WO2019201017A1 - 一种安全算法的协商方法及装置 - Google Patents

一种安全算法的协商方法及装置 Download PDF

Info

Publication number
WO2019201017A1
WO2019201017A1 PCT/CN2019/076079 CN2019076079W WO2019201017A1 WO 2019201017 A1 WO2019201017 A1 WO 2019201017A1 CN 2019076079 W CN2019076079 W CN 2019076079W WO 2019201017 A1 WO2019201017 A1 WO 2019201017A1
Authority
WO
WIPO (PCT)
Prior art keywords
security algorithm
terminal
algorithm
network
slice
Prior art date
Application number
PCT/CN2019/076079
Other languages
English (en)
French (fr)
Inventor
曾信
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2019201017A1 publication Critical patent/WO2019201017A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/16—Central resource management; Negotiation of resources or communication parameters, e.g. negotiating bandwidth or QoS [Quality of Service]
    • H04W28/24—Negotiating SLA [Service Level Agreement]; Negotiating QoS [Quality of Service]

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a method and an apparatus for negotiating a security algorithm.
  • LTE Long Term Evolution
  • AS Access Stratum
  • the process of negotiating the security algorithm is as follows: Step 1: The terminal sends an attach request to the Mobility Management Entity (MME) through the base station. The attach request carries the security capability of the terminal, for example, the security algorithm supported by the terminal.
  • MME Mobility Management Entity
  • Step 2 The base station selects a security algorithm supported by the service network according to the algorithm allowed by the pre-configured service network and the security algorithm supported by the terminal forwarded by the MME.
  • Step 3 The base station sends the selected encryption algorithm and the integrity protection algorithm to the terminal in an AS security mode command (SMC).
  • SMC AS security mode command
  • the selected security algorithm acts as a security algorithm for all data links between the terminal and the base station.
  • the 5th-generation (5G) system adopts network slicing technology.
  • Network slicing is a hardware, software, strategy, and spectrum that is dynamically deployed by network operators to meet the service quality of a specific set of users from a service perspective. Combination.
  • the network function is divided into multiple virtual network function (VNF) modules, and each VNF module can be used to perform different network functions, such as sorting, segmentation, and addition.
  • Functions such as decryption can form a network slice by dynamically deploying the VNF module to the network.
  • Each network slice contains a set of functional instances.
  • Network slicing can provide services for various types of services. From the perspective of network security, different services or different tenants have different security requirements.
  • a Chinese company located in a European country needs the Chinese company's slicing network to support China's main security algorithm because of policy requirements.
  • the European country needs the European country because of policy requirements.
  • the slicing network supports the security algorithms of Europe's main push.
  • only one security algorithm can be negotiated between the base station and the terminal. This method cannot meet the requirement of the network slice technology to select different security algorithms for different services.
  • the embodiment of the present application provides a method and a device for negotiating a security algorithm, which are used to solve the problem of how a network using a network slicing technology selects different security algorithms for different services.
  • a method for negotiating a security algorithm is provided.
  • the method is performed by a network device.
  • the method mainly includes the following steps: the network device knows n network slices accessed by the terminal, and the network device determines according to the slice algorithm configuration.
  • n target security algorithm lists, the n target security algorithm lists respectively have a corresponding relationship with the n network slices accessed by the terminal, one network slice corresponds to one target security algorithm list, and different network slices correspond to different target security algorithm lists,
  • the target security algorithms corresponding to different network slices may also be the same.
  • the network device selects a target security algorithm in each target security algorithm list of the n target security algorithm lists, thus obtaining n target security algorithms, and selecting the selected n targets A security algorithm is sent to the terminal. It is possible to implement different security algorithms for different slice instances, so that the negotiation or application granularity of the security algorithm is more refined, and meets the requirements of different security algorithms in the vertical industry. And when the terminal accesses multiple network slices, the security algorithm corresponding to multiple network slices can be indicated in one negotiation process, which can effectively reduce the number of interaction messages between the terminal and the access network device and the core network element. Reduce air load.
  • the network slice can be briefly described as a slice, or a network slice instance, or a slice instance.
  • the network device is an access network device
  • the target security algorithm is used for security protection of a link between the terminal and the access network device.
  • the slicing algorithm configuration is a security algorithm list based on the slice granularity, the slice type granularity, or the tenant granularity.
  • the slicing algorithm configuration may be, but not limited to, the following configuration manners: Method 1: Configure according to the slice type a security algorithm list, the slice algorithm configuration includes a one-to-one correspondence between the network slice type and the security algorithm list, and the network device performs, for each of the n network slices, the network slice to which the terminal access belongs a target network slice type, and determining, according to the slice algorithm configuration, the target security algorithm list corresponding to the target network slice type; and second, configuring a security algorithm list according to the slice instance, and the slice algorithm configuration includes a network slice a one-to-one correspondence between the instance and the security algorithm list, the network device performing, for each of the n network slices, determining, according to the slice algorithm configuration, a correspondence with a network slice accessed by the terminal List of target security algorithms; Third, the security
  • the slicing algorithm configuration is pre-configured and stored on the network device. It can be created by the network element of the 3GPP management slice template, or obtained directly when the slice template is modified, or obtained through the indirect mapping of the security configuration of the slice template. It can also be obtained from the core network, configuration management NE, or local maintenance terminal.
  • the security algorithm negotiates according to a locally configured default algorithm, where the traditional algorithm configured by the AS SMC process, the default algorithm As an encryption protection and integrity protection algorithm for all data links of the access layer, the user plane and the signaling plane share a set of security algorithms. In this way, it is compatible with traditional algorithm negotiation and slicing algorithm configuration, and is more flexible.
  • the AMF also needs to send the selected target security algorithm to the user plane function UPF, where the target security algorithm is used for Security protection of the link between the terminal and the UPF.
  • the target security algorithm negotiated between the terminal and the UPF can be used for security protection.
  • the network device before the network device determines the n target security algorithm lists, the network device receives the first message, where the first message is used to request to establish a session of the terminal, or the first The message is used to request a switch. That is, the security algorithm negotiation of the present application can be implemented in the access process or in the handover process.
  • the network device may further send a second message to the terminal, and carry the selected target security algorithm in the second message.
  • the second message is an RRC message.
  • the network device sends a third message to the access network device, where the third message carries the selected target security algorithm, and the third message is used to request to establish a session of the terminal. And for the access network device to send a fourth message to the terminal according to the third message, where the fourth message carries the selected target security algorithm.
  • the network device indicates the network slice to the terminal by using a single network slice selection auxiliary information S-NSSAI; or the network device indicates the network slice to the terminal by using the data bearer identifier DRB ID
  • the DRB ID has an association relationship with a protocol data unit session identifier PDU SESSION ID, and the PDU SESSION ID has an association relationship with the S-NSSAI.
  • the network device selects, in each of the target security algorithm lists in the n target security algorithm lists, an algorithm that meets the terminal security capability and has the highest priority as the target security algorithm.
  • a method for negotiating a security algorithm is provided.
  • the method is performed by a terminal.
  • the method mainly includes the following steps: the terminal receives n target security algorithms sent by the network device, where n is a positive integer, and the method is
  • the target security algorithm respectively corresponds to the n network slices accessed by the terminal; the terminal communicates with the network device according to the n target security algorithms.
  • This can implement different security algorithms for different slice instances, which makes the negotiation of the security algorithm or the granularity of the application more detailed, and meets the requirements of different security algorithms in the vertical industry.
  • the security algorithm corresponding to multiple network slices can be indicated in one negotiation process, which can effectively reduce the number of interaction messages between the terminal and the access network device and the core network element. Reduce air load.
  • the network slice can be briefly described as a slice, or a network slice instance, or a slice instance.
  • the network device is an access network device
  • the target security algorithm is used for security protection of a link between the terminal and the access network device.
  • the network device is an access and mobility management function AMF
  • the target security algorithm is used for security protection of a link between the terminal and the user plane function UPF.
  • the target security algorithm negotiated between the terminal and the UPF can be used for security protection.
  • the terminal distinguishes network slices according to any of the following ways:
  • the network slice is distinguished by a single network slice selection auxiliary information S-NSSAI; or the network slice is distinguished by a data bearer identifier DRB ID, wherein the DRB ID has an association relationship with a protocol data unit session identifier PDU SESSION ID, the PDU The SESSION ID is associated with S-NSSAI.
  • a negotiating apparatus for a security algorithm having the function of implementing the network device behavior in any of the possible aspects of the first aspect and the first aspect described above.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a chip or an integrated circuit.
  • the apparatus includes a memory and a processor, the memory stores a set of programs, the processor is configured to execute a program stored in the memory, and when the program is executed, the apparatus can perform the first aspect and the first aspect The method described in any of the possible designs.
  • the device also includes a transceiver for communicating between the device and the terminal.
  • the device is a base station or an AFM.
  • a negotiating apparatus for a security algorithm having a function of implementing terminal behavior in any of the possible aspects of the second aspect and the second aspect described above.
  • the functions may be implemented by hardware or by corresponding software implemented by hardware.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the device can be a chip or an integrated circuit.
  • the apparatus includes a memory and a processor, the memory stores a set of programs, the processor is configured to execute a program stored in the memory, and when the program is executed, the apparatus can perform the second aspect and the second aspect The method described in any of the possible designs.
  • the device also includes a transceiver for communicating between the device and the network device.
  • the device is a terminal.
  • a communication system comprising the apparatus of the third aspect and the fourth aspect.
  • a sixth aspect provides a computer storage medium storing a computer program comprising any of the possible implementations of the first aspect, the second aspect, the first aspect, or the second aspect The instructions of the method in the embodiment.
  • an embodiment of the present application provides a computer program product comprising instructions that, when run on a computer, cause the computer to perform the method described in the above aspects.
  • 1a is a schematic structural diagram of a communication system in an embodiment of the present application.
  • FIG. 1b is a schematic diagram of a deployment mode of an access network device according to an embodiment of the present application.
  • Figure 1c is a second deployment form of the access network device in the embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for negotiating a security algorithm according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method for negotiating a security algorithm in scenario 1 according to an embodiment of the present disclosure
  • FIG. 4 is a second schematic flowchart of a method for negotiating a security algorithm in scenario 1 according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of a method for negotiating a security algorithm in scenario 2 in the embodiment of the present application;
  • FIG. 6 is a second schematic flowchart of a method for negotiating a security algorithm in scenario 2 in the embodiment of the present application;
  • FIG. 7 is a schematic structural diagram of a structure of a security algorithm negotiation apparatus according to an embodiment of the present application.
  • FIG. 8 is a second schematic structural diagram of a security device negotiation apparatus according to an embodiment of the present disclosure.
  • FIG. 9 is a third schematic structural diagram of a device for negotiating a security algorithm according to an embodiment of the present application.
  • the embodiment of the present application provides a method and a device for negotiating a security algorithm, which are used to implement a network that uses network slicing technology to select different security algorithms for different services.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • FIG. 1a shows an architecture of a possible communication system to which the negotiation method of the security algorithm provided by the embodiment of the present application is applicable. It should be understood that the embodiment of the present application can be applied to, but not limited to, the system shown in FIG.
  • the communication system includes: a terminal 101, an access network (AN) device 102, an access and mobility management function (AMF) 103, and a user plane function ( User plane function (UPF) 104 and data network (DN) 105.
  • Terminal 101 communicates with DN 105 via AN device 102 and UPF 104.
  • the AN device 102 and the AMF 103 are connected through an N2 interface.
  • the AN device is connected to the AN device 102 through an N3 interface, and the UPF 104 and the DN 105 can be connected through an N6 interface.
  • the interface name is only an example.
  • each network element in FIG. 1a may be hardware, or may be functionally divided software or a combination of the two.
  • the embodiments of the present application can also be applied to other communication systems.
  • the other communication systems have network elements similar to the functions of the network elements described in FIG. 1a, and the operations performed by the network elements described in FIG. 1a can be applied to other A network element with similar functions in the communication system.
  • the terminal 101 which is also called a user equipment (UE), a mobile station (MS), a mobile terminal (MT), etc., is a device that provides voice and/or data connectivity to users.
  • the terminal device includes a handheld device having a wireless connection function, an in-vehicle device, and the like.
  • the terminal devices can be: mobile phones, tablets, laptops, PDAs, mobile internet devices (MIDs), wearable devices, virtual reality (VR) devices, augmented reality ( Augmented reality, AR) wireless terminal in equipment, industrial control, wireless terminal in self driving, wireless terminal in remote medical surgery, smart grid A wireless terminal, a wireless terminal in a transportation safety, a wireless terminal in a smart city, or a wireless terminal in a smart home.
  • the AN device 102 is a device in the communication system that connects the terminal 101 to a wireless network.
  • An AN device is a node in a radio access network, which may also be called a base station, and may also be referred to as a radio access network (RAN) node (or device).
  • RAN radio access network
  • the possible deployment modes of an access network (AN) device include: a centralized unit (CU) and a distributed unit (DU) separation scenario; and a single site. Scene. Single sites include gNB/NR-NB.
  • a gNB may have a gNB-CU and multiple gNB-DUs, and the gNB-CU and the gNB-DU are connected through an F1 interface.
  • gNB-CU is a logical node of gNB, which supports radio resource control (RRC), service data adaptation protocol (SDAP) and packet data convergence protocol (PDCP) for deploying gNB. Protocol function, or support the deployment of gNB RRC and PDCP protocol functions.
  • the gNB-CU is composed of a gNB-CU-CP and a plurality of gNB-CU-UPs, wherein the gNB-CU-CP is used to handle the function of the control plane of the gNB-CU, and the gNB-CU-UP is used to process the gNB-CU. Data surface function.
  • the gNB-DU is the logical node of the gNB and is controlled by the gNB-CU part.
  • the gNB-DU is composed of one or more cells, and supports the radio link control (RLC) layer and the medium access control layer of the gNB. Medium access control (MAC) and physical layer PHY protocol.
  • RLC radio link control
  • MAC Medium access control
  • a single station may also include a transmission reception point (TRP), an evolved Node B (eNB), a radio network controller (RNC), a Node B (Node B, NB), and a base station.
  • TRP transmission reception point
  • eNB evolved Node B
  • RNC radio network controller
  • Node B Node B
  • BSC Base station controller
  • BTS base transceiver station
  • HNB home Node B
  • BBU baseband unit
  • Wifi wireless Wireless fidelity access point
  • an AN device may be represented by a base station, and an operation performed by the base station may be an operation performed by any one of the foregoing AN devices.
  • the AMF 103 can be used to be responsible for registration of the terminal 101, mobility management, tracking area update process, reachability detection, session management function (SMF) selection, and mobile state transition management.
  • SMF session management function
  • the UPF 104 can be used to forward the user plane data of the terminal 101.
  • the main functions are packet routing and forwarding, mobility anchors, and uplink classifiers to support routing traffic to data networks and branch points to support multi-homed Packet Data Unit (PDU) sessions.
  • PDU Packet Data Unit
  • the DN 105 may be an Internet, an IP Multi-media Service (IMS) network, a regional network (ie, a local network such as a mobile edge computing (MEC) network).
  • IMS IP Multi-media Service
  • MEC mobile edge computing
  • the application server is included in the DN, and the application server provides service services to the terminal 101 by performing data transmission with the terminal 101.
  • the 5G system introduces the concept of network slicing to cope with the difference in network performance requirements of different communication services.
  • Network slicing refers to the customization of different logical networks based on different service requirements on a physical or virtual network infrastructure.
  • the network slice can be a complete end-to-end network including terminal equipment, access network, transmission network, core network and application server, which can provide complete communication service and has certain network capabilities.
  • the network slice can also be any combination of a terminal device, an access network, a transport network, a core network, and an application server.
  • a network slice may be briefly described as a slice, or it may be represented by a network slice instance, or a slice instance.
  • the network device described in this embodiment may be an access network device, or may refer to an entity having similar functions to AMF in an AMF or other communication system.
  • a protocol data unit (PDU) session that is, a PDU SESSION, is a connection between the terminal and the DN, and a connection between the terminal and the UPF.
  • the type of connection can be Internet Protocol (IP), Ethernet or unstructured data.
  • IP Internet Protocol
  • the PDU connection service supported by the core network refers to a service that provides PDU exchange between the terminal and the DN determined by the DN identifier (DNNN).
  • the terminal can establish multiple PDU sessions to connect to the same DN or different DNs.
  • the terminal can establish a PDU session served by different UPFs to connect to the same DN.
  • the active state of the PDU session refers to the state in which the user plane resources of the PDU session have been established.
  • An end-to-end connection is established between the terminal and the DN, and data can be transmitted.
  • the deactivated state of the PDU session means that only a part of the user plane is reserved for the PDU session.
  • the resource, the user plane air interface resource between the UE and the (R) AN, and the connection between the (R) AN and the UPF are not established, and data cannot be transmitted between the UE and the DN.
  • Some information of the PDU session is still reserved in the SMF and the UPF.
  • NSSAI Network Slice Selection Assistance Information
  • S-NSSAI Single Network Slice Selection Assistance Information
  • a network slice instance is a static network.
  • a terminal can establish one or more PDU SESSIONs. Each PDU SESSION will only be established in one network slice instance.
  • a PDU SESSION can contain a Data Resource Bearer (DRB) between multiple terminals and a base station.
  • DRB Data Resource Bearer
  • the network slice instance may be distinguished by, but not limited to, the following manner:
  • the terminal can learn the network slice instance according to the DRB ID notified by the base station or the core network. Specifically, the PDU SESSION ID is associated by the DRB ID, and the S-NSSAI is associated by the PDU SESSION ID, and the network slice instance is determined by the S-NSSAI.
  • the terminal obtains the PDU SESSION ID according to the PDU SESSION to which the currently established DRB belongs, and then associates the S-NSSAI with the PDU SESSION ID, and determines the network slice instance by using the S-NSSAI.
  • the slicing algorithm configuration is configured and stored in advance on the network device. It can be created by the network element of the 3GPP management slice template, or obtained directly when the slice template is modified, or obtained through the indirect mapping of the security configuration of the slice template. It can also be obtained from the core network, configuration management NE, or local maintenance terminal.
  • the slicing algorithm configuration is a security algorithm list based on the slice granularity, the slice type granularity, or the tenant granularity.
  • the slicing algorithm configuration may include, but is not limited to, the following configuration manners.
  • the first step is to configure a security algorithm list according to the slice type.
  • the slice algorithm configuration includes a one-to-one correspondence between the network slice type and the security algorithm list.
  • One slice type corresponds to one security algorithm list, and different slice types correspond to the same or different security algorithm lists.
  • Network slices under the same slice type correspond to the same list of security algorithms.
  • Manner 2 Configure a security algorithm list according to the sharding instance.
  • the snippet algorithm configuration includes a one-to-one correspondence between the network snippet instance and the security algorithm list.
  • a network snippet instance corresponds to a security algorithm list, and different network snippet instances may correspond to the same or different security.
  • Algorithm list Network slices under the same slice type may correspond to the same or non-stop list of security algorithms.
  • Manner 3 Configure a security algorithm list according to the tenant in the slice.
  • the slice algorithm configuration includes a one-to-one correspondence between the tenant and the security algorithm list.
  • One tenant corresponds to one security algorithm list, and different tenants correspond to the same or different security algorithm list.
  • the traditional algorithm configured by the AS SMC process acts as an encryption protection and integrity protection algorithm for all data links of the access layer, and the user plane and the signaling plane share a set of security algorithms.
  • Security algorithms include encryption and/or integrity protection algorithms.
  • the list of security algorithms includes one or more encryption algorithms and the priority of each encryption algorithm; it also includes one or more integrity algorithms and the priority of each integrity algorithm.
  • the negotiation method of the security algorithm provided by the embodiment of the present application is described in detail below.
  • the method can be applied to the security algorithm negotiation of the network slice, and can also be applied to the security algorithm negotiation of the bearer network in the network slice, and the negotiation process has the same principle and can be referred to.
  • the flow of the negotiation method of the security algorithm provided by the embodiment of the present application is as follows.
  • the partial steps shown in FIG. 2 are optional steps, and any two or more adjacent steps may form a solution that needs to be protected in the embodiments of the present application.
  • S202 and S203 can form a separate solution, which belongs to the scope of protection of the embodiment of the present application.
  • the network device determines whether a slice algorithm configuration exists locally. If yes, execute S202-S205, otherwise perform S202' and S203'.
  • a network device may refer to an access network device or a core network device. If the network device is an access network device, the configuration of the slice algorithm may be pre-configured, or may be sent by the core network device to the base station, for example, the AFM is sent to the base station.
  • the network device acquires information about the network slice accessed by the terminal, and determines, according to the configuration of the slice algorithm, a list of n target security algorithms corresponding to the n network slices accessed by the terminal, where n is a positive integer.
  • n 1, that is, the terminal accesses a network slice
  • the network device configures, according to the slice algorithm, a target security algorithm list corresponding to a network slice accessed by the terminal; if n>1, the network device performs the slice according to the slice.
  • the algorithm is configured to select a security algorithm list corresponding to each of the network slices of the n network slices to obtain a list of n target security algorithms.
  • the network device performs, for each of the n network slices, the network slice type to which the network slice accessed by the terminal belongs. (For convenience of description, it may be referred to as a target network slice type), and according to the slice algorithm configuration, a security algorithm list (referred to as a target security algorithm list) may be selected corresponding to the target network slice type.
  • the network device performs, for each of the n network slices, a target security algorithm list that has a correspondence with the network slice accessed by the terminal. .
  • the network device performs, for each network slice in the n network slices, the tenant to which the service of the network slice belongs, and according to the configuration of the slice algorithm, determine and The tenant to which the terminal belongs to the service of the network slice has a corresponding target security algorithm list.
  • the network device selects a target security algorithm in each target security algorithm list of the n target security algorithm lists determined in S202.
  • the network device selects, in each of the target security algorithm lists in the n target security algorithm lists, an algorithm that meets the terminal security capability and has the highest priority as the target security algorithm.
  • a total of n target security algorithms are selected, corresponding to n network slices, so that the target security algorithm corresponding to each network slice accessed by the terminal has been selected.
  • the network device sends the selected target security algorithm to the terminal, where the terminal receives the target security algorithm sent by the network device. Specifically, the network device sends n target security algorithms to the terminal, and indicates to the terminal a network slice corresponding to each security algorithm of the n target security algorithms. The network device indicates to the terminal, the n target security algorithms corresponding to the n network slices accessed by the terminal, and may be indicated by the correspondence between the network slice information and the target security algorithm. The network device can indicate the network slice by the method described in point 4) above.
  • the network device may indicate the network slice through the S-NSSAI; or indicate the network slice by using the DRB ID; or the network device only sends n target security algorithms to the terminal, and does not indicate the information of the network slice, and the terminal needs to be according to the DRB. To determine the information of the network slice.
  • the terminal receives the n target security algorithms sent by the network device, and the information of the network slice corresponding to the n target security algorithms, and determines a target security algorithm corresponding to each network slice in the n network slices.
  • the information of the network slice is S-NSSAI
  • the terminal determines which network slice is specifically according to the S-NSSAI, and further obtains the target security algorithm corresponding to the network slice;
  • the information of the network slice is the DRB ID, and the terminal according to the DRB ID Associate the PDU SESSION ID, and then associate the S-NSSAI with the PDU SESSION ID, determine the network slice through the S-NSSAI, and further obtain the target security algorithm corresponding to the network slice.
  • the terminal If the terminal only receives the n target security algorithms sent by the network device and does not receive the information of the network slice, the terminal obtains the PDU SESSION ID according to the PDU SESSION to which the currently established DRB belongs, and associates the S-NSSAI with the PDU SESSION ID.
  • the network slice is determined by the S-NSSAI, and the target security algorithm corresponding to the network slice is further obtained.
  • the network device selects a target security algorithm according to the default configured security algorithm list; a target security algorithm selected here is applied to the link between the terminal and all network slices accessed, so the security algorithm does not The differences in network slices are differentiated, and the target security algorithm is applied to the user plane and the signaling plane.
  • the network device sends a selected target security algorithm to the terminal, and after receiving the target security algorithm sent by the network device, the network device and the terminal may perform link communication security protection according to the target security algorithm.
  • the negotiation method of the security algorithm provided by the foregoing embodiment of the present invention can implement different security algorithms for different slices, so that the negotiation or application granularity of the security algorithm is more refined, and meets the requirements of different security algorithms in the vertical industry. And when the terminal accesses multiple network slices, the security algorithm corresponding to multiple network slices can be indicated in one negotiation process, which can effectively reduce the number of interaction messages between the terminal and the access network device and the core network element. Reduce air load.
  • the method for negotiating the security algorithm provided in the embodiment of the present application may be applied to a scenario in which a terminal accesses a network slice and establishes a data link (which may be referred to as a scenario 1), and may also be applied to a scenario in which a terminal switches a data link (which may be simply referred to as a scenario). two).
  • the security algorithm obtained by the method provided in this embodiment can be applied to the UP plane.
  • the security endpoint of the UP plane protection can be located in the access network, that is, the access network performs decryption and integrity check. It can also be located in the core network, that is, decryption and integrity check on the core network.
  • the negotiation method of the security algorithm provided by the embodiment of the present application is further described in detail below by using the scenario 1 and the scenario 2 and the location of the security endpoint.
  • the security endpoint is located in the access network, and the network device is the access network device (base station).
  • the negotiation process of the security algorithm is as follows.
  • the base station pre-configures or receives the slice algorithm configuration from the AMF, and configures a different security algorithm list according to the slice type, or the network slice instance, or the tenant.
  • the list of security algorithms corresponding to a slice type, or network slice instance, or tenant is [(128-NEA0-low, 128-NEA1-medium, 128-NEA2-high), (128-NIA0-low, 128-) NIA1-, 128-NIA2-high)].
  • 128-NEA0, 128-NEA1, and 128-NEA2 described in the embodiments of the present application are names of different encryption algorithms
  • 128-NIA0, 128-NIA1, and 128-NIA2 are names of different integrity algorithms, low, Medium and high represent different priorities.
  • the security capability of the terminal is the security algorithm supported by the terminal.
  • the security algorithm supported by the terminal is [(128-NEA0, 128-NEA1, 128-NEA2), (128-NIA0, 128-NIA1, 128-NIA2)].
  • the names of the encryption algorithm and the integrity algorithm are only an example, and may be updated to other names, and are also applicable to the method in the embodiment of the present application.
  • the name of the encryption algorithm may also be 256-NEA0, 256.
  • the name of the integrity algorithm can also be 256-NIA0, 256-NIA1, 256-NIA2.
  • the terminal sends a PDU session establishment request to the AMF, that is, the PDU session establishment request, so that the AMF can receive the PDU session establishment request sent by the terminal, and the PDU session establishment request can carry information such as the identifier of the terminal.
  • the AMF sends a first message to the base station, so that the base station can receive the first message sent by the AMF, where the first message is used to request to establish a session between the terminal and the base station, for example, a PDU session establishment request.
  • the base station selects a target security algorithm. If the base station has a configuration of the slice algorithm in the S300, the base station selects a security algorithm list corresponding to the network slice accessed by the terminal according to the configuration of the slice algorithm, and selects an algorithm with the highest priority and the highest priority in the security algorithm list as the target. Security algorithm. For example, the network slice where the PDU session established by the terminal is located is slice 1. The list of security algorithms corresponding to slice 1 is [(128-NEA0-low, 128-NEA1-medium), (128-NIA0-low, 128-NIA1-in)].
  • the security capability of the terminal that is, the security algorithm supported by the terminal is [(128-NEA0, 128-NEA1, 128-NEA2), (128-NIA0, 128-NIA1, 128-NIA2)].
  • the highest priority algorithm supported by the terminal in the security algorithm list corresponding to slice 1 is [128-NEA1, 128-NIA1], and [128-NEA1, 128-NIA1] is the target security algorithm corresponding to slice 1. If the terminal also accesses other network slices, the target security algorithm is selected according to the same method.
  • the terminal accesses the slice 2, and the security algorithm list corresponding to the slice 2 is [(128-NEA0-low, 128-NEA2-high), (128-NIA0-low, 128-NIA2-high)], the highest priority algorithm supported by the terminal in the list of security algorithms corresponding to slice 2 is [128-NEA2, 128-NIA2], [128-NEA1, 128-NIA1 ] is the target security algorithm corresponding to slice 2.
  • the base station selects a highest priority algorithm supported by the terminal from the default configured algorithm list as the target security algorithm.
  • S304 The base station sends a second message to the terminal, where the terminal may receive the second message sent by the base station, where the second message may carry the target security algorithm selected in S303.
  • the base station has a slice algorithm configuration in the S300, it can carry the correspondence between the network slice and the target security algorithm, for example, carrying [(S-NSSAI-1, 128-NEA1, 128-NIA1), (S-NSSAI-2, 128) -NEA1,128-NIA1)].
  • S-NSSAI-1 is used to indicate slice 1
  • S-NSSAI-2 is used to indicate slice 2.
  • other indications may also be used to indicate different slices, as described in the foregoing description of the embodiments of the present application.
  • the second message is used for RRC connection reconfiguration, for example, the second message is an RRC connection reconfiguration request.
  • the RRC connection reconfiguration request carries information of [(S-NSSAI-1, 128-NEA1, 128-NIA1), (S-NSSAI-2, 128-NEA1, 128-NIA1)].
  • the base station may select the highest priority algorithm supported by the terminal as the target security algorithm from the default configured algorithm list, and carry the target security algorithm in the second message.
  • the base station may not carry the security algorithm in the second message, and the terminal selects the algorithm carried in the AS SMC as the target security algorithm.
  • the terminal sends an RRC connection reconfiguration complete message, that is, an RRC connection reconfiguration complete message, to the base station. So far, the negotiation process between the security algorithm of the terminal and the base station is completed, and the terminal and the base station use the target security algorithm as the UP plane security protection algorithm.
  • the security endpoint is located on the core network and the network device is AMF.
  • the negotiation process of the security algorithm is as follows.
  • the AMF pre-configures the slice algorithm configuration to configure different security algorithm lists according to the slice type, or network slice instance, or tenant.
  • the list of security algorithms corresponding to a slice type, or network slice instance, or tenant is [(128-NEA0-low, 128-NEA1-medium, 128-NEA2-high), (128-NIA0-low, 128-) NIA1-, 128-NIA2-high)].
  • 128-NEA0, 128-NEA1 and 128-NEA2 are the names of different encryption algorithms
  • 128-NIA0, 128-NIA1 and 128-NIA2 are the names of different integrity algorithms, and low, medium and high represent different priorities. level.
  • the security capability of the terminal that is, the security algorithm supported by the terminal is [(128-NEA0, 128-NEA1, 128-NEA2), (128-NIA0, 128-NIA1, 128-NIA2)].
  • the terminal sends a PDU session establishment request, that is, a PDU session establishment request, to the AMF.
  • the AMF receives a PDU session establishment request sent by the terminal.
  • the PDU session establishment request may carry information such as the identifier of the terminal.
  • the AMF can determine the network slice accessed by the service of the PDU session by the terminal according to the PDU session establishment request.
  • the AMF selects a target security algorithm. If the AMF has a slicing algorithm configuration in the S400, the AMF selects a security algorithm list corresponding to the network slice accessed by the terminal according to the slicing algorithm, and selects an algorithm that meets the terminal security capability and has the highest priority in the security algorithm list as the target. Security algorithm. For example, the network slice where the PDU session established by the terminal is located is slice 1. The list of security algorithms corresponding to slice 1 is [(128-NEA0-low, 128-NEA1-medium), (128-NIA0-low, 128-NIA1-in)].
  • the security capability of the terminal that is, the security algorithm supported by the terminal is [(128-NEA0, 128-NEA1, 128-NEA2), (128-NIA0, 128-NIA1, 128-NIA2)].
  • the highest priority algorithm supported by the terminal in the security algorithm list corresponding to slice 1 is [128-NEA1, 128-NIA1], and [128-NEA1, 128-NIA1] is the target security algorithm corresponding to slice 1.
  • the AMF may select a highest priority algorithm supported by the terminal from the default configured algorithm list as the target security algorithm.
  • the AMF sends a message to the base station, where it can be recorded as a third message, and the base station receives the third message sent by the AMF.
  • the third message may carry the target security algorithm selected in 402.
  • the AMF may carry a correspondence between the network slice and the target security algorithm in the third message.
  • the third message carries information [(S-NSSAI-1, 128-NEA1, 128-NIA1)], and S-NSSAI-1 is used to indicate slice 1 .
  • the third message is used to establish a PDU session.
  • the third message is a PDU session establishment request, and the PDU session establishment request carries information of [(S-NSSAI-1, 128-NEA1, 128-NIA1)].
  • the AFM may carry the target security algorithm selected according to the default configured algorithm list in the third message, or the AFM does not carry the security algorithm in the third message, and the terminal uses the carried in the AS SMC.
  • the algorithm acts as a target security algorithm.
  • S403' the AMF sends a target security algorithm to the UPF.
  • S403 and S403' have no strict execution order and can be exchanged in order or simultaneously.
  • the base station After receiving the third message sent by the AMF, the base station sends a fourth message to the terminal.
  • the fourth message sent by the base station to the terminal is used for RRC connection reconfiguration, and the fourth message may be an RRC connection reconfiguration request.
  • the base station carries the target security algorithm in the third message in the fourth message sent to the terminal.
  • the base station carries information of [(S-NSSAI-1, 128-NEA1, 128-NIA1)] in the RRC connection reconfiguration request.
  • the base station carries the target security algorithm selected from the default configured algorithm list in the RRC connection reconfiguration request, or the base station does not carry the security algorithm in the RRC connection reconfiguration request, and the terminal can use the algorithm carried in the AS SMC as the target security algorithm. .
  • the terminal may send an RRC connection reconfiguration complete message, that is, an RRC connection reconfiguration complete message, to the base station, where the step is optional.
  • RRC connection reconfiguration complete message that is, an RRC connection reconfiguration complete message
  • the negotiation process between the terminal and the security algorithm of the core network device is completed, and the target security algorithm can be used as the UP plane security protection algorithm between the terminal and the UPF.
  • the security endpoint is located in the access network, and the network device is the target base station.
  • the negotiation process of the security algorithm is as follows.
  • the target base station acquires the configuration of the slice algorithm that is pre-configured or received from the AMF. For the rest of the steps, refer to S300.
  • the source base station is a base station currently accessed by the terminal
  • the target base station is a base station to which the terminal wants to handover.
  • the target base station After receiving the slice request sent by the source base station, the target base station determines the network slice accessed by the terminal according to the context information of the terminal service, and then selects a target security algorithm according to the slice algorithm configuration or the default algorithm configuration. For the specific selection process, the base station selects in S303. The process of the target security algorithm will not be repeated here.
  • This step is the same as the slicing process in the prior art.
  • the target base station sends a target security algorithm to the terminal. For the rest of this step, refer to S304, and the repetition will not be repeated.
  • the target base station in the foregoing process shown in FIG. 5 may be a gNB-CU.
  • the target base station in the process shown in FIG. 5 may be a gNB-CU-CP.
  • the gNB-CU-CP is configured with a slice algorithm configuration, and the gNB-CU is configured.
  • the CP selects a target security algorithm corresponding to each network slice accessed by the terminal, and sends the target security algorithm to the terminal; or, the gNB-CU-CP configures the slice algorithm configuration, and the gNB-CU-UP sends each of the terminal accesses.
  • the security algorithm list corresponding to the network slice is sent to the gNB-CU-UP, and the target security algorithm corresponding to each network slice is selected by the gNB-CU-UP, and then the selected target security algorithm is sent to the terminal; or, the gNB-CU-CP is configured.
  • gNB-CU-UP selects the target security algorithm corresponding to each network slice accessed by the terminal, and sends the selected target security algorithm to gNB-CU-UP, and the target security algorithm is transparent by gNB-CU-UP. Pass the terminal. Transparent transmission does not change the content of the original message to forward the original message.
  • the security algorithm corresponding to each slice accessed by the terminal may be negotiated, for example, it may be applicable to intra-cell handover, intra-cell CU (including CP and/or UP) handover, and cross-cell cross-CU. (including CP and / or UP) switching, as shown in Figure 6, in scenario 2, the security endpoint is located in the core network, the network device is AMF, and the negotiation process of the security algorithm is as follows.
  • S600 same as S400.
  • the target AMF pre-configured slice algorithm configuration, and the rest of this step is described in S400.
  • the target AMF, the source AMF, the target base station, and the source base station perform a handover process, and the specific handover process is as in the prior art handover process.
  • S602 the same as S402.
  • the target AMF selects the target security algorithm, and the rest of this step is described in S402, and the repetitions are not described again.
  • the target AMF sends a message to the target base station, and the target base station receives the message sent by the target AMF.
  • the target base station receives the message sent by the target AMF.
  • the target base station sends a target security algorithm to the UPF.
  • S603 and S603' have no strict execution order and can be exchanged in order or simultaneously.
  • the target base station performs the operations performed by the base station in S404, and the repeated description is not repeated.
  • the negotiation process between the terminal and the security algorithm of the core network device is completed, and the target security algorithm is used between the terminal and the UPF as the UP plane security protection algorithm.
  • the UP plane security algorithm negotiation based on the slice or tenant granularity may be implemented in a scenario where the terminal accesses the network slice and establishes a data link or the terminal switches the data link. If the base station is configured with the slice algorithm, if the base station is configured with the slice algorithm, the security algorithm corresponding to the network slice accessed by the terminal may be selected and sent to the terminal. If the base station is not configured with the slice algorithm, the default configuration may be performed.
  • the security algorithm list selects a security algorithm to send to the terminal, or according to the security algorithm sent in the existing AS SMC as the final security algorithm.
  • the security algorithm corresponding to each of the plurality of network slices accessed by the terminal may be selected and sent to the terminal, if the base station does not Configure a slicing algorithm to select a security algorithm to send to the terminal according to the default security policy list, or use the security algorithm sent in the existing AS SMC as the final security algorithm.
  • the negotiation process of different security algorithms for different slices can meet the requirements of different security algorithms in the vertical industry.
  • the security algorithm is negotiated during the handover process, the security algorithms corresponding to multiple slices can be negotiated at the same time, which reduces The number of air interface messages further reduces the air interface signaling load.
  • the embodiment of the present application further provides a security algorithm negotiation device 700, where the security device negotiation device 700 is configured to execute the network device in the foregoing method embodiment.
  • the negotiation device 700 of the security algorithm includes a processing unit 701 and a transmitting unit 702.
  • a receiving unit 703 is further included. among them:
  • the processing unit 701 is configured to determine, according to the configuration of the slice algorithm, the n target security algorithm lists, where the n target security algorithm lists respectively have a corresponding relationship with the n network slices accessed by the terminal, where n is a positive integer;
  • the processing unit 701 is configured to select a target security algorithm in each target security algorithm list of the n target security algorithm lists.
  • the sending unit 702 is configured to send the target security algorithm selected by the processing unit 701 to the terminal.
  • the processing unit 701, the sending unit 702, and the receiving unit 703 can be used to perform other steps performed by the network device in the foregoing method embodiment, and the repeated description is not repeated herein.
  • the embodiment of the present application further provides a security algorithm negotiation apparatus 800, where the security algorithm negotiation apparatus 800 is configured to perform terminal execution in the foregoing method embodiment.
  • the negotiation device 800 of the security algorithm includes a receiving unit 801 and a processing unit 802. among them:
  • the receiving unit 801 is configured to receive n target security algorithms sent by the network device, where the n target security algorithms respectively correspond to the n network slices accessed by the terminal;
  • the processing unit 802 is configured to communicate with the network device according to the n target security algorithms received by the receiving unit 801.
  • the receiving unit 801 and the processing unit 802 can be used to perform other steps performed by the terminal in the foregoing method embodiment, and the repeated description is not repeated herein.
  • the embodiment of the present application further provides a security algorithm negotiation device 900, where the security device negotiation device 900 is configured to execute the network device in the foregoing method embodiment.
  • the security algorithm device 900 includes a transceiver 901, a processor 902, and a memory 903.
  • Transceiver 901 is optional.
  • the processor 902 is configured to invoke a set of programs that, when executed, cause the processor 902 to perform the operations performed by the terminal in the positioning measurement method described above.
  • the memory 903 is used to store programs executed by the processor 902.
  • the function module sending unit 702 and the receiving unit 703 in FIG. 7 can be implemented by the transceiver 901, and the processing unit 702 can be implemented by the processor 902.
  • the function module receiving unit 801 in FIG. 8 can be implemented by the transceiver 901, and the processing unit 802 can be implemented by the processor 902.
  • the processor 902 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • CPU central processing unit
  • NP network processor
  • Processor 902 can also further include a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL), or any combination thereof.
  • the memory 903 may include a volatile memory such as a random-access memory (RAM); the memory 903 may also include a non-volatile memory such as a flash memory (flash) Memory), hard disk drive (HDD) or solid state drive (SSD); the memory 903 may also include a combination of the above types of memories.
  • RAM random-access memory
  • non-volatile memory such as a flash memory (flash) Memory), hard disk drive (HDD) or solid state drive (SSD); the memory 903 may also include a combination of the above types of memories.
  • the embodiment of the present application further provides a chip, including a processor, for supporting the device to implement the network device or the terminal involved in the foregoing method embodiment.
  • the chip is coupled to a memory or the chip includes a memory for storing program instructions and data necessary for the device.
  • the embodiment of the present application provides a computer storage medium, which stores a computer program, and the computer program includes a negotiation method for executing the foregoing security algorithm.
  • the embodiment of the present application provides a computer program product comprising instructions, when executed on a computer, causing a computer to execute a negotiation method of the above security algorithm.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种安全算法的协商方法及装置，用以用于实现采用网络切片技术的网络对不同业务选择不同的安全算法。该方法为：网络设备根据切片算法配置，确定n个目标安全算法列表，所述n个目标安全算法列表与终端接入的n个网络切片分别具有对应关系，n为正整数；所述网络设备在所述n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法，并将所选择的目标安全算法发送给所述终端。

Description

一种安全算法的协商方法及装置
本申请要求在2018年04月19日提交中国专利局、申请号为201810355864.3、发明名称为“一种安全算法的协商方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种安全算法的协商方法及装置。
背景技术
在长期演进(Long Term Evolution，LTE)系统中，终端和基站之间执行加密/解密和完整性保护的安全操作，对信令提供加密保护和完整性保护。由于不同终端设备的安全能力不同，例如，不同终端所支持的加密算法或完整性保护算法不同，因此在接入层(Access Stratum，AS)进行加密保护和完整性保护之前，需要在终端和基站间协商一套安全算法。协商安全算法的过程大致为：步骤1：终端通过基站向移动性管理实体(Mobility Management Entity，MME)发送附着请求；其中，附着请求中携带终端的安全能力，例如，携带终端支持的安全算法。步骤2：基站根据预配置的服务网络允许使用的算法，并结合MME转发的终端支持的安全算法，选择服务网络所支持的一个安全算法。步骤3：基站将选择的加密算法和完整性保护算法携带在AS安全模式命令(Security mode command，SMC)中发送给终端。所选择的安全算法作为终端和基站之间所有数据链路的安全算法。
第五代移动通信(the 5th-generation，5G)系统采用网络切片技术，网络切片是网络运营者从业务视角出发为满足特定用户集的服务质量而动态部署的硬件、软件、策略和频谱的一种组合。具体的，在支持切片技术的网络中，将网络功能划分为多个虚拟网络功能(virtual network function，VNF)模块，每个VNF模块可以用来执行不同的网络功能，例如排序、分段、加解密等功能，通过将VNF模块动态地部署到网络中，可以形成一个个网络切片。每个网络切片包含一组功能实例。网络切片能够为各种类型业务提供服务，从网络安全角度而言，不同业务或不同租户对安全有不同的需求。
不同地域的国家主推不同的种类的安全算法，例如，位于欧洲某国的中国企业因为政策要求，需要该中国企业的切片网络支持中国主推的安全算法，而该欧洲国家因为政策要求，需要该欧洲国家的切片网络支持欧洲主推的安全算法。而现有的安全算法的协商方法，基站与终端之间只能够协商出一个安全算法，这种方法不能满足采用网络切片技术的网络对不同业务选择不同安全算法的需求。
发明内容
本申请实施例提供一种安全算法的协商方法及装置，用以解决采用网络切片技术的网络如何对不同业务选择不同安全算法的问题。
本申请实施例提供的具体技术方案如下：
第一方面，提供一种安全算法的协商方法，该方法的执行主体是网络设备，该方法主要包括以下步骤：网络设备已知终端接入的n个网络切片，网络设备根据切片算法配置， 确定n个目标安全算法列表，所述n个目标安全算法列表与终端接入的n个网络切片分别具有对应关系，一个网络切片对应一个目标安全算法列表，不同网络切片对应不同的目标安全算法列表，当然不同网络切片对应的目标安全算法也可以是相同的。这里的n为正整数，所述网络设备在所述n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法，这样获得n个目标安全算法，并将所选择的n个目标安全算法发送给所述终端。能够实现不同切片实例对应不同的安全算法，使得安全算法的协商或应用的粒度更加细化，满足垂直行业不同的安全算法需求。并且当终端接入多个网络切片时，能够在一次协商过程中指示多个网络切片分别对应的安全算法，可以有效减少终端与接入网设备以及核心网网元之间的交互消息个数，减少空口负荷。
其中，网络切片可以简述为切片，也或者称为网络切片实例、或切片实例。
在一个可能的设计中，所述网络设备为接入网设备，所述目标安全算法用于所述终端与所述接入网设备之间链路的安全保护。这样，能够使得本申请上述提供的安全算法协商适用于安全保护终结点在核心网的场景，也可以适用于安全保护终结点在接入网的场景。
在一个可能的设计中，切片算法配置是基于切片粒度、切片类型粒度或租户粒度的安全算法列表，具体的，切片算法配置可以但不限于包含以下几种配置方式：方式一、按照切片类型配置安全算法列表，切片算法配置包括网络切片类型与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：确定所述终端接入的网络切片所属的目标网络切片类型，并根据所述切片算法配置，确定与所述目标网络切片类型具有对应关系的所述目标安全算法列表；方式二、按照切片实例配置安全算法列表，切片算法配置包括网络切片实例与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：根据所述切片算法配置，确定与所述终端接入的网络切片具有对应关系的所述目标安全算法列表；方式三、按照切片内的租户配置安全算法列表，切片算法配置包括租户与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：确定终端在网络切片的业务所属的租户，并根据所述切片算法配置，确定与所述终端在网络切片的业务所属的租户具有对应关系的所述目标安全算法列表。这样，可以设置不同粒度的安全算法列表，更能适应5G网络结构差异化服务的演变形式。
在一个可能的设计中，切片算法配置是预先在网络设备配置并存储的。可以通过3GPP管理切片模板的网元下发创建，或修改切片模板时直接获取，或通过切片模板的安全配置间接映射获取。也可以从核心网、配置管理网元、或者本地维护终端获取。
在一个可能的设计中，所述网络设备若确定不存在所述切片算法配置，则根据本地配置的默认算法来进行安全算法协商，其中，传统的通过AS SMC的流程配置的算法，该默认算法作为接入层所有数据链路的加密保护和完整性保护的算法，用户面和信令面共用一套安全算法。这样，能够兼容传统算法协商与切片算法配置，更具有灵活性。
在一个可能的设计中，若所述网络设备为接入和移动性管理功能AMF，则所述AMF还需要向用户面功能UPF发送所选择的目标安全算法，所述目标安全算法用于所述终端与所述UPF之间链路的安全保护。这样，才能实现终端与UPF之间能够使用协商出来的目标安全算法进行安全保护。
在一个可能的设计中，网络设备在确定n个目标安全算法列表之前，所述网络设备接收到第一消息，所述第一消息用于请求建立所述终端的会话，或者，所述第一消息用于请 求切换。也就是，本申请的安全算法协商既可以在接入流程中实现，也可以在切换流程中实现。
在一个可能的设计中，所述网络设备还可以向所述终端发送第二消息，在所述第二消息中携带所选择的目标安全算法。
可选的，第二消息是RRC消息。
在一个可能的设计中，所述网络设备向接入网设备发送第三消息，所述第三消息中携带所选择的目标安全算法，所述第三消息用于请求建立所述终端的会话，以及用于所述接入网设备根据所述第三消息向所述终端发送第四消息，所述第四消息携带所选择的目标安全算法。
在一个可能的设计中，所述网络设备通过单个网络切片选择辅助信息S-NSSAI来向所述终端指示网络切片；或者，所述网络设备通过数据承载标识DRB ID来向所述终端指示网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
在一个可能的设计中，所述网络设备在所述n个目标安全算法列表中的每一个目标安全算法列表中，选择符合终端安全能力的、且优先级最高的算法为目标安全算法。
第二方面，提供一种安全算法的协商方法，该方法的执行主体是终端，该方法主要包括以下步骤：终端接收网络设备发送的n个目标安全算法，这里的n为正整数，所述n个目标安全算法与所述终端接入的n个网络切片分别对应；所述终端根据所述n个目标安全算法，与所述网络设备进行通信。这样能够实现不同切片实例对应不同的安全算法，使得安全算法的协商或应用的粒度更加细化，满足垂直行业不同的安全算法需求。并且当终端接入多个网络切片时，能够在一次协商过程中指示多个网络切片分别对应的安全算法，可以有效减少终端与接入网设备以及核心网网元之间的交互消息个数，减少空口负荷。
其中，网络切片可以简述为切片，也或者称为网络切片实例、或切片实例。
在一个可能的设计中，所述网络设备为接入网设备，所述目标安全算法用于所述终端与所述接入网设备之间链路的安全保护。这样，能够使得本申请上述提供的安全算法协商适用于安全保护终结点在核心网的场景，也可以适用于安全保护终结点在接入网的场景。
在一个可能的设计中，所述网络设备为接入和移动性管理功能AMF，所述目标安全算法用于所述终端与所述用户面功能UPF之间链路的安全保护。这样，才能实现终端与UPF之间能够使用协商出来的目标安全算法进行安全保护。
在一个可能的设计中，所述终端根据以下任一种方式区分网络切片：
通过单个网络切片选择辅助信息S-NSSAI来区分网络切片；或者，通过数据承载标识DRB ID来区分网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
第三方面，提供一种安全算法的协商装置，该装置具有实现上述第一方面和第一方面的任一种可能的设计中网络设备行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，该装置可以是芯片或者集成电路。
在一个可能的设计中，该装置包括存储器和处理器，存储器存储有一组程序，处理器用于执行存储器存储的程序，当程序被执行时，所述装置可以执行上述第一方面和第一方面的任一种可能的设计中所述的方法。
在一个可能的设计中，该装置还包括收发器，用于该装置与终端之间进行通信。
在一个可能的设计中，该装置为基站或AFM。
第四方面，提供一种安全算法的协商装置，该装置具有实现上述第二方面和第二方面的任一种可能的设计中终端行为的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，该装置可以是芯片或者集成电路。
在一个可能的设计中，该装置包括存储器和处理器，存储器存储有一组程序，处理器用于执行存储器存储的程序，当程序被执行时，所述装置可以执行上述第二方面和第二方面的任一种可能的设计中所述的方法。
在一个可能的设计中，该装置还包括收发器，用于该装置与网络设备之间进行通信。
在一个可能的设计中，该装置为终端。
第五方面，提供了一种通信系统，该系统包括第三方面和第四方面所述的装置。
第六方面，提供了一种计算机存储介质，存储有计算机程序，该计算机程序包括用于执行第一方面、第二方面、第一方面的任一可能的实施方式或第二方面的任一可能的实施方式中的方法的指令。
第七方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
附图说明
图1a为本申请实施例中通信系统架构示意图；
图1b为本申请实施例中接入网设备的部署形态之一；
图1c为本申请实施例中接入网设备的部署形态之二；
图2为本申请实施例中安全算法的协商方法的流程示意图；
图3为本申请实施例中场景一中安全算法的协商方法的流程示意图之一；
图4为本申请实施例中场景一中安全算法的协商方法的流程示意图之二；
图5为本申请实施例中场景二中安全算法的协商方法的流程示意图之一；
图6为本申请实施例中场景二中安全算法的协商方法的流程示意图之二；
图7为本申请实施例中安全算法的协商装置结构示意图之一；
图8为本申请实施例中安全算法的协商装置结构示意图之二；
图9为本申请实施例中安全算法的协商装置结构示意图之三。
具体实施方式
本申请实施例提供一种安全算法的协商方法及装置，用于实现采用网络切片技术的网络对不同业务选择不同的安全算法。其中，方法和装置是基于同一发明构思的，由于方法和装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
需要说明的是，本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所 涉及的至少一个是指一个或多个；多个，是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序
下面将结合附图，对本申请实施例进行详细描述。
图1a示出了本申请实施例提供的安全算法的协商方法适用的一种可能的通信系统的架构，应理解，本申请实施例可以应用于但不限于图1所示的系统中。参阅图1a所示，所述通信系统中包括：终端101、接入网(access network，AN)设备102、接入和移动性管理功能(access and mobility management function，AMF)103、用户面功能(user plane function，UPF)104以及数据网络(data network，DN)105。终端101通过AN设备102以及UPF104与DN105通信。AN设备102与AMF103之间通过N2接口相连。与AN设备102之间通过N3接口相连，UPF104与DN105之间可以通过N6接口相连。接口名称只是一个示例说明，本申请实施例对此不作具体限定。此外，图1a中的各个网元可以是硬件，也可以是从功能上划分的软件或者以上二者的结合。本申请实施例还可以应用于其他通信系统，其他通信系统中具有与图1a中所述的各个网元类似功能的网元，图1a中所述的各个网元所执行的操作可以适用于其他通信系统中类似功能的网元。
终端101，又称之为用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)等，是一种向用户提供语音和/或数据连通性的设备。例如，终端设备包括具有无线连接功能的手持式设备、车载设备等。目前，终端设备可以是：手机(mobile phone)、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端，或智慧家庭(smart home)中的无线终端等。
AN设备102是通信系统中将终端101接入到无线网络的设备。AN设备为无线接入网中的节点，又可以称为基站，还可以称为无线接入网(radio access network，RAN)节点(或设备)。如图1b和图1c所示，接入网(access network，AN)设备可能的部署形态包括：集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)分离场景；以及单站点的场景。单站点包括gNB/NR-NB。如图1b所示，一个gNB可以有一个gNB-CU和多个gNB-DU组成,gNB-CU和gNB-DU之间通过F1接口相连。gNB-CU是一个gNB的逻辑节点，支持部署gNB的无线资源控制(radio resource control，RRC)、业务数据适配协议(service data adaptation protocol，SDAP)和分组数据汇聚协议(packet data convergence protocol，PDCP)协议功能，或者支持部署gNB的RRC和PDCP协议功能。gNB-CU由gNB-CU-CP和多个gNB-CU-UP构成，其中gNB-CU-CP用于处理gNB-CU的控制面的功能，而gNB-CU-UP用于处理gNB-CU的数据面功能。gNB-DU是gNB的逻辑节点并被gNB-CU部分控制，gNB-DU由一个或多个小区组成，支持部署gNB的无线链路控制(radio link control，RLC)层、媒体接入控制层(medium access control，MAC)和物理层PHY的协议。
单站点还可能包括传输接收点(transmission reception point，TRP)、演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node  B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station,BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)，或无线保真(wireless fidelity，Wifi)接入点(access point，AP)等。
本申请以下描述中，AN设备可以用基站来表述，基站所执行的操作可以是上述任意一种AN设备执行的操作。
AMF103，可用于负责终端101的注册、移动性管理、跟踪区更新流程、可达性检测、会话管理功能(session management function，SMF)的选择、移动状态转换管理等。
UPF104，可用于转发终端101的用户面数据。主要功能是数据包路由和转发、移动性锚点、上行分类器来支持路由业务流到数据网络、分支点来支持多归属分组数据单元(Packet Data Unit，PDU)会话等。
DN105可以是因特网(Internet)、IP多媒体业务(IP Multi-media Service，IMS)网络、区域网络(即本地网络，例如移动边缘计算(mobile edge computing，MEC)网络)等。DN中包括应用服务器，应用服务器通过与终端101进行数据传输，为终端101提供业务服务。
基于图1a所示的通信系统的架构，以下对本申请实施例的部分用语进行解释说明，以便于本领域技术人员理解。
1)网络切片
随着多种多样的通信业务的不断涌现，不同的通信业务对网络性能的需求存在显著的区别，5G系统引入了网络切片的概念，以应对不同通信业务对网络性能的需求的差异。网络切片是指在物理或者虚拟的网络基础设施上，根据不同的服务需求定制化不同的逻辑网络。网络切片可以是一个包括终端设备、接入网、传输网、核心网和应用服务器的完整的端到端网络，能够提供完整的通信服务，具有一定网络能力。网络切片也可以是终端设备、接入网、传输网、核心网和应用服务器的任意组合。以下描述中，网络切片可以简述为切片，也或者用网络切片实例、或切片实例表示。
2)网络设备
本申请实施例中所述的网络设备可以是接入网设备，也可以是指AMF或其他通信系统中具有与AMF类似功能的实体。
3)协议数据单元(protocol data unit，PDU)会话，即PDU SESSION，是终端和DN之间的连接，以及终端与UPF之间的连接。连接的类型可以是互联网协议(Internet Protocol，IP)，以太网或者非结构数据。核心网支持的PDU连接服务，是指提供终端和由DN的标识(DN number，DNN)确定的DN之间PDU交换的服务。终端可以建立多个PDU会话，来连接到相同的DN或者不同的DN。终端可以建立由不同的UPF提供服务的PDU会话，来连接到相同的DN。PDU会话的激活态是指PDU会话的用户面资源已经建立起来的状态，终端和DN之间建立了端到端的连接，可以传递数据；PDU会话的去激活态是指PDU会话仅保留部分用户面资源，UE和(R)AN之间的用户面空口资源，以及(R)AN和UPF之间的连接都没有建立起来，UE和DN之间不能传递数据。SMF和UPF中仍保留PDU会话的部分信息。
4)网络切片选择辅助信息(Network Slice Selection Assistance Information，NSSAI)，用于核心网为终端选择网络切片，以及用于在安全算法协商的过程中来区分不同的网络切片。NSSAI可以包括业务类型和其它用于选择切片的信息，也可以是一个切片的标识。现 有协议定义了一个终端可以同时接入8个网络切片实例，NSSAI包含了8个切片选择辅助信息(Single Network Slice Selection Assistance Information，S-NSSAI)，一个S-NSSAI用于标识一个网络切片实例。
一个网络切片实例是静态的网络，一个终端可以建立一个或多个PDU SESSION，每个PDU SESSION只会建立在一个网络切片实例中。一个PDU SESSION可以包含多个终端与基站之间的数据承载(Data Resource Bearer，DRB)。
本申请实施例中，可以但不限于通过以下方式来区别网络切片实例：
1、通过S-NSSAI来指示。
2、通过DRB ID来指示。终端可以根据基站或者核心网通知的DRB ID获知网络切片实例。具体的，通过DRB ID来关联PDU SESSION ID，再通过PDU SESSION ID来关联S-NSSAI，通过S-NSSAI来确定网络切片实例。
3、不指示。终端根据当前建立的DRB所属的PDU SESSION，获取PDU SESSION ID，再通过PDU SESSION ID来关联S-NSSAI，通过S-NSSAI来确定网络切片实例。
5)切片算法配置
本申请实施例中，切片算法配置是预先在网络设备配置并存储的。可以通过3GPP管理切片模板的网元下发创建，或修改切片模板时直接获取，或通过切片模板的安全配置间接映射获取。也可以从核心网、配置管理网元、或者本地维护终端获取。
切片算法配置是基于切片粒度、切片类型粒度或租户粒度的安全算法列表，具体的，切片算法配置可以但不限于包含以下几种配置方式。
方式一、按照切片类型配置安全算法列表，切片算法配置包括网络切片类型与安全算法列表的一一对应关系，一个切片类型对应一个安全算法列表，不同的切片类型对应相同或不同的安全算法列表。同一个切片类型下的网络切片对应相同的安全算法列表。
方式二、按照切片实例配置安全算法列表，切片算法配置包括网络切片实例与安全算法列表的一一对应关系，一个网络切片实例对应一个安全算法列表，不同的网络切片实例可以对应相同或不同的安全算法列表。同一个切片类型下的网络切片可能对应相同或不停的安全算法列表。
方式三、按照切片内的租户配置安全算法列表，切片算法配置包括租户与安全算法列表的一一对应关系，一个租户对应一个安全算法列表，不同的租户对应相同或不同的安全算法列表。
6)默认算法
传统的通过AS SMC的流程配置的算法，该默认算法作为接入层所有数据链路的加密保护和完整性保护的算法，用户面和信令面共用一套安全算法。
7)安全算法、安全算法列表
安全算法包括加密和/或完整性保护算法。安全算法列表包括一个或多个加密算法以及各个加密算法的优先级；还包括一个或多个完整性算法以及各个完整性算法的优先级。
结合图1a所示的通信系统架构，下面详细介绍一下本申请实施例提供的安全算法的协商方法。该方法可以适用于网络切片的安全算法协商，还可以应用于网络切片中的承载网络的安全算法协商，其协商过程原理相同，可参考。
如图2所示，本申请实施例提供的安全算法的协商方法的流程如下所述。其中，图2所示的部分步骤为可选步骤，任意相邻的两个或多个步骤都可以形成本申请实施例需要保 护的方案。例如S202和S203可独立形成方案，属于本申请实施例需要保护的范围。
S201、网络设备确定本地是否存在切片算法配置，若是，则执行S202～S205，否则执行S202’和S203’。网络设备可以是指接入网设备，也可以是指核心网设备。若网络设备为接入网设备，则切片算法配置可以是预先配置的，也可以是核心网设备下发给基站的，如A FM下发给基站。
S202、网络设备获取终端接入的网络切片的信息，根据切片算法配置，确定终端接入的n个网络切片对应的n个目标安全算法列表，n为正整数。
若n为1，即终端接入一个网络切片，则网络设备根据切片算法配置，选择与终端接入的一个网络切片具有对应关系的一个目标安全算法列表；若n＞1，则网络设备根据切片算法配置，选择n个网络切片中的每一个网络切片分别对应的安全算法列表，得到n个目标安全算法列表。
具体地，若切片算法配置包含网络切片类型与安全算法列表的一一对应关系，那么，网络设备针对n个网络切片中的每一个网络切片执行：确定终端接入的网络切片所属的网络切片类型(为方便描述可称为目标网络切片类型)，根据切片算法配置，选择与目标网络切片类型具有对应关系的安全算法列表(为方便描述可称为目标安全算法列表)。
若切片算法配置包含网络切片与安全算法列表的一一对应关系，那么，网络设备针对n个网络切片中的每一个网络切片执行：确定与终端接入的网络切片具有对应关系的目标安全算法列表。
若切片算法配置包含租户与安全算法列表的一一对应关系，网络设备针对n个网络切片中的每一个网络切片执行：确定终端在网络切片的业务所属的租户，并根据切片算法配置，确定与终端在网络切片的业务所属的租户具有对应关系的目标安全算法列表。
根据以上方法共获得n个目标安全算法列表。
S203、网络设备在S202中确定的n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法。
网络设备在n个目标安全算法列表中的每一个目标安全算法列表中，可以选择符合终端安全能力的、且优先级最高的算法为目标安全算法。共选择n个目标安全算法，与n个网络切片对应，这样，终端接入的每一个网络切片对应的目标安全算法均已选择完毕。
S204、网络设备将所选择的目标安全算法发送给终端，终端接收网络设备发送的目标安全算法。具体的，网络设备向终端发送n个目标安全算法，并向终端指示与n个目标安全算法的每一个安全算法具有对应关系的网络切片。网络设备向终端指示终端接入的n个网络切片对应的n个目标安全算法，可以通过网络切片信息与目标安全算法的对应关系来指示。其中，网络设备可以通过上述第4)点介绍的方法来指示网络切片。例如，网络设备可以通过S-NSSAI来指示网络切片；或者，通过DRB ID来指示网络切片；或者，网络设备仅向终端发送n个目标安全算法，而不指示网络切片的信息，需要终端根据DRB来确定网络切片的信息。
S205、终端接收到网络设备发送的n个目标安全算法，以及与n个目标安全算法具有对应关系的网络切片的信息，确定n个网络切片中的每一个网络切片对应的目标安全算法。例如，网络切片的信息为S-NSSAI，终端根据S-NSSAI确定具体是哪一个网络切片，进一步获得该网络切片对应的目标安全算法；又例如，网络切片的信息为DRB ID，终端根据DRB ID关联PDU SESSION ID，再通过PDU SESSION ID来关联S-NSSAI，通过S-NSSAI 来确定网络切片，进一步获得该网络切片对应的目标安全算法。若终端仅接收到网络设备发送的n个目标安全算法，未接收到网络切片的信息，则终端根据当前建立的DRB所属的PDU SESSION，获取PDU SESSION ID，再通过PDU SESSION ID来关联S-NSSAI，通过S-NSSAI来确定网络切片，进一步获得该网络切片对应的目标安全算法。
S202’、网络设备根据默认配置的安全算法列表，选择一个目标安全算法；这里所选择的一个目标安全算法应用于终端与所接入的所有网络切片之间的链路，因此安全算法不会根据网络切片的不同进行区分，并且该目标安全算法适用于用户面和信令面。
S203’、网络设备将选择的一个目标安全算法发送给终端，终端接收网络设备发送的目标安全算法后，网络设备与终端就可以按照该目标安全算法进行链路通信的安全保护。
通过本申请实施例上述提供的安全算法的协商方法，能够实现不同切片对应不同的安全算法，使得安全算法的协商或应用的粒度更加细化，满足垂直行业不同的安全算法需求。并且当终端接入多个网络切片时，能够在一次协商过程中指示多个网络切片分别对应的安全算法，可以有效减少终端与接入网设备以及核心网网元之间的交互消息个数，减少空口负荷。
本申请实施例提供的安全算法的协商方法可以应用于终端接入网络切片并建立数据链路的场景(可以简称为场景一)，也可以应用于终端切换数据链路的场景(可以简称为场景二)。应用本申请实施例提供的方法获得的安全算法能够适用于UP面，场景一和场景二中，UP面保护的安全终结点可以位于接入网，即在接入网进行解密和完整性校验，也可以位于核心网，即在核心网进行解密和完整性校验。
以下通过场景一和场景二、以及安全终结点的位置，对本申请实施例提供的安全算法的协商方法做进一步详细说明。
如图3所示，在场景一中，安全终结点位于接入网，网络设备为接入网设备(基站)，安全算法的协商过程如下所述。
S300、初始化过程。
基站预配置或从AMF接收切片算法配置，按照切片类型、或网络切片实例、或租户，来配置不同的安全算法列表。例如，某个切片类型、或网络切片实例、或租户对应的安全算法列表为[(128-NEA0-低，128-NEA1-中，128-NEA2-高)，(128-NIA0-低，128-NIA1-中，128-NIA2-高)]。其中，本申请实施例所描述的128-NEA0、128-NEA1和128-NEA2为不同的加密算法的名称，128-NIA0、128-NIA1和128-NIA2为不同的完整性算法的名称，低、中、高代表不同的优先级。终端的安全能力即终端支持的安全算法，终端支持的安全算法为[(128-NEA0，128-NEA1，128-NEA2)，(128-NIA0，128-NIA1，128-NIA2)]。需要说明的是，加密算法和完整性算法的名称仅仅是一种举例，还可以更新为其它名称，同样适用于本申请实施例的方法，例如，加密算法的名称还可以是256-NEA0，256-NEA1，256-NEA2，完整性算法的名称还可以是256-NIA0，256-NIA1，256-NIA2。
S301、终端向AMF发送PDU会话建立请求，即PDU session establishment request，这样AMF就可以接收终端发送的PDU会话建立请求，PDU会话建立请求中可以携带终端的标识等信息。
S302、AMF向基站发送第一消息，这样基站就可以接收AMF发送的第一消息，第一消息用于请求建立终端与基站之间的会话，比如可以是PDU会话建立请求。
S303、基站选择目标安全算法。若S300中基站存在切片算法配置，则基站根据切片 算法配置，选择终端接入的网络切片对应的安全算法列表，在安全算法列表中选择符合终端安全能力的、且优先级最高的算法，作为目标安全算法。例如，终端建立的PDU会话所在的网络切片为切片1。切片1对应的安全算法列表为[(128-NEA0-低，128-NEA1-中)，(128-NIA0-低，128-NIA1-中)]。终端的安全能力即终端支持的安全算法为[(128-NEA0，128-NEA1，128-NEA2)，(128-NIA0，128-NIA1，128-NIA2)]。切片1对应的安全算法列表中终端支持的最高优先级的算法为[128-NEA1，128-NIA1]，[128-NEA1，128-NIA1]为切片1对应的目标安全算法。若终端还接入其它网络切片，则按照相同的方法选择目标安全算法，例如，终端接入切片2，切片2对应的安全算法列表为[(128-NEA0-低，128-NEA2-高)，(128-NIA0-低，128-NIA2-高)]，切片2对应的安全算法列表中终端支持的最高优先级的算法为[128-NEA2，128-NIA2]，[128-NEA1，128-NIA1]为切片2对应的目标安全算法。
若S300中基站不存在切片算法配置，则基站从默认配置的算法列表中选择一个终端支持的最高优先级的算法作为目标安全算法。
S304、基站向终端发送第二消息，终端就可以接收基站发送的第二消息，其中第二消息中可以携带S303中选择的目标安全算法。比如若S300中基站存在切片算法配置，可以携带网络切片与目标安全算法的对应关系，例如，携带[(S-NSSAI-1，128-NEA1，128-NIA1)，(S-NSSAI-2，128-NEA1，128-NIA1)]。S-NSSAI-1用于指示切片1，S-NSSAI-2用于指示切片2。当然，还可以用其它指示方式来指示不同的切片，具体方式如本申请实施例上述内容所述。可选的，第二消息用于RRC连接重配置，例如，第二消息为RRC connection reconfiguration request。RRC connection reconfiguration request携带[(S-NSSAI-1，128-NEA1，128-NIA1)，(S-NSSAI-2，128-NEA1，128-NIA1)]的信息。
若S300中基站不存在切片算法配置，S303中基站可以从默认配置的算法列表中选择一个终端支持的最高优先级的算法作为目标安全算法，则在第二消息中携带该目标安全算法。
若S300中基站不存在切片算法配置，基站还可以在第二消息中不携带安全算法，终端选择使用AS SMC中携带的算法作目标安全算法。
S305、终端向基站发送RRC连接重配置完成消息，即RRC connection reconfiguration complete消息。至此，终端与基站的安全算法的协商流程完毕，终端和基站使用目标安全算法作为UP面安全保护算法。
如图4所示，在场景一中，安全终结点位于核心网，网络设备为AMF，安全算法的协商过程如下所述。
S400、初始化过程。AMF预配置切片算法配置，按照切片类型、或网络切片实例、或租户，来配置不同的安全算法列表。例如，某个切片类型、或网络切片实例、或租户对应的安全算法列表为[(128-NEA0-低，128-NEA1-中，128-NEA2-高)，(128-NIA0-低，128-NIA1-中，128-NIA2-高)]。其中，128-NEA0、128-NEA1和128-NEA2为不同的加密算法的名称，128-NIA0、128-NIA1和128-NIA2为不同的完整性算法的名称，低、中、高代表不同的优先级。终端的安全能力即终端支持的安全算法为[(128-NEA0，128-NEA1，128-NEA2)，(128-NIA0，128-NIA1，128-NIA2)]。
S401、终端向AMF发送PDU会话建立请求，即PDU session establishment request。AMF接收终端发送的PDU会话建立请求。PDU会话建立请求中可以携带终端的标识等信息。AMF就可以根据PDU会话建立请求确定终端该PDU会话的业务所接入的网络切片。
S402、AMF选择目标安全算法。若S400中AMF存在切片算法配置，则AMF根据切片算法配置，选择终端接入的网络切片对应的安全算法列表，在安全算法列表中选择符合终端安全能力的、且优先级最高的算法，作为目标安全算法。例如，终端建立的PDU会话所在的网络切片为切片1。切片1对应的安全算法列表为[(128-NEA0-低，128-NEA1-中)，(128-NIA0-低，128-NIA1-中)]。终端的安全能力即终端支持的安全算法为[(128-NEA0，128-NEA1，128-NEA2)，(128-NIA0，128-NIA1，128-NIA2)]。切片1对应的安全算法列表中终端支持的最高优先级的算法为[128-NEA1，128-NIA1]，[128-NEA1，128-NIA1]为切片1对应的目标安全算法。
若S400中AMF不存在切片算法配置，则AMF可从默认配置的算法列表中选择一个终端支持的最高优先级的算法作为目标安全算法。
S403、AMF向基站发送消息，这里可以记为第三消息，基站接收AMF发送的第三消息。第三消息中可以携带402中选择的目标安全算法。
具体的，若S400中AMF存在切片算法配置，则AMF可以在第三消息中携带网络切片与目标安全算法的对应关系。仍以S402中切片1的对应的目标安全算法为例，在第三消息中携带信息[(S-NSSAI-1，128-NEA1，128-NIA1)]，S-NSSAI-1用于指示切片1。可选的，第三消息用于建立PDU会话，例如第三消息为PDU session establishment request，该PDU session establishment request中携带[(S-NSSAI-1，128-NEA1，128-NIA1)]的信息。
若S400中AFM不存在切片算法配置，AFM可以在第三消息中携带按照默认配置的算法列表选择的目标安全算法，或者，AFM在第三消息中不携带安全算法，终端使用AS SMC中携带的算法作为目标安全算法。
S403’、AMF向UPF发送目标安全算法。S403和S403’没有严格的执行顺序，可以交换顺序或同时进行。
S404、基站接收到AMF发送的第三消息后，向终端发送第四消息，例如，基站向终端发送的第四消息用于RRC连接重配置，则第四消息可以为RRC connection reconfiguration request。基站在向终端发送的第四消息中携带第三消息中的目标安全算法。例如，基站在RRC connection reconfiguration request中携带[(S-NSSAI-1，128-NEA1，128-NIA1)]的信息。或者，基站在RRC connection reconfiguration request中携带从默认配置的算法列表中选择的目标安全算法，或者，基站在RRC connection reconfiguration request中不携带安全算法，终端可以使用AS SMC中携带的算法作为目标安全算法。
S405、终端接收到第四消息之后，可以向基站发送RRC连接重配置完成消息，即RRC connection reconfiguration complete消息，该步骤可选。至此，终端与核心网设备的安全算法的协商流程完毕，终端和UPF之间就可以使用目标安全算法作为UP面安全保护算法。
如图5所示，在场景二中，安全终结点位于接入网，网络设备为目标基站，安全算法的协商过程如下所述。
S500、同S300，目标基站获取预配置的或从AMF接收的切片算法配置，其余对本步骤的介绍参见S300。
S501、源基站与目标基站之间进行切换请求流程。
本步骤同现有技术中的切换流程。源基站为终端当前接入的基站，目标基站为终端欲切换到的基站。
S502、目标基站接收到源基站发送的切片请求后，根据终端业务的上下文信息确定终 端接入的网络切片，再根据切片算法配置或默认算法配置选择目标安全算法，具体选择过程见S303中基站选择目标安全算法的过程，重复之处不再赘述。
S503、目标基站、源基站与终端之间进行切片请求响应。
本步骤同现有技术中的切片流程。
S504、同S304，目标基站向终端发送目标安全算法。其余对本步骤的介绍参见S304，重复之处不再赘述。
S505、同S305。
当基站支持CU-DU分离架构时，上述图5所示流程中的目标基站可以是gNB-CU。当gNB支持DU、CU-CP和CU-UP分离时，上述图5所示流程中的目标基站可以为gNB-CU-CP，具体的，gNB-CU-CP配置好切片算法配置，gNB-CU-CP选择终端接入的每个网络切片对应的目标安全算法，将目标安全算法发送给终端；或者，gNB-CU-CP配置好切片算法配置，gNB-CU-UP发送终端接入的每个网络切片对应的安全算法列表给gNB-CU-UP，由gNB-CU-UP选择每个网络切片对应的目标安全算法，再将选择的目标安全算法发送到终端；或者，gNB-CU-CP配置好切片算法配置，gNB-CU-UP选择终端接入的每个网络切片对应的目标安全算法，将选择的目标安全算法发送到gNB-CU-UP，由gNB-CU-UP将目标安全算法透传终端。透传即不改变原消息的内容来转发原消息。
至此，终端与目标基站的安全算法的协商流程完毕，终端和目标基站使用目标安全算法作为UP面安全保护算法。
类似的，可以在其他切换过程中，协商终端所接入的各个切片对应的安全算法，例如，可以适用于小区内切换、跨小区CU(包含CP和/或UP)内切换、跨小区跨CU(包含CP和/或UP)切换，如图6所示，在场景二中，安全终结点位于核心网，网络设备为AMF，安全算法的协商过程如下所述。
S600、同S400。目标AMF预配置切片算法配置，其余对本步骤的介绍参见S400。
S601、目标AMF、源AMF、目标基站与源基站之间进行切换流程，具体切换流程如现有技术中的切换流程。
S602、同S402。目标AMF选择目标安全算法，其余对本步骤的介绍参见S402，重复之处不再赘述。
S603、目标AMF向目标基站发送消息，目标基站接收目标AMF发送的消息，该消息的介绍参见S403中第三消息的介绍，重复之处不再赘述。
S603’、目标基站向UPF发送目标安全算法。
S603和S603’没有严格的执行顺序，可以交换顺序或同时进行。
S604、同S404，目标基站执行S404中基站执行的操作，重复之处不再赘述。
S605、同S405。
至此，终端与核心网设备的安全算法的协商流程完毕，终端和UPF之间使用目标安全算法作为UP面安全保护算法。
综上所述，本申请实施例中，可以在终端接入网络切片并建立数据链路的场景或者终端切换数据链路的场景中，实现基于切片或租户粒度的UP面安全算法协商。当UP面保护终结在基站时，若基站配置了切片算法配置，则可以选择终端接入的网络切片对应的安全算法，并发送给终端，若基站未配置切片算法配置，则可以根据默认配置的安全算法列表选择一个安全算法发送给终端，或根据现有的AS SMC中发送的安全算法作为最终的安 全算法。当UP面保护终结在核心网时，若核心网设备配置了切片算法配置，则可以选择终端接入的多个网络切片中的每一个网络切片分别对应的安全算法，发送给终端，若基站未配置切片算法配置，则可以根据默认配置的安全算法列表选择一个安全算法发送给终端，或根据现有的AS SMC中发送的安全算法作为最终的安全算法。这样，通过对不同切片对应不同安全算法的协商过程，能够满足垂直行业不同安全算法需求，当在终端执行切换过程中进行安全算法协商时，还可以同时协商多个切片对应的安全算法，减少了空口消息个数进而降低空口信令负荷。
基于与上述方法实施例相同的发明构思，如图7所示，本申请实施例还提供了一种安全算法的协商装置700，该安全算法的协商装置700用于执行上述方法实施例中网络设备执行的步骤。该安全算法的协商装置700包括处理单元701和发送单元702。可选的还包括接收单元703。其中：
处理单元701，用于根据切片算法配置，确定n个目标安全算法列表，n个目标安全算法列表与终端接入的n个网络切片分别具有对应关系，n为正整数；
处理单元701，用于在n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法；
发送单元702，用于将处理单元701选择的目标安全算法发送给终端。
其中，处理单元701、发送单元702和接收单元703可用于执行上述方法实施例中网络设备执行的其它步骤，重复之处在此不再赘述。
基于与上述方法实施例相同的发明构思，如图8所示，本申请实施例还提供了一种安全算法的协商装置800，该安全算法的协商装置800用于执行上述方法实施例中终端执行的步骤。该安全算法的协商装置800包括接收单元801和处理单元802。其中：
接收单元801，用于接收网络设备发送的n个目标安全算法，n个目标安全算法与所述终端接入的n个网络切片分别对应；
处理单元802，用于根据接收单元801接收的n个目标安全算法，与网络设备进行通信。
其中，接收单元801和处理单元802可用于执行上述方法实施例中终端执行的其它步骤，重复之处在此不再赘述。
基于与上述方法实施例相同的发明构思，如图9所示，本申请实施例还提供了一种安全算法的协商装置900，该安全算法的协商装置900用于执行上述方法实施例中网络设备或终端执行的操作，该安全算法装置900包括：收发器901、处理器902和存储器903。收发器901为可选的。处理器902用于调用一组程序，当程序被执行时，使得处理器902执行上述定位测量方法中终端执行的操作。存储器903用于存储处理器902执行的程序。图7中的功能模块发送单元702、接收单元703可以通过收发器901来实现，处理单元702可以通过处理器902来实现。图8中的功能模块接收单元801可以通过收发器901来实现，处理单元802可以通过处理器902来实现。
处理器902可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。
处理器902还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device， CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器903可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器903也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器903还可以包括上述种类的存储器的组合。
为了实现上述图7或图8或图9所述的装置的功能，本申请实施例还提供一种芯片，包括处理器，用于支持该装置实现上述方法实施例中网络设备或终端所涉及的功能。在一种可能的设计中，该芯片与存储器连接或者该芯片包括存储器，该存储器用于保存该装置必要的程序指令和数据。
本申请实施例提供了一种计算机存储介质，存储有计算机程序，该计算机程序包括用于执行上述安全算法的协商方法。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述安全算法的协商方法。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (30)

  1. 一种安全算法的协商方法，其特征在于，包括：
    网络设备根据切片算法配置，确定n个目标安全算法列表，所述n个目标安全算法列表与终端接入的n个网络切片分别具有对应关系，n为正整数；
    所述网络设备在所述n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法，并将所选择的目标安全算法发送给所述终端。
  2. 如权利要求1所述的方法，其特征在于，所述网络设备根据切片算法配置，确定n个目标安全算法列表，包括：
    所述切片算法配置中包括网络切片类型与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：确定所述终端接入的网络切片所属的目标网络切片类型，并根据所述切片算法配置，确定与所述目标网络切片类型具有对应关系的所述目标安全算法列表；或者，
    所述切片算法配置中包括网络切片与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：根据所述切片算法配置，确定与所述终端接入的网络切片具有对应关系的所述目标安全算法列表；
    所述切片算法配置中包括租户与安全算法列表的一一对应关系，所述网络设备针对所述n个网络切片中的每一个网络切片执行：确定终端在网络切片的业务所属的租户，并根据所述切片算法配置，确定与所述终端在网络切片的业务所属的租户具有对应关系的所述目标安全算法列表。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述网络设备若确定不存在所述切片算法配置，则根据本地配置的默认算法来进行安全算法协商。
  4. 如权利要求1～3任一项所述的方法，其特征在于，所述网络设备为接入网设备，所述目标安全算法用于所述终端与所述接入网设备之间链路的安全保护。
  5. 如权利要求1～3任一项所述的方法，其特征在于，所述网络设备为接入和移动性管理功能AMF，所述方法还包括：
    所述AMF向用户面功能UPF发送所选择的目标安全算法，所述目标安全算法用于所述终端与所述UPF之间链路的安全保护。
  6. 如权利要求4或5所述的方法，其特征在于，网络设备在确定n个目标安全算法列表之前，所述方法还包括：
    所述网络设备接收到第一消息，所述第一消息用于请求建立所述终端的会话，或者，所述第一消息用于请求切换。
  7. 如权利要求4所述的方法，其特征在于，所述网络设备将所选择的目标安全算法发送给所述终端，包括：
    所述网络设备向所述终端发送第二消息，所述第二消息中携带所选择的目标安全算法。
  8. 如权利要求5所述的方法，其特征在于，所述网络设备将所选择的目标安全算法发送给所述终端，包括：
    所述网络设备向接入网设备发送第三消息，所述第三消息中携带所选择的目标安全算 法，所述第三消息用于请求建立所述终端的会话，以及用于所述接入网设备根据所述第三消息向所述终端发送第四消息，所述第四消息携带所选择的目标安全算法。
  9. 如权利要求1～8任一项所述的方法，其特征在于，所述方法还包括：
    所述网络设备通过单个网络切片选择辅助信息S-NSSAI来向所述终端指示网络切片；或者，
    所述网络设备通过数据承载标识DRB ID来向所述终端指示网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
  10. 如权利要求1～9任一项所述的方法，其特征在于，所述网络设备在所述n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法，包括：
    所述网络设备在所述n个目标安全算法列表中的每一个目标安全算法列表中，选择符合终端安全能力的、且优先级最高的算法为目标安全算法。
  11. 一种安全算法的协商装置，其特征在于，包括：
    处理单元，用于根据切片算法配置，确定n个目标安全算法列表，所述n个目标安全算法列表与终端接入的n个网络切片分别具有对应关系，n为正整数；
    所述处理单元，用于在所述n个目标安全算法列表的每一个目标安全算法列表中，选择目标安全算法；
    发送单元，用于将所述处理单元选择的目标安全算法发送给所述终端。
  12. 如权利要求11所述的装置，其特征在于，所述切片算法配置中包括网络切片类型与安全算法列表的一一对应关系，所述处理单元用于，所述网络设备针对所述n个网络切片中的每一个网络切片执行：确定所述终端接入的网络切片所属的目标网络切片类型，并根据所述切片算法配置，确定与所述目标网络切片类型具有对应关系的所述目标安全算法列表；或者，
    所述切片算法配置中包括网络切片与安全算法列表的一一对应关系，所述处理单元用于，针对所述n个网络切片中的每一个网络切片执行：根据所述切片算法配置，确定与所述终端接入的网络切片具有对应关系的所述目标安全算法列表；
    所述切片算法配置中包括租户与安全算法列表的一一对应关系，所述处理单元用于，针对所述n个网络切片中的每一个网络切片执行：确定终端在网络切片的业务所属的租户，并根据所述切片算法配置，确定与所述终端在网络切片的业务所属的租户具有对应关系的所述目标安全算法列表。
  13. 如权利要求11或12所述的装置，其特征在于，所述处理单元还用于：
    若确定不存在所述切片算法配置，则根据本地配置的默认算法来进行安全算法协商。
  14. 如权利要求11～13任一项所述的装置，其特征在于，所述装置为接入网设备，所述目标安全算法用于所述终端与所述接入网设备之间链路的安全保护。
  15. 如权利要求11～13任一项所述的装置，其特征在于，所述装置为接入和移动性管理功能AMF，所述发送单元还用于：
    向用户面功能UPF发送所选择的目标安全算法，所述目标安全算法用于所述终端与所述UPF之间链路的安全保护。
  16. 如权利要求14或15所述的装置，其特征在于，所述装置还包括接收单元，在确定n个目标安全算法列表之前，所述接收单元用于接收到第一消息，所述第一消息用于请 求建立所述终端的会话，或者，所述第一消息用于请求切换。
  17. 如权利要求14所述的装置，其特征在于，所述发送单元用于，向所述终端发送第二消息，所述第二消息中携带所选择的目标安全算法。
  18. 如权利要求15所述的装置，其特征在于，所述发送单元用于，向接入网设备发送第三消息，所述第三消息中携带所选择的目标安全算法，所述第三消息用于请求建立所述终端的会话，以及用于所述接入网设备根据所述第三消息向所述终端发送第四消息，所述第四消息携带所选择的目标安全算法。
  19. 如权利要求11～18任一项所述的装置，其特征在于，所述处理单元还用于，通过单个网络切片选择辅助信息S-NSSAI来向所述终端指示网络切片；或者，
    通过数据承载标识DRB ID来向所述终端指示网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
  20. 如权利要求11～19任一项所述的装置，其特征在于，所述处理单元用于，在所述n个目标安全算法列表中的每一个目标安全算法列表中，选择符合终端安全能力的、且优先级最高的算法为目标安全算法。
  21. 一种安全算法的协商方法，其特征在于，包括：
    终端接收网络设备发送的n个目标安全算法，所述n个目标安全算法与所述终端接入的n个网络切片分别对应；
    所述终端根据所述n个目标安全算法，与所述网络设备进行通信。
  22. 如权利要求21所述的方法，其特征在于，所述网络设备为接入网设备，所述目标安全算法用于所述终端与所述接入网设备之间链路的安全保护。
  23. 如权利要求21所述的方法，其特征在于，所述网络设备为接入和移动性管理功能AMF，所述目标安全算法用于所述终端与所述用户面功能UPF之间链路的安全保护。
  24. 如权利要求21～23任一项所述的方法，其特征在于，所述终端根据以下任一种方式区分网络切片：
    通过单个网络切片选择辅助信息S-NSSAI来区分网络切片；或者，通过数据承载标识DRB ID来区分网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
  25. 一种安全算法的协商装置，其特征在于，包括：
    接收单元，用于接收网络设备发送的n个目标安全算法，所述n个目标安全算法与所述终端接入的n个网络切片分别对应；
    处理单元，用于根据所述接收单元接收的所述n个目标安全算法，与所述网络设备进行通信。
  26. 如权利要求25所述的装置，其特征在于，所述处理单元还用于：
    根据以下任一种方式区分网络切片：通过单个网络切片选择辅助信息S-NSSAI来区分网络切片；或者，通过数据承载标识DRB ID来区分网络切片，其中，所述DRB ID与协议数据单元会话标识PDU SESSION ID具有关联关系，所述PDU SESSION ID与S-NSSAI具有关联关系。
  27. 一种安全算法的协商装置，其特征在于，包括收发器和处理器，所述收发器与所述处理器相连，所述收发器用于接收和发送信号，所述处理器用于调用一组程序，当所述 程序被执行时，所述处理器执行如权利要求1～10、21～24任一项所述的方法。
  28. 一种计算机可读存储介质，其特征在于，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行如权利要求1-10、21～24任意一项所述的方法。
  29. 一种计算机程序产品，其特征在于，当计算机读取并执行所述计算机程序产品时，使得计算机执行如权利要求1-10、21～24任意一项所述的方法。
  30. 一种芯片，其特征在于，所述芯片与存储器相连或者所述芯片包括所述存储器，用于读取并执行所述存储器中存储的软件程序，以实现如权利要求1-10、21～24任意一项所述的方法。
PCT/CN2019/076079 2018-04-19 2019-02-25 一种安全算法的协商方法及装置 WO2019201017A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810355864.3 2018-04-19
CN201810355864.3A CN110392370A (zh) 2018-04-19 2018-04-19 一种安全算法的协商方法及装置

Publications (1)

Publication Number Publication Date
WO2019201017A1 true WO2019201017A1 (zh) 2019-10-24

Family

ID=68240430

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/076079 WO2019201017A1 (zh) 2018-04-19 2019-02-25 一种安全算法的协商方法及装置

Country Status (2)

Country Link
CN (1) CN110392370A (zh)
WO (1) WO2019201017A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021174439A1 (en) * 2020-03-04 2021-09-10 Nokia Shanghai Bell Co., Ltd. Allocation resource of network slice
CN114025392A (zh) * 2020-07-15 2022-02-08 中移物联网有限公司 网络切片创建方法及相关设备
CN114640549A (zh) * 2022-05-19 2022-06-17 江西神舟信息安全评估中心有限公司 一种工业控制系统的防护方法及工业控制系统
WO2023151587A1 (zh) * 2022-02-11 2023-08-17 维沃移动通信有限公司 目标面数据传输方法、终端及网络侧设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111787533B (zh) * 2020-06-30 2022-08-26 中国联合网络通信集团有限公司 加密方法、切片管理方法、终端及接入和移动性管理实体
KR102319089B1 (ko) * 2020-11-02 2021-10-29 주식회사 윈스 모바일 엣지 컴퓨팅의 슬라이싱 서비스에서 트래픽 보안 처리를 위한 장치 및 방법
CN113905380A (zh) * 2021-11-01 2022-01-07 中国电信股份有限公司 接入层安全算法处理方法、系统、设备及存储介质
CN114363029B (zh) * 2021-12-28 2024-04-12 中国电信股份有限公司 差异化网络接入认证方法、装置、设备及介质
CN117858075A (zh) * 2022-09-30 2024-04-09 中兴通讯股份有限公司 承载建立处理方法、装置、系统及基站

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107094127A (zh) * 2016-02-18 2017-08-25 电信科学技术研究院 安全信息的处理方法及装置、获取方法及装置
WO2017188392A1 (en) * 2016-04-29 2017-11-02 Nec Corporation Method of enabling slice security separation
WO2017190134A2 (en) * 2016-04-29 2017-11-02 Motorola Mobility Llc Procedures to support network slicing in a wirless communication system
CN107846275A (zh) * 2016-09-20 2018-03-27 中兴通讯股份有限公司 切片网络安全隔离的方法及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106210042B (zh) * 2016-07-11 2019-06-18 清华大学 一种基于端到端网络切片的用户服务请求选择方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107094127A (zh) * 2016-02-18 2017-08-25 电信科学技术研究院 安全信息的处理方法及装置、获取方法及装置
WO2017188392A1 (en) * 2016-04-29 2017-11-02 Nec Corporation Method of enabling slice security separation
WO2017190134A2 (en) * 2016-04-29 2017-11-02 Motorola Mobility Llc Procedures to support network slicing in a wirless communication system
CN107846275A (zh) * 2016-09-20 2018-03-27 中兴通讯股份有限公司 切片网络安全隔离的方法及装置

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021174439A1 (en) * 2020-03-04 2021-09-10 Nokia Shanghai Bell Co., Ltd. Allocation resource of network slice
CN115211159A (zh) * 2020-03-04 2022-10-18 上海诺基亚贝尔股份有限公司 网络切片的分配资源
CN114025392A (zh) * 2020-07-15 2022-02-08 中移物联网有限公司 网络切片创建方法及相关设备
WO2023151587A1 (zh) * 2022-02-11 2023-08-17 维沃移动通信有限公司 目标面数据传输方法、终端及网络侧设备
CN114640549A (zh) * 2022-05-19 2022-06-17 江西神舟信息安全评估中心有限公司 一种工业控制系统的防护方法及工业控制系统
CN114640549B (zh) * 2022-05-19 2022-08-09 江西神舟信息安全评估中心有限公司 一种工业控制系统的防护方法及工业控制系统

Also Published As

Publication number Publication date
CN110392370A (zh) 2019-10-29

Similar Documents

Publication Publication Date Title
WO2019201017A1 (zh) 一种安全算法的协商方法及装置
EP3592035B1 (en) Mobile network switching method and communication device
KR102180383B1 (ko) 셀 구성 방법 및 장치
TWI733216B (zh) 無效協定資料單元會話之處理方法及其使用者設備
WO2019157885A1 (zh) 集中式单元-分布式单元架构下的通信方法、通信设备
US20190335365A1 (en) Network Handover Method and Related Device
JP6723347B2 (ja) データ無線ベアラを再構成する方法及びユーザ装置
JP6661663B2 (ja) データ無線ベアラを再構成する方法及びユーザ装置
WO2018202101A1 (zh) 一种通信方法及设备
EP3817453B1 (en) Communication method and apparatus
US11412563B2 (en) Multi-connectivity communication method and device
CN112351431B (zh) 一种安全保护方式确定方法及装置
WO2019185062A1 (zh) 一种通信方法及装置
WO2020135850A1 (zh) 通信方法和装置
JP2017514367A (ja) ベアラ管理装置、方法及び通信システム
CN110913439A (zh) 一种网元选择方法及装置
EP3749046A1 (en) Processing method for wireless backhaul communication and related device
JP6635973B2 (ja) データ分流のための方法およびデバイス
EP3346761B1 (en) Device and method for handling a packet flow in inter-system mobility
US20230199550A1 (en) Relay Management Method and Communication Apparatus
WO2017195854A1 (ja) 無線通信システム及びユーザ装置
US20230239940A1 (en) Data transmission method and apparatus
JP2019009720A (ja) 端末装置、基地局装置、通信方法、および、集積回路
WO2017152360A1 (zh) 一种为无线承载进行安全配置方法和设备
WO2017117804A1 (zh) 终端设备、接入网设备、空口配置方法和无线通信系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19789324

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19789324

Country of ref document: EP

Kind code of ref document: A1