密该相邻密钥区的密钥后发送给终端，终端再使用基站所处密钥区的密钥解密获得解密后的相邻密钥区的密钥。基站还可以采用证书对发送相邻密钥区的密钥的消息进行签名，也可以采用完整性保护密钥对发送相邻密钥区的密钥的消息进行完整性保护。
在另一个示例中，基站也可以采用单播的方式发送该相邻密钥区的密钥。进一步地，基站在接收到相邻密钥区的密钥后，可以使用基站与终端之间协商的AS层安全密钥，对该相邻密钥区的密钥进行安全保护后发送给终端。终端接收到该相邻密钥区的密钥后，使用相应的AS层安全密钥解密该相邻密钥区的密钥。
上述基站采用单播的方式发送相邻密钥区的密钥，可以应用在基站切换过程中，例如，可以由源基站发送目标基站所处密钥区的相邻密钥区的密钥给终端。具体地，源基站接收来目标基站所处密钥区的相邻密钥区的密钥，并向终端发送目标基站所处密钥区的相邻密钥区的密钥，终端接收该目标基站所处密钥区的相邻密钥区的密钥。
需要指出的是，上述实施例的各实施例场景之间可以相互结合，例如，可以两两相结合，也可以两个以上相结合，不予限制。
下面结合具体的通信场景，对上述通信方法进行具体的描述。
一个示例的通信场景为终端初始接入网络，终端通过NAS信令从移动性管理网元获取密钥。其中，网络可以是运营商网络，可以包括接入网和核心网，其中，核心网可以包括5G系统中的AMF，SMF等，不予限制。
图6为本申请实施例提供的一个示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S201、终端向移动性管理网元发送NAS请求消息。
相应地，移动性管理网元接收该NAS请求消息。
其中，该NAS请求消息用于请求获取终端所处密钥区的密钥。该NAS请求消息可以包括attach request，TAU请求，注册请求，或其它NAS信令。
S202、移动性管理网元根据NAS请求消息，获取终端的签约信息。
示例性地，如果移动性管理网元上已经保存有终端的上下文信息，且上下文信息中包括终端的签约信息，移动性管理网元可以从本地获取终端的签约信息；如果移动性管理网元上没有终端的上下文信息，或终端的上下文信息中不包括终端的签约信息，移动性管理网元可以根据NAS请求消息携带的终端的标识，向HSS或UDM获取终端的签约信息。
S203、移动性管理网元根据终端的签约信息确定终端是否被授权使用时间同步业务。
示例性地，终端的签约信息中包括该终端是否已签约时间同步业务。当移动性管理网元根据签约信息确定终端已经签约时间同步业务，则表明终端被授权使用时间同步业务，移动性管理网元可以将终端所处密钥区的密钥携带在NAS响应消息中。当移动性管理网元根据签约信息确定终端未签约时间同步业务，则表明终端未被授权使用时间同步业务，移动性管理网元发送NAS响应消息给终端，可选的，NAS响应消息可携带失败原因值，该失败原因值可以用于指示终端未被授权使用时间同步业务。
其中，S202和S203为可选的步骤。
S204、移动性管理网元向终端发送NAS响应消息，该NAS响应消息包括终端所处密钥区的密钥。
相应地，终端接收该NAS响应消息，终端可以从NAS响应消息获取并存储该密钥。
S205、基站发送第二系统信息块给所述终端。
相应地，终端接收第二系统信息块。
其中，该步骤S205为可选的步骤。
在一个实现方式中，第二系统信息块包括：密钥相关信息。终端可以接收来自该基站的携带有密钥相关信息的第二系统信息块，并根据该密钥相关信息获取终端所处密钥区的密钥，具体可以参见图5所实施例中的相关描述，不再赘述。
在另一个实现方式中，第二系统信息块包括指示信息，该指示信息指示用于携带加密的时间信息的第一系统信息块。终端可以根据该指示信息，从指示信息所指示的第一系统信息块中获取加密的时间信息，具体可以参见图5所实施例中的相关描述，不再赘述。
S206、基站根据时间信息和基站所处密钥区的密钥，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S207、基站发送第一系统信息块，该第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S208、终端根据获取的密钥解密该加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的方法，基站在系统信息块中携带加密的时间信息，终端通过NAS信令从移动性管理网元获取密钥，并根据该密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
另一个示例的通信场景为，终端初始接入网络，通过AS信令获取密钥。进一步地，AS信令中包括NAS消息，移动性管理网元通过授权指示信息来指示基站发送密钥给终端。图7a为本申请实施例提供的另一个示例的通信方法的交互流程示意图，图7a为AS信令包括NAS消息的情况。该方法可包括以下步骤：
S301a、基站接收终端发送AS请求消息，并发送该AS请求消息中的NAS请求消息给移动性管理网元。
相应地，移动性管理网元接收该NAS请求消息。
其中，该AS请求消息可以是RRC连接建立请求消息，该NAS请求消息可以是attach request，TAU请求或注册请求等。
S302a、移动性管理网元根据NAS请求消息，获取该终端的签约信息。
该步骤的实现可参考图6所示实施例的步骤S202。
S303a、移动性管理网元根据该签约信息确定该终端是否被授权使用时间同步业务。
该步骤的实现可参考图6所示实施例的步骤S203。
S304a、移动性管理网元向基站发送初始上下文建立请求消息。
其中，该初始上下文建立请求消息包括授权指示信息。该授权指示信息可以用于指示该终端被授权使用时间同步业务。
S305a、基站向终端发送RRC连接重配置消息。其中，该RRC连接重配置消息包括终端所处密钥区的密钥。
示例性地，基站根据该授权指示信息确定将密钥发给该终端，基站将终端所处密钥区的密钥携带在RRC连接重配置消息中发送给终端。
相应地，终端接收该RRC连接重配置消息，获取并存储该密钥。
S306a、基站发送第二系统信息块给终端。
相应地，终端接收该第二系统信息块。
本步骤的实现可参考图6所示实施例中的S205。
S307a、基站根据时间信息和基站所处密钥区的密钥，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S308a、基站发送第一系统信息块，该第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S309a、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端通过AS信令获取密钥，该AS信令中包括NAS请求消息，移动性管理网元授权指示基站发送密钥给终端，终端接收该密钥并根据该密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
又一个示例的通信场景为，终端处于连接态，通过AS信令从基站(当前服务终端的基站，即与终端建立有RRC信令连接的基站)获取密钥。AS信令中不包括NAS消息，则终端通过AS信令直接从基站获取密钥。图7b为本申请实施例提供的另一个示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S301b、终端发送RRC请求消息给基站。
其中，该RRC请求消息用于请求获取用于终端所处密钥区的密钥。
S302b、基站根据终端的上下文信息确定该终端被授权使用时间同步业务。
例如，如果终端的上下文信息中包括移动性管理网元的授权指示信息，则确定该终端被授权使用时间同步业务，基站可以将终端所处密钥区的密钥发给该终端。
S303b、基站发送RRC响应消息给终端，该RRC响应消息包括终端所处密钥区的密钥。
S304b、基站发送第二系统信息块给终端。
相应地，终端接收该第二系统信息块。
本步骤S304b的实现可参考图6所示实施例中的S205。
S305b、基站根据时间信息和基站所处密钥区的密钥，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S306b、基站发送第一系统信息块，该第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S307b、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端通过AS信令获取密钥，并根据该密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
又一个示例的通信场景为，终端在空闲态进行小区重选后，变更基站，此时终端所处密钥区发生变化，即终端没有当前所处密钥区的密钥。图8为本申请实施例提供的又一个 示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S401、终端在空闲态下进行小区重选后，选择驻留在基站2下的小区。
此时，终端所处的密钥区为基站2所处的密钥区。
S402、终端判断是否预先获取了基站2所处密钥区的密钥。
其中，该步骤为可选的步骤。
示例性地，终端在进行小区重选前，若基站1接收到来自移动性管理网元、相邻基站、或操作管理维护实体的基站1所处密钥区的相邻密钥区的密钥，基站1发送该相邻密钥区的密钥。终端接收到该相邻密钥区的密钥。该相邻密钥区的密钥包括基站2所处密钥区的密钥。该密钥区可采用密钥区的标识进行标识。终端在进行小区重选后，确定终端所处的密钥区为基站2所处的密钥区，则终端根据所处密钥区的标识，查找存储的相邻密钥区的密钥。若查找到了基站2所处密钥区的密钥，则无需再去获取密钥，可进行到S404。若终端未查找到存储的基站2所处密钥区的密钥，则进行到S403或S403’。
S403、通过NAS信令从移动性管理网元获取密钥的方式获取基站2所处密钥区的密钥。
其中，该步骤的实现可参考图6所示实施例的步骤S201～S204。
S403’、通过AS信令从基站2或移动性管理网元获取密钥的方式获取基站2所处密钥区的密钥。
其中，该步骤的实现可参考图7所示实施例的步骤S301～S305。
S404、基站根据基站所处密钥区的密钥和时间信息，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S405、基站发送第一系统信息块，第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤S405的实现可参考图5所示实施例中的S102。
S406、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端进行小区重选后，通过AS信令从重选后的小区所处基站获取密钥，或通过NAS信令从移动性管理网元获取密钥，并根据该密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
又一个示例的通信场景为，终端处于连接态，终端通过源基站与目标基站之间的X2接口，由源基站切换到目标基站。终端所处密钥区为目标基站所处密钥区。则如图9所示的本申请实施例提供的又一个具体示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S501、源基站向目标基站发送切换请求消息。
相应地，目标基站接收该切换请求消息。
S502、目标基站发送切换命令至源基站，该切换命令包括目标基站所处密钥区的密钥。
相应地，源基站接收该切换命令。
S503、源基站向终端发送RRC消息，该RRC消息包括目标基站所处密钥区的密钥。
相应地，终端接收该RRC消息。
其中，该RRC消息可以是RRC连接重配置消息，不予限制。
S504、基站根据基站所处密钥区的密钥和时间信息，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S505、基站发送第一系统信息块，第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S506、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端对应的基站发生切换，终端获取目标基站所处密钥区的密钥，根据目标基站所处密钥区的密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
又一个示例的通信场景为，终端处于连接态，终端通过S1接口由源基站切换到目标基站。终端所处密钥区为目标基站所处密钥区。则如图10所示的本申请实施例提供的又一个具体示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S601、源基站发送切换请求消息至移动性管理网元。
相应地，移动性管理网元接收该切换请求消息。
S602、移动性管理网元发送切换请求消息至目标基站。
相应地，目标基站接收该切换请求消息。
S603、目标基站发送切换响应消息至移动性管理网元。
相应地，移动性管理网元接收该切换响应消息。
其中，该切换响应消息包括目标基站所处密钥区的密钥。
S604、移动性管理网元发送切换命令至源基站。
相应地，源基站接收该切换命令。
其中，该切换命令包括目标基站所处密钥区的密钥。
S605、源基站向终端发送RRC消息，该RRC消息包括目标基站所处密钥区的密钥。
相应地，终端接收该RRC消息。
其中，该RRC消息可以是RRC连接重配置消息，不予限制。
S606、基站根据基站所处密钥区的密钥和时间信息，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S607、基站发送第一系统信息块，第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S608、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端对应的基站发生切换，终端获取目标基站所处密钥区的密钥，根据目标基站所处密钥 区的密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
又一个示例的通信场景为，终端处于非激活态，即终端与基站1建立RRC连接后并进入RRC非激活态(RRC inactive state)，即基站1是终端的锚点基站(anchor-RAN)；同时，基站1会为终端分配一个RNA，例如RNA1。当终端移动进入基站2，且基站2不在RNA1范围之内，移出RNA1，则终端向基站2请求恢复RRC连接，基站2为终端恢复RRC连接，同时基站2为终端分配一个新的RNA，例如RNA2。相应地，如果RNA2对应的密钥区和RNA1对应的密钥区不同，则终端所处密钥区由第一密钥区变更为第二密钥区。图11为本申请实施例提供的又一个具体示例的通信方法的交互流程示意图，该方法可包括以下步骤：
S701、终端发送RRC连接恢复请求至基站2。
相应地，基站2接收该RRC连接恢复请求。
该RRC连接恢复请求可携带终端的标识。
S702、基站2从基站1获取终端的上下文。
示例性地，基站1保存了终端的上下文。基站2发送上下文获取请求消息至基站1，该上下文获取请求消息包括终端的标识。基站1根据终端的标识获取该终端的上下文，并发送至基站2。
S703、基站2与移动性管理网元进行路径切换流程。
该路径切换流程可参考现有技术，在此不再赘述。
S704、基站2发送RRC连接释放消息至终端。
例如，基站2判断该终端发送RRC连接恢复请求是由于终端移出了RNA触发的，即RRC连接恢复请求中携带的原因值为RAN通知区更新(RAN notification area update)，且基站判断没有需要发给终端的下行数据，则基站2发送RRC连接释放消息至终端。终端接收该RRC连接释放消息。
其中，该RRC连接释放消息可以包括第二密钥区的密钥。
作为S704的一种替换方式，基站2可以发送RRC连接恢复消息至终端。
例如，基站2判断所述终端发送RRC连接恢复请求是由于终端移出了RNA触发的，即RRC连接恢复请求中携带的原因值为RAN通知区更新，且基站判断有需要发给终端的下行数据，则基站2发送RRC恢复消息至终端。终端接收该RRC连接恢复消息。
其中，该RRC连接恢复消息可以包括第二密钥区的密钥。
进一步地，当基站2发现没有了需要传输给终端的数据(例如，基站2设定一个定时器1，如果在定时器1到期之前，一直没有终端的数据需要传输)时，基站发送RRC连接释放消息至终端。终端接收该RRC连接释放消息。
其中，该RRC连接释放消息可以包括第二密钥区的密钥。
S705、基站根据基站所处密钥区的密钥和时间信息，获得加密的时间信息。
本步骤的实现可参考图5所示实施例中的S101。
S706、基站发送第一系统信息块，第一系统信息块包括加密的时间信息。
相应地，终端接收该第一系统信息块。
本步骤的实现可参考图5所示实施例中的S102。
S707、终端根据密钥解密加密的时间信息。
本步骤的实现可参考图5所示实施例中的S104。
根据本申请实施例提供的一种通信方法，基站在系统信息块中携带加密的时间信息，终端所处RAN发生变更，终端通过RRC连接恢复流程获取变更后的密钥区的密钥，根据获取的密钥解密该加密的时间信息，从而实现了时间信息的安全传输。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例还提供了一种通信系统，包括上述实施例中的终端、基站(图5所示实施例中的第一基站、或图6～图7b中任一实施例中的基站、或图9～图10中任一实施例中的源基站或目标基站、或图8、图11中任一实施例中的基站1或基站2)和上述实施例中的移动性管理网元。采用该通信系统，基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
图12为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1200可以是上述的终端。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
通信单元121，用于接收来自第一基站的第一系统信息块，所述第一系统信息块包括加密的时间信息，所述时间信息用于所述通信装置所处密钥区内的通信装置进行同步；
处理单元122，用于根据所述通信装置所处密钥区的密钥，解密所述加密的时间信息。
在一种可能的实现方式中，所述处理单元122还用于获取所述终端所处密钥区的密钥。
在另一种可能的实现方式中，所述处理单元122用于：
根据所述第一系统信息块，获取所述通信装置所处密钥区的密钥；或者，
当所述通信装置从第一密钥区移动到第二密钥区时，获取所述第二密钥区的密钥；或者，
接收来自所述第一基站的携带有密钥相关信息的第二系统信息块，并根据所述密钥相关信息获取所述通信装置所处密钥区的密钥。
在又一种可能的实现方式中，所述处理单元122用于：
当所述第一系统信息块还包括密钥相关信息，且所述通信装置存储有所述密钥相关信息对应的密钥时，获取所述存储的所述密钥相关信息对应的密钥；或者，
当所述第一系统信息块还包括密钥相关信息，且所述通信装置未存储有所述密钥相关信息对应的密钥时，获取所述终端所处密钥区的密钥；或者，
当所述通信装置根据所述通信装置存储的密钥解密所述加密的时间信息失败时，获取 所述终端所处密钥区的密钥。
在又一种可能的实现方式中，所述通信单元121用于：
当所述通信装置从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，获取所述第二密钥区的密钥；或者，
当所述通信装置从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，获取所述第二密钥区的密钥；或者，
当所述通信装置从所述第一密钥区内的无线接入网通知区RNA移动到所述第二密钥区内的RNA时，获取所述第二密钥区的密钥。
在又一种可能的实现方式中，所述通信单元121用于：
向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，所述非接入层响应消息包括所述第二密钥区的密钥；或，
向所述第二密钥区内的所述小区对应的第二基站发送第一RRC消息，并接收来自所述第二基站的第二RRC消息，所述第二RRC消息包括所述第二密钥区的密钥。
在又一种可能的实现方式中，所述通信装置处于连接态，且当所述通信装置从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述通信单元121用于：
接收来自所述源基站的RRC消息，所述RRC消息包括所述第二密钥区的密钥。
在又一种可能的实现方式中，所述通信装置处于非激活态，且当所述通信装置从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA时，所述通信单元121用于：
当所述通信装置从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA内的第三基站，向所述第三基站发送RRC连接恢复请求消息；
接收来自所述第三基站的RRC连接释放消息，所述RRC连接释放消息包括所述第二密钥区的密钥。
在又一种可能的实现方式中，所述第一系统信息块为采用证书签名后的系统信息块；
所述通信单元121还用于接收来自移动性管理网元或所述第一基站的所述证书；
所述处理单元122还用于采用所述证书验证所述第一系统信息块的签名。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的终端，基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
图13为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1300可以是上述的第一基站。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
处理单元131，用于根据时间信息和所述通信装置所处密钥区的密钥，获得加密的时间信息，所述时间信息用于所述密钥区内的终端进行同步；
通信单元132，用于发送第一系统信息块，所述第一系统信息块包括所述加密的时间信息。
在一种可能的实现方式中，所述通信单元132还用于向终端发送所述密钥。
在另一种可能的实现方式中，所述通信单元132用于接收来自移动性管理网元的授权指示信息，所述授权指示信息用于指示所述终端被授权使用时间同步业务；以及还用于根 据所述授权指示信息，向所述终端发送所述密钥。
在又一种可能的实现方式中，所述通信装置为第二密钥区内的目标基站，所述终端从第一密钥区的源基站切换到所述目标基站；
所述通信单元132用于接收来自所述源基站的切换请求消息，并向所述源基站发送切换命令，所述切换命令包括所述密钥，所述密钥为所述第二密钥区的密钥；或者，
所述通信单元132用于接收来自移动性管理网元的切换请求消息，并向所述移动性管理网元发送切换请求响应消息，所述切换请求响应消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
在又一种可能的实现方式中，所述终端从第一密钥区内的无线接入网通知区RNA移动到第二密钥区内的RNA内的所述通信装置；
所述通信单元132用于接收来自所述终端的RRC连接恢复请求消息；
以及所述通信单元132还用于根据所述RRC连接恢复请求消息，向所述终端发送RRC连接释放消息，所述RRC连接释放消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
在又一种可能的实现方式中，所述通信单元132还用于接收来自操作管理维护实体或移动性管理网元的证书；以及所述处理单元131还用于采用所述证书对所述第一系统信息块进行签名。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的第一基站，第一基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
图14为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1400可以是上述的移动性管理网元。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
通信单元141，用于接收来自终端的非接入层请求消息；
所述通信单元141还用于向所述终端发送非接入层响应消息，所述非接入层响应消息包括所述终端所处密钥区的密钥。
在一种可能的实现方式中，所述通信装置还包括：处理单元142；
所述处理单元142用于根据所述非接入层请求消息，获取所述终端的签约信息；
以及用于根据所述签约信息确定所述终端被授权使用时间同步业务时，所述移动性管理网元将所述终端所处密钥区的密钥封装在所述非接入层响应消息中。
在该实现方式中，移动性管理网元根据终端的签约信息发送密钥给终端，被授权使用时间同步业务的终端可以获取密钥，从而解密接收到的时间信息，从而可以有效地管理使用时间同步业务的终端。
在另一种可能的实现方式中，所述通信单元141还用于接收来自第一基站、或操作管理维护实体的所述密钥。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的移动性管理网元，该移动性管理网元发送终端所处密钥区的密钥给终端，终端根据获取的密钥，解密接收到的加密的时间信息，实现了时间信息的安全传输。
图15为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1500可以是上述的移动性管理网元。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
通信单元151，用于接收来自终端的非接入层请求消息；
处理单元152，用于根据所述非接入层请求消息，获取所述终端的签约信息；
当所述移动性管理网元根据所述签约信息确定所述终端被授权使用时间同步业务时，所述通信单元151还用于向第一基站发送授权指示信息，所述授权指示信息用于指示所述终端被授权使用所述时间同步业务。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的移动性管理网元，该移动性管理网元根据终端的签约信息发送密钥给终端，被授权使用时间同步业务的终端可以获取密钥，从而解密接收到的时间信息，从而可以有效地管理使用时间同步业务的终端。
图16为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1600可以是上述的移动性管理网元。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
通信单元161，用于接收来自源基站的切换请求消息；
所述通信单元161还用于向目标基站发送所述切换请求消息；
所述通信单元161还用于接收来自所述目标基站的切换请求响应消息，所述切换请求响应消息包括所述目标基站所处密钥区的密钥；
所述通信单元161还用于向所述源基站发送切换命令消息，所述切换命令消息包括所述目标基站所处密钥区的密钥。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的移动性管理网元，跟随基站切换，密钥区发生变化，终端重新获取所处密钥区的密钥，终端根据该密钥，解密接收到的时间信息，从而实现时间信息的安全传输。
图17为本发明实施例提供的一种通信装置的模块结构示意图，该通信装置1700可以是上述的源基站。该通信装置可以用于执行上述的通信方法。该通信装置可以包括：
处理单元171，用于获取目标基站所处密钥区的密钥；
通信单元172，用于向终端发送所述目标基站所处密钥区的密钥。
在一种可能的实现方式中，所述通信单元172用于向所述目标基站发送切换请求消息；以及所述通信单元172还用于接收来自所述目标基站的切换命令，所述切换命令包括所述目标基站所处密钥区的密钥。
在另一种可能的实现方式中，所述通信单元172用于向移动性管理网元发送切换请求消息；以及所述通信单元172还用于接收来自所述移动性管理网元的切换命令，所述切换命令包括所述目标基站所处密钥区的密钥。
在又一种可能的实现方式中，所述通信单元172还用于接收来所述目标基站所处密钥区的相邻密钥区的密钥；以及所述通信单元172还用于向所述终端发送所述目标基站所处 密钥区的相邻密钥区的密钥。
在该实现方式中，基站预先发送相邻密钥区的密钥给终端，使得终端在发生上述小区重选、基站切换或RNA变更时，可以直接获取终端存储的密钥，解密时间信息。
根据本发明实施例提供的一种通信装置，该通信装置可以是上述的源基站，跟随基站切换，密钥区发生变化，终端重新获取所处密钥区的密钥。
图18为本发明实施例提供的一种通信装置的简化结构示意图，该通信装置可以是上述的终端。该通信装置可用于执行上述的通信方法。便于理解和图示方便，图18中，终端设备以手机作为例子。如图18所示，终端设备包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对终端设备进行控制，执行软件程序，处理软件程序的数据等。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当需要发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。为便于说明，图18中仅示出了一个存储器和处理器。在实际的终端设备产品中，可以存在一个或多个处理器和一个或多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
在本申请实施例中，可以将具有收发功能的天线和射频电路视为终端设备的接收单元和发送单元(也可以统称为收发单元)，将具有处理功能的处理器视为终端设备的处理单元。如图18所示，终端设备包括接收单元181、处理单元182和发送单元183。接收单元181也可以称为接收器、接收机、接收电路等，发送单元183也可以称为发送器、发射器、发射机、发射电路等。处理单元182也可以称为处理器，处理单板，处理模块、处理装置等。接收单元181和发送单元183也可统称为通信单元。
例如，在一个实施例中，接收单元181，用于执行图5所示实施例的步骤S302，接收第一基站发送的第一系统信息块，该第一系统信息块中包括加密的时间信息；处理单元182，用于执行图5所示实施例的步骤S103，根据终端所处密钥区的密钥，解密该加密的时间信息。
具体可参考方法实施例的描述。
根据本发明实施例提供的一种通信装置，基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
图19为本发明实施例提供的一种通信装置的简化结构示意图，该通信装置可以是上述 的第一基站。该通信装置包括射频信号收发及转换部分以及192部分，该射频信号收发及转换部分又包括接收单元191部分和发送单元193部分(也可以统称为通信单元)。射频信号收发及转换部分主要用于射频信号的收发以及射频信号与基带信号的转换；192部分主要用于基带处理，对第一基站进行控制等。接收单元191也可以称为接收器、接收机、接收电路等，发送单元193也可以称为发送器、发射器、发射机、发射电路等。192部分通常是第一基站的控制中心，通常可以称为处理单元，用于控制第一基站执行上述图5中关于第一基站所执行的步骤。具体可参见上述相关部分的描述。
192部分可以包括一个或多个单板，每个单板可以包括一个或多个处理器和一个或多个存储器，处理器用于读取和执行存储器中的程序以实现基带处理功能以及对第一基站的控制。若存在多个单板，各个单板之间可以互联以增加处理能力。作为一中可选的实施方式，也可以是多个单板共用一个或多个处理器，或者是多个单板共用一个或多个存储器，或者是多个单板同时共用一个或多个处理器。
例如，在一个实施例中，192部分用于执行图5所示实施例中的步骤S101；以及发送单元193用于执行图5所示实施例中的步骤S102。
根据本发明实施例提供的一种通信装置，第一基站在系统信息块中携带加密的时间信息，终端根据终端所处密钥区的密钥，解密该加密的时间信息，实现了时间信息的安全传输。
图20为本发明实施例提供的一种通信装置的硬件架构示意图，该通信装置2000可以是上述的移动性管理网元。该通信装置可用于执行上述的通信方法。该通信装置可以包括：接收器201、发送器202、处理器203和存储器204，所述接收器201、发送器202、处理器203和存储器204通过通信线路相互连接。
存储器包括但不限于是随机存储记忆体(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程只读存储器(erasable programmable read only memory，EPROM)、或便携式只读存储器(compact disc read-only memory，CD-ROM)，该存储器用于相关指令及数据。
接收器用于接收数据和/或信号，以及发送器用于发送数据和/或信号。发送器和接收器可以是独立的器件，也可以是一个整体的器件。
处理器可以包括是一个或多个处理器，例如包括一个或多个中央处理器(central processing unit，CPU)，在处理器是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
具体地，在一个实施例中，图14中的处理单元142所实现的相关功能可以由一个或多个处理器来实现，通信单元141所实现的相关功能可以由接收器和发送器来实现。接收器201用于接收来自终端的非接入层请求消息，以及还用于向所述终端发送非接入层响应消息；处理器203用于根据所述非接入层请求消息，获取所述终端的签约信息；以及用于根据所述签约信息确定所述终端被授权使用时间同步业务时，所述移动性管理网元将所述终端所处密钥区的密钥封装在所述非接入层响应消息中。
在另一个实施例中，图15中的通信单元151所实现的相关功能可以由接收器和发送器 来实现，图15中的处理单元152所实现的相关功能可以由一个或多个处理器来实现。接收器201用于接收来自终端的非接入层请求消息。处理器203用于根据所述非接入层请求消息，获取所述终端的签约信息。发送器202用于当所述移动性管理网元根据所述签约信息确定所述终端被授权使用时间同步业务时，向第一基站发送授权指示信息。
在又一个实施例中，图16中的通信单元161所实现的相关功能可以由接收器和发送器来实现。接收器201用于接收来自源基站的切换请求消息；发送器202用于向目标基站发送所述切换请求消息；接收器201还用于接收来自所述目标基站的切换请求响应消息，所述切换请求响应消息包括所述目标基站所处密钥区的密钥；发送器202还用于向所述源基站发送切换命令消息，所述切换命令消息包括所述目标基站所处密钥区的密钥。
具体实现请参阅上述方法实施例的描述。
根据本发明实施例提供的一种通信装置，移动性管理网元根据终端的签约信息发送授权指示给基站，基站根据该授权指示发送终端所处密钥区的密钥给终端，终端根据该密钥解密时间信息，从而实现时间信息的安全传输。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber  line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，数字通用光盘(digital versatile disc，DVD))、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：只读存储器(read-only memory，ROM)或随机存储存储器(random access memory，RAM)、磁碟或者光盘等各种可存储程序代码的介质。

Claims (30)

  1. 一种通信方法，其特征在于，包括：
    终端接收来自第一基站的第一系统信息块，所述第一系统信息块包括加密的时间信息，所述时间信息用于所述终端所处密钥区内的终端进行同步；
    所述终端根据所述终端所处密钥区的密钥，解密所述加密的时间信息。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    所述终端获取所述终端所处密钥区的密钥。
  3. 如权利要求2所述的方法，其特征在于，所述终端获取所述终端所处密钥区的密钥，包括：
    所述终端根据所述第一系统信息块，获取所述终端所处密钥区的密钥；或者，
    当所述终端从第一密钥区移动到第二密钥区时，所述终端获取所述第二密钥区的密钥；或者，
    所述终端接收来自所述第一基站的携带有密钥相关信息的第二系统信息块，并根据所述密钥相关信息获取所述终端所处密钥区的密钥。
  4. 如权利要求3所述的方法，其特征在于，所述终端根据所述第一系统信息块，获取所述终端所处密钥区的密钥，包括：
    当所述第一系统信息块还包括密钥相关信息，且所述终端存储有所述密钥相关信息对应的密钥时，所述终端获取所述存储的所述密钥相关信息对应的密钥；或者，
    当所述第一系统信息块还包括密钥相关信息，且所述终端未存储有所述密钥相关信息对应的密钥时，所述终端获取所述终端所处密钥区的密钥；或者，
    当所述终端根据所述终端存储的密钥解密所述加密的时间信息失败时，所述终端获取所述终端所处密钥区的密钥。
  5. 如权利要求3所述的方法，其特征在于，当所述终端从第一密钥区移动到第二密钥区时，所述终端获取所述第二密钥区的密钥，包括：
    当所述终端从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，所述终端获取所述第二密钥区的密钥；或者，
    当所述终端从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述终端获取所述第二密钥区的密钥；或者，
    当所述终端从所述第一密钥区内的无线接入网通知区RNA移动到所述第二密钥区内的RNA时，所述终端获取所述第二密钥区的密钥。
  6. 如权利要求5所述的方法，其特征在于，所述当所述终端从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，所述终端获取所述第二密钥区的密钥，包括：
    所述终端向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，所述非接入层响应消息包括所述第二密钥区的密钥；或，
    所述终端向所述第二密钥区内的所述小区对应的第二基站发送第一RRC消息，并接收来自所述第二基站的第二RRC消息，所述第二RRC消息包括所述第二密钥区的密钥。
  7. 如权利要求5所述的方法，其特征在于，所述终端处于连接态，且当所述终端从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述终端获取所述第二密钥区的密钥，包括：
    所述终端接收来自所述源基站的RRC消息，所述RRC消息包括所述第二密钥区的密钥。
  8. 如权利要求5所述的方法，其特征在于，所述终端处于非激活态，且当所述终端从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA时，所述终端获取所述第二密钥区的密钥，包括：
    当所述终端从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA内的第三基站，所述终端向所述第三基站发送RRC连接恢复请求消息；
    所述终端接收来自所述第三基站的RRC连接释放消息，所述RRC连接释放消息包括所述第二密钥区的密钥。
  9. 如权利要求1～8任一项所述的方法，其特征在于，所述第一系统信息块为采用证书签名后的系统信息块，所述方法还包括：
    所述终端接收来自移动性管理网元或所述第一基站的所述证书；
    所述终端采用所述证书验证所述第一系统信息块的签名。
  10. 一种通信方法，其特征在于，包括：
    第一基站根据时间信息和所述第一基站所处密钥区的密钥，获得加密的时间信息，所述时间信息用于所述密钥区内的终端进行同步；
    所述第一基站发送第一系统信息块，所述第一系统信息块包括所述加密的时间信息。
  11. 如权利要求10所述的方法，其特征在于，所述方法还包括：
    所述第一基站向终端发送所述密钥。
  12. 如权利要求11所述的方法，其特征在于，所述第一基站向终端发送所述密钥包括：
    所述第一基站接收来自移动性管理网元的授权指示信息，所述授权指示信息用于指示所述终端被授权使用时间同步业务；
    所述第一基站根据所述授权指示信息，向所述终端发送所述密钥。
  13. 如权利要求11所述的方法，其特征在于，所述第一基站为第二密钥区内的目标基站，所述终端从第一密钥区的源基站切换到所述目标基站，所述第一基站向终端发送所述密钥包括：
    所述第一基站接收来自所述源基站的切换请求消息，并向所述源基站发送切换命令，所述切换命令包括所述密钥，所述密钥为所述第二密钥区的密钥；或者，
    所述第一基站接收来自移动性管理网元的切换请求消息，并向所述移动性管理网元发送切换请求响应消息，所述切换请求响应消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
  14. 如权利要求11所述的方法，其特征在于，所述终端从第一密钥区内的无线接入网通知区RNA移动到第二密钥区内的RNA内的所述第一基站，所述第一基站向终端发送所述密钥包括：
    所述第一基站接收来自所述终端的RRC连接恢复请求消息；
    所述第一基站根据所述RRC连接恢复请求消息，向所述终端发送RRC连接释放消息，所述RRC连接释放消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
  15. 如权利要求10～14任一项所述的方法，其特征在于，所述方法还包括：
    所述第一基站接收来自操作管理维护实体或移动性管理网元的证书；
    所述第一基站采用所述证书对所述第一系统信息块进行签名。
  16. 一种通信装置，其特征在于，包括：
    通信单元，用于接收来自第一基站的第一系统信息块，所述第一系统信息块包括加密的时间信息，所述时间信息用于所述通信装置所处密钥区内的通信装置进行同步；
    处理单元，用于根据所述通信装置所处密钥区的密钥，解密所述加密的时间信息。
  17. 如权利要求16所述的通信装置，其特征在于，所述处理单元还用于获取所述终端所处密钥区的密钥。
  18. 如权利要求17所述的通信装置，其特征在于，所述处理单元用于：
    根据所述第一系统信息块，获取所述通信装置所处密钥区的密钥；或者，
    当所述通信装置从第一密钥区移动到第二密钥区时，获取所述第二密钥区的密钥；或者，
    接收来自所述第一基站的携带有密钥相关信息的第二系统信息块，并根据所述密钥相关信息获取所述通信装置所处密钥区的密钥。
  19. 如权利要求18所述的通信装置，其特征在于，所述处理单元用于：
    当所述第一系统信息块还包括密钥相关信息，且所述通信装置存储有所述密钥相关信息对应的密钥时，获取所述存储的所述密钥相关信息对应的密钥；或者，
    当所述第一系统信息块还包括密钥相关信息，且所述通信装置未存储有所述密钥相关信息对应的密钥时，获取所述终端所处密钥区的密钥；或者，
    当所述通信装置根据所述通信装置存储的密钥解密所述加密的时间信息失败时，获取所述终端所处密钥区的密钥。
  20. 如权利要求18所述的通信装置，其特征在于，所述通信单元用于：
    当所述通信装置从所述第一密钥区内的小区重选到所述第二密钥区内的小区时，获取所述第二密钥区的密钥；或者，
    当所述通信装置从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，获取所述第二密钥区的密钥；或者，
    当所述通信装置从所述第一密钥区内的无线接入网通知区RNA移动到所述第二密钥区内的RNA时，获取所述第二密钥区的密钥。
  21. 如权利要求20所述的通信装置，其特征在于，所述通信单元用于：
    向移动性管理网元发送非接入层请求消息，并接收来自所述移动性管理网元的非接入层响应消息，所述非接入层响应消息包括所述第二密钥区的密钥；或，
    向所述第二密钥区内的所述小区对应的第二基站发送第一RRC消息，并接收来自所述第二基站的第二RRC消息，所述第二RRC消息包括所述第二密钥区的密钥。
  22. 如权利要求20所述的通信装置，其特征在于，所述通信装置处于连接态，且当 所述通信装置从所述第一密钥区内的源基站切换到所述第二密钥区内的目标基站时，所述通信单元用于：
    接收来自所述源基站的RRC消息，所述RRC消息包括所述第二密钥区的密钥。
  23. 如权利要求20所述的通信装置，其特征在于，所述通信装置处于非激活态，且当所述通信装置从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA时，所述通信单元用于：
    当所述通信装置从所述第一密钥区内的RNA移动到所述第二密钥区内的RNA内的第三基站，向所述第三基站发送RRC连接恢复请求消息；
    接收来自所述第三基站的RRC连接释放消息，所述RRC连接释放消息包括所述第二密钥区的密钥。
  24. 如权利要求16～23任一项所述的通信装置，其特征在于，所述第一系统信息块为采用证书签名后的系统信息块；
    所述通信单元还用于接收来自移动性管理网元或所述第一基站的所述证书；
    所述处理单元还用于采用所述证书验证所述第一系统信息块的签名。
  25. 一种通信装置，其特征在于，包括：
    处理单元，用于根据时间信息和所述通信装置所处密钥区的密钥，获得加密的时间信息，所述时间信息用于所述密钥区内的终端进行同步；
    通信单元，用于发送第一系统信息块，所述第一系统信息块包括所述加密的时间信息。
  26. 如权利要求25所述的通信装置，其特征在于，所述通信单元还用于向终端发送所述密钥。
  27. 如权利要求26所述的通信装置，其特征在于，所述通信单元用于接收来自移动性管理网元的授权指示信息，所述授权指示信息用于指示所述终端被授权使用时间同步业务；以及还用于根据所述授权指示信息，向所述终端发送所述密钥。
  28. 如权利要求26所述的通信装置，其特征在于，所述通信装置为第二密钥区内的目标基站，所述终端从第一密钥区的源基站切换到所述目标基站；
    所述通信单元用于接收来自所述源基站的切换请求消息，并向所述源基站发送切换命令，所述切换命令包括所述密钥，所述密钥为所述第二密钥区的密钥；或者，
    所述通信单元用于接收来自移动性管理网元的切换请求消息，并向所述移动性管理网元发送切换请求响应消息，所述切换请求响应消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
  29. 如权利要求26所述的通信装置，其特征在于，所述终端从第一密钥区内的无线接入网通知区RNA移动到第二密钥区内的RNA内的所述通信装置；
    所述通信单元用于接收来自所述终端的RRC连接恢复请求消息；
    以及所述通信单元还用于根据所述RRC连接恢复请求消息，向所述终端发送RRC连接释放消息，所述RRC连接释放消息包括所述密钥，所述密钥为所述第二密钥区的密钥。
  30. 如权利要求25～29任一项所述的通信装置，其特征在于：
    所述通信单元还用于接收来自操作管理维护实体或移动性管理网元的证书；
    所述处理单元还用于采用所述证书对所述第一系统信息块进行签名。
PCT/CN2019/073227 2018-02-13 2019-01-25 通信方法及装置 WO2019157930A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP19754286.3A EP3745755A4 (en) 2018-02-13 2019-01-25 COMMUNICATION PROCESS AND APPARATUS
US16/991,378 US20200374139A1 (en) 2018-02-13 2020-08-12 Communications method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810149663.8A CN110167019A (zh) 2018-02-13 2018-02-13 通信方法及装置
CN201810149663.8 2018-02-13

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/991,378 Continuation US20200374139A1 (en) 2018-02-13 2020-08-12 Communications method and apparatus

Publications (1)

Publication Number Publication Date
WO2019157930A1 true WO2019157930A1 (zh) 2019-08-22

Family

ID=67619150

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/073227 WO2019157930A1 (zh) 2018-02-13 2019-01-25 通信方法及装置

Country Status (4)

Country Link
US (1) US20200374139A1 (zh)
EP (1) EP3745755A4 (zh)
CN (1) CN110167019A (zh)
WO (1) WO2019157930A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2020160656A (ja) * 2019-03-26 2020-10-01 セイコーエプソン株式会社 情報配信システム、ネットワークサーバー及びネットワークサーバーの制御方法
US11310661B2 (en) * 2020-02-14 2022-04-19 Mediatek Inc. Security key synchronization method and associated communications apparatus
CN116419222A (zh) * 2021-12-29 2023-07-11 华为技术有限公司 一种通信方法及装置

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102804826A (zh) * 2010-03-17 2012-11-28 瑞典爱立信有限公司 用于srns重定位的增强密钥管理

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017176068A1 (en) * 2016-04-06 2017-10-12 Samsung Electronics Co., Ltd. System and method for validating authenticity of base station and/or information received from base station

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102804826A (zh) * 2010-03-17 2012-11-28 瑞典爱立信有限公司 用于srns重定位的增强密钥管理

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
KUN SUN; PENG NING; CLIFF WANG: "TinySeRSync: Secure and Resilient Time Synchronization in Wire- less Sensor Networks", PROCEEDINGS OF THE 13TH ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY, 30 October 2006 (2006-10-30), pages 264 - 277, XP058157167, DOI: 10.1145/1180405.1180439 *
SAURABH GANERIWAL; CHRISTINA PÖPPER; SRDJAN ČAPKUN; MANI B SRIVASTAVA: "Secure Time Synchronization in Sensor Networks", ACM TRANSACTIONS ON INFORMATION AND SYSTEM SECURITY, vol. 11, no. 4, 23, 31 July 2008 (2008-07-31), pages 1 - 35, XP058138039, ISSN: 1094-9224, DOI: 10.1145/1380564.1380571 *
See also references of EP3745755A4
YANG WEI;WANG QIN;WAN YA-DONG;HE: "Design of Secure Multi-hop Time Synchronization Protocol for IEEE802.15.4e", COMPUTER SCIENCE, vol. 44, no. 3, 15 March 2017 (2017-03-15), pages 175 - 181,194, XP009522592, ISSN: 1002-137X, DOI: 10.11896/j.issn.1002-137X.2017.03.0038 *

Also Published As

Publication number Publication date
US20200374139A1 (en) 2020-11-26
EP3745755A1 (en) 2020-12-02
EP3745755A4 (en) 2021-04-14
CN110167019A (zh) 2019-08-23

Similar Documents

Publication Publication Date Title
KR101490243B1 (ko) 이종망간 핸드오버시 빠른 보안연계 설정방법
JP2020507268A (ja) ５ｇにおけるアイドルモード中のセキュリティコンテキストハンドリング
WO2018201487A1 (en) Method and apparatus for carrying out a group handover
JP7287534B2 (ja) Ｍｍｅデバイスにおいて実行される方法及びｍｍｅデバイス
CN104737570A (zh) 生成用于第一用户设备和第二用户设备之间的设备对设备通信的密钥的方法和设备
JP2011512750A (ja) 無線通信システムにおいて、ハンドオーバ、またはハンドオーバを実行している間に鍵管理を実行するためのシステムおよび方法
US11323976B2 (en) Network device and radio communication method
KR102290691B1 (ko) 통신 방법 및 장치
CN104160730A (zh) 快速接入方法和装置
JP7255949B2 (ja) 通信方法および装置
US20200374139A1 (en) Communications method and apparatus
CN104349312A (zh) 用于支持双连接的安全处理的方法
US20220210859A1 (en) Data transmission method and apparatus
CN113841366B (zh) 通信方法及装置
ES2911513T3 (es) Equipo de usuario, estación base y métodos para establecimiento de conexión
WO2019065955A1 (ja) セキュリティ確立方法、端末装置及びネットワーク装置
CN114223231B (zh) 通信方法及装置
WO2020220862A1 (zh) 一种通信方法及装置
CN108464056A (zh) 用户设备信息的配置方法、装置、基站及核心网设备
KR20100092353A (ko) 트래픽 암호화 키 관리방법 및 장치
CN114026900A (zh) 归属控制的网络切片秘密性
WO2019178722A1 (zh) 一种获取密钥的方法及装置、计算机存储介质
EP4274310A1 (en) Network intercommunication method and apparatus
EP4319046A1 (en) Security configuration method and communication apparatus in switching scene
WO2023065226A1 (en) Identifying relay user equipment for sidelink relay

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19754286

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019754286

Country of ref document: EP

Effective date: 20200914

ENP Entry into the national phase

Ref document number: 2019754286

Country of ref document: EP

Effective date: 20200826