WO2020020029A1 - 密钥更新方法、终端及网络侧设备 - Google Patents

密钥更新方法、终端及网络侧设备 Download PDF

Info

Publication number
WO2020020029A1
WO2020020029A1 PCT/CN2019/096327 CN2019096327W WO2020020029A1 WO 2020020029 A1 WO2020020029 A1 WO 2020020029A1 CN 2019096327 W CN2019096327 W CN 2019096327W WO 2020020029 A1 WO2020020029 A1 WO 2020020029A1
Authority
WO
WIPO (PCT)
Prior art keywords
key update
key
random access
terminal
network
Prior art date
Application number
PCT/CN2019/096327
Other languages
English (en)
French (fr)
Inventor
张艳霞
吴昱民
Original Assignee
维沃移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 维沃移动通信有限公司 filed Critical 维沃移动通信有限公司
Publication of WO2020020029A1 publication Critical patent/WO2020020029A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W74/00—Wireless channel access
    • H04W74/08—Non-scheduled access, e.g. ALOHA
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W74/00—Wireless channel access
    • H04W74/08—Non-scheduled access, e.g. ALOHA
    • H04W74/0833—Random access procedures, e.g. with 4-step access

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to a method for updating a key, a terminal, and a network-side device.
  • Figure 1 shows a simplified two-step random access process
  • Msg0 (message 0): configuration information required by the network-side device for the two-step random access configured by the terminal, such as the sending resources of Msg1 (message 1);
  • Msg1 The terminal selects a random access resource and uses the random access resource to send a random access preamble to the base station.
  • the terminal identifier is carried in Msg1, and the network-side device can determine which terminal is sending the random access request message through the identifier.
  • Msg1 can also carry control plane data or user plane data. For example, it can be used for small data transmission in an inactive (inactive or deactivated) terminal, which can reduce the signaling overhead during terminal state transition.
  • the network-side device sends a random access response to the terminal.
  • the random access response should carry a terminal identifier, which is used to indicate whether the terminal competes for successful access. If the competitive access is successful, the random access response may also carry timing advance TA, uplink grant UL grant, and other information.
  • the PDCP (Packet Data Convergence Protocol) layer in NR is responsible for handling the security issues of the AS layer (access layer), which is implemented through encryption / decryption and integrity protection / verification.
  • AS layer access layer
  • encryption and integrity protection functions can be enabled for both control plane data and user plane data.
  • RRC Radio Resource Control
  • the encryption algorithm and integrity protection algorithm are configured by higher layers.
  • the main input parameters required by the PDCP layer for security processing include: the security protection count value COUNT, the direction DIRECTION (used to identify the direction of data transmission), the wireless bearer identifier BEARER, and the key KEY.
  • the two parameters of BEARER and KEY are provided by the high level.
  • different KEYs are used.
  • the KEY parameter refers to the control plane data encryption key.
  • the control plane data encryption key, control plane data integrity protection key, user plane data encryption key, and user plane data integrity protection key are derived through a specific algorithm based on the base station key.
  • COUNT occupies 32 bits, and the value range is [0,2 32 -1].
  • COUNT is composed of HFN (Hyper Frame Number) and PDCP SN (Packet Data Convergence Protocol Sequence Number, The packet data convergence protocol sequence number) consists of two parameters.
  • PDCP COUNT wrap around From the perspective of security theory, for a certain radio bearer, a given COUNT value cannot be processed securely with the same key.
  • a non-connected terminal such as an inactive terminal
  • small data transmission or RRC connection establishment / recovery / reconstruction can be performed based on a simplified two-step competitive random access method.
  • data such as user plane data
  • the present disclosure provides a key update method, terminal, and network-side device in real time to solve the problem of secure processing of data carried in a random access request message in two-step competitive random access.
  • a key update method which is applied to a terminal, includes:
  • An embodiment of the present disclosure also provides a method for updating a key, which is applied to a network-side device, including:
  • An embodiment of the present disclosure further provides a terminal, including:
  • a request sending module configured to send a random access request message to a network-side device, where the random access request message carries a data packet that the terminal performs security processing according to the currently stored first key;
  • a response receiving module configured to receive a random access response message carrying key update information sent by the network-side device
  • the key update module is configured to determine an updated second key according to the key update information.
  • An embodiment of the present disclosure further provides a terminal, including a processor, a memory, and a computer program stored on the memory and executable on the processor.
  • the computer program is implemented as described above when executed by the processor. The steps of the key update method described above.
  • An embodiment of the present disclosure further provides a network-side device, including:
  • a request receiving module configured to receive a random access request message sent by a terminal, where the random access request message carries a data packet that the terminal performs security processing according to a currently stored first key;
  • the response sending module is configured to send a random access response message carrying the key update information to the terminal.
  • An embodiment of the present disclosure further provides a network-side device including a processor, a memory, and a computer program stored on the memory and executable on the processor.
  • the computer program is implemented when the processor is executed by the processor. Steps of the key update method as described above.
  • An embodiment of the present disclosure further provides a computer-readable storage medium on which a computer program is stored.
  • a computer program is stored on which a computer program is stored.
  • the terminal and the network-side device can update the key based on the key update information, thereby improving the security of data transmission.
  • Figure 1 shows a simplified two-step random access process
  • FIG. 2 is a schematic structural diagram of a parameter COUNT required for security processing
  • FIG. 3 is a schematic structural diagram of a wireless communication system according to an embodiment of the present disclosure.
  • FIG. 4 shows one of the steps of a key update method provided by an embodiment of the present disclosure
  • FIG. 5 shows a second flowchart of the steps of the key update method provided by the embodiment of the present disclosure
  • FIG. 6 shows one of the structural schematic diagrams of a terminal provided by an embodiment of the present disclosure
  • FIG. 7 shows a second schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a terminal and a network-side device according to an embodiment of the present disclosure
  • FIG. 9 is a schematic structural diagram of a network-side device according to an embodiment of the present disclosure.
  • words such as “exemplary” or “for example” are used as examples, illustrations or illustrations. Any embodiment or design described as “exemplary” or “for example” in the embodiments of the present disclosure should not be construed as more preferred or advantageous over other embodiments or designs. Rather, the use of the words “exemplary” or “for example” is intended to present the relevant concept in a concrete manner.
  • the detection method, transmission method, terminal, and network-side device of the advance indication signal provided by the embodiments of the present disclosure can be applied to a wireless communication system.
  • the wireless communication system may be a 5G system, an evolved long term evolution (evolved long term evolution, eLTE) system, or a subsequent evolved communication system.
  • FIG. 3 a schematic diagram of an architecture of a wireless communication system according to an embodiment of the present disclosure.
  • the wireless communication system may include a network-side device 10 and a terminal (the terminal may also be referred to as a user-side device).
  • the terminal is referred to as UE11, and the UE11 may be connected to the network-side device 10.
  • the connection between the foregoing devices may be a wireless connection.
  • a solid line is used in FIG. 3 for illustration.
  • the above communication system may include multiple UEs, network-side devices, and may communicate with multiple UEs (transmit signaling or transmit data).
  • the network-side device 10 provided in the embodiment of the present disclosure may be a base station.
  • the base station may be a commonly used base station, an evolved base station (eNB), or a network-side device in a 5G system (for example, Next-generation base station (next generation node, base station, gNB) or transmission and reception point (transmission and reception point (TRP)) or cell cell and other equipment.
  • eNB evolved base station
  • 5G system for example, Next-generation base station (next generation node, base station, gNB) or transmission and reception point (transmission and reception point (TRP)) or cell cell and other equipment.
  • Next-generation base station next generation node, base station, gNB
  • TRP transmission and reception point
  • the terminal provided in the embodiments of the present disclosure may be a mobile phone, a tablet computer, a notebook computer, an Ultra-Mobile Personal Computer (UMPC), a netbook, a wearable device (Wearable Device), a vehicle-mounted device, or a personal digital assistant (Personal Digital Assistant, PDA). It should be noted that the specific types of terminals are not limited in the embodiments of the present disclosure.
  • UMPC Ultra-Mobile Personal Computer
  • PDA Personal Digital Assistant
  • an embodiment of the present disclosure provides a key update method, which is applied to a terminal and includes:
  • Step 401 Send a random access request message to the network-side device, where the random access request message carries a data packet that the terminal performs security processing according to the currently stored first key.
  • the network side device and the terminal have the same understanding of the key, that is, the key currently stored on the terminal is the same as the key currently stored on the network side device.
  • the key currently stored by the terminal is the first key, and accordingly, the key currently stored by the network-side device is also the first key.
  • Step 402 Receive a random access response message carrying the key update information sent by the network-side device.
  • the random access request message in step 401 and the random access response message in step 402 are Msg1 and Msg2 in a two-step competition random access procedure.
  • the random access response sent by the network-side device to the terminal when the key needs to be updated carries the key update information. It should be noted that the network side may not carry the key update information in the random access response sent to the terminal when the key update is not required.
  • the random access response message may also carry other information, such as identification information of the terminal, timing advance, and uplink authorization information, which are not listed here one by one.
  • Step 403 Determine an updated second key according to the key update information.
  • the updated second key is the root key KgNB *.
  • the terminal needs to store the updated second key locally, and delete or ignore the previously used first key. Further, after determining the updated second key, if the terminal has small data to be transmitted, the terminal uses the updated second key to securely process the data to be transmitted, and then transmits the data through a random access request message, which can reduce Signaling overhead during terminal state transition, that is, the terminal can implement data transmission without switching the RRC state.
  • the key update information includes:
  • a key update indication used to indicate whether the terminal performs a key update
  • the key update instruction may be 1-bit instruction information. For example, a value of "1" indicates that the terminal performs key update, and a value of "0" indicates that the terminal does not perform key update; for another example, the value is " 1 "indicates that the terminal does not perform key update, and a value of" 0 "indicates that the terminal performs key update.
  • step 403 includes:
  • the updated second key is determined according to the first key currently stored in the terminal and a preset key update algorithm.
  • the preset key update algorithm may be agreed by the protocol, or may be pre-negotiated and configured by the terminal and the network-side device, for example, the preset key update algorithm is a horizontal key update algorithm.
  • the new key (that is, the second key) derived by the terminal according to the currently stored first key and a preset key update algorithm is derived by the network-side device according to the currently stored first key and a preset key update algorithm.
  • the new key (ie, the second key) is the same.
  • step 402 includes:
  • security processing mentioned above specifically include: Processing and integrity protection processing are not specifically limited here.
  • the network-side device may carry the key update information in each random access response message sent, or may send it when the network-side device determines that a key update is needed.
  • the random access response message carries the key update information, which is not specifically limited herein.
  • step 401 includes:
  • the COUNT value includes the super frame number HFN and PDCP SN.
  • the PDCP and SN are part of the header of the PDCP data packet.
  • the HFN is not transmitted in the PDCP header and is maintained by the terminal and the network-side equipment.
  • the terminal can determine the COUNT value of the data packet according to the HFN maintained by the terminal and the PDCP SN carried in the header of the data packet.
  • the terminal needs to update the COUNT value of the currently sent data packet in real time.
  • step 402 includes:
  • the COUNT value of the data packet carried in the random access request message is determined by the network-side device according to the PDCP SN carried in the header of the data packet carried in the random access request message.
  • the network-side device After receiving the random access request message sent by the terminal, the network-side device determines the COUNT value of the data packet according to the PDCP SN carried in the header of the data packet carried by the random access request message and the HFN maintained by the network-side device itself, so that the COUNT value of the data packet is based on the COUNT. Value, currently stored key, etc. to decrypt and / or integrity verify the packet.
  • the COUNT value of the data packet is greater than a preset value, a random access response message carrying the key update information is sent to the terminal.
  • the preset value is agreed by the protocol or configured by the network; and the preset value may be a maximum value of COUNT, that is, 2 32 -1; or the preset value may be a value less than the maximum value of COUNT It is not specifically limited here.
  • the method further includes:
  • the COUNT value is set to the initial value. For example, if the initial value of the COUNT value is zero, the COUNT value is set to 0 after the updated second key is determined, that is, both HFN and PDCP and SN are set to 0. When the terminal and / or the network-side device communicates using the updated second key, the COUNT value is re-started from the initial value.
  • the network side is not targeted for the case where the terminal and the network side device do not maintain the COUNT value.
  • the device directly carries the key update information in the random access response message to implement the key update.
  • the COUNT value is maintained by the terminal and the network side
  • the COUNT value of the data packet received by the network side is greater than a preset value
  • the incoming response message carries key update information to implement key update and ensure the security of data transmission.
  • an embodiment of the present disclosure further provides a method for updating a key, which is applied to a network-side device, including:
  • Step 501 Receive a random access request message sent by a terminal, where the random access request message carries a data packet that the terminal performs security processing according to a currently stored first key.
  • the network side device and the terminal have the same understanding of the key, that is, the key currently stored on the terminal is the same as the key currently stored on the network side device.
  • the key currently stored by the terminal is the first key, and accordingly, the key currently stored by the network-side device is also the first key.
  • Step 502 Send a random access response message carrying the key update information to the terminal.
  • the random access request message in step 501 and the random access response message in step 502 are Msg1 and Msg2 in a two-step competition random access procedure.
  • the random access response sent by the network-side device to the terminal when the key needs to be updated carries the key update information. It should be noted that the network side may not carry the key update information in the random access response sent to the terminal when the key update is not required.
  • the random access response message may also carry other information, such as identification information of the terminal, timing advance, and uplink authorization information, which are not listed here one by one.
  • the key update information includes:
  • a key update indication used to indicate whether the terminal performs a key update
  • the key update instruction may be 1-bit instruction information. For example, a value of "1" indicates that the terminal performs key update, and a value of "0" indicates that the terminal does not perform key update; for another example, the value is " 1 "indicates that the terminal does not perform key update, and a value of" 0 "indicates that the terminal performs key update.
  • the method further includes:
  • the updated second key is determined according to the first key currently stored by the network-side device and a preset key update algorithm.
  • the preset key update algorithm may be agreed by the protocol, or may be pre-negotiated and configured by the terminal and the network-side device, for example, the preset key update algorithm is a horizontal key update algorithm.
  • the new key (that is, the second key) derived by the terminal according to the currently stored first key and a preset key update algorithm is derived by the network-side device according to the currently stored first key and a preset key update algorithm.
  • the new key (ie, the second key) is the same.
  • both the terminal and the network-side device may determine an updated second key according to the key update information, and update the updated second key.
  • the second key is stored locally.
  • step 502 includes:
  • the random access response message carrying the key update information sent by the network side is processed securely based on the key (ie, the first key) before the update.
  • security processing mentioned above specifically include: encryption Processing and integrity protection processing are not specifically limited here.
  • the network-side device may carry the key update information in each random access response message sent, or may send it when the network-side device determines that a key update is needed.
  • the random access response message carries the key update information, which is not specifically limited herein.
  • this embodiment of the present disclosure also provides a way to determine whether the current key needs to be updated.
  • Specific terminals and network-side devices maintain a COUNT value.
  • the COUNT value is greater than a preset value
  • the network-side device decides to randomly access the key.
  • the incoming response message carries the key update information.
  • the terminal may send the random access request message carrying the security processed data packet according to the data packet carried in the random access request message.
  • the PDCP SN carried in the header determines the COUNT value of the data packet.
  • step 501 includes:
  • the COUNT value includes the super frame number HFN and PDCP SN.
  • the PDCP and SN are part of the header of the PDCP data packet.
  • the HFN is not transmitted in the PDCP header and is maintained by the terminal and the network-side equipment.
  • the terminal can determine the COUNT value of the data packet according to the HFN maintained by the terminal and the PDCP SN carried in the header of the data packet.
  • the terminal needs to update the COUNT value of the currently sent data packet in real time.
  • the network-side device After receiving the random access request message sent by the terminal, the network-side device determines the COUNT value of the data packet according to the PDCP SN carried in the packet header of the data packet carried by the random access request message and the HFN maintained by the network-side device itself, so that Value, currently stored key, etc. to decrypt and / or integrity verify the packet.
  • step 502 includes:
  • the preset value is agreed by the protocol or configured by the network; and the preset value may be a maximum value of COUNT, that is, 2 32 -1; or the preset value may be a value less than the maximum value of COUNT It is not specifically limited here.
  • the method further includes:
  • the COUNT value is set to the initial value. For example, if the initial value of the COUNT value is zero, the COUNT value is set to 0 after the updated second key is determined, that is, both HFN and PDCP and SN are set to 0. When the terminal and / or the network-side device communicates using the updated second key, the COUNT value is re-started from the initial value.
  • the network side is not targeted for the case where the terminal and the network side device do not maintain the COUNT value.
  • the device directly carries the key update information in the random access response message to implement the key update.
  • the COUNT value is maintained by the terminal and the network side
  • the COUNT value of the data packet received by the network side is greater than a preset value
  • the incoming response message carries key update information to implement key update and ensure the security of data transmission.
  • Step 1 The terminal sends a random access request message to the network-side device.
  • the data carried in the random access request message is subjected to security processing, such as encryption, according to the first key currently stored by the terminal.
  • security processing such as encryption
  • each time a data packet is sent The PDCP entity of the terminal updates the COUNT value and HFN of the data packet based on the PDCP and SN carried in the data packet;
  • Step 2 The network side receives the data carried in the random access message. For each received data packet, the PDCP entity on the network side updates the COUNT value and HFN of the data packet based on the PDCP SN carried in the received packet;
  • Step 3 When the COUONT value of the data packet is greater than a preset value, the network-side device sends a random access response carrying the key update information to the terminal;
  • the key update information includes: used to indicate whether the terminal performs key update A key update indication; and / or, an updated second key;
  • the random access response sent by the network-side device is processed securely based on the pre-update key
  • Step 4 The terminal receives the random access response message, and updates the key information carried in the random access response message.
  • the behavior of the terminal is any of the following:
  • the terminal When the key update instruction instructs the terminal to perform key update, the terminal derives the updated second key based on a preset key update algorithm (such as a horizontal key update algorithm) and stores it; or the terminal directly stores the key update information to carry The updated second key.
  • a preset key update algorithm such as a horizontal key update algorithm
  • Step 5 The PDCP entity of the terminal sets the COUNT value to an initial value; for example, HFN and PDCP and SN are set to zero.
  • Step 6 The terminal sends a random access request message to the network-side device, and the data carried in the random access request message is securely processed according to the first key currently stored by the terminal, such as encryption;
  • Step 7 The network-side device sends a random access response carrying the key update information to the terminal;
  • the key update information includes: a key update instruction for indicating whether the terminal performs key update; and / or, the updated first Two keys
  • the random access response sent by the network-side device is processed securely based on the pre-update key
  • Step 8 The terminal receives the random access response message, and updates the key information carried in the random access response message, and the behavior of the terminal is any of the following:
  • the terminal When the key update instruction instructs the terminal to perform key update, the terminal derives the updated second key based on a preset key update algorithm (such as a horizontal key update algorithm) and stores it; or the terminal directly stores the key update information to carry The updated second key.
  • a preset key update algorithm such as a horizontal key update algorithm
  • the network side is not targeted for the case where the terminal and the network side device do not maintain the COUNT value.
  • the device directly carries the key update information in the random access response message to implement the key update.
  • the COUNT value is maintained by the terminal and the network side
  • the COUNT value of the data packet received by the network side is greater than a preset value
  • the incoming response message carries key update information to implement key update and ensure the security of data transmission.
  • an embodiment of the present disclosure further provides a terminal 600, including:
  • the request sending module 601 is configured to send a random access request message to a network-side device, where the random access request message carries a data packet that the terminal performs security processing according to the currently stored first key;
  • a response receiving module 602 configured to receive a random access response message carrying key update information sent by the network-side device
  • the key update module 603 is configured to determine an updated second key according to the key update information.
  • the key update information includes:
  • a key update indication used to indicate whether the terminal performs a key update
  • the key update module includes:
  • a key update submodule configured to: in a case where the key update information includes the key update instruction and the key update instruction is used to instruct a terminal to perform a key update, according to a first key currently stored in the terminal And a preset key update algorithm to determine an updated second key.
  • the response receiving module includes:
  • the first response receiving submodule is configured to receive a random access response message carrying the key update information and sent by the network-side device after performing security processing according to the first key currently stored by the network-side device.
  • the request sending module includes:
  • the request sending submodule is configured to send a random access request message to a network-side device, and determine the security of the data packet according to a packet data aggregation protocol sequence number PDCP carried in a packet header carried in the random access request message.
  • Count COUNT value a packet data aggregation protocol sequence number PDCP carried in a packet header carried in the random access request message.
  • the response receiving module includes:
  • a second response receiving submodule configured to receive a random access response message carrying key update information sent by the network-side device when the COUNT value of the data packet carried in the random access request message is greater than a preset value ;
  • the COUNT value of the data packet carried in the random access request message is determined by the network-side device according to the PDCP SN carried in the header of the data packet carried in the random access request message.
  • the terminal further includes:
  • the first setting module is used to set the COUNT value to an initial value.
  • the network-side device when the terminal carries data in the simplified two-step random access request message, for the case where the terminal and the network-side device do not maintain the COUNT value, the network-side device directly sends a random access response message.
  • the key update information is carried in the key to implement the key update.
  • the key update is carried in the random access response message when the COUNT value of the data packet received by the network side is greater than a preset value. Information, implement key updates, and ensure the security of data transmission.
  • the terminals provided in the embodiments of the present disclosure are terminals capable of performing the above-mentioned key update method, all the embodiments of the above-mentioned key update method are applicable to the terminal, and all can achieve the same or similar beneficial effects.
  • the terminal 700 includes, but is not limited to, a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, The user input unit 707, the interface unit 708, the memory 709, the processor 710, and the power supply 711 and other components.
  • a radio frequency unit 701 a radio frequency unit 701
  • a network module 702 an audio output unit 703, an input unit 704, a sensor 705, a display unit 706,
  • the terminal structure shown in FIG. 7 does not constitute a limitation on the terminal, and the terminal may include more or fewer components than shown in the figure, or some components may be combined, or different component arrangements.
  • the terminal includes, but is not limited to, a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a car terminal, a wearable device, a pedometer
  • the radio frequency unit 701 is configured to send a random access request message to a network-side device, where the random access request message carries a data packet that the terminal performs security processing according to the currently stored first key; and receives the network-side device A random access response message sent with the key update information;
  • a processor 710 configured to determine an updated second key according to the key update information
  • the terminal when the terminal carries data in the simplified two-step random access request message, for the case where the terminal and the network side device do not maintain the COUNT value, the network side device directly carries the secret in the random access response message.
  • the key update information is used to implement the key update.
  • the key update information is carried in the random access response message to implement The key is updated to ensure the security of data transmission.
  • the radio frequency unit 701 may be used to receive and send signals during the transmission and reception of information or during a call. Specifically, the downlink data from the base station is received and processed by the processor 710; The uplink data is sent to the base station.
  • the radio frequency unit 701 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, and the like.
  • the radio frequency unit 701 can also communicate with a network and other devices through a wireless communication system.
  • the terminal provides users with wireless broadband Internet access through the network module 702, such as helping users to send and receive email, browse web pages, and access streaming media.
  • the audio output unit 703 may convert audio data received by the radio frequency unit 701 or the network module 702 or stored in the memory 709 into audio signals and output them as sound. Moreover, the audio output unit 703 may also provide audio output (for example, a call signal reception sound, a message reception sound, etc.) related to a specific function performed by the terminal 700.
  • the audio output unit 703 includes a speaker, a buzzer, a receiver, and the like.
  • the input unit 704 is configured to receive an audio or video signal.
  • the input unit 704 may include a graphics processing unit (GPU) 7041 and a microphone 7042.
  • the graphics processor 7041 pairs images of still pictures or videos obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. Data is processed.
  • the processed image frames may be displayed on a display unit 706.
  • the image frames processed by the graphics processor 7041 may be stored in the memory 709 (or other storage medium) or transmitted via the radio frequency unit 701 or the network module 702.
  • the microphone 7042 can receive sound, and can process such sound into audio data.
  • the processed audio data can be converted into a format that can be transmitted to a mobile communication base station via the radio frequency unit 701 in the case of a telephone call mode.
  • the terminal 700 further includes at least one sensor 705, such as a light sensor, a motion sensor, and other sensors.
  • the light sensor includes an ambient light sensor and a proximity sensor.
  • the ambient light sensor can adjust the brightness of the display panel 7061 according to the brightness of the ambient light.
  • the proximity sensor can close the display panel 7061 and / when the terminal 700 is moved to the ear. Or backlight.
  • an accelerometer sensor can detect the magnitude of acceleration in various directions (usually three axes).
  • sensor 705 can also include fingerprint sensor, pressure sensor, iris sensor, molecular sensor, gyroscope, barometer, hygrometer, thermometer, infrared The sensors and the like are not repeated here.
  • the display unit 706 is configured to display information input by the user or information provided to the user.
  • the display unit 706 may include a display panel 7061.
  • the display panel 7061 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.
  • the user input unit 707 may be used to receive inputted numeric or character information, and generate key signal inputs related to user settings and function control of the terminal.
  • the user input unit 707 includes a touch panel 7071 and other input devices 7072.
  • Touch panel 7071 also known as touch screen, can collect user's touch operations on or near it (for example, the user uses a finger, stylus, etc. any suitable object or accessory on touch panel 7071 or near touch panel 7071 operating).
  • the touch panel 7071 may include two parts, a touch detection device and a touch controller.
  • the touch detection device detects the user's touch position, and detects the signal caused by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into contact coordinates, and sends it To the processor 710, receive the command sent by the processor 710 and execute it.
  • various types such as resistive, capacitive, infrared, and surface acoustic wave can be used to implement the touch panel 7071.
  • the user input unit 707 may further include other input devices 7072.
  • other input devices 7072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, and details are not described herein again.
  • the touch panel 7071 may be overlaid on the display panel 7061.
  • the touch panel 7071 detects a touch operation on or near the touch panel 7071, the touch panel 7071 transmits the touch operation to the processor 710 to determine the type of the touch event.
  • the type of event provides corresponding visual output on the display panel 7061.
  • the touch panel 7071 and the display panel 7061 are implemented as two independent components to implement the input and output functions of the terminal, in some embodiments, the touch panel 7071 and the display panel 7061 can be integrated and Implement the input and output functions of the terminal, which are not limited here.
  • the interface unit 708 is an interface through which an external device is connected to the terminal 700.
  • the external device may include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, and audio input / output (I / O) port, video I / O port, headphone port, and more.
  • the interface unit 708 may be used to receive an input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the terminal 700 or may be used between the terminal 700 and an external device. Transfer data.
  • the memory 709 may be used to store software programs and various data.
  • the memory 709 may mainly include a storage program area and a storage data area, where the storage program area may store an operating system, an application program (such as a sound playback function, an image playback function, etc.) required for at least one function; the storage data area may store data according to Data (such as audio data, phone book, etc.) created by the use of mobile phones.
  • the memory 709 may include a high-speed random access memory, and may further include a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device, or other volatile solid-state storage devices.
  • the processor 710 is a control center of the terminal, and uses various interfaces and lines to connect various parts of the entire terminal.
  • the processor 710 runs or executes software programs and / or modules stored in the memory 709, and calls data stored in the memory 709 to execute Various functions and processing data of the terminal, so as to monitor the terminal as a whole.
  • the processor 710 may include one or more processing units; optionally, the processor 710 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and an application program, etc.
  • the tuning processor mainly handles wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 710.
  • the terminal 700 may further include a power source 711 (such as a battery) for supplying power to various components.
  • a power source 711 such as a battery
  • the power source 711 may be logically connected to the processor 710 through a power management system, so as to implement charge, discharge, and power management through the power management system. And other functions.
  • the terminal 700 includes some functional modules that are not shown, and details are not described herein again.
  • an embodiment of the present disclosure further provides a terminal, including a processor 800, a memory 810, and a computer program stored on the memory 810 and executable on the processor 800.
  • the computer program When executed by the processor 800, each process of the foregoing embodiment of the key update method is implemented, and the same technical effects can be achieved. To avoid repetition, details are not described herein again.
  • An embodiment of the present disclosure further provides a computer-readable storage medium.
  • a computer program is stored on the computer-readable storage medium.
  • the processes of the foregoing key update method embodiments are implemented, and the same can be achieved.
  • Technical effects To avoid repetition, we will not repeat them here.
  • the computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • an embodiment of the present disclosure further provides a network-side device 900, including:
  • the request receiving module 901 is configured to receive a random access request message sent by a terminal, where the random access request message carries a data packet that the terminal performs security processing according to a currently stored first key;
  • the response sending module 902 is configured to send a random access response message carrying the key update information to the terminal.
  • the key update information includes:
  • a key update indication used to indicate whether the terminal performs a key update
  • the network-side device further includes:
  • a determining module configured to: in a case where the key update information includes the key update instruction and the key update instruction is used to instruct a terminal to perform a key update, according to a first key currently stored by the network-side device and A preset key update algorithm determines an updated second key.
  • the response sending module includes:
  • the first response sending submodule is configured to send a random access response message carrying the key update information to the terminal after the security processing is performed according to the first key currently stored by the network-side device.
  • the request receiving module includes:
  • the request receiving submodule is configured to receive a random access request message sent by the terminal, and determine a security count COUNT value of the data packet according to a PDCP SN carried in a header of the data packet carried in the random access request message.
  • the response sending module includes:
  • the second response sending submodule is configured to send a random access response message carrying the key update information to the terminal if the COUNT value of the data packet carried in the random access request message is greater than a preset value.
  • the network-side device further includes:
  • the second setting module is used to set the COUNT value to an initial value.
  • the network-side device when the terminal carries data in the simplified two-step random access request message, for the case where the terminal and the network-side device do not maintain the COUNT value, the network-side device directly sends a random access response message.
  • the key update information is carried in the key to implement the key update.
  • the key update is carried in the random access response message when the COUNT value of the data packet received by the network side is greater than a preset value. Information, implement key updates, and ensure the security of data transmission.
  • the network-side device provided by the embodiment of the present disclosure is a network-side device capable of performing the above-mentioned key update method, and all the embodiments of the above-mentioned key update method are applicable to the network-side device, and all can achieve the same Or similar benefits.
  • an embodiment of the present disclosure further provides a network-side device, including a processor 800, a memory 810, and a computer program stored on the memory 810 and executable on the processor 800.
  • a network-side device including a processor 800, a memory 810, and a computer program stored on the memory 810 and executable on the processor 800.
  • the computer program is executed by the processor 800, each process of the foregoing embodiment of the key update method is implemented, and the same technical effects can be achieved. To avoid repetition, details are not described herein again.
  • An embodiment of the present disclosure further provides a computer-readable storage medium.
  • a computer program is stored on the computer-readable storage medium.
  • the processes of the foregoing key update method embodiments are implemented, and the same can be achieved.
  • Technical effects To avoid repetition, we will not repeat them here.
  • the computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • the methods in the above embodiments can be implemented by means of software plus a necessary universal hardware platform, and of course, also by hardware, but in many cases the former is better.
  • Implementation Based on this understanding, the technical solution of the present disclosure that is essentially or contributes to the existing technology can be embodied in the form of a software product that is stored in a storage medium (such as ROM / RAM, magnetic disk, The optical disc) includes several instructions for causing a terminal (which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the embodiments of the present disclosure.
  • a terminal which may be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开提供一种密钥更新方法、终端及网络侧设备，该方法包括：向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；根据所述密钥更新信息，确定更新后的第二密钥。

Description

密钥更新方法、终端及网络侧设备
相关申请的交叉引用
本申请主张在2018年7月26日在中国提交的中国专利申请No.201810835733.5的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，尤其是指一种密钥更新方法、终端及网络侧设备。
背景技术
根据RAN1会议结论，新空口NR将引入简化的两步随机接入流程，以减少四步随机接入的时延。如图1所示为简化的两步随机接入流程：
Msg0(消息0)：网络侧设备给终端配置的两步随机接入所需的配置信息，例如Msg1(消息1)的发送资源等；
Msg1：终端选择随机接入资源并利用该随机接入资源向基站发送随机接入前导码(preamble)。同时，在Msg1中携带终端标识，通过该标识网络侧设备可以确定是哪一个终端在发送随机接入请求消息。此外，Msg1中还可以携带控制面数据或用户面数据，例如可适用于inactive态(非激活态或去激活态)的终端进行小数据传输，可以降低终端状态转换时的信令开销；
Msg2：网络侧设备向终端发送随机接入响应。该随机接入响应中应携带终端标识，用于表明终端是否竞争接入成功。如果竞争接入成功，随机接入响应中还可以携带定时提前量TA，上行授权UL grant等信息。
NR中PDCP(Packet Data Convergence Protocol，分组数据汇聚协议)层负责处理AS层(接入层)的安全性问题，通过加密/解密和完整性保护/验证实现。目前NR中，对控制面数据和用户面数据都可以启用加密和完整性保护功能，其中，对于用户面数据，这两个功能为RRC(Radio Resource Control，无线资源控制)可配置功能。
加密算法和完整性保护算法由高层配置。PDCP层在进行安全处理时所 需的主要输入参数包括：安全性保护计数值COUNT，方向DIRECTION(用于标识数据传输方向)，无线承载标识BEARER和密钥KEY。
其中，BEARER和KEY两个参数由高层提供。针对不同的用途，使用不同的KEY，例如对控制面数据的加密时，KEY参数指的是控制面数据加密密钥。控制面数据加密密钥、控制面数据完整性保护密钥、用户面数据加密密钥以及用户面数据完整性保护密钥是基于基站密钥通过特定算法推导出来的。
NR中，COUNT占32比特，取值范围为[0,2 32-1]，如图2所示，COUNT由HFN(Hyper Frame Number，超帧号)和PDCP SN(Packet Data Convergence Protocol Sequence Number，分组数据汇聚协议序列号)两个参数组成。HFN表示PDCP SN溢出的次数，比如SN为5比特，那么SN的取值范围是0～31，当SN＝31后，下一次对发送数据包的编号将从SN＝0开始，此时HFN加1。如果COUNT在取值范围内循环取值，那么当其达到最大值后，再次更新时将会取值为0，这称为PDCP COUNT发生了翻转更新(wrap around)。从安全理论角度讲，对于某无线承载，给定的COUNT值不能用相同的密钥进行安全处理。
综上，对于非连接态终端(例如inactive态的终端)，可以基于简化的两步竞争随机接入方法进行小数据传输或RRC连接建立/恢复/重建。但是，目前对两步竞争随机接入中Msg1携带的数据(例如用户面数据)的安全处理还没有解决方案。
发明内容
本公开实时提供一种密钥更新方法、终端及网络侧设备，以解决对两步竞争随机接入中的随机接入请求消息携带的数据的安全处理问题。
为了解决上述技术问题，本公开是这样实现的：一种密钥更新方法，应用于终端，包括：
向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
根据所述密钥更新信息，确定更新后的第二密钥。
本公开实施例还提供了一种密钥更新方法，应用于网络侧设备，包括：
接收终端发送的随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
向所述终端发送携带密钥更新信息的随机接入响应消息。
本公开实施例还提供了一种终端，包括：
请求发送模块，用于向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
响应接收模块，用于接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
密钥更新模块，用于根据所述密钥更新信息，确定更新后的第二密钥。
本公开实施例还提供了一种终端，包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如上所述的密钥更新方法的步骤。
本公开实施例还提供了一种网络侧设备，包括：
请求接收模块，用于接收终端发送的随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
响应发送模块，用于向所述终端发送携带密钥更新信息的随机接入响应消息。
本公开实施例还提供了一种网络侧设备，包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如上所述的密钥更新方法的步骤。
本公开实施例还提供了一种计算机可读存储介质，所述计算机可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如上所述的密钥更新方法的步骤。
在本公开实施例中，通过在随机接入响应消息中携带密钥更新信息，可以使得终端和网络侧设备基于该密钥更新信息实现密钥的更新，提升数据传输的安全性。
附图说明
为了更清楚地说明本公开实施例的技术方案，下面将对本公开实施例的描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1表示简化的两步随机接入流程；
图2表示安全处理所需参数COUNT值的结构示意图；
图3表示本公开实施例提供的一种无线通信系统的架构示意图；
图4表示本公开实施例提供的密钥更新方法的步骤流程图之一；
图5表示本公开实施例提供的密钥更新方法的步骤流程图之二；
图6表示本公开实施例提供的终端的结构示意图之一；
图7表示本公开实施例提供的终端的结构示意图之二；
图8表示本公开实施例提供的终端和网络侧设备的结构示意图；
图9表示本公开实施例提供的网络侧设备的结构示意图。
具体实施方式
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
下面将结合本公开实施例中的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本公开一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
在本公开实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本公开实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
下面结合附图介绍本公开的实施例。本公开实施例提供的提前指示信号的检测方法、传输方法、终端及网络侧设备可以应用于无线通信系统中。该 无线通信系统可以为采用5G系统，或者演进型长期演进(Evolved Long Term Evolution，eLTE)系统，或者后续演进通信系统。参考图3，为本公开实施例提供的一种无线通信系统的架构示意图。如图3所示，该无线通信系统可以包括：网络侧设备10和终端(终端也可称为用户侧设备)，例如终端记做UE11，UE11可以与网络侧设备10连接。在实际应用中上述各个设备之间的连接可以为无线连接，为了方便直观地表示各个设备之间的连接关系，图3中采用实线示意。
需要说明的是，上述通信系统可以包括多个UE，网络侧设备和可以与多个UE通信(传输信令或传输数据)。
本公开实施例提供的网络侧设备10可以为基站，该基站可以为通常所用的基站，也可以为演进型基站(evolved node base station，eNB)，还可以为5G系统中的网络侧设备(例如下一代基站(next generation node base station，gNB)或发送和接收点(transmission and reception point，TRP))或者小区cell等设备。
本公开实施例提供的终端可以为手机、平板电脑、笔记本电脑、超级移动个人计算机(Ultra-Mobile Personal Computer，UMPC)、上网本、可穿戴式设备(Wearable Device)、车载设备或者个人数字助理(Personal Digital Assistant，PDA)等。需要说明的是，在本公开实施例中并不限定终端的具体类型。
如图4所示，本公开实施例提供一种密钥更新方法，应用于终端，包括：
步骤401，向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包。
本步骤中，为了保证网络侧设备进行加密或完整性保护的数据包可以被终端成功解密或进行完整性验证，或者，为了保证终端进行加密或完整性保护的数据包可以被网络侧设备成功解密或进行完整性验证，网络侧设备和终端对密钥的理解是一致的，即终端当前存储的密钥与网络侧设备当前存储的密钥相同。例如，终端当前存储的密钥为第一密钥，相应地，网络侧设备当前存储的密钥也为第一密钥。
步骤402，接收所述网络侧设备发送的携带密钥更新信息的随机接入响 应消息。
作为一个实施例，步骤401中的随机接入请求消息和步骤402中的随机接入响应消息为两步竞争随机接入流程中的Msg1和Msg2。为了实现密钥的更新，网络侧设备在需要进行密钥更新的时候给终端发送的随机接入响应中携带密钥更新信息。需要说明的是，网络侧可以在不需要进行密钥更新的时候给终端发送的随机接入响应中不携带密钥更新信息。
进一步地，随机接入响应消息中还可以携带其他信息，例如终端的标识信息、定时提前量、上行授权信息等，在此不一一枚举。
步骤403，根据所述密钥更新信息，确定更新后的第二密钥。例如更新后的第二密钥为根密钥KgNB*。
作为一个实施例，终端确定更新后的第二密钥之后，需要将更新后的第二密钥存储在本地，并删除或忽略之前使用的第一密钥。进一步地，终端在确定更新的第二密钥之后，若有小数据待传输，则采用更新后的第二密钥对待传输的数据进行安全处理之后再通过随机接入请求消息进行传输，可以降低终端状态转换时的信令开销，即终端无需切换RRC状态即可实现数据传输。
较佳地，本公开的上述实施例中，所述密钥更新信息包括：
用于指示终端是否进行密钥更新的密钥更新指示；和/或，
更新后的第二密钥。
其中，密钥更新指示可以是1比特指示信息，例如，取值为“1”指示终端进行密钥更新，取值为“0”则指示终端不进行密钥更新；再例如，取值为“1”指示终端不进行密钥更新，取值为“0”则指示终端进行密钥更新。
进一步地，在所述密钥更新信息包括所述密钥更新指示的情况下，步骤403包括：
在所述密钥更新指示用于指示终端进行密钥更新的情况下，根据终端当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
需要说明的是，预设密钥更新算法可以是协议约定的，也可以是终端和网络侧设备预先协商配置的，例如预设密钥更新算法为水平密钥更新算法。终端根据当前存储的第一密钥和预设密钥更新算法推导出的新的密钥(即第二密钥)与网络侧设备根据当前存储的第一密钥和预设密钥更新算法推导出 的新的密钥(即第二密钥)相同。
可选地，本公开的上述实施例中，步骤402包括：
接收所述网络侧设备根据网络侧设备当前存储的第一密钥进行安全处理后发送的携带所述密钥更新信息的随机接入响应消息。即网络侧发送的携带所述密钥更新信息的随机接入响应消息是基于更新前的密钥(即第一密钥)进行了安全处理的。
需要说明的是，上述提及的安全处理(包括终端根据第一密钥对数据包进行的安全处理以及网络侧设备根据第一密钥对随机接入响应消息进行的安全处理)具体包括：加密处理和完整性保护处理等，在此不做具体限定。
进一步需要说明的是，上述步骤402中网络侧设备可以在每次发送的随机接入响应消息中均携带密钥更新信息，也可以在网络侧设备确定需要进行密钥更新的时候在其发送的随机接入响应消息中携带密钥更新信息，在此不做具体限定。
承接上例，本公开实施例还提供一种判断当前是否需要更新密钥的方式，具体的终端和网络侧设备维护COUNT值，当COUNT值大于预设值的情况下网络侧设备决定在随机接入响应消息中携带密钥更新信息。相应地，为了保证终端和网络侧设备对数据包的COUNT值理解一致，步骤401包括：
向网络侧设备发送随机接入请求消息，并根据所述随机接入请求消息携带的数据包的包头携带的分组数据汇聚协议序列号PDCP SN确定所述数据包的安全计数COUNT值。
需要说明的是，COUNT值包括超帧号HFN和PDCP SN。其中PDCP SN是PDCP数据包的包头的一部分，HFN不在PDCP包头中传输，由终端和网络侧设备各自维护。终端根据自身维护的HFN和数据包的包头携带的PDCP SN可以确定该数据包的COUNT值。终端需要实时更新当前发送的数据包的COUNT值。
相应地，步骤402包括：
接收所述网络侧设备在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下发送的携带密钥更新信息的随机接入响应消息；
其中，所述随机接入请求消息携带的数据包的COUNT值由所述网络侧 设备根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定。
网络侧设备接收到终端发送的随机接入请求消息之后，根据随机接入请求消息携带的数据包的包头携带的PDCP SN和网络侧设备自身维护的HFN确定该数据包的COUNT值，从而根据COUNT值、当前存储的密钥等对数据包进行解密和/或完整性验证。并在数据包的COUNT值大于预设值的情况下，向终端发送携带密钥更新信息的随机接入响应消息。
该预设值是协议约定的，或者网络配置的；且该预设值可以是COUNT的最大取值，即2 32-1；或者，该预设值可以是小于COUNT的最大取值的一个值，在此不作具体限定。
进一步地，针对终端和网络侧设备维护数据包的COUNT值的情况，步骤403之后，所述方法还包括：
将COUNT值设为初始值。例如COUNT值的初始值为零，则在确定更新后的第二密钥之后将COUNT值置0，即HFN和PDCP SN均设置为0。当终端和/或网络侧设备使用更新后的第二密钥进行通信时，COUNT值从初始值开始重新进行取值。
综上，本公开的上述实施例中提供的密钥更新方法中，当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
如图5所示，本公开实施例还提供一种密钥更新方法，应用于网络侧设备，包括：
步骤501，接收终端发送的随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包。
本步骤中，为了保证网络侧设备进行加密或完整性保护的数据包可以被终端成功解密或进行完整性验证，或者，为了保证终端进行加密或完整性保护的数据包可以被网络侧设备成功解密或进行完整性验证，网络侧设备和终端对密钥的理解是一致的，即终端当前存储的密钥与网络侧设备当前存储的 密钥相同。例如，终端当前存储的密钥为第一密钥，相应地，网络侧设备当前存储的密钥也为第一密钥。
步骤502，向所述终端发送携带密钥更新信息的随机接入响应消息。
作为一个实施例，步骤501中的随机接入请求消息和步骤502中的随机接入响应消息为两步竞争随机接入流程中的Msg1和Msg2。为了实现密钥的更新，网络侧设备在需要进行密钥更新的时候给终端发送的随机接入响应中携带密钥更新信息。需要说明的是，网络侧可以在不需要进行密钥更新的时候给终端发送的随机接入响应中不携带密钥更新信息。
进一步地，随机接入响应消息中还可以携带其他信息，例如终端的标识信息、定时提前量、上行授权信息等，在此不一一枚举。
较佳地，本公开的上述实施例中，所述密钥更新信息包括：
用于指示终端是否进行密钥更新的密钥更新指示；和/或，
更新后的第二密钥。
其中，密钥更新指示可以是1比特指示信息，例如，取值为“1”指示终端进行密钥更新，取值为“0”则指示终端不进行密钥更新；再例如，取值为“1”指示终端不进行密钥更新，取值为“0”则指示终端进行密钥更新。
进一步地，在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，所述方法还包括：
根据网络侧设备当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
需要说明的是，预设密钥更新算法可以是协议约定的，也可以是终端和网络侧设备预先协商配置的，例如预设密钥更新算法为水平密钥更新算法。终端根据当前存储的第一密钥和预设密钥更新算法推导出的新的密钥(即第二密钥)与网络侧设备根据当前存储的第一密钥和预设密钥更新算法推导出的新的密钥(即第二密钥)相同。
作为一个实施例，在网络侧设备向终端发送携带密钥更新信息的随机接入响应之后，终端和网络侧设备均可以根据其密钥更新信息确定更新后的第二密钥，并将更新后的第二密钥存储在本地。
可选地，本公开的上述实施例中，步骤502包括：
向所述终端发送根据所述网络侧设备当前存储的第一密钥进行安全处理后的携带所述密钥更新信息的随机接入响应消息。
即网络侧发送的携带所述密钥更新信息的随机接入响应消息是基于更新前的密钥(即第一密钥)进行了安全处理的。
需要说明的是，上述提及的安全处理(包括终端根据第一密钥对数据包进行的安全处理以及网络侧设备根据第一密钥对随机接入响应消息进行的安全处理)具体包括：加密处理和完整性保护处理等，在此不做具体限定。
进一步需要说明的是，上述步骤402中网络侧设备可以在每次发送的随机接入响应消息中均携带密钥更新信息，也可以在网络侧设备确定需要进行密钥更新的时候在其发送的随机接入响应消息中携带密钥更新信息，在此不做具体限定。
承接上例，本公开实施例还提供一种判断当前是否需要更新密钥的方式，具体的终端和网络侧设备维护COUNT值，当COUNT值大于预设值的情况下网络侧设备决定在随机接入响应消息中携带密钥更新信息。相应地，为了保证终端和网络侧设备对数据包的COUNT值理解一致，终端在发送携带经过安全处理的数据包的随机接入请求消息之后可以根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定所述数据包的COUNT值。
相应地，步骤501包括：
接收终端发送的随机接入请求消息，根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定所述数据包的安全计数COUNT值。
需要说明的是，COUNT值包括超帧号HFN和PDCP SN。其中PDCP SN是PDCP数据包的包头的一部分，HFN不在PDCP包头中传输，由终端和网络侧设备各自维护。终端根据自身维护的HFN和数据包的包头携带的PDCP SN可以确定该数据包的COUNT值。终端需要实时更新当前发送的数据包的COUNT值。
网络侧设备接收到终端发送的随机接入请求消息之后，根据随机接入请求消息携带的数据包的包头携带的PDCP SN和网络侧设备自身维护的HFN确定该数据包的COUNT值，从而根据COUNT值、当前存储的密钥等对数据包进行解密和/或完整性验证。
进一步地，步骤502包括：
在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下，向所述终端发送携带密钥更新信息的随机接入响应消息。
该预设值是协议约定的，或者网络配置的；且该预设值可以是COUNT的最大取值，即2 32-1；或者，该预设值可以是小于COUNT的最大取值的一个值，在此不作具体限定。
进一步地，针对终端和网络侧设备维护数据包的COUNT值的情况，步骤502之后，所述方法还包括：
将COUNT值设为初始值。例如COUNT值的初始值为零，则在确定更新后的第二密钥之后将COUNT值置0，即HFN和PDCP SN均设置为0。当终端和/或网络侧设备使用更新后的第二密钥进行通信时，COUNT值从初始值开始重新进行取值。
综上，本公开的上述实施例中提供的密钥更新方法中，当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
为了更清楚的描述本公开实施例提供的上述密钥更新方法，下面分别针对终端和网络侧设备维护COUNT值的情况以及终端和网络侧设备部维护COUNT值的情况进行详细描述：
示例一(终端和网络侧设备维护COUNT值)
步骤1：终端向网络侧设备发送随机接入请求消息，该随机接入请求消息中携带的数据根据终端当前存储的第一密钥进行安全处理，例如加密；额外的，每发送一个数据包，终端的PDCP实体基于数据包携带的PDCP SN更新数据包的COUNT值和HFN；
步骤2：网络侧接收随机接入消息中携带的数据。对于每个接收到的数据包，网络侧的PDCP实体基于接收包携带的PDCP SN更新数据包的COUNT值和HFN；
步骤3：在数据包的COUONT值大于预设值的情况下，网络侧设备向终端发送携带密钥更新信息的随机接入响应；该密钥更新信息包括：用于指示终端是否进行密钥更新的密钥更新指示；和/或，更新后的第二密钥；
其中，网络侧设备发送的随机接入响应基于更新前的密钥进行安全处理；
步骤4：终端接收随机接入响应消息，针对随机接入响应消息携带的密钥更新信息，终端的行为为以下任意一种：
当密钥更新指示指示终端进行密钥更新时，终端基于预设密钥更新算法(例如水平密钥更新算法)推导更新后的第二密钥，并存储；或终端直接存储密钥更新信息携带的更新后的第二密钥。
步骤5：终端的PDCP实体将COUNT值设为初始值；例如，将HFN和PDCP SN设置为零。
示例二(终端和网络侧设备不维护COUNT值)
步骤6：终端向网络侧设备发送随机接入请求消息，该随机接入请求消息中携带的数据根据终端当前存储的第一密钥进行安全处理，例如加密；
步骤7：网络侧设备向终端发送携带密钥更新信息的随机接入响应；该密钥更新信息包括：用于指示终端是否进行密钥更新的密钥更新指示；和/或，更新后的第二密钥；
其中，网络侧设备发送的随机接入响应基于更新前的密钥进行安全处理；
步骤8：终端接收随机接入响应消息，针对随机接入响应消息携带的密钥更新信息，终端的行为为以下任意一种：
当密钥更新指示指示终端进行密钥更新时，终端基于预设密钥更新算法(例如水平密钥更新算法)推导更新后的第二密钥，并存储；或终端直接存储密钥更新信息携带的更新后的第二密钥。
综上，本公开的上述实施例中提供的密钥更新方法中，当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
如图6所示，本公开实施例还提供一种终端600，包括：
请求发送模块601，用于向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
响应接收模块602，用于接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
密钥更新模块603，用于根据所述密钥更新信息，确定更新后的第二密钥。
较佳地，本公开的上述实施例中，所述密钥更新信息包括：
用于指示终端是否进行密钥更新的密钥更新指示；和/或，
更新后的第二密钥。
较佳地，本公开的上述实施例中，所述密钥更新模块包括：
密钥更新子模块，用于在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，根据终端当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
较佳地，本公开的上述实施例中，所述响应接收模块包括：
第一响应接收子模块，用于接收所述网络侧设备根据网络侧设备当前存储的第一密钥进行安全处理后发送的携带所述密钥更新信息的随机接入响应消息。
较佳地，本公开的上述实施例中，所述请求发送模块包括：
请求发送子模块，用于向网络侧设备发送随机接入请求消息，并根据所述随机接入请求消息携带的数据包的包头携带的分组数据汇聚协议序列号PDCP SN确定所述数据包的安全计数COUNT值。
较佳地，本公开的上述实施例中，所述响应接收模块包括：
第二响应接收子模块，用于接收所述网络侧设备在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下发送的携带密钥更新信息的随机接入响应消息；
其中，所述随机接入请求消息携带的数据包的COUNT值由所述网络侧设备根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定。
较佳地，本公开的上述实施例中，所述终端还包括：
第一设置模块，用于将COUNT值设为初始值。
综上，本公开的上述实施例中当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
需要说明的是，本公开实施例提供的终端是能够执行上述密钥更新方法的终端，则上述密钥更新方法的所有实施例均适用于该终端，且均能达到相同或相似的有益效果。
图7为实现本公开各个实施例的一种终端的硬件结构示意图，该终端700包括但不限于：射频单元701、网络模块702、音频输出单元703、输入单元704、传感器705、显示单元706、用户输入单元707、接口单元708、存储器709、处理器710、以及电源711等部件。本领域技术人员可以理解，图7中示出的终端结构并不构成对终端的限定，终端可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。在本公开实施例中，终端包括但不限于手机、平板电脑、笔记本电脑、掌上电脑、车载终端、可穿戴设备、以及计步器等。
其中，射频单元701，用于向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
处理器710，用于根据所述密钥更新信息，确定更新后的第二密钥；
本公开的上述实施例中当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
应理解的是，本公开实施例中，射频单元701可用于收发信息或通话过 程中，信号的接收和发送，具体的，将来自基站的下行数据接收后，给处理器710处理；另外，将上行的数据发送给基站。通常，射频单元701包括但不限于天线、至少一个放大器、收发信机、耦合器、低噪声放大器、双工器等。此外，射频单元701还可以通过无线通信系统与网络和其他设备通信。
终端通过网络模块702为用户提供了无线的宽带互联网访问，如帮助用户收发电子邮件、浏览网页和访问流式媒体等。
音频输出单元703可以将射频单元701或网络模块702接收的或者在存储器709中存储的音频数据转换成音频信号并且输出为声音。而且，音频输出单元703还可以提供与终端700执行的特定功能相关的音频输出(例如，呼叫信号接收声音、消息接收声音等等)。音频输出单元703包括扬声器、蜂鸣器以及受话器等。
输入单元704用于接收音频或视频信号。输入单元704可以包括图形处理器(Graphics Processing Unit，GPU)7041和麦克风7042，图形处理器7041对在视频捕获模式或图像捕获模式中由图像捕获装置(如摄像头)获得的静态图片或视频的图像数据进行处理。处理后的图像帧可以显示在显示单元706上。经图形处理器7041处理后的图像帧可以存储在存储器709(或其它存储介质)中或者经由射频单元701或网络模块702进行发送。麦克风7042可以接收声音，并且能够将这样的声音处理为音频数据。处理后的音频数据可以在电话通话模式的情况下转换为可经由射频单元701发送到移动通信基站的格式输出。
终端700还包括至少一种传感器705，比如光传感器、运动传感器以及其他传感器。具体地，光传感器包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板7061的亮度，接近传感器可在终端700移动到耳边时，关闭显示面板7061和/或背光。作为运动传感器的一种，加速计传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别终端姿态(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；传感器705还可以包括指纹传感器、压力传感器、虹膜传感器、分子传感器、陀螺仪、气压计、湿度计、温度计、红外线传感器等，在此不再赘述。
显示单元706用于显示由用户输入的信息或提供给用户的信息。显示单元706可包括显示面板7061，可以采用液晶显示器(Liquid Crystal Display，LCD)、有机发光二极管(Organic Light-Emitting Diode,OLED)等形式来配置显示面板7061。
用户输入单元707可用于接收输入的数字或字符信息，以及产生与终端的用户设置以及功能控制有关的键信号输入。具体地，用户输入单元707包括触控面板7071以及其他输入设备7072。触控面板7071，也称为触摸屏，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触控面板7071上或在触控面板7071附近的操作)。触控面板7071可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器710，接收处理器710发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触控面板7071。除了触控面板7071，用户输入单元707还可以包括其他输入设备7072。具体地，其他输入设备7072可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆，在此不再赘述。
进一步地，触控面板7071可覆盖在显示面板7061上，当触控面板7071检测到在其上或附近的触摸操作后，传送给处理器710以确定触摸事件的类型，随后处理器710根据触摸事件的类型在显示面板7061上提供相应的视觉输出。虽然在图7中，触控面板7071与显示面板7061是作为两个独立的部件来实现终端的输入和输出功能，但是在某些实施例中，可以将触控面板7071与显示面板7061集成而实现终端的输入和输出功能，具体此处不做限定。
接口单元708为外部装置与终端700连接的接口。例如，外部装置可以包括有线或无线头戴式耳机端口、外部电源(或电池充电器)端口、有线或无线数据端口、存储卡端口、用于连接具有识别模块的装置的端口、音频输入/输出(I/O)端口、视频I/O端口、耳机端口等等。接口单元708可以用于接收来自外部装置的输入(例如，数据信息、电力等等)并且将接收到的输入传输到终端700内的一个或多个元件或者可以用于在终端700和外部装置之间传输数 据。
存储器709可用于存储软件程序以及各种数据。存储器709可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序(比如声音播放功能、图像播放功能等)等；存储数据区可存储根据手机的使用所创建的数据(比如音频数据、电话本等)等。此外，存储器709可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。
处理器710是终端的控制中心，利用各种接口和线路连接整个终端的各个部分，通过运行或执行存储在存储器709内的软件程序和/或模块，以及调用存储在存储器709内的数据，执行终端的各种功能和处理数据，从而对终端进行整体监控。处理器710可包括一个或多个处理单元；可选地，处理器710可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器710中。
终端700还可以包括给各个部件供电的电源711(比如电池)，可选地，电源711可以通过电源管理系统与处理器710逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。
另外，终端700包括一些未示出的功能模块，在此不再赘述。
可选地，如图8所示，本公开实施例还提供一种终端，包括处理器800，存储器810，存储在存储器810上并可在所述处理器800上运行的计算机程序，该计算机程序被处理器800执行时实现上述密钥更新方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本公开实施例还提供一种计算机可读存储介质，计算机可读存储介质上存储有计算机程序，该计算机程序被处理器执行时实现上述密钥更新方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。其中，所述的计算机可读存储介质，如只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
如图9所示，本公开实施例还提供一种网络侧设备900，包括：
请求接收模块901，用于接收终端发送的随机接入请求消息，所述随机接 入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
响应发送模块902，用于向所述终端发送携带密钥更新信息的随机接入响应消息。
较佳地，本公开的上述实施例中，所述密钥更新信息包括：
用于指示终端是否进行密钥更新的密钥更新指示；和/或，
更新后的第二密钥。
较佳地，本公开的上述实施例中，所述网络侧设备还包括：
确定模块，用于在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，根据网络侧设备当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
较佳地，本公开的上述实施例中，所述响应发送模块包括：
第一响应发送子模块，用于向所述终端发送根据所述网络侧设备当前存储的第一密钥进行安全处理后的携带所述密钥更新信息的随机接入响应消息。
较佳地，本公开的上述实施例中，所述请求接收模块包括：
请求接收子模块，用于接收终端发送的随机接入请求消息，根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定所述数据包的安全计数COUNT值。
较佳地，本公开的上述实施例中，所述响应发送模块包括：
第二响应发送子模块，用于在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下，向所述终端发送携带密钥更新信息的随机接入响应消息。
较佳地，本公开的上述实施例中，所述网络侧设备还包括：
第二设置模块，用于将COUNT值设为初始值。
综上，本公开的上述实施例中当终端在简化的两步随机接入请求消息中携带数据时，针对终端和网络侧设备不维护COUNT值的情况下网络侧设备直接在随机接入响应消息中携带密钥更新信息，实现密钥更新；针对终端和网络侧维护COUNT值的情况下当网络侧接收到的数据包的COUNT值大于预设值时在随机接入响应消息中携带密钥更新信息，实现密钥更新，保证数据传输的安全性。
需要说明的是，本公开实施例提供的网络侧设备是能够执行上述密钥更新方法的网络侧设备，则上述密钥更新方法的所有实施例均适用于该网络侧设备，且均能达到相同或相似的有益效果。
可选地，如图8所示，本公开实施例还提供一种网络侧设备，包括处理器800、存储器810及存储在所述存储器810上并可在所述处理器800上运行的计算机程序，所述计算机程序被所述处理器800执行时实现上述密钥更新方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。
本公开实施例还提供一种计算机可读存储介质，计算机可读存储介质上存储有计算机程序，该计算机程序被处理器执行时实现上述密钥更新方法实施例的各个过程，且能达到相同的技术效果，为避免重复，这里不再赘述。其中，所述的计算机可读存储介质，如只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等。
需要说明的是，在本文中，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者装置不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者装置所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括该要素的过程、方法、物品或者装置中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到上述实施例方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端(可以是手机，计算机，服务器，空调器，或者网络设备等)执行本公开各个实施例所述的方法。
上面结合附图对本公开的实施例进行了描述，但是本公开并不局限于上述的具体实施方式，上述的具体实施方式仅仅是示意性的，而不是限制性的，本领域的普通技术人员在本公开的启示下，在不脱离本公开宗旨和权利要求 所保护的范围情况下，还可做出很多形式，均属于本公开的保护之内。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以权利要求的保护范围为准。

Claims (32)

  1. 一种密钥更新方法，应用于终端，所述密钥更新方法包括：
    向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
    接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
    根据所述密钥更新信息，确定更新后的第二密钥。
  2. 根据权利要求1所述的方法，其中，所述密钥更新信息包括：
    用于指示终端是否进行密钥更新的密钥更新指示；和/或，
    更新后的第二密钥。
  3. 根据权利要求2所述的方法，其中，在所述密钥更新信息包括所述密钥更新指示的情况下，
    所述根据所述密钥更新信息，确定更新后的密钥，包括：
    在所述密钥更新指示用于指示终端进行密钥更新的情况下，根据终端当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
  4. 根据权利要求1所述的方法，其中，所述接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息，包括：
    接收所述网络侧设备根据网络侧设备当前存储的第一密钥进行安全处理后发送的携带所述密钥更新信息的随机接入响应消息。
  5. 根据权利要求1所述的方法，其中，所述向网络侧设备发送随机接入请求消息，包括：
    向网络侧设备发送随机接入请求消息，并根据所述随机接入请求消息携带的数据包的包头携带的分组数据汇聚协议序列号PDCP SN确定所述数据包的安全计数COUNT值。
  6. 根据权利要求5所述的方法，其中，所述接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息，包括：
    接收所述网络侧设备在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下发送的携带密钥更新信息的随机接入响应消息；
    其中，所述随机接入请求消息携带的数据包的COUNT值由所述网络侧 设备根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定。
  7. 根据权利要求5所述的方法，其中，所述根据所述密钥更新信息，确定更新后的第二密钥的步骤之后，所述方法还包括：
    将COUNT值设为初始值。
  8. 一种密钥更新方法，应用于网络侧设备，所述密钥更新方法包括：
    接收终端发送的随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
    向所述终端发送携带密钥更新信息的随机接入响应消息。
  9. 根据权利要求8所述的方法，其中，所述密钥更新信息包括：
    用于指示终端是否进行密钥更新的密钥更新指示；和/或，
    更新后的第二密钥。
  10. 根据权利要求9所述的方法，其中，在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，所述方法还包括：
    根据网络侧设备当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
  11. 根据权利要求8所述的方法，其中，所述向所述终端发送携带密钥更新信息的随机接入响应消息，包括：
    向所述终端发送根据所述网络侧设备当前存储的第一密钥进行安全处理后的携带所述密钥更新信息的随机接入响应消息。
  12. 根据权利要求8所述的方法，其中，所述接收终端发送的随机接入请求消息，包括：
    接收终端发送的随机接入请求消息，根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定所述数据包的安全计数COUNT值。
  13. 根据权利要求12所述的方法，其中，所述向所述终端发送携带密钥更新信息的随机接入响应消息，包括：
    在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下，向所述终端发送携带密钥更新信息的随机接入响应消息。
  14. 根据权利要求12所述的方法，其中，所述向所述终端发送携带密钥 更新信息的随机接入响应消息的步骤之后，所述方法还包括：
    将COUNT值设为初始值。
  15. 一种终端，包括：
    请求发送模块，用于向网络侧设备发送随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
    响应接收模块，用于接收所述网络侧设备发送的携带密钥更新信息的随机接入响应消息；
    密钥更新模块，用于根据所述密钥更新信息，确定更新后的第二密钥。
  16. 根据权利要求15所述的终端，其中，所述密钥更新信息包括：
    用于指示终端是否进行密钥更新的密钥更新指示；和/或，
    更新后的第二密钥。
  17. 根据权利要求15所述的终端，其中，所述密钥更新模块包括：
    密钥更新子模块，用于在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，根据终端当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
  18. 根据权利要求15所述的终端，其中，所述响应接收模块包括：
    第一响应接收子模块，用于接收所述网络侧设备根据网络侧设备当前存储的第一密钥进行安全处理后发送的携带所述密钥更新信息的随机接入响应消息。
  19. 根据权利要求15所述的终端，其中，所述请求发送模块包括：
    请求发送子模块，用于向网络侧设备发送随机接入请求消息，并根据所述随机接入请求消息携带的数据包的包头携带的分组数据汇聚协议序列号PDCP SN确定所述数据包的安全计数COUNT值。
  20. 根据权利要求19所述的终端，其中，所述响应接收模块包括：
    第二响应接收子模块，用于接收所述网络侧设备在所述随机接入请求消息携带的数据包的COUNT值大于预设值的情况下发送的携带密钥更新信息的随机接入响应消息；
    其中，所述随机接入请求消息携带的数据包的COUNT值由所述网络侧设备根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定。
  21. 根据权利要求19所述的终端，还包括：
    第一设置模块，用于将COUNT值设为初始值。
  22. 一种终端，包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如权利要求1至7中任一项所述的密钥更新方法的步骤。
  23. 一种计算机可读存储介质，所述计算机可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如权利要求1至7中任一项所述的密钥更新方法的步骤。
  24. 一种网络侧设备，包括：
    请求接收模块，用于接收终端发送的随机接入请求消息，所述随机接入请求消息中携带终端根据当前存储的第一密钥进行安全处理的数据包；
    响应发送模块，用于向所述终端发送携带密钥更新信息的随机接入响应消息。
  25. 根据权利要求24所述的网络侧设备，其中，所述密钥更新信息包括：
    用于指示终端是否进行密钥更新的密钥更新指示；和/或，
    更新后的第二密钥。
  26. 根据权利要求25所述的网络侧设备，还包括：
    确定模块，用于在所述密钥更新信息包括所述密钥更新指示且所述密钥更新指示用于指示终端进行密钥更新的情况下，根据网络侧设备当前存储的第一密钥和预设密钥更新算法，确定更新后的第二密钥。
  27. 根据权利要求24所述的网络侧设备，其中，所述响应发送模块包括：
    第一响应发送子模块，用于向所述终端发送根据所述网络侧设备当前存储的第一密钥进行安全处理后的携带所述密钥更新信息的随机接入响应消息。
  28. 根据权利要求24所述的网络侧设备，其中，所述请求接收模块包括：
    请求接收子模块，用于接收终端发送的随机接入请求消息，根据所述随机接入请求消息携带的数据包的包头携带的PDCP SN确定所述数据包的安全计数COUNT值。
  29. 根据权利要求28所述的网络侧设备，其中，所述响应发送模块包括：
    第二响应发送子模块，用于在所述随机接入请求消息携带的数据包的 COUNT值大于预设值的情况下，向所述终端发送携带密钥更新信息的随机接入响应消息。
  30. 根据权利要求28所述的网络侧设备，还包括：
    第二设置模块，用于将COUNT值设为初始值。
  31. 一种网络侧设备，包括处理器、存储器及存储在所述存储器上并可在所述处理器上运行的计算机程序，所述计算机程序被所述处理器执行时实现如权利要求8至14中任一项所述的密钥更新方法的步骤。
  32. 一种计算机可读存储介质，所述计算机可读存储介质上存储计算机程序，所述计算机程序被处理器执行时实现如权利要求8至14中任一项所述的密钥更新方法的步骤。
PCT/CN2019/096327 2018-07-26 2019-07-17 密钥更新方法、终端及网络侧设备 WO2020020029A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810835733.5 2018-07-26
CN201810835733.5A CN110769418B (zh) 2018-07-26 2018-07-26 一种密钥更新方法、终端及网络侧设备

Publications (1)

Publication Number Publication Date
WO2020020029A1 true WO2020020029A1 (zh) 2020-01-30

Family

ID=69181197

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/096327 WO2020020029A1 (zh) 2018-07-26 2019-07-17 密钥更新方法、终端及网络侧设备

Country Status (2)

Country Link
CN (1) CN110769418B (zh)
WO (1) WO2020020029A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210185637A1 (en) * 2019-12-16 2021-06-17 Qualcomm Incorporated Network assisted positioning without service request procedure

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113381966B (zh) * 2020-03-09 2023-09-26 维沃移动通信有限公司 信息上报方法、信息接收方法、终端及网络侧设备
CN113766494A (zh) * 2020-05-27 2021-12-07 维沃移动通信有限公司 密钥获取方法、装置、用户设备及网络侧设备
WO2022133912A1 (zh) * 2020-12-24 2022-06-30 华为技术有限公司 侧行链路通信方法、装置和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101060404A (zh) * 2006-04-19 2007-10-24 华为技术有限公司 无线网络中防止重放攻击的方法及系统
CN103581899A (zh) * 2012-07-30 2014-02-12 中国移动通信集团公司 一种数据传输方法、装置、系统和相关设备
CN104010299A (zh) * 2014-05-21 2014-08-27 中国人民解放军信息工程大学 基于物理层安全的移动通信会话私密性增强方法
WO2018085726A1 (en) * 2016-11-04 2018-05-11 Intel IP Corporation Performing 2-step random access channel (rach) procedures

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8195940B2 (en) * 2002-04-05 2012-06-05 Qualcomm Incorporated Key updates in a mobile wireless system
CN101237444B (zh) * 2007-01-31 2013-04-17 华为技术有限公司 密钥处理方法、系统和设备
US8666077B2 (en) * 2008-05-07 2014-03-04 Alcatel Lucent Traffic encryption key generation in a wireless communication network
CN102833743B (zh) * 2011-06-17 2016-12-07 中兴通讯股份有限公司 公共警报系统密钥更新信息的发送、更新方法和相应设备
CN102869011B (zh) * 2011-07-05 2017-10-03 广东纬德信息科技有限公司 无线通信系统中pws密钥更新方法、网络侧设备及终端
US10592679B2 (en) * 2016-06-10 2020-03-17 Apple Inc. Support for changing encryption classes of files

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101060404A (zh) * 2006-04-19 2007-10-24 华为技术有限公司 无线网络中防止重放攻击的方法及系统
CN103581899A (zh) * 2012-07-30 2014-02-12 中国移动通信集团公司 一种数据传输方法、装置、系统和相关设备
CN104010299A (zh) * 2014-05-21 2014-08-27 中国人民解放军信息工程大学 基于物理层安全的移动通信会话私密性增强方法
WO2018085726A1 (en) * 2016-11-04 2018-05-11 Intel IP Corporation Performing 2-step random access channel (rach) procedures

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
QUALCOMM INCORPORATED: "Early Data Transmission", 3GPP TSG RAN WGI MEETING #90 R1-1712804, 25 August 2017 (2017-08-25), pages 2 - 6, XP051315616 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210185637A1 (en) * 2019-12-16 2021-06-17 Qualcomm Incorporated Network assisted positioning without service request procedure

Also Published As

Publication number Publication date
CN110769418B (zh) 2022-06-28
CN110769418A (zh) 2020-02-07

Similar Documents

Publication Publication Date Title
CN109257740B (zh) Profile下载方法、移动终端及可读存储介质
WO2020020029A1 (zh) 密钥更新方法、终端及网络侧设备
CA2995514C (en) Message protection method, and related device, and system
WO2019154082A1 (zh) 波束失败恢复的方法、终端设备及网络设备
WO2020001530A1 (zh) 测量方法、终端和网络侧设备
WO2019062627A1 (zh) 随机接入方法、移动终端及网络设备
WO2021037148A1 (zh) 数据传输方法及终端
JP7179087B2 (ja) Ｒｒｃ接続再確立のベアラ設定方法、端末及びネットワーク機器
WO2020216329A1 (zh) 切换方法及终端
WO2020001424A1 (zh) 载波聚合配置信息的处理方法和终端
WO2019214706A1 (zh) 接入控制方法、消息广播方法及相关设备
WO2019056959A1 (zh) 完整性保护方法、终端和基站
US11219071B2 (en) System information transmission method and user terminal
WO2021175244A1 (zh) 授权和策略参数配置方法、终端及网络功能
WO2021180051A1 (zh) 信息上报方法、信息接收方法、终端及网络侧设备
US11690122B2 (en) Connection re-establishment method and related device
WO2021027681A1 (zh) 辅助信息上报方法、配置方法、终端和网络侧设备
WO2020216331A1 (zh) 随机接入方法及终端
CN110831250B (zh) 一种处理方法及终端
WO2019137425A1 (zh) 重配置方法、终端及基站
US20210204329A1 (en) Random access method and terminal
WO2020244477A1 (zh) 网络标识信息的发送方法、接收方法及通信设备
WO2020063282A1 (zh) 信息指示方法、指示接收方法、终端及网络侧设备
CN111615158B (zh) 一种更新方法、重建请求处理方法、终端和网络设备
CN110839298B (zh) 一种移动性管理方法及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19841870

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19841870

Country of ref document: EP

Kind code of ref document: A1