WO2019205934A1

WO2019205934A1 - Information transmission method and relevant device

Info

Publication number: WO2019205934A1
Application number: PCT/CN2019/082017
Authority: WO
Inventors: 刘强生; 王爱成
Original assignee: 华为技术有限公司
Priority date: 2018-04-26
Filing date: 2019-04-10
Publication date: 2019-10-31
Also published as: CN110417708A; CN110417708B

Abstract

Disclosed are an information transmission method and a relevant device. Same are used for reducing CPU resource consumption and reducing cost while ensuring data security. The method of the embodiments of the present application comprises: a central unit (CU) performing security negotiation with a user equipment (UE) to obtain a negotiation result, wherein the negotiation result is used for indicating whether an air interface between the CU and the UE is encrypted using a packet data convergence protocol (PDCP); and the CU sending a first message to a distributed unit (DU), wherein when the negotiation result indicates that the air interface is encrypted using the PDCP protocol, the first message indicates that a user plane bearer between the CU and the DU is not encrypted using an Internet Protocol Security (IPSec) protocol.

Description

Information transmission method and related equipment

The present application claims priority to Chinese Patent Application No. 20 181 039 184 7.5, filed on Apr. 26, 2018, the entire disclosure of which is incorporated herein by reference. in.

Technical field

The present application relates to the field of wireless communications technologies, and in particular, to an information transmission method and related devices.

Background technique

The uplink data sent by the user equipment (UE) is transmitted to the core network through the base station (eNodeB, eNB), and the uplink data needs to undergo the following encryption/decryption process, as shown in FIG. A base station encryption diagram includes: 1. The UE performs air interface encryption on the uplink data to protect the uplink data in the wireless transmission process; 2. After receiving the uplink data sent by the UE, the eNB decrypts the uplink data, and Before the decrypted uplink data is sent to the core network, encryption is performed again to protect the security of the network transmission process of the uplink data on the backhaul network. Similarly, the downlink data sent from the core network to the UE also needs to undergo two encryption and decryption processes.

In the prior art, a conventional eNB node can be decomposed into a central unit (CU) and a plurality of distributed units (DUs), and communication between the CU and the DU needs to cross the backhaul network. In order to ensure the security of communication between CU-DUs, Internet Protocol Security (IPSec) is introduced. Therefore, in order to ensure the security of data transmission between CU-DUs, it is necessary to The data is IPSec added/decrypted.

However, in the prior art, IPSec encryption/decryption requires a large amount of CPU resources to be consumed, resulting in an increase in cost.

Summary of the invention

The embodiment of the present application provides an information transmission method and related device, which are used to reduce CPU consumption and reduce cost while ensuring data security.

A first aspect of the embodiments of the present application provides an information transmission method, including: performing a security negotiation between a central unit CU and a user equipment UE, and obtaining a negotiation result, where the negotiation result is used to indicate between the CU and the UE. Whether the air interface is encrypted using a packet data convergence layer PDCP protocol; the CU transmitting a first message to the distributed unit DU; when the negotiation result indicates that the air interface is encrypted using the PDCP protocol, the first message is used The user plane bearer between the CU and the DU is indicated not to be encrypted using the Internet Protocol Secure IPSec protocol.

In a possible implementation, in a first implementation manner of the first aspect of the embodiments, the DU is provided with a first interface, where the first interface is a user plane communication between the DU and the CU. The first interface is configured with a first encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is subjected to encryption/decryption processing using the IPSec protocol; The unencrypted address is used to indicate that the IPSec protocol is not used to perform encryption/decryption processing on the user plane data packet; after the CU sends the first message to the DU, the method further includes: the CU receiving the sent by the DU And a first response message, where the first response message is used to indicate that the address carried by the user plane at the DU end is the first unencrypted address.

In a possible implementation, in a second implementation manner of the first aspect of the embodiment of the present application, after the CU receives the first response message sent by the DU, the method further includes: using the CU The PDCP protocol encrypts the downlink user plane data packet; the CU sets the destination address of the downlink user plane data packet to the first unencrypted address; and the CU determines according to the first unencrypted address. The downlink user plane data packet is not encrypted by using the IPSec protocol; the CU sends the downlink user plane data packet to the DU.

In a possible design, in a third implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the first message is used. And indicating that the user plane bearer is encrypted by using the IPSec protocol; the first response message is used to indicate that the address that the user plane bears at the DU end is the first encrypted address.

In a possible design, in a fourth implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the method further includes: The CU sets the destination address of the downlink user plane data packet to the first encrypted address, and the CU determines, according to the first encrypted address, the downlink user plane data packet to be encrypted by using the IPSec protocol. Obtaining the encrypted downlink user plane data packet; the CU sends the encrypted downlink user plane data packet to the DU.

In a possible design, in a fifth implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, and the CU and the DU are The method further includes: the CU encrypts the downlink user plane data packet by using the PDCP protocol; and the CU sets the destination address of the downlink user plane data packet to The first non-encrypted address; the CU sends the downlink user plane data packet to the SeGW.

In a possible design, in a sixth implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface does not use the PDCP protocol encryption, and the CU and the DU When the communication between the two passes through the SeGW, the method further includes: the CU setting a destination address of the downlink user plane data packet as the first encrypted address; and sending, by the CU, the downlink user plane data packet The SeGW.

In a possible design, in a seventh implementation manner of the first aspect of the embodiments, the CU has a second interface, where the second interface is a user plane communication between the CU and the DU The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; The non-encrypted address is used to indicate that the user plane data message is not subjected to encryption/decryption processing using the IPSec protocol.

In a possible design, in an eighth implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the first message carries The second encrypted address.

In a possible design, in a ninth implementation manner of the first aspect of the embodiments of the present application, when the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, the first message carries Said second non-encrypted address.

In a possible design, in a tenth implementation manner of the first aspect of the embodiments, the method further includes: the CU receiving a target user plane data packet; and when the target user plane data packet When the protocol port number used is included in the first interval, the CU determines to use the IPSec protocol to encrypt/decrypt the target user plane data packet; when the protocol port number used by the target user plane data packet includes In the second interval, the CU determines to use the IPSec protocol to encrypt/decrypt the target user plane data packet; or, when the protocol used by the target user plane data packet is the first protocol, The CU determines to use the IPSec protocol to add/decrypt the target user plane data packet; when the protocol used by the target user plane data packet is the second protocol, the CU determines not to use the IPSec The protocol adds/decrypts the target user plane data message.

A second aspect of the embodiments of the present application provides an information transmission method, including: when an air interface between a central unit CU and a user equipment UE is encrypted by using a packet data convergence layer PDCP protocol, the distributed unit DU receives the CU transmission. The first message is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.

In a possible implementation, in a first implementation manner of the second aspect of the embodiments, the DU is provided with a first interface, where the first interface is user plane communication between the DU and the CU. The first interface is configured with a first encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is subjected to encryption/decryption processing using the IPSec protocol; The non-encrypted address is used to indicate that the user plane data packet is not subjected to encryption/decryption processing using the IPSec protocol; and when the air interface is encrypted by using the PDCP protocol, the method further includes: the DU to the CU Sending a first response message, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.

In a possible implementation, in a second implementation manner of the second aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, the method further includes: the DU receiving the UE And sending, by the DU, the source address of the uplink user plane data packet to the first unencrypted address; the DU determining, according to the first unencrypted address, not using the The IPSec protocol encrypts the uplink user plane data packet, and the DU sends the uplink user plane data packet to the CU.

In a possible design, in a third implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol to encrypt, the first message is used to indicate the user plane. The bearer is encrypted by using the IPSec protocol; the first response message is used to indicate that the address carried by the user plane on the DU end is the first encrypted address.

In a possible design, in a fourth implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol encryption, the method further includes: the DU receiving the The uplink user plane data packet sent by the UE; the DU sets the source address of the uplink user plane data packet to the first encrypted address; the DU determines, according to the first encrypted address, the IPSec The protocol encrypts the uplink user plane data packet to obtain the encrypted uplink user plane data packet, and the DU sends the encrypted uplink user plane data packet to the CU.

In a possible design, in a fifth implementation manner of the second aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, and communication between the DU and the CU passes through a SeGW The method further includes: the DU receiving an uplink user plane data packet sent by the UE; the DU setting a source address of the uplink user plane data packet as the first unencrypted address; The DU is determined according to the first unencrypted address, and the uplink user plane data packet is not encrypted by using the IPSec protocol; the DU sends the uplink user plane data packet to the SeGW.

In a possible design, in a sixth implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol encryption, and the communication between the DU and the CU passes In the case of the SeGW, the method further includes: the DU receiving an uplink user plane data packet sent by the UE; and the DU setting a source address of the uplink user plane data packet as the first encrypted address; Determining, according to the first encrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol, to obtain an encrypted uplink user plane data packet; and the DU will be the encrypted uplink user. The face data message is sent to the SeGW.

In a possible design, in a seventh implementation manner of the second aspect of the embodiment, the CU has a second interface, where the second interface is a user plane communication between the CU and the DU. The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; The non-encrypted address is used to indicate that the user plane data message is not subjected to encryption/decryption processing using the IPSec protocol.

In a possible design, in an eighth implementation manner of the second aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, the first message carries the second non-encrypted address.

In a possible design, in a ninth implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol to encrypt, the first message carries the second encryption address.

In a possible design, in a tenth implementation manner of the second aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, the method further includes: the DU receiving the UE The uplink user plane data packet sent; the DU sets the destination address of the uplink user plane data packet to the second unencrypted address; the DU determines according to the second unencrypted address, and does not use the The IPSec protocol encrypts the uplink user plane data packet, and the DU sends the uplink user plane data packet to the CU.

In a possible design, in an eleventh implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol encryption, the method further includes: the DU receiving station An uplink user plane data packet sent by the UE; the DU sets a destination address of the uplink user plane data packet as the second encryption address; and the DU determines, according to the second encryption address, using the The IPSec protocol encrypts the uplink user plane data packet to obtain the encrypted uplink user plane data packet, and the DU sends the encrypted uplink user plane data packet to the CU.

In a possible design, in a twelfth implementation manner of the second aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, and the communication between the DU and the CU is In the case of the SeGW, the method further includes: the DU receiving an uplink user plane data packet sent by the UE; the DU setting a destination address of the uplink packet to the second unencrypted address; Determining, according to the second unencrypted address, the uplink user plane data packet is not encrypted by using the second protocol; the DU sending the uplink user plane data packet to the SeGW.

In a possible design, in a thirteenth implementation manner of the second aspect of the embodiments of the present application, when the air interface does not use the PDCP protocol encryption, and the communication between the DU and the CU The method further includes: the DU receiving an uplink user plane data packet sent by the UE; the DU setting a destination address of the uplink user plane data packet as the second encrypted address; Determining, according to the second encrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol, to obtain an encrypted uplink user plane data packet; and the DU will be the encrypted The uplink user plane data packet is sent to the SeGW.

A third aspect of the embodiments of the present application provides a central unit CU, including: a first transceiver unit, configured to perform security negotiation with a user equipment UE, to obtain a negotiation result, where the negotiation result is used to indicate the CU and the Whether the air interface between the UEs is encrypted using the packet data convergence layer PDCP protocol; the second transceiver unit is configured to send the first message to the distributed unit DU; when the negotiation result indicates that the air interface uses the PDCP protocol to encrypt The first message is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.

In a possible implementation, in a first implementation manner of the third aspect of the embodiments, the DU has a first interface, where the first interface is a user plane communication between the DU and the CU. The first interface is configured with a first encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is subjected to encryption/decryption processing using the IPSec protocol; The non-encrypted address is used to indicate that the IPSec protocol is not used to perform encryption/decryption processing on the user plane data packet; the second transceiver unit is further configured to: receive the first response message sent by the DU, the first response The message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.

In a possible implementation, in a second implementation manner of the third aspect of the embodiments of the present application, the CU further includes: a processing unit, configured to encrypt, by using the PDCP protocol, a downlink user plane data packet; Setting a destination address of the downlink user plane data packet to the first unencrypted address, and determining, configured to determine, according to the first unencrypted address, the downlink user plane data by using the IPSec protocol The packet is encrypted. The second transceiver unit is further configured to send the downlink user plane data packet to the DU.

In a possible design, in a third implementation manner of the third aspect of the embodiments of the present application, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the first message is used. And indicating that the user plane bearer is encrypted by using the IPSec protocol; the first response message is used to indicate that the address that the user plane bears at the DU end is the first encrypted address.

In a possible design, in a fourth implementation manner of the third aspect of the embodiments of the present application, when the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, and the CU and the DU are The CU further includes: the processing unit is further configured to: encrypt the downlink user plane data packet by using the PDCP protocol; and use the destination address of the downlink user plane data packet And the third transceiver unit is configured to send the downlink user plane data packet to the SeGW.

In a possible implementation, in a fifth implementation manner of the third aspect of the embodiments, the CU has a second interface, where the second interface is a user plane communication between the CU and the DU. The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; The non-encrypted address is used to indicate that the user plane data message is not subjected to encryption/decryption processing using the IPSec protocol.

A fourth aspect of the present application provides a distributed unit DU, including: a first transceiver unit, configured to receive when an air interface between a central unit CU and a user equipment UE is encrypted using a packet data convergence layer PDCP protocol. The first message sent by the CU is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.

In a possible design, in a first implementation manner of the fourth aspect of the embodiments of the present application, the DU has a first interface, and the first interface is a user plane communication between the DU and the CU. The first interface is configured with a first encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is subjected to encryption/decryption processing using the IPSec protocol; The non-encrypted address is used to indicate that the IPSec protocol is not used to perform encryption/decryption processing on the user plane data packet; when the air interface is encrypted by using the PDCP protocol, the first transceiver unit is further configured to: The CU sends a first response message, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.

In a possible design, in a second implementation manner of the fourth aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, the DU further includes: the second transceiver unit, And the processing unit is configured to: set a source address of the uplink user plane data packet to the first unencrypted address; the determining unit is further configured to: Determining, according to the first unencrypted address, that the uplink user plane data packet is not encrypted by using the IPSec protocol; the first transceiver unit is further configured to send the uplink user plane data packet to The CU.

In a possible design, in a third implementation manner of the fourth aspect of the embodiments of the present application, when the air interface is encrypted by using the PDCP protocol, and the communication between the DU and the CU passes through the SeGW The DU further includes: the second transceiver unit is further configured to: receive an uplink user plane data packet sent by the UE; the processing unit is further configured to: source the uplink user plane data packet Setting the address as the first non-encrypted address; the determining unit is further configured to: according to the first unencrypted address, encrypt the uplink user plane data packet without using the IPSec protocol; The third transceiver unit is further configured to send the uplink user plane data packet to the SeGW.

In a possible design, in a fourth implementation manner of the fourth aspect of the embodiments, the CU has a second interface, where the second interface is a user plane communication between the CU and the DU. The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; The non-encrypted address is used to indicate that the IPSec protocol is not used to perform encryption/decryption processing on the user plane data packet; when the air interface is encrypted by using the PDCP protocol, the DU further includes: the second transceiver unit, The processing unit is further configured to: set the destination address of the uplink user plane data packet to the second unencrypted address; the determining unit is further configured to receive the uplink user plane data packet sent by the UE. The method further includes: determining, according to the second unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol; the first transceiver unit is further configured to use the uplink user plane datagram Send to The CU.

A fifth aspect of the present application provides a computer readable storage medium having stored therein instructions that, when executed on a computer, cause the computer to perform the methods described in the above aspects.

A sixth aspect of the present application provides a computer program product comprising instructions which, when run on a computer, cause the computer to perform the methods described in the various aspects above.

As can be seen from the foregoing technical solutions, the embodiment of the present application has the following advantages: the central unit CU performs security negotiation with the user equipment UE, and obtains a negotiation result, where the negotiation result is used to indicate an air interface between the CU and the UE. Whether to use the packet data convergence layer PDCP protocol encryption; the CU sends a first message to the distributed unit DU; when the negotiation result indicates that the air interface uses the PDCP protocol to encrypt, the first message is used to indicate The user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol. In the embodiment of the present application, when the result of the negotiation between the CU and the UE is that the air interface between the CU and the UE is encrypted by using the PDCP protocol, the CU notifies the user plane bearer between the DUCU and the DU that the IPSec protocol is not used for encryption, and the data is guaranteed. At the same time of security, it also reduces CPU resource consumption and reduces costs.

DRAWINGS

1 is a schematic diagram of a possible existing base station encryption;

FIG. 2 is a schematic diagram of a possible function provided by an embodiment of the present application;

FIG. 3 is a schematic diagram of a possible data encryption transmission according to an embodiment of the present application;

4a is a flowchart of a possible information transmission method according to an embodiment of the present application;

FIG. 4b is a flowchart of another possible information transmission method according to an embodiment of the present application;

4c is a schematic diagram of a possible interface provided by an embodiment of the present application;

FIG. 4 is a schematic diagram of a possible data packet transmission according to an embodiment of the present application;

FIG. 5 is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 5b is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 6 is a flowchart of another possible method for transmitting information according to an embodiment of the present application;

FIG. 6b is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 7 is a schematic diagram of another possible data encryption transmission provided by an embodiment of the present application;

FIG. 7b is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 7c is a flowchart of another possible method for transmitting information according to an embodiment of the present application;

FIG. 8 is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 8b is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 9 is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 9b is a flowchart of another possible information transmission method according to an embodiment of the present application;

FIG. 10 is a schematic diagram of an embodiment of a possible central unit according to an embodiment of the present application; FIG.

FIG. 11 is a schematic diagram of an embodiment of a possible distributed unit according to an embodiment of the present disclosure;

FIG. 12 is a schematic block diagram of a communication apparatus according to an embodiment of the present application;

FIG. 13 is a schematic structural diagram of a communication apparatus according to an embodiment of the present application;

FIG. 14 is a schematic structural diagram of a system according to an embodiment of the present application.

detailed description

The technical solutions in the embodiments of the present invention will be described with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments.

The terms "first", "second", "third", "fourth", etc. (if present) in the specification and claims of the present invention and the above figures are used to distinguish similar objects without having to use To describe a specific order or order. It is to be understood that the data so used may be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than what is illustrated or described herein. In addition, the terms "comprises" and "comprises" and "the" and "the" are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

The embodiment of the present application provides an information transmission method and related equipment, which are used to ensure data security, reduce CPU resource consumption, and speed up the system.

In the process of continuous evolution of wireless base stations, there has been a demand to re-segment the eNB function. The function of the eNB node is split into two parts: CU and DU, and the functions of the CU and the DU are separated and deployed. The DU is deployed in the original access network and the CU is moved closer to the core network. In addition, as shown in FIG. 2, a possible function diagram of the present application is provided. In FIG. 2, the air interface of the eNB adopts a hierarchical structure, and the radio link control (RRC) is sequentially from top to bottom. PDCP-radio link control (RLC)-media access control (MAC)-physical layer (PHY) level, eNB through the S1 interface and evolved packet core network (evolved packet Core, EPC) is connected for signaling or data transmission. In the architecture of eNB re-segmentation, RRC and PDCP in the original eNB are deployed on the CU, RLC, MAC, and PHY are deployed on the DU, and the CU and EPC pass. The S1 interface is connected, and the CU and the DU are connected by the new interface Itf-CuDu to transmit signaling or data. It should be noted that the naming manner of the new interface is not limited in this application.

In the eNB re-segmentation scenario, the user data transmitted by the UE is transmitted to the CU, and needs to undergo the following encryption/decryption process. As shown in FIG. 3, it is a possible data encryption transmission diagram, including: user data flow. The process from the UE through the DU to the CU, where

The air interface is encrypted between the UE and the CU to ensure the security of the user data in the wireless transmission process. It should be noted that the air interface encryption/decryption is handled by the PDCP in the 3gpp protocol, so there is corresponding processing on the UE and the CU. The module is responsible for PDCP encryption and PDCP decryption;

The IPSec protocol is introduced between the CU and the DU for encryption to ensure the security of user data transmission between the CU and the DU. Therefore, there are corresponding processing modules on the DU and the CU to be responsible for IPSec encryption and IPSec decryption.

It should be noted that the user data of the UE to the CU has been PDCP encrypted in many scenarios, and the user data is transmitted on the CU-DU interface. From the perspective of user data security, it is unnecessary to use IPSec encryption again, and IPSec encryption and decryption also consume a lot of CPU resources. In view of this, the embodiment of the present application provides a data encryption method, which can be applied to various application scenarios, including:

A: When the communication between the CU and the DU does not pass through the SeGW:

Scenario 1: The first interface on the DU side is configured with a specific IP address on the DU side to establish a user plane bearer. The specific IP address on the DU side is used to distinguish whether the user plane bearer between the DU and the CU is encrypted by using the IPSec protocol. The specific IP address of the DU side includes a first encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted by using the IPSec protocol, and the first non-encrypted address is used. The user interface is instructed to perform encryption/decryption processing on the user plane data packet without using the IPSec protocol, and the first interface is an interface for the user plane communication between the DU and the CU. In addition, the IP address on the second interface on the CU side does not need to distinguish between the DU and the Whether the user plane bearer between the CUs is encrypted by using the IPSec protocol, where the second interface is an interface for the user plane communication between the CU and the DU;

Scenario 2: The first interface on the DU side is configured with a specific IP address on the DU side to establish a user plane bearer, and the second interface on the CU side is also configured with a specific IP address on the CU side to establish a user plane bearer. The IP address is used to distinguish whether the user plane bearer between the CU and the DU is encrypted by using the IPSec protocol, for example, the specific IP address of the CU side includes a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate The user plane data packet is encrypted/decrypted by using the IPSec protocol, and the second non-encrypted address is used to indicate that the user plane data packet is not encrypted/decrypted by using the IPSec protocol;

Scenario 3: The second interface on the CU side is configured with a specific IP address on the CU side to establish a user plane bearer, and the IP address on the first interface on the DU side does not need to distinguish whether the user plane bearer between the DU and the CU is encrypted by using the IPSec protocol. .

B: When the communication between the CU and the DU passes through the SeGW:

Scenario 4: The first interface on the DU side is configured with a specific IP address on the DU side to establish a user plane bearer, and the IP address on the second interface on the CU side does not need to distinguish whether the user plane bearer between the DU and the CU uses the IPSec protocol. encryption;

Scenario 5: The first interface on the DU side is configured with a specific IP address on the DU side to establish a user plane bearer, and the second interface on the CU side is also configured with a specific IP address on the CU side to establish a user plane bearer.

Scenario 6: The second interface on the CU side is configured with a specific IP address on the CU side to establish a user plane bearer, and the IP address on the first interface on the DU side does not need to distinguish whether the user plane bearer between the DU and the CU is encrypted by using the IPSec protocol. .

The following description will be respectively made based on the above-described scenarios in conjunction with specific embodiments.

Referring to FIG. 4a and FIG. 4b, an embodiment of the method in the scenario 1 of the embodiment of the present application is introduced, which specifically includes:

401. The CU performs security negotiation with the UE to obtain a negotiation result.

The CU performs security negotiation with the UE, and obtains a negotiation result. The negotiation result is used to indicate whether the air interface between the CU and the UE is encrypted using the PDCP protocol, where the air interface is an interface between the UE and the base station.

It should be noted that the CU and the UE perform the security negotiation to obtain the negotiation result in multiple manners, including: the UE sends the algorithm set information to the CU, where the algorithm set information includes information of the algorithm supported by the UE; and the CU receives the algorithm set information. After comparing the algorithm in the algorithm set information with the algorithm supported by the CU, the intersection algorithm is determined, and the intersection algorithm is an algorithm supported by both the CU and the UE. It can be understood that the intersection algorithm may include one or more algorithms. When the intersection algorithm includes an algorithm, the CU sends the information of the intersection algorithm to the UE. If the intersection algorithm is an encryption algorithm, the negotiation result is CU and The air interface between the UEs is encrypted using the PDCP protocol; if the intersection algorithm is an unencrypted algorithm, the result of the negotiation is that the air interface between the CU and the UE is not encrypted using the PDCP protocol. When the intersection algorithm includes multiple algorithms, the CU may select one of the multiple algorithms to send to the UE, that is, the negotiation result is encrypted by the air interface using the PDCP protocol; or the CU may select any one of the multiple algorithms. An algorithm sends to the UE. If any algorithm selected is an encryption algorithm, the negotiation result is that the air interface uses the PDCP protocol to encrypt; otherwise, the negotiation result is that the air interface does not use the PDCP protocol to encrypt. In summary, there are various ways in which the CU and the DU perform security negotiation to obtain the negotiation result, which is not limited herein.

It can be understood that the results obtained by the CU and the UE for security negotiation are different, and the subsequent processes are different and independent of each other. Therefore, after the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, steps 402-411 in FIG. 4a are performed; if the negotiation result indicates that the air interface between the CU and the UE is not used. If the PDCP protocol is encrypted, steps 412-421 in Figure 4b are performed; the details are as follows:

402. The CU sends the first indication information to the DU.

When the result of the negotiation indicates that the air interface is encrypted by using the PDCP protocol, the CU sends a first message to the DU through the first control plane interface, where the first message carries the first indication information, where the first indication information is used to indicate the CU and the DU. The user plane bearer is not encrypted by using the IPSec protocol, and the first control plane interface is an interface for the control plane communication between the CU and the DU. For ease of understanding, a 1-bit encryption indication bit may be set in the first message. When the encryption indication bit is set to 0, it indicates that the user plane bearer between the CU and the DU is not encrypted using the IPSec protocol; when the encryption indication bit is set to At 1 o'clock, it indicates that the user plane bearer between the CU and the DU is encrypted by using the IPSec protocol; optionally, the 2 bit encryption indication bit may be set in the first message, and when the encryption indication bit is set to 01, the CU and the DU are indicated. The user plane bearer between the two is not encrypted by using the IPSec protocol; when the encryption indicator bit is set to 10, it indicates that the user plane bearer between the CU and the DU is encrypted using the IPSec protocol. Therefore, the CU indicates to the DU whether the user plane bearer is encrypted by using the IPSec protocol, which is not limited in this application.

The user plane bearer between the CU and the DU can be understood as a GTP-U tunnel established between the CU and the DU for transmitting the user plane data stream.

It should be noted that the first message may be a user plane bearer setup request message, or may be other existing messages or new messages, which is not limited in this application.

In addition, when the first message is a user plane bearer setup request message, the first message may carry a user plane address on the CU side.

403. The DU sends a first response message to the CU.

It should be noted that the first interface on the DU side is configured with a specific IP address on the DU side to establish a user plane bearer with the CU, and the specific IP address on the DU side is used to distinguish the user plane bearer between the DU and the CU. Whether to use IPSec protocol encryption. For ease of understanding, please refer to FIG. 4c, which is a schematic diagram of a possible DU side interface provided by the embodiment of the present application. The first interface is an interface used by the DU side to communicate with the CU, and the first interface includes at least two specific interfaces. The user plane IP address, that is, the first non-encrypted address and the second unencrypted address, wherein the first encrypted address is used in an IPSec communication scenario, and indicates that the user plane data packet is encrypted/decrypted by using the IPSec protocol; The encrypted address is used in the non-IPSec communication scenario, indicating that the user plane data packet is not encrypted/decrypted by using the IPSec protocol. It should be noted that FIG. 4c is merely an exemplary diagram in which the first interface, the first encrypted address, and the second unencrypted address may be understood as a logical concept, but not physically.

Therefore, after receiving the first indication information carried by the first message sent by the CU, the DU determines, according to the first indication information, that the user plane bearer between the DU and the CU does not need to perform IPSec encryption, and selects the first unencrypted address as the first The user plane address of the interface is used to establish a user plane bearer, that is, a GTP-U tunnel between the CU and the DU, and send a first response message to the CU in response to the first message, where the first response message carries the first response. Information, the first response information includes a first unencrypted address to indicate to the CU that the address of the user plane carried between the DU and the CU at the DU end is the first unencrypted address.

The first response message may be a user plane bearer setup response message, or may be another existing message or a new message, which is not limited in this application. Therefore, when the DU obtains the user plane address on the CU side, and the CU obtains the user plane address on the DU side, the establishment of the user plane bearer between the CU and the DU can be realized.

404. The UE sends a first uplink user plane data packet to the DU.

It should be noted that, after the bearer between the CU and the DU and the bearer between the UE and the core network are established, the UE transmits the user plane data to the core network through the DU and the CU. Specifically, when the negotiation result between the CU and the UE is that the air interface between the CU and the UE is encrypted by using the PDCP protocol, the UE performs PDCP encryption processing on the first uplink user plane data packet, and performs encryption processing on the air interface. The first uplink user plane data packet is sent to the DU.

405. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

406. The DU sends a first uplink user plane data packet to the CU.

For ease of understanding of the present application, please refer to FIG. 4d, which is a schematic diagram of a possible data packet transmission. In the figure, the UE sends a data packet, and the data packet is marked with the address of the UE as the source address, and the server on the Internet to be reached. The address is the destination address, and the UE transmits the data packet to the eNB. The eNB encapsulates the data packet into a GTP packet that can be transmitted in the GTP tunnel, and the source address of the data packet is replaced with the address of the eNB, and the destination address is Replace with the address of the serving gateway (SGW) that will arrive. After the data packet arrives at the SGW, the source address of the data packet is changed to the address of the SGW, the destination address of the data packet is changed to the address of the packet data network gateway (P-GW), and the transmitted tunnel is also changed by the S1GTP tunnel. The S5GTP tunnel. After the data packet arrives at the P-GW, the P-GW unpacks the data packet, obtains its real destination address, and then sends the data packet to the server corresponding to the destination address to complete a data packet from the UE to the Internet. Upload.

Therefore, after receiving the PDCP-encrypted first uplink user plane data packet sent by the UE, the DU uses the first unencrypted address as the source address of the first uplink user plane data packet to complete the encapsulation of the GTP-U tunnel. . The DU determines, according to the first unencrypted address, that the first uplink user plane data packet is not encrypted by using the IPSec protocol, and the first uplink user plane data packet is directly sent to the CU by using the first interface on the DU side.

407a. The CU determines to decrypt the first uplink user plane data packet by using the IPSec protocol.

407b. The CU sends a first uplink user plane data packet to the SGW.

After receiving the first uplink user plane data packet that is not encrypted by the IPSec protocol, the CU performs GTP-U decapsulation on the first uplink user plane data packet, and obtains the decapsulated The first uplink user plane data packet is directly processed for subsequent processing, where the CU uses the PDCP protocol to perform air interface decryption on the first uplink user plane data packet, and the first uplink user plane datagram is used. Before the message is sent to the SGW, the first uplink user plane data packet is encrypted again to ensure the security of the first uplink user plane data packet transmitted between the CU and the SGW. Therefore, the CU sends the first uplink user plane data packet after the subsequent processing to the SGW.

408a. The SGW sends a first downlink user plane data packet to the CU.

408b. The CU determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

409. The CU sends the first downlink user plane data packet to the DU.

When the core network needs to send the first downlink user plane data packet to the UE through the CU and the DU, the CU receives the first downlink user plane data packet from the core network. If the result of the negotiation between the CU and the UE is that the air interface between the CU and the UE needs to be encrypted by using the PDCP protocol, the CU needs to perform PDCP encryption processing on the first downlink data.

In addition, the CU uses the first unencrypted address as the destination address of the first downlink user plane data packet to complete the encapsulation of the GTP-U tunnel. And the CU determines, according to the first unencrypted address, that the first downlink user plane data packet is not encrypted by using the IPSec protocol, and sends the first downlink user plane data packet directly to the second interface on the CU side to the first downlink user plane data packet. DU.

410. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

411. The DU sends a first downlink user plane data packet to the UE.

After receiving the first downlink user plane data packet that is not encrypted by the IPSec protocol, the DU can determine, by using the format of the first downlink user plane data packet, that the IPSec protocol is not used. The first downlink user plane data packet is decrypted, and then the first downlink user plane data packet is directly GTP-U decapsulated, and the decapsulated first downlink user plane data packet is obtained, and then performed. Processing, wherein the subsequent processing includes: sending, by using an air interface, the first downlink user plane data packet to the UE, so that the UE decrypts the first downlink user plane data packet by using a PDCP protocol to obtain the decrypted A downlink user plane data message.

It is to be noted that, in the present application, the first uplink user plane data packet is transmitted from the UE to the SGW through steps 404 to 407b, and the first downlink user plane data packet is implemented from the SGW to the UE through steps 408a to 411. For the transmission, there is no sequence of steps between the two processes, that is, steps 404 to 407b may be performed first, or steps 408a to 411 may be performed first, or may be performed at the same time, which is not limited herein.

If the result of the negotiation indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 4b, which specifically includes:

412. The CU sends the second indication information to the DU.

When the result of the negotiation indicates that the air interface is not encrypted by using the PDCP protocol, the first message sent by the CU to the DU through the first control plane interface carries the second indication information, where the second indication information is used to indicate the user plane between the CU and the DU. The bearer is encrypted using the IPSec protocol.

413. The DU sends a second response message to the CU.

After receiving the second indication information carried by the first message sent by the CU, the DU determines, according to the second indication information, that the user plane bearer between the DU and the CU needs to perform IPSec encryption, and uses the first encrypted address as the user of the first interface. a face address, to establish a user plane bearer between the CU and the DU, that is, a GTP-U tunnel, and send a first response message carrying the second response information to the CU, where the second response information includes the first encrypted address to the CU. The address indicating that the user plane between the DU and the CU is carried on the DU end is the first encrypted address.

414. The UE sends a second uplink user plane data packet to the DU.

Specifically, when the result of the negotiation between the CU and the UE is that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, the UE does not perform PDCP encryption processing on the second uplink user plane data packet, but uses the air interface to The second uplink user plane data packet is directly sent to the DU.

415. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

416. The DU sends a second uplink user plane data packet to the CU.

Therefore, after receiving the second uplink user plane data packet sent by the UE, the DU uses the first encrypted address as the source address of the second uplink user plane data packet to complete the encapsulation of the GTP-U tunnel. The DU determines, according to the first encrypted address, the IPSec protocol to encrypt the second uplink user plane data packet, and then obtains the IPSec encrypted second uplink user plane data packet, to complete the second uplink user plane datagram. IPSec encryption. Therefore, the DU sends the IPSec-encrypted second uplink user plane data packet directly to the CU through the first interface on the DU side.

417a. The CU determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

417b. The CU sends a second uplink user plane data packet to the SGW.

After receiving the second uplink user plane data packet, the CU decrypts the second uplink user plane data packet by using the IPSec protocol, and then decapsulates the GTP-U tunnel to obtain a solution. The second uplink user plane data packet after the packet is sealed. After the CU sends the second uplink user plane data packet to the SGW, the CU performs subsequent processing on the second uplink user plane data packet, where the subsequent processing may include: according to the security configuration between the CU and the SGW, The IPSec protocol is used to encrypt the second uplink user plane data packet to ensure the security of the second uplink user plane data packet transmission between the CU and the core network.

The CU then sends the second uplink user plane data packet after the subsequent processing to the SGW.

418a. The SGW sends a second downlink user plane data packet to the CU.

418b. The CU determines to encrypt the second downlink user plane data packet by using the IPSec protocol.

419. The CU sends a second downlink user plane data packet to the DU.

When the core network needs to send the second downlink user plane data packet to the UE through the CU and the DU, the CU receives the second downlink user plane data packet from the core network. The CU determines, according to the negotiation result, that the second downlink user plane data packet is encrypted without using the PDCP protocol.

In addition, the CU uses the first encrypted address as the destination address of the second downlink user plane data packet to complete the encapsulation of the GTP-U tunnel. The CU determines, according to the first encrypted address, that the second downlink user plane data packet is to be encrypted by using the IPSec protocol, to obtain the second downlink user plane data packet after the IPSec encryption. The IPSec-encrypted second downlink user plane data packet is sent to the DU through the second interface on the CU side.

420. The DU determines to decrypt the second downlink user plane data packet by using the IPSec protocol.

421. The DU sends a second downlink user plane data packet to the UE.

After receiving the second downlink user plane data packet, the DU uses the IPSec protocol to decrypt the second uplink user plane data packet, and then decapsulates the GTP-U tunnel to obtain a solution. The second downlink user plane data packet after the packet is sealed. And performing the subsequent processing on the decapsulated second downlink user plane data packet, where the subsequent processing includes: sending the decapsulated second downlink user plane data packet to the UE by using the air interface, and the UE does not need to use the PDCP The protocol decrypts the decapsulated second downlink user plane data packet.

It should be noted that, in this application, the second uplink user plane data packet is transmitted from the UE to the core network through steps 414 to 417b, and the second downlink user plane data packet is implemented from the core network through steps 418a to 411. For the transmission of the UE, there is no sequence of steps between the two processes, that is, steps 414 to 417b may be performed first, or steps 418a to 421 may be performed first, or may be performed at the same time, which is not limited herein.

Optionally, in the embodiment of the present application, the first interface of the DU is configured with the first encrypted address and the first unencrypted address to distinguish whether the user plane data stream needs IPSec encryption. It can be understood that, in actual applications, there are various ways to distinguish whether the user plane data stream needs IPSec encryption, including: based on the protocol port number: for example, the user plane data stream that requires IPSec encryption uses the port number of 10000-29999, and does not need to be used. The user plane data stream encrypted by IPSec uses the port number of 30000-49999; or it is distinguished based on the protocol type: for example, the user plane data stream requiring IPSec encryption uses the GTPU protocol, and the user plane data stream that does not require IPSec encryption uses the UDP protocol. Therefore, there are various ways to distinguish whether IPSec encryption is required, and the specifics are not limited herein.

It should be noted that the embodiment of the present application can be implemented not only in the network architecture of the LTE, but also in the 5G radio access network, the mobile communication system (UMTS), and the code division multiple access (code division multiple access, CDMA) or wideband code division multiple access (WCDMA) network architecture.

In the embodiment of the present application, it is possible to flexibly determine whether the transmission of the user plane data stream in the CU-DU interface uses IPSec encryption/decryption according to whether the UE air interface performs PDCP encryption, that is, when the UE air interface performs PDCP encryption, the user plane The transmission of the data stream in the CU-DU interface does not use IPSec encryption/decryption; when the UE air interface does not perform PDCP encryption, the transmission of the user plane data stream in the CU-DU interface needs to use IPSec encryption/decryption, which is guaranteed. At the same time of user data security, more flexible IPSec encryption/decryption reduces CPU resource consumption and speeds up the system.

Referring to FIG. 5a and FIG. 5b, an embodiment of the method in the scenario 2 of the embodiment of the present application includes:

501. The CU performs security negotiation with the UE to obtain a negotiation result.

It should be noted that, after the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, step 502-511 in FIG. 5a is performed; if the negotiation result indicates the air between the CU and the UE. If the interface does not use PDCP encryption, perform steps 512-521 in Figure 5b; the details are as follows:

502. The CU sends the first indication information to the DU.

503. The DU sends a first response message to the CU.

504. The UE sends a first uplink user plane data packet to the DU.

In the embodiment of the present application, the steps 501 to 504 are similar to the steps 401 to 404 in the embodiment shown in FIG. 4a, and details are not described herein again.

505. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

506. The DU sends a first uplink user plane data packet to the CU.

It should be noted that, in the embodiment of the present application, the second interface on the CU side is also configured with a specific IP address on the CU side to establish a user plane bearer, and the specific IP address on the CU side is used to distinguish the user between the CU and the DU. Whether the bearer is encrypted by using the IPSec protocol, and includes a second encrypted address and a second unencrypted address, where the second encrypted address is used in an IPSec communication scenario, indicating that the packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted The address is used in a non-IPSec communication scenario, indicating that the packet is not encrypted or decrypted using the IPSec protocol.

Therefore, after receiving the PDCP-encrypted first uplink user plane data packet sent by the UE, the DU uses the second unencrypted address as the destination address of the first uplink user plane data packet to complete the encapsulation of the GTP-U tunnel. The DU determines, according to the second unencrypted address, that the first uplink user plane data packet is not encrypted by using the IPSec protocol, and the first uplink user plane data packet is directly sent to the CU by using the first interface on the DU side.

507a. The CU determines that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

507b. The CU sends a first uplink user plane data packet to the SGW.

After receiving the first uplink user plane data packet that is not encrypted by using the IPSec protocol, the CU may determine, by using the format of the first uplink user plane data packet, that the first IPSec protocol is not used. The uplink user plane data packet is decrypted, and then the first uplink user plane data packet is directly GTP-U decapsulated, and the decapsulated first uplink user plane data packet is obtained. And performing the subsequent processing on the first uplink user plane data packet, where the CU uses the PDCP protocol to perform air interface decryption on the first uplink user plane data packet, and performs the first uplink on the first uplink user plane data packet. Before the user plane data packet is sent to the SGW, the first uplink user plane data packet is encrypted again to ensure the security of the first uplink user plane data packet transmitted between the CU and the core network. Therefore, the CU sends the first uplink user plane data packet after the subsequent processing to the SGW.

508a. The SGW sends a first downlink user plane data packet to the CU.

508b. The CU determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

509. The CU sends the first downlink user plane data packet to the DU.

510. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

511. The DU sends a first downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 508a to 511 are similar to the steps 408a to 411 in the embodiment shown in FIG. 4a, and details are not described herein again.

It is to be noted that, in this application, the transmission of the first uplink data from the UE to the SGW is implemented by using the steps 504 to 507b, and the transmission of the first downlink data from the SGW to the UE is implemented by using the steps 508a to 511. There is no sequence of steps, that is, steps 504 to 507b may be performed first, or steps 508a to 511 may be performed first, or may be performed at the same time, which is not limited herein.

If the negotiation result indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 5b, which specifically includes:

512. The CU sends the second indication information to the DU.

513. The DU sends a second response message to the CU.

514. The UE sends a second uplink user plane data packet to the DU.

In the embodiment of the present application, the steps 512 to 514 are similar to the steps 412 to 414 in the embodiment shown in FIG. 4b, and details are not described herein again.

515. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

516. The DU sends a second uplink user plane data packet to the CU.

Therefore, after receiving the second uplink user plane data packet sent by the UE, the DU uses the second encrypted address as the destination address of the second uplink user plane data packet to complete the encapsulation of the GTP-U tunnel. The DU determines, according to the second encrypted address, the IPSec protocol to encrypt the second uplink user plane data packet, and sends the second uplink user plane data packet to the CU directly through the first interface on the DU side.

517a. The CU determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

517b. The CU sends a second uplink user plane data packet to the SGW.

After receiving the second uplink user plane data packet, the CU decrypts the second uplink user plane data packet by using the IPSec protocol, and then decapsulates the GTP-U tunnel to obtain a solution. The second uplink user plane data packet after the packet is sealed. And performing the subsequent processing on the decapsulated second uplink user plane data packet, where the subsequent processing may include: performing security configuration between the CU and the SGW before sending the second uplink user plane data packet to the SGW. The second uplink user plane data packet is encrypted by using the IPSec protocol to ensure the security of the second uplink user plane data packet transmitted between the CU and the core network. The CU then sends the second uplink user plane data packet after the subsequent processing to the SGW.

518a. The SGW sends a second downlink user plane data packet to the CU.

518b. The CU determines to encrypt the second downlink user plane data packet by using the IPSec protocol.

519. The CU sends a second downlink user plane data packet to the DU.

520. The DU determines to decrypt the second downlink user plane data packet by using the IPSec protocol.

521. The DU sends a second downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 518 to 521 are similar to the steps 418 to 421 in the embodiment shown in FIG. 4a, and details are not described herein again.

It should be noted that, in this application, the transmission of the second uplink data from the UE to the SGW is implemented by using steps 514 to 517b, and the transmission of the second downlink data from the SGW to the UE is implemented by steps 518a to 511, between the two processes. There is no sequence of steps, that is, steps 514 to 517b may be performed first, or steps 518a to 521 may be performed first, or may be performed at the same time, which is not limited herein.

In the embodiment of the present application, the second interface and the second unencrypted address may be configured on the second interface of the CU to distinguish whether the IPSec-encrypted user plane data stream is required, and the achievable manner of the embodiment of the present application is added.

Referring to FIG. 6a and FIG. 6b, an embodiment of the method in the scenario 3 is performed in the scenario of the embodiment. In the scenario 3, the second interface on the CU side is also configured with a specific IP address on the CU side to establish a user plane bearer. The specific IP address of the CU is used to distinguish whether the user plane bearer between the CU and the DU is encrypted by using the IPSec protocol, and includes a second encrypted address and a second unencrypted address, where the second encrypted address is used in the IPSec communication scenario. Indicates that the packet is encrypted/decrypted by using the IPSec protocol. The second non-encrypted address is used in the non-IPSec communication scenario, indicating that the packet is not encrypted or decrypted by using the IPSec protocol. In addition, in scenario 3, the IP address of the first interface on the DU side does not need to distinguish whether the user plane bearer between the DU and the CU is encrypted using the IPSec protocol.

Specifically include:

601. The CU performs security negotiation with the UE to obtain a negotiation result.

In the embodiment of the present application, the step 601 is similar to the step 401 in the embodiment shown in FIG. 4a, and details are not described herein again.

After the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, steps 602-611 in FIG. 6a are performed; if the negotiation result indicates that the air interface between the CU and the UE does not use the PDCP protocol. Encryption, then perform steps 612-621 in Figure 6b; the details are as follows:

602. The CU sends the first indication information to the DU.

When the result of the negotiation indicates that the air interface is encrypted by using the PDCP protocol, the first message sent by the CU to the DU through the first control plane interface carries the first indication information, where the second indication information is used to indicate the user plane bearer between the CU and the DU. The IPSec protocol is not used for encryption, and the second unencrypted address is used as the user plane address of the second interface, that is, the address carried by the user plane between the CU and the DU at the CU end is the second unencrypted address.

603. The DU sends a first response message to the CU.

After receiving the first indication information carried by the first message sent by the CU, the DU determines, according to the first indication information, that the user plane bearer between the DU and the CU does not need to perform IPSec encryption, and determines that the second unencrypted address is the second CU side. User plane address of the interface. Optionally, in response to the first message carrying the first indication information, the DU sends a first response message to the CU, where the first response message includes first response information, where the first response information includes a user plane bearer address on the DU side. .

604. The UE sends a first uplink user plane data packet to the DU.

605. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

606. The DU sends a first uplink user plane data packet to the CU.

607a. The CU determines that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

607b. The CU sends a first uplink user plane data packet to the SGW.

In the embodiment of the present application, the steps 604 to 607b are similar to the steps 504 to 507b in the embodiment shown in FIG. 5a, and details are not described herein again.

608a. The SGW sends a first downlink user plane data packet to the CU.

608b. The CU determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

609. The CU sends a first downlink user plane data packet to the DU.

When the SGW needs to send the first downlink user plane data packet to the UE through the CU and the DU, the CU receives the first downlink user plane data packet from the SGW. If the result of the negotiation between the CU and the UE is that the air interface between the CU and the UE needs to be encrypted by using the PDCP protocol, the CU needs to perform PDCP encryption processing on the first downlink data.

In addition, the CU uses the second unencrypted address as the source address of the first downlink user plane data packet to complete the encapsulation of the GTP-U tunnel. And the CU determines, according to the second unencrypted address, that the first downlink user plane data packet is not encrypted by using the IPSec protocol, and sends the first downlink user plane data packet directly to the second interface on the CU side to the first downlink user plane data packet. DU.

610. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

611. The DU sends a first downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 610 to 611 are similar to the steps 410 to 411 in the embodiment shown in FIG. 4a, and details are not described herein again.

It is to be noted that, in the present application, the first uplink user plane data packet is transmitted from the UE to the SGW through steps 604 to 607b, and the first downlink user plane data packet is implemented from the core network through steps 608a to 611. For the transmission of the UE, there is no sequence of steps between the two processes, that is, steps 604 to 607b may be performed first, or steps 608a to 611 may be performed first, or may be performed at the same time, which is not limited herein.

If the result of the negotiation indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 6b, which specifically includes:

612. The CU sends the second indication information to the DU.

When the result of the negotiation indicates that the air interface is not encrypted by using the PDCP protocol, the first message sent by the CU to the DU through the first control plane interface carries the second indication information, where the second indication information is used to indicate the user plane between the CU and the DU. The bearer is encrypted by using the IPSec protocol, and the second encrypted address is used as the user plane address of the second interface, that is, the address carried by the user plane between the CU and the DU at the CU end is the second encrypted address.

613. The DU sends a second response message to the CU.

After receiving the second indication information carried by the first message sent by the CU, the DU determines, according to the second indication information, that the user plane bearer between the DU and the CU needs to perform IPSec encryption, and determines that the second encrypted address is the second interface on the CU side. User face address. Optionally, in response to the first message carrying the second indication information, the DU sends a first response message carrying the second response information to the CU, where the second response information includes a user plane bearer address on the DU side.

614. The UE sends a second uplink user plane data packet to the DU.

615. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

616. The DU sends a second uplink user plane data packet to the CU.

617a. The CU determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

617b. The CU sends a second uplink user plane data packet to the SGW.

In the embodiment of the present application, the steps 614 to 617b are similar to the steps 514 to 517b in the embodiment shown in FIG. 5b, and details are not described herein again.

618a. The SGW sends a second downlink user plane data packet to the CU.

618b. The CU determines to encrypt the second downlink user plane data packet by using the IPSec protocol.

619. The CU sends a second downlink user plane data packet to the DU.

When the SGW needs to send the second downlink user plane data packet to the UE through the CU and the DU, the CU receives the second downlink user plane data packet from the SGW. The CU determines, according to the negotiation result, that the second downlink user plane data packet is encrypted without using the PDCP protocol.

In addition, the CU uses the second encrypted address as the source address of the second downlink user plane data packet to complete the encapsulation of the GTP-U tunnel. And the CU determines, according to the second encrypted address, that the second downlink user plane data packet is to be encrypted by using the IPSec protocol, to obtain the second downlink user plane data packet that is encrypted by the IPSec protocol. And sending the encrypted second downlink user plane data packet to the DU through the second interface on the CU side.

620. The DU determines to use the IPSec protocol to decrypt the second downlink user plane data packet.

621. The DU sends a second downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 620 to 621 are similar to the steps 520 to 521 in the embodiment shown in FIG. 5b, and details are not described herein again.

It is to be noted that, in the present application, the second uplink user plane data packet is transmitted from the UE to the SGW through steps 614 to 617b, and the second downlink user plane data packet is implemented from the SGW to the UE through steps 618a to 611. For the transmission, there is no sequence of steps between the two processes, that is, steps 614 to 617b may be performed first, or steps 618a to 611 may be performed first, or may be performed at the same time, which is not limited herein.

It should be noted that the communication between the CU and the DU may pass through the SeGW, and after the CU is deployed in the SeGW, refer to FIG. 7a, which is another possible data encryption transmission diagram, including: the user data stream passes through the DU from the UE in sequence. SeGW to CU process, where

The IPSec protocol is used for encryption between the DU and the SeGW to ensure the security of user data transmission on the backhaul network. Therefore, there are corresponding processing modules on the DU and SeGW to be responsible for IPSec encryption and IPSec decryption.

Therefore, when the communication between the CU and the DU passes through the SeGW, refer to FIG. 7b and FIG. 7c, and the method for the method in the scenario 4 of the embodiment of the present application is specifically introduced.

701. The CU performs security negotiation with the UE to obtain a negotiation result.

It should be noted that, in the embodiment of the present application, the step 701 is similar to the step 401 in the embodiment shown in FIG. 4a, and details are not described herein again.

After the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, steps 702-713 in FIG. 4a are performed; if the negotiation result indicates that the air interface between the CU and the UE does not use the PDCP protocol. Encryption, then perform steps 714-725 in Figure 4b; as follows:

702. The CU sends the first indication information to the DU.

It should be noted that, in the embodiment of the present application, the first indication information sent by the CU to the DU in step 702 is similar to the first indication information sent by the CU to the DU in step 402 in the embodiment shown in FIG. 4a, specifically No longer.

In this embodiment, the CU sends the first indication information to the DU through the transit of the SeGW.

703. The DU sends a first response message to the CU.

It should be noted that, in the embodiment of the present application, the first response information sent by the CU to the DU in step 703 is similar to the first response information sent by the CU to the DU in step 403 in the embodiment shown in FIG. 4a, specifically No longer.

In this embodiment, the DU sends the first response information to the CU through the transit of the SeGW.

704. The UE sends a first uplink user plane data packet to the DU.

705. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the steps 704 to 705 are similar to the steps 404 to 405 in the embodiment shown in FIG. 4a, and details are not described herein again.

706. The DU sends a first uplink user plane data packet to the SeGW.

The DU determines, according to the first unencrypted address, that the first uplink user plane data packet is not encrypted by using the IPSec protocol, and then sends the first uplink user plane data packet to the SeGW.

707. The SeGW determines that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

After receiving the first uplink user plane data packet, the SeGW determines, according to the packet format of the first uplink user plane data packet, that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

708a. The SeGW sends a first uplink user plane data packet to the CU.

708b. The CU sends a first uplink user plane data packet to the SGW.

After the GW is used to decrypt the first uplink user plane data packet, the GW sends the first uplink user plane data packet to the CU, so that the CU performs GTP-U on the first uplink user plane data packet. The tunnel unblocking process obtains the first uplink user plane data packet after decapsulation. And the CU performs a subsequent operation on the decapsulated first uplink user plane data packet, where the subsequent processing includes: the CU uses the PDCP protocol to perform the air interface decryption on the first uplink user plane data packet, and Before the uplink user plane data packet is sent to the core network, the first uplink user plane data packet is encrypted again to ensure the security of the first uplink user plane data packet transmitted between the CU and the core network. Therefore, the CU sends the first uplink user plane data packet after the subsequent processing to the SGW.

709a. The SGW sends a first downlink user plane data packet to the CU.

709b. The CU sends the first downlink user plane data packet to the SwGW.

When the SGW needs to sequentially send the first downlink user plane data packet to the UE through the CU, the SeGW, and the DU, the CU receives the first downlink user plane data packet from the SGW. The result of the negotiation between the CU and the UE is that the air interface between the CU and the UE needs to be encrypted by using the PDCP protocol, and the CU performs PDCP encryption processing on the first downlink data based on the negotiation result.

In addition, the CU uses the first non-encrypted address as the destination address of the first downlink user plane data packet to complete the encapsulation of the GTP-U tunnel, and sends the encapsulated first downlink user plane data packet to the SeGW. .

710. The SeGW determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

711. The SeGW sends the first downlink user plane data packet to the DU.

After receiving the first downlink user plane data packet, the SeGW obtains the first non-encrypted address of the first downlink user plane data packet, and determines, according to the first non-encrypted address, that the IPSec protocol is not used. The first downlink user plane data packet is encrypted, and the first downlink user plane data packet is directly sent to the DU.

712. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

713. The DU sends a first downlink user plane data packet to the UE.

After receiving the first downlink user plane data packet, the DU determines whether to use the IPSec protocol to decrypt the first downlink user plane data packet, and then performs the decapsulation of the GTP-U tunnel, including: the DU passes the first The format of the downlink user plane data packet determines that the first downlink user plane data packet is not decrypted by using the IPSec protocol, so the GTP-U tunnel is directly decapsulated for the first downlink user plane data packet. The first downlink user plane data packet after decapsulation is obtained. and

Performing a subsequent processing on the decapsulated first downlink user plane data packet, where the subsequent processing includes: sending the first downlink user plane data packet to the UE by using an air interface, so that the UE uses the PDCP protocol to The first downlink user plane data packet is decrypted to obtain the decrypted first downlink user plane data packet.

It is to be noted that, in the present application, the first uplink user plane data packet is transmitted from the UE to the SGW through steps 704 to 708b, and the first downlink user plane data packet is implemented from the SGW to the UE through steps 709a to 713. For the transmission, there is no sequence of steps between the two processes, that is, steps 704 to 708b may be performed first, or steps 709a to 713 may be performed first, or may be performed at the same time, which is not limited herein.

If the result of the negotiation indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 7c, which specifically includes:

714. The CU sends the second indication information to the DU.

It should be noted that, in the embodiment of the present application, the second indication information sent by the CU to the DU in step 714 is similar to the second indication information sent by the CU to the DU in step 412 in the embodiment shown in FIG. 4a, specifically No longer.

In this embodiment, the CU sends the second indication information to the DU through the transit of the SeGW.

715. The DU sends a second response message to the CU.

It should be noted that, in the embodiment of the present application, the second response information sent by the CU to the DU in step 715 is similar to the second response information sent by the CU to the DU in step 413 in the embodiment shown in FIG. 4a, specifically No longer.

In this embodiment, the DU sends the second response information to the CU through the transit of the SeGW.

716. The UE sends a second uplink user plane data packet to the DU.

717. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the steps 716 to 717 are similar to the steps 414 to 415 in the embodiment shown in FIG. 4b, and details are not described herein again.

718. The DU sends a second uplink user plane data packet to the SeGW.

After the IPSec protocol is used to encrypt the second uplink user plane data packet, the IPSec encrypts the second uplink user plane data packet, and obtains the second uplink user plane encrypted by the IPSec protocol. The data packet is sent to the SeGW by the encrypted second uplink user plane data packet.

719. The SeGW determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

After receiving the second uplink user plane data packet, the SeGW obtains the source address of the second uplink user plane data packet as the first encrypted address, and determines that the second uplink user plane data packet needs to be decrypted by using the IPSec protocol. .

720a. The SeGW sends a second uplink user plane data packet to the CU.

720b. The CU sends a second uplink user plane data packet to the SGW.

After the GWec determines to use the IPSec protocol to decrypt the second uplink user plane data packet, the IPSec protocol decrypts the second uplink user plane data packet to obtain the decrypted second uplink user plane data packet, and then The decrypted second uplink user plane data packet is sent to the CU, so that the CU performs GTP-U tunnel decapsulation on the second uplink user plane data packet, and obtains the decapsulated second uplink user plane data packet. The CU performs subsequent processing on the decapsulated second uplink user plane data packet, where the subsequent processing may include: before sending the decapsulated second uplink user plane data packet to the core network, The decapsulated second uplink user plane data packet is encrypted to ensure the security of the second uplink user plane data packet transmitted between the CU and the core network.

721a. The SGW sends a second downlink user plane data packet to the CU.

721b. The CU sends a second downlink user plane data packet to the SeGW.

When the SGW needs to pass the CU, the SeGW, and the DU in sequence to send the second downlink user plane data packet to the UE, the CU receives the second downlink user plane data packet from the core network. The CU determines, according to the negotiation result, that the second downlink user plane data packet is encrypted without using the PDCP protocol.

In addition, the CU uses the first encrypted address as the destination address of the second downlink user plane data packet to complete the encapsulation of the GTP-U tunnel, and sends the encapsulated second downlink user plane data packet to the SeGW.

722. The SeGW determines to encrypt the second downlink user plane data packet by using the IPSec protocol.

After receiving the second downlink user plane data packet sent by the CU, the SeGW obtains the destination address of the second downlink user plane data packet as the first encrypted address, and determines, according to the first encrypted address, that the IPSec protocol is used. The second downlink user plane data packet is encrypted.

723. The SeGW sends a second downlink user plane data packet to the DU.

After the GWec uses the IPSec protocol to encrypt the second downlink user plane data packet, the IPSec encrypts the second downlink user plane data packet to obtain the encrypted second downlink user plane data packet. The encrypted second downlink user plane data packet is sent to the DU.

724. The DU determines to decrypt the second downlink user plane data packet by using the IPSec protocol.

725. The DU sends a second downlink user plane data packet to the UE.

After receiving the second downlink user plane data packet that is encrypted by the IPSec protocol, the DU decrypts the second downlink user plane data packet by using the IPSec protocol, and then decapsulates the GTP-U tunnel to obtain a solution. The second downlink user plane data packet after the packet is sealed. The DU performs subsequent processing on the decapsulated second downlink user plane data packet. The subsequent processing includes: sending the second downlink user plane data packet to the UE by using the air interface, and the UE does not need to use the PDCP protocol to decrypt the second downlink user plane data packet.

It should be noted that, in the embodiment shown in FIG. 7c, the transmission of the second uplink data from the UE to the SGW is implemented through steps 716 to 720b, and the transmission of the second downlink data from the SGW to the UE is implemented through steps 721a to 725. There is no sequence of steps between the two processes, that is, steps 716 to 720b may be performed first, or steps 721a to 725 may be performed first, or may be performed at the same time, which is not limited herein.

In the embodiment of the present application, for the scenario in which the SeGW is deployed between the CU and the DU, the PDCP encryption may be flexibly determined according to whether the UE air interface performs the IPSec encryption/decryption in the DU-SeGW, thereby reducing the CPU. The consumption of resources reduces costs.

Referring to FIG. 8a and FIG. 8b, an embodiment of the method in the scenario 5 of the embodiment of the present application includes:

801. The CU performs security negotiation with the UE to obtain a negotiation result.

After the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, steps 802-813 in FIG. 8a are performed; if the negotiation result indicates that the air interface between the CU and the UE does not use the PDCP protocol. Encryption, then perform steps 814-825 in Figure 8b; the details are as follows:

802. The CU sends the first indication information to the DU.

803. The DU sends a first response message to the CU.

804. The UE sends a first uplink user plane data packet to the DU.

In the embodiment of the present application, the steps 801 to 804 are similar to the steps 701 to 704 shown in FIG. 7b, and details are not described herein again.

805. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the step 805 is similar to the step 505 shown in FIG. 5a, and details are not described herein again.

806. The DU sends a first uplink user plane data packet to the SeGW.

In the embodiment of the present application, the step 806 is similar to the step 706 shown in FIG. 7b, and details are not described herein again.

807. The SeGW determines that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

After receiving the first uplink user plane data packet that is not encrypted by using the IPSec protocol, the SeGW may determine, according to the format of the first uplink user plane data packet, that the first uplink user plane data packet is not decrypted by using the IPSec protocol. .

808a. The SeGW sends a first uplink user plane data packet to the CU.

808b. The CU sends a first uplink user plane data packet to the SGW.

809a. The SGW sends the first downlink user plane data packet to the CU.

809b. The CU sends the first downlink user plane data packet to the SwGW.

810. The SeGW determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

811. The SeGW sends a first downlink user plane data packet to the DU.

812. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

813. The DU sends a first downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 808a to 813 are similar to the steps 708a to 713 shown in FIG. 7b, and are not limited herein.

If the result of the negotiation indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 8b, specifically including;

814. The CU sends the second indication information to the DU.

815. The DU sends a second response message to the CU.

816. The UE sends a second uplink user plane data packet to the DU.

In the embodiment of the present application, the steps 814 to 816 are similar to the steps 714 to 716 shown in FIG. 7c, which are not limited herein.

817. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the step 817 is similar to the step 515 shown in FIG. 5b, and details are not described herein again.

818. The DU sends a second uplink user plane data packet to the SeGW.

In the embodiment of the present application, the step 818 is similar to the step 718 shown in FIG. 7c, which is not limited herein.

819. The SeGW determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

After receiving the second uplink user plane data packet, the SeGW obtains the destination address of the second uplink user plane data packet as the second encrypted address, and determines the format of the second uplink user plane data packet, and uses IPSec. The protocol decrypts the second uplink user plane data packet.

820a. The SeGW sends a second uplink user plane data packet to the CU.

820b. The CU sends a second uplink user plane data packet to the SGW.

821a. The SGW sends a second downlink user plane data packet to the CU.

821b. The CU sends a second downlink user plane data packet to the SeGW.

822. The SeGW determines to encrypt the second downlink user plane data packet by using the IPSec protocol.

823. The SeGW sends a second downlink user plane data packet to the DU.

824. The DU determines to use the IPSec protocol to decrypt the second downlink user plane data packet.

825. The DU sends a second downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 820a to 825 are similar to the steps 720a to 725 shown in FIG. 7c, which are not limited herein.

In the embodiment of the present application, for the scenario in which the SeGW is deployed between the CU and the DU, the second interface of the CU side may be configured with the second encrypted address and the second unencrypted address to distinguish whether the IPSec encrypted user plane data stream is required, and The achievable manner of the embodiment of the present application.

Referring to FIG. 9a and FIG. 9b, an embodiment of the method in the scenario 6 of the embodiment of the present application includes:

901. The CU performs security negotiation with the UE to obtain a negotiation result.

After the CU obtains the negotiation result, if the negotiation result indicates that the air interface between the CU and the UE is encrypted by using the PDCP protocol, steps 902-913 in FIG. 9a are performed; if the negotiation result indicates that the air interface between the CU and the UE does not use the PDCP protocol. Encryption, then steps 914-925 in Figure 9b are performed; the details are as follows:

902. The CU sends the first indication information to the DU.

903. The DU sends a first response message to the CU.

904. The UE sends a first uplink user plane data packet to the DU.

905. The DU determines to encrypt the first uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the steps 901 to 905 are similar to the steps 601 to 605 shown in FIG. 6a, and details are not described herein again.

906. The DU sends a first uplink user plane data packet to the SeGW.

907. The SeGW determines that the first uplink user plane data packet is not decrypted by using the IPSec protocol.

908a. The SeGW sends a first uplink user plane data packet to the CU.

908b. The CU sends a first uplink user plane data packet to the SGW.

In the embodiment of the present application, the steps 906 to 908b are similar to the steps 806 to 808b shown in FIG. 8a, and details are not described herein again.

909a. The SGW sends a first downlink user plane data packet to the CU.

909b. The CU sends the first downlink user plane data packet to the SwGW.

When the SGW needs to send the first downlink user plane data packet to the UE through the CU and the DU, the CU receives the first downlink user plane data packet from the core network. If the result of the negotiation between the CU and the UE is that the air interface between the CU and the UE needs to be encrypted by using the PDCP protocol, the CU needs to perform PDCP encryption processing on the first downlink data.

In addition, the CU uses the second unencrypted address as the source address of the first downlink user plane data packet to complete the encapsulation of the GTP-U tunnel, and directly sends the encapsulated first downlink user plane data packet. Give SeGW.

910. The SeGW determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol.

In the embodiment of the present application, in step 910, the SeGW determines that the first downlink user plane data packet is not encrypted by using the IPSec protocol, and the CU determines in step 608 of FIG. 6a that the IPSec protocol is not used for the first downlink user. The manner in which the data packets are encrypted is similar, and details are not described here.

911. The SeGW sends the first downlink user plane data packet to the DU.

The SeGW determines that the first downlink user plane data packet is not directly encrypted by using the IPSec protocol, and the first downlink user plane data packet is directly sent to the DU.

912. The DU determines to decrypt the first downlink user plane data packet by using the IPSec protocol.

913. The DU sends a first downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 912 to 913 are similar to the steps 610 to 611 shown in FIG. 6a, and details are not described herein again.

If the result of the negotiation indicates that the air interface between the CU and the UE is not encrypted by using the PDCP protocol, refer to FIG. 9b, which specifically includes:

914. The CU sends the second indication information to the DU.

915. The DU sends a second response message to the CU.

916. The UE sends a second uplink user plane data packet to the DU.

917. The DU determines to encrypt the second uplink user plane data packet by using the IPSec protocol.

In the embodiment of the present application, the steps 914 to 917 are similar to the steps 612 to 615 shown in FIG. 6b, and details are not described herein again.

918. The DU sends a second uplink user plane data packet to the SeGW.

919. The SeGW determines to decrypt the second uplink user plane data packet by using the IPSec protocol.

920a. The SeGW sends a second uplink user plane data packet to the CU.

920b. The CU sends a second uplink user plane data packet to the SGW.

In the embodiment of the present application, the steps 918 to 920b are similar to the steps 818 to 820b shown in FIG. 8b, and details are not described herein again.

921a. The SGW sends a second downlink user plane data packet to the CU.

921b. The CU sends a second downlink user plane data packet to the SeGW.

In the embodiment of the present application, the step 921a is similar to the step 821a shown in FIG. 8b, and details are not described herein again.

The manner in which the CU sends the second downlink user plane data packet to the SeGW in step 921b is similar to the manner in which the CU sends the second downlink user plane data packet to the DU in the step 619 shown in FIG. 6b, and details are not described herein again.

922. The SeGW determines to use the IPSec protocol to encrypt the second downlink user plane data packet.

In the embodiment of the present application, in step 922, the SeGW determines the manner of encrypting the second downlink user plane data packet by using the IPSec protocol, and the step 618 shown in FIG. 6b determines that the IPSec protocol uses the IPSec protocol to the second downlink user plane data packet. The manner of encryption is similar, and will not be described here.

923. The SeGW sends a second downlink user plane data packet to the DU.

The SeGW determines to use the IPSec protocol to encrypt the second downlink user plane data packet, and then sends the encrypted second downlink user plane data packet to the DU.

924. The DU determines to decrypt the second downlink user plane data packet by using the IPSec protocol.

925. The DU sends a second downlink user plane data packet to the UE.

In the embodiment of the present application, the steps 924 to 925 are similar to the steps 824 to 825 shown in FIG. 8b, and are not limited herein.

In the embodiment of the present application, for the scenario in which the SeGW is deployed between the CU and the DU, the second interface and the second unencrypted address may be configured on the second interface on the CU side to distinguish whether the IPSec encrypted user plane data stream is required. The achievable manner of the embodiment of the present application is added.

The information transmission method in the embodiment of the present application is described above. The following describes the central unit in the embodiment of the present application. Referring to FIG. 10, an embodiment of the central unit in the embodiment of the present application, the central unit may perform the foregoing method. The operation of the CU in the embodiment, the CU includes:

The first transceiver unit 1001 is configured to perform security negotiation with the user equipment UE to obtain a negotiation result, where the negotiation result is used to indicate whether an air interface between the CU and the UE is encrypted by using a packet data convergence layer PDCP protocol;

The second transceiver unit 1002 is configured to send a first message to the distributed unit DU.

When the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, the first message is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.

Optionally, in some possible implementations, the DU is provided with a first interface, where the first interface is an interface for the DU to perform user plane communication with the CU; An address and a first non-encrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the first non-encrypted address is used to indicate that the IPSec protocol is not used. Adding/decrypting the user plane data message;

The second transceiver unit 1002 is further configured to:

Receiving a first response message sent by the DU, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.

Optionally, in some possible implementation manners, the CU further includes:

The processing unit 1003 is configured to encrypt the downlink user plane data packet by using the PDCP protocol, and set the destination address of the downlink user plane data packet to the first unencrypted address;

The determining unit 1004 is configured to determine, according to the first unencrypted address, that the downlink user plane data packet is not encrypted by using the IPSec protocol;

The second transceiver unit 1002 is further configured to send the downlink user plane data packet to the DU.

Optionally, in some possible implementation manners, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the first message is used to indicate that the user plane bearer is encrypted by using the IPSec protocol. The first response message is used to indicate that the address carried by the user plane on the DU end is the first encrypted address.

Optionally, in some possible implementation manners, when the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, and the communication between the CU and the DU passes through a security gateway SeGW, the CU Also includes:

The processing unit 1003 is further configured to: encrypt, by using the PDCP protocol, a downlink user plane data packet; and set a destination address of the downlink user plane data packet to the first unencrypted address;

The third transceiver unit 1005 is configured to send the downlink user plane data packet to the SeGW.

Optionally, in some possible implementation manners, the CU has a second interface, where the second interface is an interface for the CU to perform user plane communication with the DU; and the second interface is configured with a second encryption. An address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used to indicate that the IPSec protocol is not used. Add/decrypt the user plane data message.

Referring to FIG. 11, an embodiment of a distributed unit in the embodiment of the present application, the distributed unit may perform the operation of the DU in the foregoing method embodiment, where the DU includes:

The first transceiver unit 1101 is configured to receive a first message sent by the CU when the air interface between the central unit CU and the user equipment UE is encrypted by using a packet data convergence layer PDCP protocol, where the first message is used to indicate The user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.

When the air interface is encrypted by using the PDCP protocol, the first transceiver unit 1101 is further configured to:

Sending a first response message to the CU, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.

Optionally, in some possible implementations, when the air interface is encrypted by using the PDCP protocol, the DU further includes:

The second transceiver unit 1103 is further configured to receive an uplink user plane data packet sent by the UE.

The processing unit 1104 is configured to: set a source address of the uplink user plane data packet to the first unencrypted address;

The determining unit 1102 is configured to determine, according to the first unencrypted address, that the uplink user plane data packet is not encrypted by using the IPSec protocol;

The first transceiver unit 1101 is further configured to send the uplink user plane data packet to the CU.

Optionally, in some possible implementations, when the air interface is encrypted by using the PDCP protocol, and the communication between the DU and the CU passes through the SeGW, the DU further includes:

The second transceiver unit 1103 is further configured to receive an uplink user plane data packet sent by the UE;

The processing unit 1104 is further configured to: set a source address of the uplink user plane data packet to the first unencrypted address;

The determining unit 1102 is further configured to: determine, according to the first unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol;

The third transceiver unit 1105 is configured to send the uplink user plane data packet to the SeGW.

Optionally, in some possible implementation manners, the CU has a second interface, where the second interface is an interface for the CU to perform user plane communication with the DU; and the second interface is configured with a second encryption. An address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used to indicate that the IPSec protocol is not used. Adding/decrypting the user plane data message;

When the air interface is encrypted using the PDCP protocol, the DU further includes:

The processing unit 1104 is further configured to set a destination address of the uplink user plane data packet to the second unencrypted address;

The determining unit 1102 is further configured to: determine, according to the second unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol;

The CU and the DU in the embodiment of the present application are described in detail from the perspective of the modular functional entity, and the CU and the DU in the embodiment of the present application are described in detail below.

Please refer to Figure 12. In the case of an integrated unit, Figure 12 shows a possible schematic diagram of a communication device. The communication device 1200 includes a processing unit 1202 and a communication unit 1203. The processing unit 1202 is configured to control and manage the operation of the communication device. The communication device 1200 can also include a storage unit 1201 for storing program codes and data required by the communication device.

In one embodiment, the communication device can be the CU described above. For example, the processing unit 1202 is configured to support the CU to perform step 401, steps 407a and 408b in FIG. 4a, step 401, step 417a and step 418b in FIG. 4b, step 501, steps 507a and 508b in FIG. 5a, in FIG. 5b Step 501, step 517a and step 518b, steps 601, 607a and 608b in Fig. 6a, step 601, step 617a and step 618b in Fig. 6b, and/or other processes for the techniques described herein. The communication unit 1203 is configured to support communication between the CU and other devices. For example, the communication unit 1203 is configured to support the CU to perform steps 402 to 403, step 406, step 407b, step 408a, and step 409 in FIG. 4a, step 412 in FIG. 4b. 413, 416, 417b, 418a and 419, steps 502 to 503, 506, 507b, 508a and 509 in FIG. 5a, steps 512 to 513, 516, 517b in FIG. 5b Step 518a and step 519, steps 602 to 603, step 606, step 607b, step 608a and step 609 in Fig. 6a, steps 612 to 613, step 616, step 617b, step 618a and step 619 in Fig. 6b, Steps 702 to 703, 7a to 709b in 7b, steps 720a to 721b in Fig. 7c, steps 802 to 803 in Fig. 8a, steps 808a to 809b, steps 820a to 821b in Fig. 8b, steps in Fig. 9a 902 to 903, steps 908a through 909b, steps 920a through 921b in Figure 9b, and/or other processes for the techniques described herein.

In another embodiment, the communication device can be the DU described above. For example, the processing unit 1202 is configured to support the DU to perform step 405, step 410 in FIG. 4a, step 415 in step 4b, step 420, step 505 in step 5a, step 510, step 515 in step 5b, step 520, Step 605 in step 6a, step 610, step 615 in step 6b, step 620, step 705 in step 7b, step 712, step 717 in step 7c, step 724, step 805 in step 8a, step 812, Step 817, step 824, step 905, step 912 of Figure 9a, step 917, step 924 of Figure 9b, and/or other processes for the techniques described herein. The communication unit 1203 is configured to support communication of the DU with other devices. For example, the communication unit 1203 is configured to support the DU to perform steps 402 to 404, step 406, step 409, and step 411 in FIG. 4a, steps 412 to 414 in FIG. 4b. Step 416, step 419, and step 421, steps 502 to 504, step 506, step 509, and step 511 in FIG. 5a, steps 512 to 514, step 516, step 519, and step 521 in FIG. 5b, Steps 602 to 604, step 606, step 609, and step 611 in 6a, steps 612 to 614, step 616, step 619, and step 621 in FIG. 6b, steps 702 to 704, step 706, and steps in FIG. 7b 711, and step 713, steps 714 to 716, step 718, step 723, and step 725 in FIG. 7c, steps 802 to 804, step 806, step 811, and step 813 in FIG. 8a, step 814 in FIG. 8b To 816, step 818, step 823, and step 825, steps 902 to 904, step 906, step 911, and step 913 in FIG. 9a, steps 914 to 916, step 918, step 923, and step 925 in FIG. 9b. ,, and/or other processes for the techniques described herein.

The processing unit 1202 may be a processor or a controller, for example, may be a central processing unit (CPU), a general-purpose processor, a digital signal processor (DSP), and an application-specific integrated circuit (application-specific). Integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, transistor logic device, hardware component, or any combination thereof. It is possible to implement or carry out the various illustrative logical blocks, modules and circuits described in connection with the present disclosure. The processor can also be a combination of computing functions, for example, including one or more microprocessor combinations, a combination of a DSP and a microprocessor, and the like. The communication unit 1203 may be a communication interface, a transceiver, a transceiver circuit, etc., wherein the communication interface is a collective name and may include one or more interfaces, such as a transceiver interface. The storage unit 701 can be a memory.

The processing unit 1202 can be a processor, the communication unit 1203 can be a communication interface, and when the storage unit 1201 can be a memory, as shown in FIG. 13, the communication device 1310 includes a processor 1312, a communication interface 1313, and a memory 1311. Alternatively, the communication device 1310 may further include a bus 1314. The communication interface 1313, the processor 1312, and the memory 1311 may be connected to each other through a bus 1314; the bus 1314 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA). Bus, etc. The bus 1314 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 13, but it does not mean that there is only one bus or one type of bus.

Similarly, in one embodiment, communication device 1310 can be used to indicate the steps of the CU described above. In another embodiment, communication device 1310 can be used to indicate the steps of DU described above. I will not repeat them here.

The embodiment of the present application further provides a system, as shown in FIG. 14 , which is a schematic structural diagram of a possible system provided by the present application. The system may include one or more central processing unit 1422 and memory 1432, one or more. A storage medium 1430 of storage application 1442 or data 1444 (eg, one or one storage device in Shanghai). Among them, the memory 1432 and the storage medium 1430 may be short-term storage or persistent storage. Programs stored on storage medium 1430 may include one or more modules (not shown), each of which may include a series of instruction operations in the system. Still further, central processor 1422 can be configured to communicate with storage medium 1430, executing a series of instruction operations in storage medium 1430 on system 1400. System 1400 can also include one or more power sources 1426, one or more wired or wireless network interfaces 1450, one or more input and output interfaces 1458, and/or one or more operating systems 1441, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc.

The embodiment of the information transmission method described above with reference to Figs. 4a to 9b can be realized based on the system configuration shown in Fig. 14.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in accordance with embodiments of the present application are generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer readable storage medium or transferred from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions can be from a website site, computer, server or data center Transmission to another website site, computer, server or data center via wired (eg coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg infrared, wireless, microwave, etc.). The computer readable storage medium can be any available media that can be stored by a computer or a data storage device such as a server, data center, or the like that includes one or more available media. The usable medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (such as a solid state disk (SSD)) or the like.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. .

The above embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents. The modifications and substitutions of the embodiments do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

An information transmission method, comprising:

The central unit CU performs security negotiation with the user equipment UE to obtain a negotiation result, where the negotiation result is used to indicate whether the air interface between the CU and the UE is encrypted by using a packet data convergence layer PDCP protocol;

Sending, by the CU, a first message to the distributed unit DU;

When the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, the first message is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.
The method according to claim 1, wherein the DU has a first interface, and the first interface is an interface for the DU to perform user plane communication with the CU; And an encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the first non-encrypted address is used to indicate that the IPSec is not used. The protocol performs encryption/decryption processing on the user plane data message;

After the CU sends the first message to the DU, the method further includes:

The CU receives the first response message sent by the DU, and the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.
The method according to claim 2, wherein after the CU receives the first response message sent by the DU, the method further includes:

The CU encrypts the downlink user plane data packet by using the PDCP protocol;

Setting, by the CU, a destination address of the downlink user plane data packet as the first unencrypted address;

The CU determines, according to the first unencrypted address, that the downlink user plane data packet is not encrypted by using the IPSec protocol;

The CU sends the downlink user plane data packet to the DU.
The method according to claim 2, wherein when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt, the first message is used to indicate that the user plane bearer uses the IPSec protocol. The first response message is used to indicate that the address carried by the user plane on the DU end is the first encrypted address.
The method according to claim 2, wherein when the negotiation result indicates that the air interface is encrypted using the PDCP protocol, and the communication between the CU and the DU passes through a security gateway SeGW, The method also includes:

The CU encrypts the downlink user plane data packet by using the PDCP protocol;

Setting, by the CU, a destination address of the downlink user plane data packet as the first unencrypted address;

The CU sends the downlink user plane data packet to the SeGW.
The method according to any one of claims 1 to 5, wherein the CU has a second interface, and the second interface is an interface for the CU to perform user plane communication with the DU; The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used for The user is instructed to perform encryption/decryption processing on the user plane data message without using the IPSec protocol.
An information transmission method, comprising:

When the air interface between the central unit CU and the user equipment UE is encrypted by using the packet data convergence layer PDCP protocol, the distributed unit DU receives the first message sent by the CU, where the first message is used to indicate the CU and the The user plane bearer between the DUs is not encrypted using the Internet Protocol Secure IPSec protocol.
The method according to claim 7, wherein the DU has a first interface, and the first interface is an interface for the DU to perform user plane communication with the CU; And an encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the first non-encrypted address is used to indicate that the IPSec is not used. The protocol performs encryption/decryption processing on the user plane data message;

When the air interface is encrypted using the PDCP protocol, the method further includes:

The DU sends a first response message to the CU, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.
The method according to claim 8, wherein when the air interface is encrypted using the PDCP protocol, the method further comprises:

Receiving, by the DU, an uplink user plane data packet sent by the UE;

Setting, by the DU, a source address of the uplink user plane data packet as the first unencrypted address;

Determining, according to the first unencrypted address, that the uplink user plane data packet is not encrypted by using the IPSec protocol;

The DU sends the uplink user plane data packet to the CU.
The method according to claim 8, wherein when the air interface is encrypted using the PDCP protocol, and the communication between the DU and the CU passes through the SeGW, the method further includes:

Receiving, by the DU, an uplink user plane data packet sent by the UE;

Setting, by the DU, a source address of the uplink user plane data packet as the first unencrypted address;

Determining, according to the first unencrypted address, that the uplink user plane data packet is not encrypted by using the IPSec protocol;

The DU sends the uplink user plane data packet to the SeGW.
The method according to any one of claims 7 to 10, wherein the CU has a second interface, and the second interface is an interface for the CU to perform user plane communication with the DU; The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used for The user is instructed to perform encryption/decryption processing on the user plane data message without using the IPSec protocol.
The method of claim 11, wherein when the air interface is encrypted using the PDCP protocol, the method further comprises:

Receiving, by the DU, an uplink user plane data packet sent by the UE;

Setting, by the DU, a destination address of the uplink user plane data packet as the second unencrypted address;

Determining, according to the second unencrypted address, that the uplink user plane data packet is not encrypted by using the IPSec protocol;

The DU sends the uplink user plane data packet to the CU.
A central unit CU, comprising:

a first transceiver unit, configured to perform security negotiation with the user equipment UE, to obtain a negotiation result, where the negotiation result is used to indicate whether an air interface between the CU and the UE is encrypted by using a packet data convergence layer PDCP protocol;

a second transceiver unit, configured to send a first message to the distributed unit DU;

When the negotiation result indicates that the air interface is encrypted by using the PDCP protocol, the first message is used to indicate that the user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.
The CU according to claim 13, wherein the DU has a first interface, and the first interface is an interface for the DU to perform user plane communication with the CU; And an encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the first non-encrypted address is used to indicate that the IPSec is not used. The protocol performs encryption/decryption processing on the user plane data message;

The second transceiver unit is further configured to:

Receiving a first response message sent by the DU, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.
The CU according to claim 14, wherein the CU further comprises:

a processing unit, configured to encrypt, by using the PDCP protocol, a downlink user plane data packet; and set a destination address of the downlink user plane data packet to the first unencrypted address;

a determining unit, configured to determine, according to the first non-encrypted address, that the downlink user plane data packet is encrypted by using the IPSec protocol;

The second transceiver unit is further configured to send the downlink user plane data packet to the DU.
The CU according to claim 14, wherein the first message is used to indicate that the user plane bearer uses the IPSec protocol, when the negotiation result indicates that the air interface does not use the PDCP protocol to encrypt. The first response message is used to indicate that the address carried by the user plane on the DU end is the first encrypted address.
The CU according to claim 14, wherein when the negotiation result indicates that the air interface is encrypted using the PDCP protocol, and the communication between the CU and the DU passes through a security gateway SeGW, The CU also includes:

The processing unit is further configured to: encrypt the downlink user plane data packet by using the PDCP protocol; and set a destination address of the downlink user plane data packet to the first unencrypted address;

The third transceiver unit is configured to send the downlink user plane data packet to the SeGW.
The CU according to any one of claims 13 to 17, wherein the CU has a second interface, and the second interface is an interface for the CU to perform user plane communication with the DU; The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used for The user is instructed to perform encryption/decryption processing on the user plane data message without using the IPSec protocol.
A distributed unit DU, comprising:

a first transceiver unit, configured to receive a first message sent by the CU, where the air interface between the central unit CU and the user equipment UE is encrypted by using a packet data convergence layer PDCP protocol, where the first message is used to indicate the The user plane bearer between the CU and the DU is not encrypted using the Internet Protocol Secure IPSec protocol.
The DU according to claim 19, wherein the DU has a first interface, and the first interface is an interface for the DU to perform user plane communication with the CU; And an encrypted address and a first unencrypted address, where the first encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the first non-encrypted address is used to indicate that the IPSec is not used. The protocol performs encryption/decryption processing on the user plane data message;

When the air interface is encrypted by using the PDCP protocol, the first transceiver unit is further configured to:

Sending a first response message to the CU, where the first response message is used to indicate that the address carried by the user plane on the DU end is the first unencrypted address.
The DU according to claim 20, wherein when the air interface is encrypted using the PDCP protocol, the DU further includes:

The second transceiver unit is further configured to receive an uplink user plane data packet sent by the UE;

The processing unit is further configured to: set a source address of the uplink user plane data packet to the first unencrypted address;

The determining unit is further configured to: determine, according to the first unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol;

The first transceiver unit is further configured to send the uplink user plane data packet to the CU.
The DU according to claim 21, wherein when the air interface is encrypted using the PDCP protocol, and the communication between the DU and the CU passes through the SeGW, the DU further includes:

The second transceiver unit is further configured to receive an uplink user plane data packet sent by the UE;

The processing unit is further configured to: set a source address of the uplink user plane data packet to the first unencrypted address;

The determining unit is further configured to: determine, according to the first unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol;

The third transceiver unit is further configured to send the uplink user plane data packet to the SeGW.
The DU according to any one of claims 19 to 22, wherein the CU has a second interface, and the second interface is an interface for the CU to perform user plane communication with the DU; The second interface is configured with a second encrypted address and a second unencrypted address, where the second encrypted address is used to indicate that the user plane data packet is encrypted/decrypted using the IPSec protocol; and the second non-encrypted address is used for Instructing to perform encryption/decryption processing on the user plane data packet without using the IPSec protocol;

When the air interface is encrypted using the PDCP protocol, the DU further includes:

The second transceiver unit is further configured to receive an uplink user plane data packet sent by the UE;

The processing unit is configured to set a destination address of the uplink user plane data packet to the second unencrypted address;

The determining unit is further configured to: determine, according to the second unencrypted address, that the uplink user plane data packet is encrypted by using the IPSec protocol;

The first transceiver unit is further configured to send the uplink user plane data packet to the CU.
A computer readable storage medium, comprising instructions for causing a computer to perform the method of any one of claims 1 to 12 when the instructions are run on a computer.
An information transmission system, characterized in that the information transmission system comprises the central unit CU according to any one of claims 13 to 18, and the distribution according to any one of claims 19 to 23. Unit DU.