WO2020030153A1 - 双连接通信方法及其装置、系统 - Google Patents

双连接通信方法及其装置、系统 Download PDF

Info

Publication number
WO2020030153A1
WO2020030153A1 PCT/CN2019/100095 CN2019100095W WO2020030153A1 WO 2020030153 A1 WO2020030153 A1 WO 2020030153A1 CN 2019100095 W CN2019100095 W CN 2019100095W WO 2020030153 A1 WO2020030153 A1 WO 2020030153A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
base station
secondary base
plane security
user
Prior art date
Application number
PCT/CN2019/100095
Other languages
English (en)
French (fr)
Inventor
李�赫
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to KR1020207021911A priority Critical patent/KR102346419B1/ko
Priority to EP19847452.0A priority patent/EP3731550A4/en
Publication of WO2020030153A1 publication Critical patent/WO2020030153A1/zh
Priority to US16/916,481 priority patent/US11665535B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/30—Security of mobile devices; Security of mobile applications
    • H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/15—Setup of multiple wireless link connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0055—Transmission or use of information for re-establishing the radio link
    • H04W36/0069—Transmission or use of information for re-establishing the radio link in case of dual connectivity, e.g. decoupled uplink/downlink
    • H04W36/00698—Transmission or use of information for re-establishing the radio link in case of dual connectivity, e.g. decoupled uplink/downlink using different RATs
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a dual-connection communication method, a device, and a system thereof.
  • a process of user plane security between the user terminal and the network node is started. It may include: 1.
  • the session management network element sends the obtained user plane security policy to the network node (that is, the base station).
  • the user plane security policy includes whether user plane encryption protection is required, preferred, or Not needed (not required), and user plane integrity protection is required (required), preferred to be enabled (preferred), or not needed (not needed); 2, if it is required to be enabled, the network node is enabled Corresponding protection; if it does not need to be enabled, the network node does not need to enable the corresponding protection; if it is inclined to enable, the network node determines whether to enable the corresponding protection according to the sufficient resources; 3, the network node sends a radio resource control (radio) to the user terminal (resource control, RRC) reconfiguration request message, which carries indication information about the type of user plane protection The instruction information is used to indicate whether to enable encryption protection and integrity protection. 4.
  • radio resource control radio resource control
  • the user terminal receives the RRC reconfiguration message from the network node, activates the corresponding user plane security according to the instruction information of the user plane protection type, and generates the corresponding user plane security.
  • the network node has the same protection key; 5.
  • the user terminal sends an RRC reconfiguration response message to the network node.
  • the above process for enabling user plane security is for a 5G single connection scenario.
  • a 5G dual connection scenario that is, a scenario where a user terminal connects two network nodes (primary base station and secondary base station), how to enable the user terminal and secondary base station User plane security protection is an urgent technical issue.
  • the technical problem to be solved in the embodiments of the present application is to provide a dual connection communication method, a device and a system thereof, which can solve a technical problem of how to enable user plane security protection between a user terminal and a secondary base station in a 5G dual connection scenario, so that it can Ensure the confidentiality and integrity of user plane data transmission in the 5G dual connectivity scenario.
  • a first aspect of the embodiments of the present application provides a dual-connection communication method, including:
  • the primary base station sends a first message to the secondary base station, where the first message includes a user plane security policy, and the user plane security policy is used by the secondary base station to determine a user plane security protection method between the secondary base station and the user terminal;
  • the primary base station receives a second message from the secondary base station, where the second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal;
  • the master base station sends a third message to the user terminal, where the third message includes the user plane security enable type indication information.
  • the primary base station sends a user plane security policy to the secondary base station.
  • the secondary base station determines a user plane security protection method between the secondary base station and the user terminal according to the user plane security policy, and sends an instruction to the primary base station to indicate the secondary base station and the user.
  • the user plane security opening type indication information of the user plane security protection method between terminals the master base station sends the user plane security opening type indication information to the user terminal, so that the user terminal activates the user terminal and the user plane according to the user plane security opening type indication information.
  • the user plane security protection method between the secondary base stations can enable the user plane security protection between the user terminal and the secondary base station to ensure the confidentiality and integrity of user plane data transmission in the 5G dual connectivity scenario.
  • the user plane security policy includes user plane encryption protection instruction information and user plane integrity protection instruction information.
  • the user plane encryption protection instruction information is used to indicate three possible values, which are notneeded, preferred, and required.
  • User plane integrity The protection indication information is used to indicate three possible values, which are not required, preferred, and required. not required indicates that activation is not required, that is, it is not enabled; preferred indicates that activation can be enabled or not, that is, that it can be enabled or disabled, and required indicates that it must be activated, that is, enabled.
  • the primary base station determines the user plane integrity protection indication information in the user plane security policy. Not turned on, that is "preferred" or "not needed”.
  • the first message further includes a security capability of the user terminal.
  • the security capability of the user terminal refers to which encryption algorithms and which integrity protection algorithms are supported by the user terminal.
  • the security capability of the user terminal is carried in the first message, so that the secondary base station selects a security algorithm to be used between the secondary base station and the user terminal from the security capabilities of the user terminal according to which system the base station is in.
  • the second message further includes a security algorithm between the secondary base station and the user terminal
  • the third message further includes a security algorithm between the secondary base station and the user terminal, that is, the security algorithm selected by the secondary base station.
  • the primary base station before the primary base station sends the first message to the secondary base station, the primary base station obtains a first user plane security policy of the user terminal.
  • the first user plane security policy is the original user plane security policy.
  • the granularity of the first user plane security policy of the user terminal may be a packet data unit (PDU) session, that is, different PDU sessions correspond to different user plane security policies.
  • the granularity of the first user plane security policy may also be a network slice. , One or more of quality of service flow and data radio bearer.
  • the master base station may obtain the user plane security policy of the user terminal from the core network element during the establishment of the PDU session, or may obtain the user plane security policy of the user terminal from the source base station when the base station is used as the target base station during the base station handover process.
  • the first message further includes user plane information corresponding to the user plane security policy, so that the user terminal can know that the user plane data received from the primary base station and the secondary base station are in the same PDU session.
  • the user plane information may include one or more of a PDU session identifier, a network slice identifier, a quality of service flow identifier, a 5G service quality flow indicator, and a data radio bearer identifier.
  • the user plane security policy carried in the first message is the first user plane security policy of the user terminal, that is, the primary base station directly sends the first user plane security policy acquired by it to the secondary base station, so that The secondary base station generates a mapped user plane security policy according to the first user plane security policy, and determines a user plane security protection method between the secondary base station and the user terminal according to the mapped user plane security policy.
  • the user plane security policy carried in the first message is a second user plane security policy generated by the primary base station according to the first user plane security policy of the user terminal, and the primary base station sends the first message to the secondary base station.
  • a second user plane security policy was generated according to the first user plane security policy of the user terminal.
  • the second user plane security policy is a mapped user plane security policy generated by the master base station.
  • the primary base station may generate a second user plane security policy according to the capabilities of the primary base station, the capabilities of the secondary base station, and the first user plane security policy, so that the second user plane security policy can be used by both the primary base station and the secondary base station.
  • the capability of the primary base station or the secondary base station may include one or more of information such as whether to enable user plane encryption protection and whether to enable user plane integrity protection, resource usage, supported security algorithms, current status, and configuration information. Species.
  • the secondary base station does not support user plane integrity protection
  • the user plane integrity protection indication information in the first user plane security policy is enabled
  • the second user generated by the primary base station The user plane integrity protection indication information in the plane security policy is set to off.
  • the primary base station determines a user plane security protection method between the primary base station and the user terminal according to the second user plane security policy; and when the user plane security termination point is on the secondary base station, the primary base station does not The user plane security protection method between the primary base station and the user terminal is activated, that is, the user plane data is not protected or unsecured according to the user plane security protection method between the primary base station and the user terminal.
  • the primary base station receives a third user plane security policy from the secondary base station, where the third user plane security policy is generated by the secondary base station according to the first user plane security policy of the user terminal, that is, the third The user plane security policy is a user plane security policy mapped by the secondary base station.
  • the secondary base station informs the primary base station of its mapped user plane security policy, so that the primary base station learns the user plane security protection method between the secondary base station and the user terminal.
  • the primary base station learns the user plane security protection method between the secondary base station and the user terminal, and can set the user plane security protection method between the primary base station and the user terminal to be the same as the user plane security protection method between the secondary base station and the user terminal.
  • the primary base station when it receives the third user plane security policy from the secondary base station, it may send a third user plane security policy to the access management network element, where the third user plane security policy
  • the user plane security protection method between the secondary base station and the user terminal may be instructed, so that the access management network element obtains the user plane security opening result.
  • the master base station may determine the third user plane security policy according to the user plane security enable type indication information, and send the third user plane security policy to the access management network element, so that the access management network element learns The user plane opens the result securely.
  • the primary base station receives uplink user plane data from the user terminal, where the uplink user plane data is data that the user terminal performs security protection according to a user plane security protection method between the user terminal and the secondary base station, And sending uplink user plane data to the secondary base station, so that when the secondary base station receives the uplink user plane data, it performs security protection on the secondary base station according to the user plane security protection method between the secondary base station and the user terminal.
  • a second aspect of the embodiments of the present application provides a master base station, and the master base station has a function of implementing the method provided in the first aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the primary base station includes a transceiver unit configured to send a first message to the secondary base station, where the first message includes a user plane security policy, and the user plane security policy is used by the secondary base station to determine the secondary base station and the secondary base station.
  • User plane security protection method between user terminals further used to receive a second message from the secondary base station, the second message includes user plane security enable type indication information, the user plane security enable type indication information is used to instruct the secondary base station and A user plane security protection method between user terminals; further configured to send a third message to the user terminal, where the third message includes the user plane security enable type indication information.
  • the master base station may further include a processing unit for generating a second user plane security policy.
  • the master base station includes a processor, a transceiver, and a memory, where the computer program is stored in the memory, the computer program includes program instructions, and the processor is configured to call the program code to perform the following operations: Sending a first message to the secondary base station, the first message including a user plane security policy, the user plane security policy being used by the secondary base station to determine a user plane security protection method between the secondary base station and the user terminal; receiving a second message from the secondary base station The second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal; a third message is sent to the user terminal, and the third The message includes the user plane security enable type indication information.
  • the master base station may further include a processing unit for generating a second user plane security policy.
  • the implementation of the device can refer to the implementation of the method. .
  • a third aspect of the embodiments of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores instructions that, when run on a computer, cause the computer to execute the method described in the first aspect above.
  • a fourth aspect of the embodiments of the present application provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the method described in the first aspect above.
  • a fifth aspect of the embodiments of the present application provides a dual-connection communication method, including:
  • the secondary base station receives a first message from the primary base station, where the first message includes a user plane security policy
  • the secondary base station determines a user plane security protection method between the secondary base station and the user terminal according to the user plane security policy
  • the secondary base station activates a user plane security protection method between the secondary base station and the user terminal;
  • the secondary base station sends a second message to the primary base station.
  • the second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal.
  • the secondary base station determines a user plane security protection method between the secondary base station and the user terminal according to the user plane security policy, and activates the user plane security protection method between the secondary base station and the user terminal, and sends the method to the primary base station.
  • User plane security enable type indication information for indicating a user plane security protection method between the secondary base station and the user terminal, so that the primary base station sends the user plane security enable type indication information to the user terminal, so that the user terminal and the secondary base station can be opened.
  • the user plane security is ensured between 5G and dual-connection scenarios.
  • the first message further includes a security capability of the user terminal
  • the secondary base station may select a security algorithm between the secondary base station and the user terminal according to the security capability of the user terminal.
  • the second message further includes a security algorithm between the secondary base station and the user terminal, so that the primary base station notifies the user terminal of the security algorithm between the secondary base station and the user terminal, so that the user terminal can The security algorithm between the base station and the user terminal performs security protection or de-security protection.
  • the first message further includes user plane information corresponding to the user plane security policy, so that the user terminal can know that the user plane data received from the primary base station and the secondary base station are in the same PDU session.
  • the secondary base station activating the user plane security protection method between the secondary base station and the user terminal may include: the secondary base station according to the user plane security protection method between the secondary base station and the user terminal, and the secondary base station and the user A security algorithm between terminals and a security key between the secondary base station and the user terminal activate a user plane security protection method between the secondary base station and the user terminal.
  • the secondary base station generates a security key between the secondary base station and the user terminal.
  • the secondary base station uses a user plane security protection method between the secondary base station and the user terminal, and security between the secondary base station and the user terminal.
  • An algorithm and a security key between the secondary base station and the user terminal activate a user plane security protection method between the secondary base station and the user terminal.
  • the user plane security policy is the first user plane security policy of the user terminal, that is, when the primary base station obtains the first user plane security policy of the user terminal, it directly sends it to the secondary base station.
  • the base station generates a third user plane security policy according to the first user plane security policy; and determines a user plane security protection method between the secondary base station and the user terminal according to the third user plane security policy.
  • the third user plane security policy is a mapped user plane security policy generated by the secondary base station.
  • the secondary base station may generate a third user plane security policy according to the capabilities of the secondary base station, the primary base station, and the first user plane security policy.
  • the secondary base station sends the third user plane security policy generated by the secondary base station to the primary base station, so that the primary base station learns a user plane security protection method between the secondary base station and the user terminal.
  • the user plane security policy is a second user plane security policy
  • the second user plane security policy is a mapped user plane security policy generated by the primary base station according to the first user plane security policy of the user terminal.
  • the base station determines a user plane security protection method between the secondary base station and the user terminal according to the second user plane security policy.
  • the secondary base station receives the first uplink user plane data and the second uplink user plane data from the primary base station and the user terminal, respectively, where the first uplink user plane data and the second user plane data are users
  • the terminal performs user plane data after security protection according to the user plane security protection method between the user terminal and the secondary base station; the secondary base station performs security deprotection on the first uplink user plane data and the second user plane data, and obtains the User plane data, and send the user plane data to the user plane network element after de-security protection, so as to achieve user plane security protection between the user terminal and the secondary base station.
  • a sixth aspect of the embodiments of the present application provides a secondary base station, and the secondary base station has a function of implementing the method provided in the fifth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the secondary base station includes a transceiver unit and a processing unit.
  • the transceiver unit is configured to receive a first message from the primary base station, where the first message includes a user plane security policy; and the processing unit is configured according to the user.
  • the plane security policy determines a user plane security protection method between the secondary base station and the user terminal, and activates a user plane security protection method between the secondary base station and the user terminal.
  • the transceiver unit is further configured to send a second message to the primary base station.
  • the message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal.
  • the secondary base station includes a processor, a transceiver, and a memory.
  • the memory stores a computer program.
  • the computer program includes program instructions.
  • the processor is configured to call the program code to perform the following operations: Receive a first message from the primary base station, the first message includes a user plane security policy; determine a user plane security protection method between the secondary base station and the user terminal according to the user plane security policy, and activate the user plane between the secondary base station and the user terminal Security protection method; sending a second message to the primary base station, the second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal.
  • the implementation of the device can refer to the implementation of the method. .
  • a seventh aspect of the embodiments of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores instructions, and when the computer-readable storage medium is run on a computer, causes the computer to execute the method described in the fifth aspect.
  • An eighth aspect of the embodiments of the present application provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the method described in the fifth aspect.
  • a ninth aspect of the embodiments of the present application provides a dual-connection communication method, including:
  • the user terminal receives a third message from the primary base station.
  • the third message includes user plane security enable type indication information and a security algorithm selected by the secondary base station.
  • the user plane security enable type indication information is used to indicate the user between the secondary base station and the user terminal. Face protection method;
  • the user terminal activates the user plane security protection method with the secondary base station according to the user plane security enable type indication information and the security algorithm selected by the secondary base station;
  • the user terminal performs security protection on uplink user plane data according to a user plane security protection method between the user terminal and the secondary base station.
  • the user terminal learns the user plane security protection method between the user terminal and the secondary base station, and the user terminal and the secondary base station by receiving the user plane security opening type indication information from the primary base station and the security algorithm selected by the secondary base station.
  • the security algorithm between base stations activates the user plane security protection method between the user terminal and the secondary base station to enable the user plane security protection between the user terminal and the secondary base station, thereby ensuring the user plane data transmission in the 5G dual connectivity scenario. Confidentiality and integrity.
  • the user terminal generates a security key between the user terminal and the secondary base station, and according to the user plane security enable type indication information, the security algorithm selected by the secondary base station, and the security secret between the user terminal and the secondary base station. Key to activate the user plane security protection method with the secondary base station.
  • the user terminal securely protects uplink user plane data according to a user plane security protection method between the user terminal and the secondary base station, including: the user terminal sends the first uplink user to the secondary base station and the primary base station, respectively. Plane data and second uplink user plane data; wherein the first uplink user plane data and the second user plane data are user plane data that the user terminal performs security protection according to a user plane security protection method between the user terminal and the secondary base station.
  • a tenth aspect of the embodiments of the present application provides a user terminal, and the user terminal has a function of implementing the method provided in the ninth aspect.
  • the functions may be implemented by hardware, and may also be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the functions described above.
  • the user terminal includes a transceiver unit and a processing unit.
  • the transceiver unit is configured to receive a third message from the primary base station, where the third message includes user plane security enable type indication information and the secondary base station selection information.
  • Security algorithm the user plane security enable type indication information is used to indicate the user plane security protection method between the secondary base station and the user terminal;
  • the processing unit is used to activate and User plane security protection method between the secondary base stations;
  • the processing unit is further configured to perform security protection on the uplink user plane data according to the user plane security protection method between the user terminal and the secondary base station.
  • the user terminal includes a processor, a transceiver, and a memory, where the computer program is stored in the memory, the computer program includes program instructions, and the processor is configured to call the program code to perform the following operations: Receive a third message from the primary base station, the third message includes user plane security enable type indication information and a security algorithm selected by the secondary base station, and the user plane security enable type indication information is used to indicate user plane security between the secondary base station and the user terminal Protection method; activate the user plane security protection method with the secondary base station according to the user plane security enable type indication information and the security algorithm selected by the secondary base station; according to the user plane security protection method between the user terminal and the secondary base station, protect the uplink user plane Data is protected.
  • An eleventh aspect of the embodiments of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores instructions, and when the computer-readable storage medium runs on a computer, causes the computer to execute the method described in the ninth aspect.
  • a twelfth aspect of the embodiments of the present application provides a computer program product including instructions, which when executed on a computer, causes the computer to execute the method described in the ninth aspect.
  • a thirteenth aspect of the embodiments of the present application provides a dual-connection communication system, including a primary base station and a secondary base station;
  • the primary base station is configured to send a first message to the secondary base station, where the first message includes a user plane security policy;
  • the secondary base station is configured to receive a first message sent by the primary base station, and determine a user plane security protection method between the secondary base station and the user terminal according to a user plane security policy; send a second message to the primary base station, and the second message includes the user plane security enable Type indication information, the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal;
  • the primary base station is further configured to receive a second message sent from the secondary base station, and send a third message to the user terminal.
  • the third message includes user plane security enable type indication information.
  • the dual-connection communication system provided in the thirteenth aspect of the embodiments of the present application can enable user plane security protection between a user terminal and a secondary base station, thereby ensuring the confidentiality and integrity of user plane data transmission in a 5G dual connection scenario.
  • the system further includes a user terminal;
  • the user terminal is configured to receive a third message from the primary base station.
  • the third message includes user plane security enable type indication information and a security algorithm selected by the secondary base station.
  • the user plane security enable type indication information is used to indicate the secondary base station and the user terminal.
  • the user terminal is further configured to activate the user plane security protection method with the secondary base station according to the user plane security enable type indication information and the security algorithm selected by the secondary base station;
  • the user terminal is further configured to perform security protection on uplink user plane data according to a user plane security protection method between the user terminal and the secondary base station.
  • the primary base station when the secondary base station does not support user plane integrity protection, is further configured to determine that the user plane integrity protection indication information in the user plane security policy is not enabled.
  • the master base station is further configured to obtain the original user plane security policy of the user terminal; generate a mapped user plane security policy according to the original user plane security policy; wherein the user included in the first message The plane security policy maps the user plane security policy of the master base station.
  • the user plane security policy included in the first message is a mapped user plane security policy generated by the primary base station according to the first user plane security policy.
  • the system further includes a user plane network element
  • the primary base station is further configured to receive the first uplink user plane data sent from the user terminal, and send the first uplink user plane data to the secondary base station;
  • the secondary base station is further configured to receive the second uplink user plane data sent from the user terminal and the first user plane data sent by the primary base station; perform security protection on the first uplink user plane data and the second user plane data, and obtain a solution.
  • User plane data after security protection sending user plane data after security protection to the user plane network element; wherein the first uplink user plane data and the second user plane data are user terminals according to the user between the user terminal and the secondary base station.
  • Face protection method User face data after security protection.
  • system further includes an access management network element
  • the primary base station is further configured to send a third user plane security policy to the access management network element, where the third user plane security policy is a mapped user plane security policy generated by the secondary base station, or the third user plane security policy is the primary base station.
  • the user plane security policy determined according to the user plane security enable type indication information.
  • FIG. 1 is a schematic flowchart of LTE dual-connection communication
  • FIG. 2 is a schematic diagram of a network architecture to which an embodiment of the present application is applied;
  • FIG. 3a is a schematic diagram of a 5G dual connectivity architecture to which an embodiment of the present application is applied;
  • FIG. 3b is a schematic diagram of another 5G dual connectivity architecture to which an embodiment of the present application is applied;
  • FIG. 5 is a schematic flowchart of a dual-connection communication method provided in Embodiment 2 of the present application.
  • FIG. 6 is a schematic diagram of a logical structure of a dual-connection communication device according to an embodiment of the present application.
  • FIG. 7 is a simplified schematic diagram of a physical structure of a dual-connection communication device according to an embodiment of the present application.
  • At least one or more of the following or similar expressions refers to any combination of these items, including any combination of single or plural items.
  • at least one (a), a, b, or c can be expressed as: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple .
  • words such as “first” and “second” are used to distinguish between the same or similar items having substantially the same functions and functions. Those skilled in the art can understand that the words “first”, “second” and the like do not limit the number and execution order, and the words “first” and “second” are not necessarily different.
  • the network architecture and service scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. With the evolution of the network architecture and the emergence of new service scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.
  • a master base station (master node, MN).
  • a base station that initiates dual connectivity is referred to as a master base station, and may also be referred to as a master network node, a first base station, or a first network node.
  • a secondary base station In a dual connectivity scenario, another base station selected by the primary base station to serve the user terminal is called a secondary base station. It can also be called a secondary base station, a secondary network node, a secondary network node, or a secondary base station. Two base stations or a second network node.
  • User plane security policy including user plane encryption protection indication information and user plane integrity protection indication information.
  • the user plane encryption protection indication information is used to indicate three possible values, which are not required, preferred, and required
  • the user plane integrity protection instruction information is used to indicate three possible values, which are not required, preferred, and required.
  • activation is not required, preferred indicates that activation can be performed or not, and required indicates that activation must be performed.
  • the above three possible values can be indicated by 2 bits. For example, 00 indicates that activation is not required, 01 indicates that activation is possible or not, and 11 indicates that activation is required.
  • the manner in which the user plane encryption protection indication information and the user plane integrity protection indication information specifically indicate the three possible values are not limited in the embodiments of the present application.
  • User plane encryption protection is to protect the confidentiality of data during transmission (so it can be called user plane confidentiality protection)
  • user plane integrity protection is to protect the integrity of data during user plane transmission. Confidentiality means that the real content cannot be seen directly, and integrity means that the data is original and has not been tampered with.
  • the user plane security protection method refers to whether user plane encryption protection is enabled on the user terminal side, the primary base station side, or the secondary base station side, and whether user plane integrity protection is enabled.
  • the secondary base station may combine the user plane security policy and the user plane security protection method configured by the secondary base station to determine the user plane security protection method of the secondary base station. Assuming that the user plane security protection method configured by the secondary base station is to enable user plane encryption protection, The user plane integrity protection is not turned on. If the user plane encryption protection instruction information included in the user plane security policy is "required", the user plane encryption protection is turned on, and the secondary base station determines that its user plane security protection method is to enable the user plane encryption protection.
  • the user plane integrity protection is not turned on; if the user plane encryption protection instruction information included in the user plane security policy is "not needed", the user plane encryption protection is not turned on, and the secondary base station determines that its user plane security protection method is not turned on User plane encryption protection, user plane integrity protection is not turned on; if the user plane encryption protection indication information included in the user plane security policy is "preferred", the secondary base station determines whether to enable user plane encryption protection according to certain conditions, such as in the secondary When base station resources are sufficient, user plane encryption protection can be enabled .
  • User plane security enable type indication information is used by the base station side to indicate whether the user plane encryption protection is enabled on the terminal side and whether the user plane integrity protection is enabled. For example, it is used to indicate that the user plane encryption protection is enabled and the user plane integrity protection is disabled.
  • the user plane security enable type indication information can be indicated by 2 bits, 1 bit indicates whether encryption protection is enabled or disabled, and another bit indicates whether integrity protection is enabled or disabled.
  • the security algorithm may include a security algorithm used by the user plane and a security algorithm used by the signaling plane.
  • the security algorithms used by the user plane are used to protect the user plane data, and can include user plane encryption algorithms and user plane integrity algorithms.
  • the security algorithm used by the signaling plane is used to protect the signaling, and can include a signaling plane encryption algorithm and a signaling plane integrity algorithm.
  • the security algorithm used by the user plane and the security algorithm used by the signaling plane may be the same or different. The same specific meaning is that if the user plane integrity protection is enabled, the integrity algorithm used by the user plane and the signaling plane are the same; if the user plane encryption protection is enabled, the encryption algorithm and signaling used by the user plane The same encryption algorithm is used.
  • the security algorithm used by the signaling plane is different from the security algorithm used by the user plane.
  • the encryption algorithm used by the user plane is encryption algorithm A
  • the encryption algorithm used by the signaling plane is encryption algorithm B
  • the user plane and signaling Both use the integrity algorithm C.
  • the security algorithm used by the user plane and the security algorithm used by the signaling plane are different.
  • the security key may include a key for protecting user plane data and a key for protecting signaling plane.
  • the key for protecting user plane data is used to protect user plane data, and may include a user plane encryption key and a user plane integrity protection key.
  • the key for protecting the signaling plane is used to protect the signaling.
  • the key for protecting the signaling may be a key for protecting the RRC signaling.
  • the key for protecting the RRC signaling may include a protection key and an encryption key for protecting the integrity of the RRC signaling.
  • the user plane / signaling plane security algorithm and the key protecting the user plane / signaling plane data are used to protect the user plane data.
  • the user plane / signaling plane data is encrypted and protected using an encryption key and an encryption algorithm; and the user plane / signaling plane data is integrity protected using an integrity protection key and an integrity protection algorithm.
  • the embodiment of the present invention does not limit the sequential relationship between encryption protection and integrity protection, that is, the user plane / signaling plane data may be encrypted and protected first, and then integrity protection may be performed; or the user plane / signaling plane may be integrated first. Protection, and then encrypt the user plane / signaling plane data.
  • the user plane and the signaling plane may not use the same execution order.
  • Unlock the security protection For the node that performs the security function, the user plane / signaling plane security algorithm and the key protecting the user plane / signaling plane data are used to obtain the original user plane data. Specifically, the encrypted user plane / signaling plane data is decrypted using an encryption key and an encryption algorithm; the integrity protection key and the integrity protection algorithm are used to perform integrity protection verification on the user plane data.
  • the embodiment of the present invention does not limit the order of decryption and verification integrity protection. However, it should be understood that if the user plane / signaling plane data is first encrypted and then protected by integrity, then unsecured protection is to verify the integrity protection first and then decrypt the encrypted user plane data; if the user The data of the plane / signaling plane is protected by integrity first, and then encrypted. The order of unsecured protection is to decrypt the encrypted data first, and then perform integrity protection verification.
  • Activating the user plane / signaling plane security protection method means that when the user plane / signaling plane security protection method is determined, the user plane / signaling plane security algorithm and the secret of protecting the user plane / signaling plane data are protected. Key to activate the user plane / signaling plane security protection method, that is, use the user plane / signaling plane security protection method, user plane / signaling plane security algorithm, and a key to protect the user plane / signaling plane data to transmit the data to be transmitted. User plane / signaling plane data for security protection.
  • the determined user plane security protection method is user plane encryption protection on, user plane integrity protection off, user plane encryption algorithm is encryption algorithm A, and user plane encryption key is key K
  • Encryption algorithm A and key K are used for user plane encryption protection of the user plane data.
  • the effect of activating the user plane security protection method is that the nodes that perform user plane security protection can start to perform security protection on the user plane data and start de-security protection of the user plane data.
  • the two actions of security protection and solution security protection may be further activated separately. For example, after the base station sends a security activation message, the base station activates security deactivation; after the base station receives the security activation confirmation message, the base station activates security protection.
  • FIG. 1 is a schematic flowchart of LTE dual-connection communication.
  • the process may include the following steps:
  • Step 1 The user terminal establishes an RRC connection with the primary base station.
  • Step 2 The primary base station determines to start the dual connection, and sends a secondary base station management request to the secondary base station.
  • the master base station uses the KeNB to calculate the S-KeNB.
  • This KeNB is the root key shared by the master base station and the user terminal.
  • the user terminal and the master base station can calculate the S-KeNB according to the KeNB calculation, and generate a protected RRC message between the user terminal and the master base station Command key and key to protect user plane data.
  • the S-KeNB is a root key between the secondary base station and the user terminal.
  • the user terminal and the secondary base station can generate a key for protecting user plane data between the user terminal and the secondary base station according to the S-KeNB.
  • a key to protect RRC signaling such as the integrity key of the RRC signaling plane or an encryption key to the RRC signaling plane
  • a key to protect user plane data such as the user plane encryption key.
  • the primary base station When the primary base station determines to start the dual connection, it sends a secondary base station management request to the secondary base station to start the dual connection.
  • the secondary base station management request may be a secondary base station addition request or a secondary base station modification request.
  • the secondary base station management request includes the security capabilities of the S-KeNB and the user terminal.
  • the security capabilities of the user terminal include the security algorithms supported by the user terminal, that is, which encryption algorithms and which integrity protection algorithms the user terminal supports.
  • the secondary base station management request includes an S-KeNB, so that the secondary base station generates a key for protecting user plane data according to the S-KeNB.
  • step 3 the secondary base station selects an encryption algorithm.
  • the selected encryption algorithm and the key for protecting user plane data generated by the S-KeNB together protect the user plane data transmission between the user terminal and the secondary base station.
  • Step 4 The secondary base station sends a secondary base station management response to the primary base station.
  • the secondary base station management response includes an encryption algorithm selected by the secondary base station.
  • the secondary base station management response is used to respond to the secondary base station management request. If the secondary base station management request is a secondary base station addition request, the secondary base station management response is a secondary base station addition response; if the secondary base station management request is a secondary base station modification request, the secondary base station The management response modifies the response for the secondary base station.
  • the primary base station sends an RRC connection reconfiguration request to the user terminal.
  • the RRC connection reconfiguration request includes a secondary cell group (SCG) counter and an encryption algorithm selected by the secondary base station.
  • the SCG counter is used by the user terminal to generate an S-KeNB.
  • the S-KeNB is the same as the S-KeNB calculated by the master base station.
  • the user terminal can then generate a key for protecting user plane data according to the S-KeNB.
  • the base station calculates that the S-KeNB is the same, so the key generated by the user terminal to protect the user plane data is the same as the key generated by the secondary base station to protect the user plane data, so that the user terminal and the secondary base station use the same key for the user plane data. protection.
  • Step 6 The user terminal sends an RRC connection reconfiguration response to the primary base station.
  • Step 7 The primary base station sends a secondary base station reconfiguration completion message to the secondary base station.
  • the primary base station informs the secondary base station of the S-KeNB determined by the primary base station, so that the secondary base station uses the selected encryption algorithm and a key generated by the S-KeNB to protect the user plane data between the user terminal and the secondary base station.
  • the transmitted user plane data is protected.
  • the user terminal uses the same encryption algorithm and the key to protect the user plane data to protect the user plane data transmitted between the user terminal and the secondary base station, thereby realizing the user between the user terminal and the secondary base station. Face encryption protection.
  • the embodiments of the present application provide a dual connection communication method and a device thereof, which can solve the technical problem of how to enable user plane security between a user terminal and a secondary base station in a 5G dual connection scenario, thereby ensuring users in the 5G dual connection scenario. Confidentiality and integrity of data transmission.
  • the dual connection communication method and device provided in the embodiments of the present application can also solve the technical problem of how to enable user plane security between a user terminal and a primary base station, and between a user terminal and a secondary base station in a 5G dual connection scenario.
  • FIG. 2 is a schematic diagram of a network architecture to which an embodiment of the present application is applied.
  • the schematic diagram of the network architecture is a schematic diagram of a dual connectivity network architecture, including a primary base station, a secondary base station, and a user terminal.
  • a solid black line indicates a signaling plane data transmission path
  • a black dotted line indicates a user plane data transmission path.
  • This architecture does not rule out that with the evolution of standardization, there is a signaling plane message passing between the user terminal and the secondary base station, that is, it does not exclude that the signaling plane message between the user terminal and the secondary base station has security negotiation, security activation, etc. in the prior art. Security related processes through the master base station.
  • the main base station is a base station that initiates dual connectivity. It can be a next generation base station (gNB) in a 5G network or an evolved node base station (eNB or eNodeB) in an LTE network. It may be an upgraded eNB, ie, a next generation eNodeB (ng-eNB), or a base station in a future communication system.
  • gNB next generation base station
  • eNB evolved node base station
  • eNodeB evolved node base station
  • ng-eNB next generation eNodeB
  • ng-eNB next generation eNodeB
  • mobility management network element may be a fourth-generation mobile communications (4 th -generation, 4G) mobility management entity (Mobility core network management entity, MME ), It can also be the access and mobility management function (AMF) in the 5G core network, or it can be a network element with the same function as the MME or AMF in the future core network; for example, with the user Area network element connection for transmitting user plane data.
  • the user plane network element can be a serving gateway (SGW) in the 4G core network, or a user plane function (UPF) in the 5G core network. It can also be a network element in the future core network that has the same function as the SGW or UPF.
  • the secondary base station selects another base station that serves the user terminal in cooperation with the main base station, which may be an eNB, gNB, or ng-eNB, or a base station in a future communication system.
  • the main base station which may be an eNB, gNB, or ng-eNB, or a base station in a future communication system.
  • the two network nodes connected to the user terminal are eNBs, and the secondary base station usually only has a direct X2 interface with the primary base station.
  • the secondary base station can have direct interfaces with the MME and SGW.
  • the secondary base station In the 5G dual connectivity scenario, that is, at least one of the two network nodes connected to the user terminal is gNB, the secondary base station has a direct interface with the primary base station, and the secondary base station and the UPF can have a direct interface.
  • the secondary base station can have a direct interface with the AMF.
  • the user terminals involved in the embodiments of the present application may include various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices, or other processing devices connected to a wireless modem; they may also include user equipment (user equipment, UE ), Subscriber unit, cellular phone, smart phone, wireless data card, personal digital assistant (PDA) computer, tablet computer, wireless modem (modem), handheld Handheld, laptop, cordless phone or wireless local loop (WLL) station, machine type communication (MTC) terminal, UE, mobile station (mobile station, MS), terminal device (terminal device) or relay user equipment.
  • the relay user equipment may be, for example, a 5G residential gateway (RG).
  • RG 5G residential gateway
  • the user terminal stores long-term keys and related functions.
  • a user terminal performs two-way authentication with a core network element (such as AMF or Authentication Server Function (AUSF), etc.), it uses a long-term key and related functions to verify the authenticity of the network.
  • a core network element such as AMF or Authentication Server Function (AUSF), etc.
  • FIG. 3a and FIG. 3b are schematic diagrams of two 5G dual-connection architectures to which the embodiments of the present application are applied.
  • the primary base station is gNB and the secondary base station is ng-eNB; or the primary base station is ng-eNB and the secondary base station is gNB; or the primary base station is gNB and the secondary base station is gNB.
  • This section describes the case where the secondary base station is ng-eNB or gNB.
  • the schematic diagram of the 5G dual connectivity architecture shown in FIG. 3a and FIG. 3b does not constitute a limitation on the embodiment of the present application.
  • the access management network element is responsible for mobility management, which can be the AMF in the 5G core network or the network element responsible for mobility management in the future core network.
  • the user plane network element is a user plane data exit, which is connected to an external network (such as a data network (DN)). It can be a UPF in the 5G core network, or it can be used as a user plane data exit in the future core network to communicate with external users.
  • DN data network
  • the user plane network elements are described using UPF as an example.
  • the session management network element is used to allocate session resources to the user plane. It can be the session management function (SMF) in the 5G core network, or it can be a network element that allocates session resources to the user plane in the future core network. In the embodiment of the application, the session management network element is described by using SMF as an example.
  • SMF session management function
  • a signaling plane path may exist between the secondary base station and the core network element, and a signaling plane path may exist between the secondary base station and the user terminal. See Figures 3a and 3b. Shown in solid gray line.
  • Figure 3a The difference between Figure 3a and Figure 3b is that the user plane security endpoint in Figure 3a is on the secondary base station (SN), the SN and user plane network elements exchange user plane data, and the user plane security endpoint in Figure 3b is on the primary base station.
  • SN secondary base station
  • MN MN
  • the user plane security endpoint is on the SN
  • the SN secures the user plane data.
  • the UE secures the uplink user plane data according to the user plane security protection method between the UE and the SN.
  • Two channels send security-protected uplink user-plane data to the SN; one channel directly sends the security-protected uplink user-plane data to the SN, and the other channel sends the security-protected uplink user-plane data to the SN through the MN (that is, the security sent by the MN to the UE)
  • the protected uplink user plane data is transparently transmitted to the SN).
  • the SN receives the securely protected uplink user plane data, it performs unsecure protection on the uplink user plane data according to the user plane security protection method between the SN and the UE.
  • the SN For the downlink user plane data, the SN performs security protection on the downlink user plane data according to the user plane security protection method between the SN and the UE, and sends the protected downlink user plane data to the UE through two channels, and sends the security protection directly to the UE all the way Downlink user plane data; the other way is to send the downlink user plane data after security protection to the UE through the MN.
  • the UE receives the downlink user plane data after security protection, the UE uses the user plane security protection method between the UE and the SN to send downlink users to the downlink user plane data. Face data for solution security protection. It needs to be understood that the two paths do not necessarily exist at the same time.
  • the SN can also send all data to the UE through the MN after encryption. For example, when the resource utilization of the SN reaches a certain threshold, the SN sends all messages to the UE through the MN.
  • a user terminal Taking the UE as an example, the access management network element uses AMF as an example, the session management network element uses SMF as an example, and the user plane network element uses UPF as an example.
  • the method may include, but is not limited to, the following steps:
  • Step S401 the MN obtains a first user plane security policy.
  • the first user plane security policy is the original user plane security policy. Compared to "mapped”, "mapped” can be processed on a “raw” basis.
  • the PDU session establishment process may include: the UE sends a PDU session establishment request to the AMF through the MN; when the AMF receives the PDU session establishment request, the AMF sends the content related to the session establishment request in the PDU session establishment request to the SMF; the SMF receives the When session establishment request related content, session related contract information can be obtained from unified data management (UDM), SMF can obtain user plane security policy from session related contract information, or SMF from SMF local configuration information Obtain a user plane security policy; the SMF sends a PDU session establishment completion message to the UE through the AMF and the MN, and the PDU session establishment completion message includes the user plane security policy.
  • UDM unified data management
  • SMF can obtain user plane security policy from session related contract information, or SMF from SMF local configuration information
  • the SMF sends a PDU session establishment completion message to the UE through the AMF and the MN, and the PDU session establishment completion message includes the user plane security policy
  • the user plane security policy obtained by the SMF is the user plane security policy of the UE.
  • the user plane security policy may be the user plane security policy of the UE's PDU session.
  • the user plane security policy is different. distinguish.
  • the user plane security policy of the UE can also correspond to other granularities, such as corresponding to the network slice identity, quality of service flow identity (QFI), and 5G Corresponds to a 5G QoS indicator (5QI) and a data radio bearer identity (DRB ID).
  • the MN can initiate the dual connection process after the PDU session is established, or it can initiate the dual connection process during the PDU session establishment. If the MN initiates the dual connection process after the PDU session is established, step S401 may be performed after the PDU session is established. If the MN initiates the dual connection process during the PDU session establishment, the SMF sends a PDU session establishment completion message to the MN through the AMF. When the MN receives the RRC connection reconfiguration response from the UE, it sends a PDU session establishment completion message to the UE.
  • the MN may obtain the first user plane security policy by receiving a PDU session establishment completion message from the SMF, that is, the user plane security policy carried in the PDU session establishment completion message is used as the first user plane security policy.
  • the MN may also send a request to the SMF to obtain the session-related contract information through the AMF.
  • the SMF requests the UDM to obtain the session-related contract information.
  • the SMF receives the UDM response and the session-related contract information includes
  • the SMF can obtain the user plane security policy from the session-related contract information.
  • the SMF obtains the user plane security policy from the local configuration information of the SMF.
  • the SMF sends the obtained user plane security policy to the MN through the AMF.
  • the MN receives the user plane security policy, it uses the user plane security policy as the first user plane security policy.
  • the user plane security policy sent by the source base station or sent by the AMF may be used as the first user plane security policy.
  • step S402 is further included, and the MN generates a second user plane security policy.
  • the second user plane security policy is a mapped user plane security policy.
  • the second user plane security policy does not include a case where preferences are enabled. That is, the user plane encryption protection indication information is “required” or “not needed”, and the user plane encryption protection is “required” or “not needed”.
  • the MN may generate a second user plane security policy according to the first user plane security policy, referring to the capabilities of the SN and the current state information of the UE.
  • the capabilities of the SN may include one or more of whether the SN supports enabling user plane encryption protection and whether to enable user plane integrity protection; resources of the SN; configuration information of the SN and security algorithms supported by the SN.
  • the configuration information of the SN For example, when the SN is an ng-eNB, the configuration information is a fixed configuration user plane security protection method.
  • the configured user plane security protection method is user plane encryption protection on, and user plane integrity protection is off.
  • the security algorithms supported by the SN include the encryption algorithms and integrity protection algorithms supported by the SN.
  • the security algorithms supported by the SN vary depending on the communication system to which the SN belongs. For example, the security algorithm supported when the SN is ng-eNB and the SN is gNB. The security algorithms supported at that time are different, or the security algorithms supported when the SN is ng-eNB are the same as those supported when the SN is gNB, but the identifiers representing the algorithms are different. For example, ng-eNB only recognizes algorithms that begin with the letter "E”, such as EIA1, EEA1, etc .; gNB only recognizes algorithms that begin with the letter "N,” such as NIA1, NEA1, and so on. Among them, although EEA1 and NEA1 are different identifiers, the specific security algorithms they represent are the same.
  • the current state information of the UE may include one or more of information such as a current rate situation of the UE, a power amount of the UE, and information on a capability limitation of the UE.
  • the capability limitation information of the UE is used to indicate whether the UE is a UE with limited capabilities (such as an IoT device) or an UE with unlimited capabilities.
  • the base station that generates the mapped user plane security policy needs to comprehensively consider information such as the configuration of the MN, the current status of the MN, the configuration of the SN, the current status of the SN, and the current status of the UE One or more.
  • the configuration of MN / SN is what kind of user plane security protection method MN / SN supports.
  • the current state of MN / SN refers to the current resource usage of MN / SN.
  • MN / SN can decide whether to activate a certain resource according to the current resource usage. This kind of preference activates user plane security protection.
  • the current state information of the UE may include one or more of information such as the current rate of the UE, the power of the UE, and the capability limitation information of the UE.
  • the capability limitation information of the UE is used to indicate whether the UE is a UE with limited capabilities (such as an IoT device) or an UE with unlimited capabilities.
  • the specific method by which the MN generates a mapped user plane security policy can be:
  • the MN can generate the second user plane security policy in the following ways:
  • Method 1 After learning the user plane security protection method configured by the SN (ng-eNB), the MN may combine the first user plane security policy and the user plane security protection method configured by the SN (ng-eNB) to generate a second User plane security policy.
  • the user plane security protection method configured by the SN may be fixedly configured on the SN (ng-eNB), that is, the SN (ng-eNB) can only adopt the configured user plane security protection method.
  • the user plane security protection method configured by the SN (ng-eNB) can also be configured on the MN, so that the MN can learn the user plane security protection method configured by the SN (ng-eNB), and the MN can also learn the SN (ng -eNB) configured user plane security protection method, for example, SN (ng-eNB) actively informs the MN of its configured user plane security protection method.
  • the user plane security protection method configured by SN may be to enable user plane encryption protection and disable user plane integrity protection.
  • the MN combines the first user plane security policy and SN (ng-eNB) configuration.
  • the method for generating a second user plane security policy by the method for user plane security protection may specifically include: A.
  • the generated second user plane security policy The included user plane integrity protection instruction information is “not needed”; if the user plane integrity protection instruction information included in the first user plane security policy is “not needed”, the generated second user plane security policy includes User plane integrity protection instruction information is still “not needed”; B, if the user plane encryption protection instruction information included in the first user plane security policy is "preferred”, the generated second user plane security policy includes User plane encryption protection instruction information is "required”; if the user plane encryption protection instruction information included in the first user plane security policy is "required” , The generated user plane encryption protection indication information included in the second user plane security policy is still “required”.
  • the second user plane security policy generated by the MN is obtained by enabling user plane encryption protection and disabling user plane integrity protection according to the user plane security protection method configured by the SN (ng-eNB).
  • the configured user plane security protection method is other types, and the second user plane security policy generated by the MN will also change, depending on the user plane security protection method configured by the SN (ng-eNB).
  • the generated second user plane security policy is consistent with the user plane security protection method configured by the SN (ng-eNB)
  • the generated second user plane security policy is the same as the user plane security policy corresponding to the user plane security protection method configured by the SN.
  • Method 2 Without knowing the user plane security protection method configured by the SN (ng-eNB), according to the first user plane security policy, the MN can combine the requirements of the operator or network deployment, and the current status information of the UE. Generate a second user plane security policy. At this time, the second user plane security policy generated by the MN may correspond to the user plane security protection method configured by the SN (ng-eNB).
  • the MN may generate a second user plane security policy according to whether the SN supports enabling user plane encryption protection and whether to support enabling user plane integrity protection in combination with the first user plane security policy. For example, if the SN (ng-eNB) does not support enabling user plane integrity protection, the generated user plane integrity protection indication information in the second user plane security policy is "not needed".
  • the MN may generate a second user plane security policy according to whether the SN supports enabling user plane encryption protection and whether to support enabling user plane integrity protection and the configuration information of the MN in combination with the first user plane security policy. For example, if SN (ng-eNB) does not support enabling user plane integrity protection, the user plane integrity protection indication information in the generated second user plane security policy is "not needed”; SN (ng-eNB) encryption protection Both support for opening and support for closing, the MN determines that the user plane encryption protection indication is "required” or "not needed” according to the configuration information of the MN and the resource situation of the UE.
  • the MN needs to firstly combine the original user plane security policy with the configuration of the MN, the current state of the MN, the configuration of the SN, the current state of the SN, and the current state of the UE.
  • One or more contents of information such as information, determine the user plane security protection method.
  • the user plane security protection method can be further transformed into user plane security enable type indication information.
  • the MN can convert the content of the user plane security enable type indication information into a second user plane security policy; it can also directly use the user plane security enable type indication information as the second user plane security policy.
  • the second user plane security policy is the user plane security enable type indication information.
  • the MN (ng-eNB) can generate the second user plane security policy in the following ways:
  • the MN when the MN (ng-eNB) learns its user plane security protection method, it combines its user plane security protection method and the first user plane security policy to generate a second user plane security policy. Since the MN is an ng-eNB, the MN knows exactly what the user plane security protection method is, so the MN can directly combine its user plane security protection method and the first user plane security policy to generate a second user plane security policy. For example, if the user plane encryption protection of the MN can be turned on dynamically and the MN does not support user plane integrity protection, the MN can determine the user plane encryption protection as "required" according to the information such as the MN configuration, the current resource usage of the MN, and the current status information of the UE.
  • the MN does not support user plane integrity protection, so the user plane integrity protection is "not needed.”
  • the user plane integrity protection is "not needed.”
  • For a specific generation method refer to the first manner of generating a second user plane security policy when the SN is ng-eNB and the MN is gNB.
  • the current state information of the UE may include one or more of information such as a current rate situation of the UE, a power amount of the UE, and information about a capability limitation of the UE.
  • the capability limitation information of the UE is used to indicate whether the UE is a UE with limited capabilities (such as an IoT device) or an UE with unlimited capabilities.
  • Method 2 The MN (ng-eNB) is fixedly configured with a user plane security protection method.
  • the MN (ng-eNB) can combine the configured user plane security protection method and the first user plane security policy to generate a second user plane security policy. .
  • the generated second user plane security policy is also fixed.
  • For a specific generation method refer to the first manner of generating a second user plane security policy when the SN is ng-eNB and the MN is gNB.
  • the MN may generate a second user plane security policy according to the first user plane security policy, combined with the requirements of the operator or the requirements of network deployment, and the current state information of the UE.
  • the MN (ng-eNB) dynamically determines whether to enable user plane encryption protection according to the user plane encryption protection indication information included in the first user plane security policy. For example, the MN (ng-eNB) does not always enable user plane encryption protection.
  • the user plane encryption protection instruction information included in the second user plane security policy may be the same as the user plane encryption protection instruction information included in the first user plane security policy; the user plane included in the second user plane security policy Integrity protection indication information cannot be "required”.
  • the MN may generate a second user plane security policy in combination with the first user plane security policy according to whether the SN (gNB) supports the user plane encryption protection and whether the user plane integrity protection is enabled. For example, if the SN (gNB) does not support enabling user plane integrity protection, the generated user plane integrity protection indication information in the second user plane security policy is "not needed".
  • the user plane security protection method between the MN and the UE may be determined according to the second user plane security policy.
  • the MN determines that the user plane security termination point is on the SN, the MN does not need to activate the user plane security protection method between the MN and the UE.
  • the MN can determine whether the user plane security termination point can be placed on the SN according to the first information.
  • the first information may be information configured locally by the MN, or may be a first user plane security policy. For example, if SN is ng-eNB, MN is gNB, and the user plane integrity protection indication information included in the first user plane security policy is "required", then the MN can only place the user plane security endpoint on the MN (that is, not Offload the PDU session of the MN to the SN), and then it can be determined that the user plane security termination point is on the MN. Except for this case, the user plane security endpoint can be on the SN.
  • the MN may determine to place the user plane security termination point on the SN, and then may determine that the user plane security termination point is on the SN. It is applicable to the scenario where the SN is gNB or the SN is ng-eNB.
  • the user plane security endpoint of the same PDU session can be flexibly placed on the MN for a while. It will be placed in the SN for a while, so when the MN or SN generates the mapped user plane security policy, it needs to consider the capability of another base station. For example, if one of them is an ng-eNB, the ng-eNB cannot enable integrity protection, then the integrity protection in the mapped user plane security policy must be disabled, that is, it cannot be activated.
  • the user plane security protection method between the MN and the UE and the user between the SN and the UE remains unchanged. Therefore, the user plane security protection method between the MN and the UE and the user between the SN and the UE The method of face protection is the same. Therefore, the mapped user plane security policy can be generated by the MN or the SN. However, it should be noted that when the user plane security endpoint is on the SN, the MN only generates a mapped user plane security policy and does not need to activate the user plane security protection method between the MN and the UE.
  • the SN When the user plane security endpoint is on the SN and the mapped user plane security policy is determined by the SN, the SN must both generate the mapped user plane security policy and activate the user plane security protection method between the UE and the SN . At this time, the MN only needs to pass the original security policy to the SN.
  • Step S403 The MN sends a first message to the SN, where the first message includes a user plane security policy and a security capability of the UE. Accordingly, the SN receives the first message from the MN.
  • the first message may be an SN addition request.
  • the first message is an SN addition request.
  • the first message may also be a SN modification request.
  • the security capabilities of the UE include security algorithms supported by the UE in the LTE system and / or security algorithms supported by the 5G system. Specifically, the security capability of the UE is transferred between the access network and the core network in the form of an identifier.
  • the security capability of the UE refers to which encryption algorithms and which integrity protection algorithms the UE supports.
  • the first message carries the security capabilities of the UE, so that the SN selects the security algorithm to be used between the SN and the UE from the security capabilities of the UE according to which system the base station is in.
  • the SN is gNB, and the SN is based on the UE ’s 5G
  • the security algorithm supported in the system that is, the SN selects the algorithm represented by the identifier that starts with "N".
  • the SN is an ng-eNB.
  • the SN selects a security algorithm between the SN and the UE according to a security algorithm supported by the UE in the LTE system, that is, the SN selects an algorithm represented by an identifier beginning with "E".
  • the user plane security policy carried in the first message is the first user plane security policy.
  • the first message further includes user plane information corresponding to the first user plane security policy, and the user plane information may include a PDU session identifier, that is, an identifier of a PDU session requested by the UE to be established.
  • the user plane information enables the UE to know that the user plane data received from the MN and the SN are in the same session, that is, the MN and the SN may directly use the user plane information or transform and process the user plane information before use, so that the UE can associate with the User plane data sent by two base stations.
  • the user plane information may further include one or more of a network slice identifier, a quality of service flow identifier (QFI), 5QI, and a DRB ID.
  • QFI quality of service flow identifier
  • the user plane security policy carried in the first message is a second user plane security policy, so that the SN activates a user plane security protection method between the SN and the UE according to the second user plane security policy.
  • the first message also includes user plane information corresponding to the second user plane security policy.
  • the user plane information includes a PDU session identifier, and further includes one or more of a network slice identifier, QFI, 5QI, and DRB ID.
  • the first message further includes Ksn, which is calculated by the MN using Kmn.
  • Ksn is the root key between the SN and the UE.
  • the SN and the UE can generate a key for protecting user plane data between the UE and the SN according to the Ksn, such as a user plane encryption key and a user plane integrity protection key.
  • the SN can also generate a key for protecting the signaling plane between the UE and the SN according to the Ksn. Keys for protecting the signaling plane, such as the integrity key of the RRC signaling plane and the encryption key of the RRC signaling plane.
  • the first message further includes identification information, and the identification information is used to indicate whether the user plane security policy carried in the first message is the first user plane security policy or the second user plane security policy.
  • the identification information may be indicated by a bit, for example, "0" indicates that the user plane security policy is a first user plane security policy, and "1" indicates that the user plane security policy is a second user plane security policy.
  • the bit can be a bit added to the bit length of the first user plane security policy or the second user plane security policy, or it can be a bit independent of the first user plane security policy or the second user plane security policy. Bit.
  • Step S404 The SN determines a user plane security protection method between the SN and the UE.
  • the SN determines the user plane security protection method between the SN and the UE, that is, the SN can adopt the user plane security protection method between the SN and the UE to securely protect user plane data.
  • the user plane security protection method between the SN and the UE is to enable user plane encryption protection and not to enable user plane integrity protection, then the SN can enable user plane encryption protection for user plane data and not enable user plane integrity protection.
  • the SN When the SN is ng-eNB and the MN is gNB, the SN (ng-eNB) is configured with a user plane security protection method.
  • the SN can directly determine the configured user plane security protection method as the user plane between the SN and the UE. Security protection methods.
  • the SN does not care whether the first message carries the first user plane security policy or the second user plane security policy.
  • the SN may determine a user plane security protection method between the SN and the UE according to the first user plane security policy.
  • the SN determines a method for enabling user plane encryption protection according to the user plane encryption protection indication information included in the first user plane security policy. Specifically, if the user plane encryption protection instruction information is "required”, the SN enables user plane encryption protection between the SN and the UE; if the user plane encryption protection instruction information is "not required", the SN does not enable the SN and the UE. User plane encryption protection between users; if the user plane encryption protection indication information is "preferred", the SN determines whether to enable user plane encryption protection between the SN and the UE according to certain conditions. For example, if the SN resources are sufficient, the SN can Enable user plane encryption protection between SN and UE.
  • the SN determines the method of enabling user plane integrity protection between the SN and the UE according to the user plane integrity protection method configured in the user plane security protection method, that is, determines the user plane integrity protection method configured by the SN as the SN and A method for enabling user plane integrity protection between UEs.
  • the user plane integrity protection method configured by the SN is not to enable user plane integrity protection, so the SN does not enable user plane integrity protection between the SN and the UE.
  • the user plane integrity protection between the SN and the UE is directly set to not enabled.
  • the SN determines a method for enabling the integrity protection according to the user plane integrity protection indication information included in the first user plane security policy. Specifically, if the user plane integrity protection indication information is "preferred", the SN determines whether to enable user plane integrity protection between the SN and the UE according to certain conditions, for example, if the SN does not support user plane integrity protection , The user plane integrity protection between the SN and the UE is not enabled; for example, when the security capabilities of the UE can support enabling the user plane integrity protection and the SN supports the user plane integrity protection, the SN enables the user plane integrity protection sexual protection; if the user plane integrity protection indication information is "not needed", the SN does not enable user plane integrity protection between the SN and the UE.
  • the SN determines and activates the user plane encryption protection opening method between the SN and the UE according to the user plane encryption protection method configured in the user plane security protection method, that is, determines the user plane encryption protection method configured by the SN as the SN and the UE.
  • the method for enabling user plane encryption protection between users For example, if the user plane encryption protection method configured by the SN is to enable user plane encryption protection, then the SN enables user plane encryption protection between the SN and the UE.
  • the SN combines the first user plane security policy and the capabilities of the MN to generate a third user plane security policy, and determines between the SN and the UE according to the third user plane security policy.
  • the third user plane security policy is a mapped user plane security policy generated by the SN.
  • the SN combines the first user plane security policy and the capabilities of the MN to generate a third user plane security policy, which is similar to the MN combining the first user plane security policies and the capabilities of the SN to generate a third user plane security policy.
  • the SN determines the user plane security protection method between the SN and the UE according to the third user plane security policy, that is, the SN determines whether to enable the user plane encryption protection according to the user plane encryption protection instruction information included in the third user plane security policy.
  • User plane integrity protection indication information determines whether to enable user plane integrity protection.
  • the SN may combine the first user plane security policy and the user plane security protection method configured by the MN (ng-eNB) to generate a third user plane security policy, and then determine the third user plane security policy according to the third user plane security policy.
  • User plane security protection method between SN and UE may combine the first user plane security policy and the user plane security protection method configured by the MN (ng-eNB) to generate a third user plane security policy, and then determine the third user plane security policy according to the third user plane security policy.
  • the SN determines a user plane security protection method between the SN and the UE according to the second user plane security policy, that is, the SN according to the user plane included in the second user plane security policy
  • the encryption protection instruction information determines whether to enable user plane encryption protection
  • the included user plane integrity protection instruction information determines whether to enable user plane integrity protection. If the second user plane security policy is user plane security enable type indication information, the SN directly determines the user plane security protection method according to the user plane security enable type indication information.
  • the SN determines a method for enabling user plane encryption protection according to the user plane encryption protection indication information included in the first user plane security policy. Specifically, if the user plane encryption protection instruction information is "required", the SN enables user plane encryption protection between the SN and the UE; if the user plane encryption protection instruction information is "not required”, the SN does not enable the SN and the UE.
  • the SN determines a method for enabling the integrity protection according to the user plane integrity protection indication information included in the first user plane security policy. Specifically, if the user plane integrity protection indication information is “not needed”, the SN does not enable user plane integrity protection between the SN and the UE.
  • the SN determines and activates the user plane encryption protection opening method between the SN and the UE according to the user plane encryption protection method configured in the user plane security protection method, that is, determines the user plane encryption protection method configured by the SN as the SN and the UE.
  • the method for enabling user plane encryption protection between users For example, if the user plane encryption protection method configured by the SN is to enable user plane encryption protection, then the SN enables user plane encryption protection between the SN and the UE.
  • Step S405 The SN selects a security algorithm between the SN and the UE.
  • the SN may select a security algorithm between the SN and the UE according to the security capability of the UE carried in the first message. For example, if the SN is gNB, the SN may select a security algorithm between the SN and the UE according to a security algorithm supported by the UE in the 5G system.
  • step S405 is performed after step S404, that is, the SN first determines a user plane security protection method between the SN and the UE, and then selects a security algorithm between the SN and the UE. Then, the SN only needs to be The security algorithm used by the user plane is selected. The security algorithm used by the signaling plane needs to be selected again.
  • the algorithms used by the signaling plane security algorithm and the user plane security algorithm may be the same or different. The same specific meaning is that if user plane encryption protection is enabled, the user plane security algorithm used and the signaling plane security algorithm used are the same; if user plane integrity protection is enabled, the integrity algorithm and signaling plane used by the user plane The integrity algorithm used is the same.
  • the security algorithm used by the signaling plane is different from the security algorithm used by the user plane.
  • the encryption algorithm used by the user plane is encryption algorithm A
  • the encryption algorithm used by the signaling plane is encryption algorithm B
  • the user plane Both the signaling plane and the integrity plane use the integrity algorithm C.
  • step S405 is performed before step S404, that is, the SN first selects a security algorithm between the SN and the UE, and then determines a user plane security protection method between the SN and the UE. Since the SN first selects a security algorithm between the SN and the UE, the selected security algorithm is used for both signal plane protection and user plane protection. After the SN determines the user plane security protection method between the SN and the UE, the SN determines which selected security algorithm to use for the user plane security protection according to the determined user plane security protection method. For example, SN first selects an encryption algorithm and an integrity protection algorithm. After that, the user plane security protection method determined by SN is enabled for the user plane encryption, and the user plane integrity protection is not enabled. Then, SN determines to use the encryption protection algorithm for the user plane. No user plane integrity protection algorithm is used.
  • the SN generates a key for protecting user plane data between the UE and the SN according to the Ksn carried in the first message.
  • the SN can also generate a key for protecting the signaling plane between the UE and the SN according to the Ksn.
  • the SN activates the user plane security protection method between the SN and the UE when the user plane security protection method between the SN and the UE, the security algorithm between the SN and the UE, and the key for protecting the user plane data are determined. That is, the SN can use the user plane security protection method between the SN and the UE, the security algorithm between the SN and the UE, and the key to protect the user plane data to secure the downlink user plane data and unsecure the uplink user plane data. protection.
  • the determined user plane security protection method is user plane encryption protection on, user plane integrity protection off
  • user plane encryption algorithm is encryption algorithm A
  • user plane encryption key is key K
  • the encryption algorithm A and the key K perform user plane encryption protection on the downlink user plane data.
  • Step S406 The SN sends a second message to the MN, where the second message includes user plane security enable type indication information and a security algorithm between the SN selected by the SN and the UE. Accordingly, the MN receives a second message from the SN.
  • the second message is used to respond to the first message, and may be an SN addition response or an SN modification response. That is, if the first message is an SN addition request, the second message is an SN addition response.
  • the user plane security enable type indication information is used to indicate a user plane security protection method between the SN activated by the SN and the UE.
  • the user plane security enable type indication information can be indicated by 2 bits, 1 bit indicates whether encryption protection is enabled or disabled, and another bit indicates whether integrity protection is enabled or disabled. For example, when the first bit is "1", the user plane encryption protection is turned on, and when the second bit is "1", the user plane integrity protection is turned on. Assume that the user plane between the SN determined by the SN and the UE The security protection method is that the user plane encryption protection is enabled, and the user plane integrity protection is not enabled. At this time, the user plane security enable type indication information can be expressed as "10".
  • the second message carries the user plane security enable type indication information, so that the MN carries it in the RRC connection reconfiguration response and sends it to the UE, thereby facilitating the UE to know the user plane security protection method with the SN.
  • the SN sends the third user plane security policy to the MN, and the SN determines a user plane security protection method between the SN and the UE according to the third user plane security policy, in other words
  • the third user plane security policy may indicate a user plane security protection method between the SN and the UE, and may be a mapped user plane security policy determined by the SN itself.
  • the SN sends a third user plane security policy to the MN, so that the MN learns the user plane security protection method between the SN and the UE.
  • the third user plane security policy may be independent of the second message and not sent to the MN in the same message, that is, the third user plane security policy is not carried in the second message.
  • the SN directly determines the user plane security protection method according to the user plane security enable type indication information.
  • the MN when the MN knows the user plane security protection method between the SN and the UE, it can determine that the user plane security protection method between the MN and the UE is the same as the user plane security protection method between the SN and the UE. Assuming that the user plane security protection method between SN and UE is user plane encryption protection and user plane integrity protection is on, but MN does not support enabling user plane integrity protection, then the user plane security protection method between MN and UE is User plane encryption protection is on, user plane integrity protection is off. In other words, the final user-plane security protection method depends on the specific situation.
  • step S406 the method further includes step S407, where the UE and the MN perform an access stratum (AS) security mode command (SMC) process.
  • AS access stratum
  • SMC security mode command
  • step S407 is not necessarily performed after step S406, and may be performed before the dual connection process, that is, when the signaling plane security between the UE and the MN needs to be activated.
  • the ASSMC includes a security algorithm between the MN and the UE selected by the MN.
  • the security algorithm may include a signaling plane security algorithm and a user plane security algorithm.
  • the signaling plane security algorithm and the user plane security algorithm may be the same or different. If they are the same, the selected security algorithm passed is used for both the control plane and the user plane.
  • the MN determines the user plane security protection method between the MN and the UE, it can determine the user plane security algorithm according to the security algorithm used by the signaling plane.
  • steps S408 and S409 are further included.
  • Step S409a the MN sends a fifth message to the AMF or SMF, where the fifth message includes a fourth user plane security policy. Accordingly, the AMF or SMF receives the fifth message from the MN.
  • the fifth message may be a security result message. This message is used to inform the AMF or SMF user plane that the security plane is turned on.
  • the fourth user plane security policy included in the security result message is the third user plane security policy
  • the third user plane security policy may indicate the relationship between the SN and the UE.
  • the MN may generate a user plane security policy according to the user plane security protection method between the SN and the UE, and use it as the fourth user plane security policy.
  • the fourth user The plane security policy may indicate a user plane security protection method between the SN and the UE.
  • the fourth user plane security policy included in the fifth message may also be a mapped user plane security policy generated by the MN, and the mapped user plane security policy may indicate a user plane security protection method between the SN and the UE.
  • the fifth message also includes user plane information corresponding to the fourth user plane security policy.
  • the user plane information may include a PDU session identifier, and further includes one or more of a network slice identifier, QFI, 5QI, and DRB ID.
  • step S409 the AMF sends a sixth message to the MN. Accordingly, the MN receives a sixth message from the AMF.
  • the sixth message is used to respond to the fifth message, and the sixth message may be a security result response message, which is used to inform the MN that the AMF or SMF has received the security result message.
  • Step S410 the MN sends a third message to the UE, where the third message includes the security algorithm determined by the SN and the user plane security enable type indication information. Accordingly, the UE receives a third message from the MN.
  • the third message may be an RRC connection reconfiguration request.
  • the user plane security enable type indication information is used to indicate a user plane security protection method between the SN activated by the SN and the UE.
  • the third message further includes an SN counter.
  • the SN counter is used by the UE to generate a Ksn.
  • the Ksn is the same as the Ksn calculated by the MN.
  • the UE can generate a key for protecting user plane data according to the Ksn.
  • the calculated Ksn is the same, so the key for protecting user plane data generated by the UE is the same as the key for protecting user plane data generated by the SN, so that the UE and the SN use the same key to protect the user plane data.
  • the UE can also generate a key for protecting the signaling plane according to the Ksn, which is the same as the key for the protecting signaling plane generated by the SN.
  • Step S411 The UE activates a user plane security protection method with the SN by using the security algorithm determined by the SN.
  • the UE When the UE receives the third message, it can learn the security algorithm between the SN selected by the SN and the UE, and the UE uses this security algorithm to perform security protection on the uplink user plane data.
  • the UE When the UE receives the third message, it can know the user plane security protection method between the SN and the UE.
  • the UE activates the user plane security protection method between the UE and the SN, that is, the UE and the SN are protected according to the user plane security protection method. User plane data is protected. At this time, the UE does not activate the user plane security protection method with the MN.
  • the UE In the case that the third message includes an SN counter, the UE generates a Ksn according to the SN counter.
  • the Ksn is the same as the Ksn calculated by the MN, and the UE can generate a key for protecting user plane data according to the Ksn.
  • Ksn is the same, so the key generated by the UE to protect the user plane data is the same as the key generated by the SN to protect the user plane data, so that the UE and the SN use the same key to protect the user plane data.
  • the UE may also generate a key for protecting the signaling plane according to the Ksn, which is the same as the key for the protecting signaling plane generated by the SN.
  • Step S412 The UE sends a fourth message to the MN. Accordingly, the MN receives a fourth message from the UE.
  • the fourth message may be an RRC connection reconfiguration response, and the RRC connection reconfiguration response is used to respond to the RRC connection reconfiguration request.
  • the UE performs security protection on the uplink user plane data according to the user plane security protection method between the UE and the SN, which may include the UE using the user plane security protection method between the UE and the SN, the security algorithm between the UE and the SN, and protecting the user plane.
  • the data key secures the uplink user plane data.
  • the UE performs de-security protection on uplink user plane data according to a user plane security protection method between the UE and the SN.
  • Security protection means encryption protection and / or integrity protection.
  • Unsecured protection means decryption and / or verification integrity protection.
  • Step S413 The UE sends the first uplink user plane data to the MN for security protection according to the user plane security protection method between the UE and the SN.
  • the MN receives the first uplink user plane data from the UE.
  • the UE uses the SN-activated user plane security protection method, the security algorithm selected by the SN, and the generated key to protect the user plane data to secure the uplink user plane data, and sends the first uplink user plane data after security protection to the MN.
  • the user plane security protection method activated by SN is that user plane encryption protection is turned on and user plane integrity protection is turned off.
  • the security algorithm determined by SN is to use user plane encryption protection algorithm A.
  • the UE uses The user plane encryption protection algorithm A and the generated key for protecting user plane data encrypt the uplink user plane data, and send the uplink user plane data encrypted with the encryption protection algorithm A and the key to the MN.
  • User plane data is integrity protected.
  • Step S414 the MN sends the first uplink user plane data to the SN for security protection according to the user plane security protection method between the UE and the SN. Accordingly, the SN receives the first uplink user plane data from the MN.
  • the MN forwards the security-protected first uplink user plane data received by the UE to the SN.
  • the MN forwards the uplink user plane data sent by the UE to the SN according to the user plane security protection method between the SN and the UE, that is, the MN transparently transmits the uplink user plane data after the UE security protection. Because the UE only activates the user plane security protection method with the SN, and the UE sends uplink user plane data to the MN according to the user plane security protection method between the UE and the SN, when the MN receives the uplink user plane data, It can only be forwarded to the SN.
  • the MN Since the user plane security endpoint is in the SN, the MN does not perform any security operations and directly forwards the received data to the SN.
  • Step S415 The UE sends the second uplink user plane data to the SN for security protection according to the user plane security protection method between the UE and the SN. Accordingly, the SN receives the second uplink user plane data from the UE.
  • the UE uses the SN-activated user plane security protection method, the security algorithm selected by the SN, and the generated key to protect the user plane data to securely protect the uplink user plane data, and sends the second uplink user plane data after the security protection to the SN.
  • the SN When the SN receives the uplink user plane data forwarded by the MN, the SN activates the user plane security protection method to unsecure the uplink user plane data, including performing the uplink user plane data according to the SN activated user plane security protection method. Integrity protection verification.
  • the uplink user plane data is decrypted according to the security algorithm selected by the SN and the generated key to protect the user plane data.
  • the SN When the SN receives the uplink user plane data from the UE, it performs a security check on the uplink user plane data according to the SN activated user plane security protection method, including the uplink user plane data according to the SN activated user plane security protection method. Integrity protection verification is performed, and the uplink user plane data is decrypted according to the security algorithm selected by the SN and the generated key to protect the user plane data.
  • the integrity protection is performed.
  • the integrity protection verification is performed before decryption. If the uplink user plane data sent by the UE is integrity protected first and then encrypted, the SN decrypts the uplink user plane data before receiving the integrity protection verification.
  • Step S417 the SN sends the uplink user plane data to the UPF after the security is de-protected.
  • the SN sends the uplink user plane data after decryption and integrity protection verification to the UPF, so that the UPF sends the uplink user plane data to the corresponding data network.
  • Steps S413 to S417 are for the protection of uplink user plane data.
  • the SN receives the downlink user plane data from the UPF, and uses the user plane security protection method between the SN and the UE, and the method between the SN and the UE.
  • the security algorithm and the generated key for protecting the user plane data securely protect the downlink user plane data, and one way directly sends the protected downlink user plane data to the UE; the other way sends the secured user downlink data to the UE through the MN.
  • the UE When the UE receives the security-protected downlink user plane data, the UE performs unsecure protection on the downlink user plane data according to the user plane security protection method between the UE and the SN, so that the UE obtains the downlink user plane data.
  • the MN determines that the user plane security termination point is on the SN, and the SN activates the user plane security protection method and security algorithm between the SN and the UE, and notifies the MN of the SN, and the MN notifies the UE.
  • SN activated user plane security protection method and SN selected security algorithm, and then the UE can perform security protection on uplink user plane data according to the user plane security protection method and the security algorithm, thereby realizing user plane security protection between UE and SN , Which can ensure the confidentiality and integrity of user plane data transmission in the 5G dual connectivity scenario.
  • the SN is a gNB, and a signaling plane path can exist between the SN and the UE
  • the SN determines a user plane security protection method and a security algorithm between the SN and the UE
  • the user plane security opening type indication information and the security algorithm selected by the SN may be sent to the UE directly through the RRC connection reconfiguration message.
  • the UE secures the uplink user plane data according to the user plane security protection method activated by the SN and the selected security algorithm, and sends the uplink user plane data to the SN.
  • a user terminal Taking the UE as an example, the access management network element uses AMF as an example, the session management network element uses SMF as an example, and the user plane network element uses UPF as an example.
  • the method may include, but is not limited to, the following steps:
  • Step S501 the MN obtains a first user plane security policy.
  • step S501 For the implementation of step S501, reference may be made to the detailed description of step S401 in the embodiment shown in FIG. 4, and details are not described herein again.
  • step S502 if the user plane security endpoint is on the MN, the MN does not need to generate a Ksn for the SN.
  • the MN performs security protection on the user plane data. At this time, the MN does not need to generate Ksn for the SN, that is, it does not need to use Kmn calculation to obtain Ksn.
  • a user plane security protection method may be fixedly configured on the ng-eNB, the MN may determine and activate the user plane security protection method configured by it and activate the user plane security protection method between the MN and the UE.
  • step S502 it further includes step S503, and the MN generates a second user plane security policy.
  • step S503 For the implementation of step S503, reference may be made to the detailed description of step S402 in the embodiment shown in FIG. 4, and details are not described herein again.
  • the MN may determine a user plane security protection method between the MN and the UE according to the generated second user plane security policy, and may be determined with the SN in the embodiment shown in FIG. 4 according to the generated second user plane security policy.
  • the user plane security protection method is similar.
  • the MN determines the user plane security protection method between the MN and the UE, it activates the user plane security protection method between the MN and the UE.
  • Step S504 the MN sends a first message to the SN. Accordingly, the SN receives the first message from the MN.
  • step S504 does not carry any user plane security policy. Since the MN does not generate Ksn, the first message does not carry Ksn.
  • the first message in step S504 may carry a PDU session identifier, and may also carry other user plane information, such as a DRB identifier.
  • Step S505 the SN sends a second message to the MN. Accordingly, the MN receives a second message from the SN.
  • step S505 the method further includes step S506, where the UE and the MN perform an ASSMC process.
  • step S506 For the implementation process of step S506, refer to the detailed description of step S407 in the embodiment shown in FIG. 4, and details are not described herein again.
  • steps S507 and S508 are further included.
  • Step S507 the MN sends a fifth message to the AMF, where the fifth message includes a third user plane security policy. Accordingly, the AMF receives a fifth message from the MN.
  • the fifth message may be a security result message.
  • the third user plane security policy carried in the security result message is the second user plane security policy generated by the MN.
  • the third user plane security policy carried by the N2 request is the acquired first user plane security policy.
  • step S508 the AMF sends a sixth message to the MN. Accordingly, the MN receives a sixth message from the AMF.
  • step S509 the MN sends a third message to the UE, where the third message includes information indicating the user plane security enable type. Accordingly, the UE receives a third message from the MN.
  • the third message may be an RRC connection reconfiguration request.
  • the user plane security enable type indication information is used to indicate a user plane security protection method between the MN activated by the MN and the UE.
  • Step S510 The UE determines a security algorithm and activates a user plane security protection method between the UE and the MN.
  • the UE can learn the security algorithm between the MN and the UE from the ASSMC.
  • the UE When the UE receives the third message, it can learn the user plane security protection method between the MN and the UE.
  • the UE activates the user plane security protection method between the MN and the MN, that is, the user plane security protection method User plane data for security protection. At this time, the UE does not activate the user plane security protection method with the SN.
  • Step S511 The UE sends a fourth message to the MN. Accordingly, the MN receives a fourth message from the UE.
  • the UE performs security protection on uplink user plane data according to a user plane security protection method between the UE and the MN, which may include the UE using the user plane security protection method between the UE and the MN, a security algorithm between the UE and the MN, and protecting the user plane
  • the data key secures the uplink user plane data.
  • step S512 the UE sends the first uplink user plane data to the SN for security protection according to the user plane security protection method between the UE and the MN.
  • the SN receives the first uplink user plane data from the UE.
  • Step S513 the SN sends the first uplink user plane data to the MN for security protection according to the user plane security protection method between the UE and the MN. Accordingly, the MN receives the first uplink user plane data from the SN.
  • the SN forwards the uplink user plane data sent by the UE to the MN according to the user plane security protection method between the MN and the UE, that is, the SN transparently transmits the uplink user plane data after the UE security protection.
  • Step S514 The UE sends the second uplink user plane data to the MN for security protection according to the user plane security protection method between the UE and the MN. Accordingly, the MN receives the second uplink user plane data from the UE.
  • Step S515 The MN performs de-security protection on the uplink user plane data.
  • step S5166 the MN sends the uplink user plane data after the security protection is released to the UPF.
  • the MN determines that the user plane security endpoint is on the MN, and the MN notifies the MN of the user plane security protection method between the MN and the UE, and the MN notifies the UE that User plane security protection method, and then the UE can perform security protection on uplink user plane data according to the user plane security protection method, thereby realizing user plane security protection between the UE and the MN, thereby ensuring user plane data transmission in a 5G dual connectivity scenario. Confidentiality and integrity.
  • the dual-connection communication device 60 may include a transceiver unit 601 and a processing unit 602.
  • the dual-connection communication device 60 may be a primary base station, a secondary base station, or a user terminal.
  • the dual-connected communication device 60 is a master base station:
  • the transceiver unit 601 is configured to send a first message to the secondary base station, where the first message includes a user plane security policy, and the user plane security policy is used by the secondary base station to determine a user plane security protection method between the secondary base station and the user terminal; For receiving a second message from the secondary base station, the second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal; Sending a third message to the user terminal, where the third message includes the user plane security enable type indication information.
  • the master base station may further include a processing unit for generating a second user plane security policy.
  • the processing unit 602 is configured to determine that the user plane integrity protection indication information in the user plane security policy is not enabled when the secondary base station does not support user plane integrity protection.
  • the processing unit 602 is further configured to obtain a first user plane security policy of a user terminal.
  • the processing unit 602 is further configured to generate a second user-plane security policy according to a first user-plane security policy of the user terminal.
  • the processing unit 602 is further configured to determine a user plane security protection method between the primary base station and the user terminal according to the second user plane security policy, and when the user plane security termination point is in the secondary base station , The user plane security protection method between the main base station and the user terminal is not activated.
  • the transceiver unit 601 is further configured to receive uplink user plane data from the user terminal.
  • the uplink user plane data is secured by the user terminal according to a user plane security protection method between the user terminal and the secondary base station. Protected data, and send the uplink user plane data to the secondary base station.
  • the dual-connected communication device 60 When the dual-connected communication device 60 is a master base station, in addition to the functions of the MN in the method embodiment shown in FIG. 4, it can also implement the functions of the MN in the embodiment shown in FIG. 5. Each unit in the dual-connected communication device 60 For the detailed execution process, refer to the execution steps of the MN in the foregoing method embodiment, and details are not described herein.
  • the dual-connected communication device 60 is a secondary base station:
  • the transceiver unit 601 is configured to receive a first message from the primary base station, where the first message includes a user plane security policy;
  • the processing unit 602 determines a user plane security protection method between the secondary base station and the user terminal according to the user plane security policy;
  • the processing unit 602 is further configured to activate a user plane security protection method between the secondary base station and the user terminal;
  • the transceiver unit 602 is further configured to send a second message to the primary base station, where the second message includes user plane security enable type indication information, and the user plane security enable type indication information is used to indicate a user plane security protection method between the secondary base station and the user terminal. .
  • the user plane security policy is the first user plane security policy of the user terminal; when the processing unit 601 is used for the user plane security policy to determine a user plane security protection method between the secondary base station and the user terminal, specifically It is configured to generate a third user plane security policy according to the first user plane security policy, and determine a user plane security protection method between the secondary base station and the user terminal according to the third user plane security policy.
  • the user plane security policy is a second user plane security policy generated by the primary base station according to the first user plane security policy; and the processing unit 602 is used for the user plane security policy to determine the relationship between the secondary base station and the user terminal.
  • the user plane security protection method is specifically used to determine a user plane security protection method between the secondary base station and the user terminal according to the second user plane security policy.
  • the transceiver unit 601 is further configured to receive first uplink user plane data and second uplink user plane data from the master base station and the user terminal, respectively, where the first uplink user plane data and the second uplink user plane data
  • the user plane data is user plane data after the user terminal performs security protection according to a user plane security protection method between the user terminal and the secondary base station.
  • the processing unit 602 is further configured to perform processing on the first uplink user plane data and the second user plane data. De-secure security protection to obtain user-plane data after de-security protection; the transceiver unit 601 is further configured to send the user-plane data to the user-plane network element after de-security protection.
  • the dual-connected communication device 60 is a secondary base station, in addition to the functions of the SN in the method embodiment described in FIG. 4, the functions of the SN in the embodiment shown in FIG. 5 can also be implemented.
  • the functions of the SN in the embodiment shown in FIG. 5 can also be implemented.
  • For the detailed execution process refer to the execution steps of the SN in the foregoing method embodiment, and details are not described herein.
  • the dual-connection communication device 60 is a user terminal:
  • the transceiver unit 601 is configured to receive a third message from the primary base station.
  • the third message includes user plane security enable type indication information and a security algorithm selected by the secondary base station.
  • the user plane security enable type indication information is used to instruct the secondary base station and the user terminal.
  • a processing unit 602 configured to activate a user plane security protection method with the secondary base station according to the user plane security enable type indication information and the security algorithm selected by the secondary base station;
  • the processing unit 602 is further configured to perform security protection on the uplink user plane data according to a user plane security protection method between the user terminal and the secondary base station.
  • the processing unit 602 is configured to securely protect uplink user plane data according to a user plane security protection method between the user terminal and the secondary base station, and is specifically configured to control the transceiver unit 601 to the secondary base station and
  • the primary base station sends first uplink user plane data and second uplink user plane data, where the first uplink user plane data and the second user plane data are secured by the user terminal according to a user plane security protection method between the user terminal and the secondary base station.
  • User plane data after protection.
  • the dual-connected communication device 60 When the dual-connected communication device 60 is a user terminal, in addition to the functions of the UE in the method embodiment shown in FIG. 4, the functions of the UE in the embodiment shown in FIG. 5 can also be implemented. Each unit in the dual-connected communication device 60 For the detailed execution process, refer to the execution steps of the UE in the foregoing method embodiments, and details are not described herein.
  • FIG. 7 is a simplified schematic diagram of a physical structure of a dual-connection communication device according to an embodiment of the present application.
  • the dual-connection communication device 70 may be a primary base station, a secondary base station, or a user terminal.
  • the dual-connection communication device 70 includes a transceiver 701, a processor 702, and a memory 703.
  • the transceiver 701, the processor 702, and the memory 703 may be connected to each other through a bus 704, or may be connected in other ways.
  • the related functions implemented by the transceiver unit 601 shown in FIG. 6 may be implemented by the transceiver 701.
  • the related functions implemented by the processing unit 602 shown in FIG. 6 may be implemented by one or more processors 702.
  • the memory 703 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or A portable read-only memory (CD-ROM).
  • RAM random access memory
  • ROM read-only memory
  • EPROM erasable programmable read-only memory
  • CD-ROM portable read-only memory
  • the transceiver 701 is configured to send data and / or signaling and receive data and / or signaling.
  • the transceiver 701 may be configured to communicate with the UE, SN, AMF, and UPF, for example, step S403 in the embodiment shown in FIG. , Step S406, step S407, step S408, step S409, step S410, step S413, and step S414; perform step S504, step S505, step S506, step S507, step S508, step S509, step in the embodiment shown in FIG. 5 S511, step S513, step S514, and step S516. It should be noted that when the user plane security termination point is on the MN, the transceiver 701 and the UPF perform user plane data transmission.
  • the transceiver 701 may be configured to communicate with the MN, UE, and UPF, for example, perform steps S403, S406, Step S414, step S415, and step S417; step S504, step S505, step S512, and step S513 in the embodiment shown in FIG. 5 are performed. It should be noted that when the user plane security termination point is on the SN, the transceiver 701 and the UPF perform user plane data transmission.
  • the transceiver 701 may be configured to communicate with the MN and the SN, for example, perform steps S407, S410, and S412 in the embodiment shown in FIG. , Step S413 and step S415; step S506, step S509, step S511, step S512 and step S514 in the embodiment shown in FIG. 5 are executed.
  • the processor 702 may include one or more processors, for example, one or more central processing units (CPUs).
  • processors for example, one or more central processing units (CPUs).
  • the CPU may be a single-core CPU, or Can be a multi-core CPU.
  • the processor 702 may be configured to perform an operation of controlling the MN, for example, perform steps S401 and S402 in the embodiment shown in FIG. 4; execute FIG. 5 Step S501, step S502, step S503, and step S515 in the illustrated embodiment.
  • the processor 702 may be configured to perform operations for controlling the SN, for example, perform steps S404, S405, and S416 in the embodiment shown in FIG.
  • the processor 702 may be configured to perform an operation for controlling the MN, for example, perform step S411 in the embodiment shown in FIG. 4; Step S510 in the example.
  • the memory 703 is configured to store program codes and data of the dual-connection communication device 70.
  • FIG. 7 only shows a simplified design of the dual-connected communication device.
  • the dual-connected communication device may also include other necessary components, including but not limited to any number of transceivers, processors, controllers, memories, communication units, etc., and all the devices that can implement this application are in Within the scope of this application.
  • An embodiment of the present application further provides a dual-connection communication system, which may include a primary base station and a secondary base station.
  • the primary base station and the secondary base station may be used to implement the functions of the MN and SN in the embodiment shown in FIG. Functions of MN and SN in the embodiment shown in FIG. 5.
  • the dual-connection communication system may further include a user terminal, which may be used to implement the functions of the UE in the embodiment shown in FIG. 4, and may also be used to implement the functions of the UE in the embodiment shown in FIG. 5.
  • a user terminal which may be used to implement the functions of the UE in the embodiment shown in FIG. 4, and may also be used to implement the functions of the UE in the embodiment shown in FIG. 5.
  • the dual-connection communication system may further include a user plane network element, which may be used to interact with the secondary base station, receive uplink user plane data from the secondary base station, and send downlink user plane data to the secondary base station to implement the implementation shown in FIG. 4
  • a user plane network element which may be used to interact with the secondary base station, receive uplink user plane data from the secondary base station, and send downlink user plane data to the secondary base station to implement the implementation shown in FIG. 4
  • the user plane network element can be used to interact with the master base station, receive uplink user plane data from the master base station, and send downlink user plane data to the master base station to implement the function of the UPF in the embodiment shown in FIG. 5.
  • the dual-connection communication system may further include an access management network element, which may be used to interact with the main base station to implement the functions of the AMF in the embodiment shown in FIG. 4 and may also implement the AMF in the embodiment shown in FIG. 5 Functions.
  • an access management network element which may be used to interact with the main base station to implement the functions of the AMF in the embodiment shown in FIG. 4 and may also implement the AMF in the embodiment shown in FIG. 5 Functions.
  • the processes may be completed by a computer program instructing related hardware.
  • the program may be stored in a computer-readable storage medium.
  • the foregoing storage media include: ROM or random storage memory RAM, magnetic disks, or optical discs, which can store various program code media. Therefore, another embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores instructions, and when the computer-readable storage medium runs on the computer, the computer executes the methods described in the above aspects.
  • Yet another embodiment of the present application further provides a computer program product containing instructions, which when executed on a computer, causes the computer to execute the methods described in the above aspects.
  • the disclosed systems, devices, and methods may be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of the unit is only a logical function division.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, which may be electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objective of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium.
  • the computer instructions may be transmitted from a website site, computer, server, or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) Another website site, computer, server, or data center for transmission.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, and the like that includes one or more available medium integration.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种双连接通信方法及其装置、系统，其中方法可包括如下步骤：主基站向辅基站发送第一消息，第一消息包括用户面安全策略，该用户面安全策略用于辅基站确定辅基站与用户终端之间的用户面安全保护方法；主基站接收来自辅基站的第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；主基站向用户终端发送第三消息，该第三消息包括该用户面安全开启类型指示信息。采用本申请实施例，可以解决5G双连接场景下，如何开启用户终端与辅基站之间的用户面安全的技术问题，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。

Description

双连接通信方法及其装置、系统
本申请要求于2018年8月10日提交中国专利局、申请号为201810911030.6、申请名称为“双连接通信方法及其装置、系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，具体涉及双连接通信方法及其装置、系统。
背景技术
随着通信技术的发展，为了满足第五代移动通信(5 th-generation，5G)场景下的安全需求，除了沿用长期演进(long term evolution，LTE)系统中的用户面加密保护之外，还引入用户面完整性保护，用户面完整性保护即保护数据在用户面传输过程中的完整性。并且，还引入了用户面按需安全，即用户面加密保护和用户面完整性保护按照是否需要来开启。
目前，在用户终端(例如用户设备(user equipment，UE))与网络节点单连接的场景下，即只有一个网络节点为用户终端服务的场景，开启用户终端与网络节点之间用户面安全的流程可包括：1，会话管理网元将其获取的用户面安全策略发送至网络节点(即基站)，用户面安全策略包括用户面加密保护是需要开启的(required)、倾向开启的(preferred)或不需要开启的(not needed)，以及用户面完整性保护是需要开启的(required)、倾向开启的(preferred)或不需要开启的(not needed)；2，若是需要开启的，则网络节点开启相应保护；若是不需要开启的，则网络节点不需要开启相应保护；若是倾向开启的，则网络节点根据资源是否足够来确定是否开启相应保护；3，网络节点向用户终端发送无线资源控制(radio resource control，RRC)重配置请求消息，该消息携带开用户面保护类型的指示信息，该指示信息用于指示是否开启加密保护，是否开启完整性保护；4，用户终端接收到来自网络节点的RRC重配置消息，根据用户面保护类型的指示信息激活相应的用户面安全，并生成与网络节点相同的保护密钥；5，用户终端向网络节点发送RRC重配置响应消息。
上述开启用户面安全的流程针对5G单连接场景，在5G双连接的场景下，即一个用户终端连接两个网络节点(主基站和辅基站)的场景，如何开启用户终端与辅基站之间的用户面安全保护是亟待解决的技术问题。
发明内容
本申请实施例所要解决的技术问题在于，提供双连接通信方法及其装置、系统，可以解决5G双连接场景下，如何开启用户终端与辅基站之间的用户面安全保护的技术问题，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。
本申请实施例第一方面提供一种双连接通信方法，包括：
主基站向辅基站发送第一消息，该第一消息包括用户面安全策略，该用户面安全策略用于辅基站确定辅基站与用户终端之间的用户面安全保护方法；
主基站接收来自辅基站的第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；
主基站向用户终端发送第三消息，该第三消息包括该用户面安全开启类型指示信息。
本申请实施例第一方面，主基站向辅基站发送用户面安全策略，辅基站根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法，向主基站发送指示辅基站与用户终端之间的用户面安全保护方法的用户面安全开启类型指示信息，主基站向用户终端发送该用户面安全开启类型指示信息，以使用户终端根据该用户面安全开启类型指示信息激活用户终端与辅基站之间的用户面安全保护方法，从而可以开启用户终端与辅基站之间的用户面安全保护，保证5G双连接场景下用户面数据传输的机密性和完整性。
其中，用户面安全策略包括用户面加密保护指示信息和用户面完整性保护指示信息，用户面加密保护指示信息用于指示三种可能的值，分别为not needed、preferred和required，用户面完整性保护指示信息用于指示三种可能的值，分别为not needed、preferred和required。not needed表示不需要激活，即不开启；preferred表示可以激活可以不激活，即可以开启也可以不开启；required表示必须激活，即开启。
在一种可能的实现方式中，主基站向辅基站发送第一消息之前，在辅基站不支持用户面完整性保护的情况下，主基站确定用户面安全策略中的用户面完整性保护指示信息不是开启的，即是“preferred”或“not needed”。
在一种可能的实现方式中，第一消息还包括用户终端的安全能力，用户终端的安全能力指的是用户终端支持哪些加密算法和哪些完整性保护算法。在第一消息中携带用户终端的安全能力，以便辅基站根据其是哪种系统下的基站从用户终端的安全能力中选择辅基站与用户终端之间的将要使用的安全算法。
在一种可能的实现方式中，第二消息还包括辅基站与用户终端之间的安全算法，第三消息还包括辅基站与用户终端之间的安全算法，即辅基站将其选择的安全算法通过主基站告知用户终端，以便用户终端根据辅基站所选择的安全算法对用户面数据进行安全保护或解安全保护。
在一种可能的实现方式中，主基站向辅基站发送第一消息之前，主基站获取用户终端的第一用户面安全策略。其中，第一用户面安全策略为原始的用户面安全策略。用户终端的第一用户面安全策略的粒度可以是分组数据单元(packet data unit，PDU)会话，即不同PDU会话对应不同的用户面安全策略，第一用户面安全策略的粒度还可以是网络切片、服务质量流和数据无线承载等中的一种或多种。
其中，主基站可在建立PDU会话的过程中从核心网网元获取用户终端的用户面安全策略，也可以在基站切换过程中作为目标基站时，从源基站获取用户终端的用户面安全策略。
在一种可能的实现方式中，第一消息还包括用户面安全策略对应的用户面信息，以便用户终端可以知道从主基站和辅基站接收到的用户面数据是同一个PDU会话的。该用户面信息可以包括PDU会话标识，还可以包括网络切片标识、服务质量流标识、5G服务质量流指示符、数据无线承载标识等中的一种或多种。
在一种可能的实现方式中，第一消息所携带的用户面安全策略为用户终端的第一用户面安全策略，即主基站直接将其获取的第一用户面安全策略发送至辅基站，以便辅基站根据第一用户面安全策略生成映射的用户面安全策略，并根据映射的用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，第一消息所携带的用户面安全策略为主基站根据用户终端的第一用户面安全策略生成的第二用户面安全策略，主基站向辅基站发送第一消息之前，根据用户终端的第一用户面安全策略，生成第二用户面安全策略。其中，第二用户面安全策略为主基站生成的映射的用户面安全策略。辅基站在接收到第二用户面安全策略的情况下，可直接根据第二用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。
其中，主基站可根据主基站的能力、辅基站的能力以及第一用户面安全策略生成第二用户面安全策略，使得第二用户面安全策略可以同时被主基站和辅基站使用。其中，主基站或辅基站的能力可以包括是否支持开启用户面加密保护以及是否支持开启用户面完整性保护，资源使用情况，支持的安全算法，当前状态和配置信息等信息中的一种或多种。
在一种可能的实现方式中，在辅基站不支持用户面完整性保护的情况下，当第一用户面安全策略中的用户面完整性保护指示信息为开启时，主基站生成的第二用户面安全策略中的用户面完整性保护指示信息被设置为关闭。
在一种可能的实现方式中，主基站根据第二用户面安全策略确定主基站与用户终端之间的用户面安全保护方法；在用户面安全终结点在辅基站上的情况下，主基站不激活主基站与用户终端之间的用户面安全保护方法，即不根据主基站与用户终端之间的用户面安全保护方法对用户面数据进行安全保护或解安全保护。
在一种可能的实现方式中，主基站接收来自辅基站的第三用户面安全策略，其中，第三用户面安全策略由辅基站根据用户终端的第一用户面安全策略生成的，即第三用户面安全策略为辅基站映射的用户面安全策略。辅基站将其映射的用户面安全策略告知主基站，以便主基站获知辅基站与用户终端之间的用户面安全保护方法。主基站在获知辅基站与用户终端之间的用户面安全保护方法可将主基站与用户终端之间的用户面安全保护方法设置为与辅基站与用户终端之间的用户面安全保护方法相同。
在一种可能的实现方式中，主基站在接收到来自辅基站的第三用户面安全策略的情况下，可向接入管理网元发送第三用户面安全策略，该第三用户面安全策略可以指示辅基站与用户终端之间的用户面安全保护方法，以便接入管理网元获知用户面安全开启结果。
在一种可能的实现方式中，主基站可根据用户面安全开启类型指示信息确定第三用户面安全策略，并向接入管理网元发送第三用户面安全策略，以便接入管理网元获知用户面安全开启结果。
在一种可能的实现方式中，主基站接收来自用户终端的上行用户面数据，其中上行用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的数据，并向辅基站发送上行用户面数据，以便辅基站在接收到该上行用户面数据时，根据辅基站与用户终端之间的用户面安全保护方法对其进行解安全保护。
本申请实施例第二方面提供一种主基站，该主基站具有实现第一方面提供方法的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实现方式中，该主基站包括：收发单元，用于向辅基站发送第一消息，该第一消息包括用户面安全策略，该用户面安全策略用于辅基站确定辅基站与用户终端之间的用户面安全保护方法；还用于接收来自辅基站的第二消息，该第二消息包括用户面安 全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；还用于向用户终端发送第三消息，该第三消息包括该用户面安全开启类型指示信息。该主基站还可以包括处理单元，用于生成第二用户面安全策略。
在一种可能的实现方式中，该主基站包括：处理器、收发器和存储器，其中，存储器中存储计算机程序，计算机程序包括程序指令，处理器被配置用于调用程序代码，执行以下操作：向辅基站发送第一消息，该第一消息包括用户面安全策略，该用户面安全策略用于辅基站确定辅基站与用户终端之间的用户面安全保护方法；接收来自辅基站的第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；向用户终端发送第三消息，该第三消息包括该用户面安全开启类型指示信息。该主基站还可以包括处理单元，用于生成第二用户面安全策略。
基于同一发明构思，由于该主基站解决问题的原理以及有益效果可以参见第一方面所述的方法以及所带来的有益效果，因此该装置的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例第三方面提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
本申请实施例第四方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面所述的方法。
本申请实施例第五方面提供一种双连接通信方法，包括：
辅基站接收来自主基站的第一消息，该第一消息包括用户面安全策略；
辅基站根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法；
辅基站激活辅基站与用户终端之间的用户面安全保护方法；
辅基站向主基站发送第二消息，第二消息包括用户面安全开启类型指示信息，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法。
本申请实施例第五方面，辅基站根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法，并激活辅基站与用户终端之间的用户面安全保护方法，向主基站发送用于指示辅基站与用户终端之间的用户面安全保护方法的用户面安全开启类型指示信息，以便主基站向用户终端发送该用户面安全开启类型指示信息，从而可以开启用户终端与辅基站之间的用户面安全，保证5G双连接场景下用户面数据传输的机密性和完整性。
在一种可能的实现方式中，第一消息还包括用户终端的安全能力，辅基站可以根据用户终端的安全能力选择辅基站与用户终端之间的安全算法。
在一种可能的实现方式中，第二消息还包括辅基站与用户终端之间的安全算法，以便主基站将辅基站与用户终端之间的安全算法告知用户终端，以使用户终端可以根据辅基站与用户终端之间的安全算法进行安全保护或解安全保护。
在一种可能的实现方式中，第一消息还包括用户面安全策略对应的用户面信息，以便用户终端可以知道从主基站和辅基站接收到的用户面数据是同一个PDU会话的。
在一种可能实现的方式中，辅基站激活辅基站与用户终端之间的用户面安全保护方法，可包括：辅基站根据辅基站与用户终端之间的用户面安全保护方法、辅基站与用户终端之 间的安全算法以及辅基站与用户终端之间的安全密钥激活辅基站与用户终端之间的用户面安全保护方法。
在一种可能实现的方式中，辅基站生成辅基站与用户终端之间的安全密钥，辅基站使用辅基站与用户终端之间的用户面安全保护方法、辅基站与用户终端之间的安全算法以及辅基站与用户终端之间的安全密钥激活辅基站与用户终端之间的用户面安全保护方法。
在一种可能实现的方式中，用户面安全策略为用户终端的第一用户面安全策略，即主基站在获取到用户终端的第一用户面安全策略时，直接将其发送至辅基站，辅基站根据第一用户面安全策略生成第三用户面安全策略；根据第三用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。其中，第三用户面安全策略为辅基站生成的映射的用户面安全策略。
其中，辅基站可根据辅基站的能力、主基站的能力以及第一用户面安全策略生成第三用户面安全策略。
在一种可能实现的方式中，辅基站向主基站发送辅基站生成的第三用户面安全策略，以便主基站获知辅基站与用户终端之间的用户面安全保护方法。
在一种可能实现的方式中，用户面安全策略为第二用户面安全策略，第二用户面安全策略为主基站根据用户终端的第一用户面安全策略生成的映射的用户面安全策略，辅基站根据第二用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。
在一种可能实现的方式中，辅基站分别接收来自主基站以及用户终端的第一上行用户面数据和第二上行用户面数据；其中，第一上行用户面数据和第二用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的用户面数据；辅基站对第一上行用户面数据和第二用户面数据进行解安全保护，得到解安全保护后的用户面数据，并向用户面网元发送解安全保护后的用户面数据，从而实现用户终端与辅基站之间的用户面安全保护。
本申请实施例第六方面提供一种辅基站，该辅基站具有实现第五方面提供方法的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实现方式中，该辅基站包括收发单元和处理单元，收发单元，用于接收来自主基站的第一消息，该第一消息包括用户面安全策略；处理单元，用于根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法，激活辅基站与用户终端之间的用户面安全保护方法；收发单元，还用于向主基站发送第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，该辅基站包括：处理器、收发器和存储器，其中，存储器中存储计算机程序，计算机程序包括程序指令，处理器被配置用于调用程序代码，执行以下操作：接收来自主基站的第一消息，该第一消息包括用户面安全策略；根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法，激活辅基站与用户终端之间的用户面安全保护方法；向主基站发送第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方 法。
基于同一发明构思，由于该辅基站解决问题的原理以及有益效果可以参见第五方面所述的方法以及所带来的有益效果，因此该装置的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例第七方面提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第五方面所述的方法。
本申请实施例第八方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第五方面所述的方法。
本申请实施例第九方面提供一种双连接通信方法，包括：
用户终端接收来自主基站的第三消息，该第三消息包括用户面安全开启类型指示信息和辅基站选择的安全算法，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；
用户终端根据用户面安全开启类型指示信息和辅基站选择的安全算法，激活与辅基站之间的用户面安全保护方法；
用户终端根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
本申请实施例第九方面，用户终端通过接收来自主基站的用户面安全开启类型指示信息和辅基站选择的安全算法，获知用户终端与辅基站之间的用户面安全保护方法以及用户终端与辅基站之间的安全算法，激活用户终端与辅基站之间的用户面安全保护方法，以开启用户终端与辅基站之间的用户面安全保护，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。
在一种可能的实现方式中，用户终端生成用户终端与辅基站之间的安全密钥，根据用户面安全开启类型指示信息、辅基站选择的安全算法以及用户终端与辅基站之间的安全密钥，激活与辅基站之间的用户面安全保护方法。
在一种可能的实现方式中，用户终端根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护，包括：用户终端分别向辅基站以及主基站发送第一上行用户面数据和第二上行用户面数据；其中，第一上行用户面数据和第二用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
本申请实施例第十方面提供一种用户终端，该用户终端具有实现第九方面提供方法的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实现方式中，该用户终端包括收发单元和处理单元，收发单元，用于接收来自主基站的第三消息，该第三消息包括用户面安全开启类型指示信息和辅基站选择的安全算法，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；处理单元，用于根据用户面安全开启类型指示信息和辅基站选择的安全算法，激活与辅基站之间的用户面安全保护方法；处理单元，还用于根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
在一种可能的实现方式中，该用户终端包括：处理器、收发器和存储器，其中，存储 器中存储计算机程序，计算机程序包括程序指令，处理器被配置用于调用程序代码，执行以下操作：接收来自主基站的第三消息，该第三消息包括用户面安全开启类型指示信息和辅基站选择的安全算法，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；根据用户面安全开启类型指示信息和辅基站选择的安全算法，激活与辅基站之间的用户面安全保护方法；根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
基于同一发明构思，由于该用户终端解决问题的原理以及有益效果可以参见第九方面所述的方法以及所带来的有益效果，因此该装置的实施可以参见方法的实施，重复之处不再赘述。
本申请实施例第十一方面提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第九方面所述的方法。
本申请实施例第十二方面提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第九方面所述的方法。
本申请实施例第十三方面提供一种双连接通信系统，包括主基站和辅基站；
主基站，用于向辅基站发送第一消息，第一消息包括用户面安全策略；
辅基站，用于接收主基站发送的第一消息，根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法；向主基站发送第二消息，第二消息包括用户面安全开启类型指示信息，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；
主基站，还用于接收来自辅基站发送的第二消息，并向用户终端发送第三消息，第三消息包括用户面安全开启类型指示信息。
本申请实施例第十三方面提供的双连接通信系统，可以开启用户终端与辅基站之间的用户面安全保护，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。
在一种可能的实现方式中，该系统还包括用户终端；
用户终端，用于接收来自主基站的第三消息，该第三消息包括用户面安全开启类型指示信息和辅基站选择的安全算法，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；
用户终端，还用于根据用户面安全开启类型指示信息和辅基站选择的安全算法，激活与辅基站之间的用户面安全保护方法；
用户终端，还用于根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
在一种可能的实现方式中，在辅基站不支持用户面完整性保护的情况下，主基站，还用于确定用户面安全策略中的用户面完整性保护指示信息为不开启。
在一种可能的实现方式中，主基站，还用于获取用户终端的原始的用户面安全策略；根据原始的用户面安全策略生成映射的用户面安全策略；其中，第一消息中包括的用户面安全策略为主基站映射的用户面安全策略。
在一种可能的实现方式中，第一消息中包括的用户面安全策略为主基站根据第一用户面安全策略生成的映射的用户面安全策略。
在一种可能的实现方式中，该系统还包括用户面网元；
主基站，还用于接收来自用户终端发送的第一上行用户面数据，并将第一上行用户面数据发送给辅基站；
辅基站，还用于接收来自用户终端发送的第二上行用户面数据以及主基站发送的第一用户面上行数据；对第一上行用户面数据和第二用户面数据进行解安全保护，得到解安全保护后的用户面数据；向用户面网元发送解安全保护后的用户面数据；其中，第一上行用户面数据和第二用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
在一种可能的实现方式中，该系统还包括接入管理网元；
主基站，还用于向接入管理网元发送第三用户面安全策略，该第三用户面安全策略为辅基站生成的映射的用户面安全策略，或该第三用户面安全策略为主基站根据用户面安全开启类型指示信息所确定的用户面安全策略。
附图说明
为了更清楚地说明本申请实施例或背景技术中的技术方案，下面将对本申请实施例或背景技术中所需要使用的附图进行说明。
图1为LTE双连接通信的流程示意图；
图2为应用本申请实施例的网络架构示意图；
图3a为应用本申请实施例的一种5G双连接架构示意图；
图3b为应用本申请实施例的另一种5G双连接架构示意图；
图4为本申请实施例一提供的双连接通信方法的流程示意图；
图5为本申请实施例二提供的双连接通信方法的流程示意图；
图6为本申请实施例提供的双连接通信装置的逻辑结构示意图；
图7为本申请实施例提供的双连接通信装置的实体结构简化示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。其中，在本申请的描述中，除非另有说明，“/”表示前后关联的对象是一种“或”的关系，例如，A/B可以表示A或B；本申请中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况，其中A,B可以是单数或者复数。并且，在本申请的描述中，除非另有说明，“多个”是指两个或多于两个。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。另外，为了便于清楚描述本申请实施例的技术方案，在本申请的实施例中，采用了“第一”、“第二”等字样对功能和作用基本相同的相同项或相似项进行区分。本领域技术人员可以理解“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施 例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
下面将对本申请实施例涉及的名称或术语进行介绍：
主基站(master Node，MN)，在双连接场景下，将发起双连接的基站称为主基站，也可以称为主网络节点、第一基站或第一网络节点。
辅基站(secondary Node，SN)，在双连接场景下，将主基站选择的另一个协同为用户终端服务的基站称为辅基站，也可以称为从基站、辅网络节点、从网络节点、第二基站或第二网络节点。
用户面安全策略，包括用户面加密保护指示信息和用户面完整性保护指示信息。用户面加密保护指示信息用于指示三种可能的值，分别为not needed、preferred和required，用户面完整性保护指示信息用于指示三种可能的值，分别为not needed、preferred和required。其中，not needed表示不需要激活，preferred表示可以激活可以不激活，required表示必须激活。上述三种可能的值可以采用2比特(bit)来指示，例如00指示不需要激活，01指示可以激活可以不激活，11指示必须激活。用户面加密保护指示信息和用户面完整性保护指示信息具体采用何种方式对三种可能的值进行指示，在本申请实施例中不作限定。
用户面加密保护即保护数据在传输过程中的机密性(因此又可以被称作用户面机密性保护)，用户面完整性保护即保护数据在用户面传输过程中的完整性。机密性是指无法被直接看出真实内容，完整性是指数据是原始的没有被窜改的。
用户面安全保护方法，指的是用户终端侧、主基站侧或辅基站侧的用户面加密保护是否开启以及用户面完整性保护是否开启。例如，辅基站可结合用户面安全策略和辅基站所配置的用户面安全保护方法来确定辅基站的用户面安全保护方法，假设辅基站所配置的用户面安全保护方法为开启用户面加密保护，不开启用户面完整性保护，若用户面安全策略所包括的用户面加密保护指示信息为“required”，则开启用户面加密保护，辅基站确定出其用户面安全保护方法为开启用户面加密保护，不开启用户面完整性保护；若用户面安全策略所包括的用户面加密保护指示信息为“not needed”，则不开启用户面加密保护，辅基站确定出其用户面安全保护方法为不开启用户面加密保护，不开启用户面完整性保护；若用户面安全策略所包括的用户面加密保护指示信息为“preferred”，则辅基站根据某些条件判断是否开启用户面加密保护，例如在辅基站资源充足的情况下，可以开启用户面加密保护。
用户面安全开启类型指示信息，用于基站侧指示终端侧用户面加密保护是否开启以及用户面完整性保护是否开启，例如，用于指示用户面加密保护开，用户面完整性保护关。用户面安全开启类型指示信息可以采用2比特位来指示，1个比特位指示加密保护是开启还是不开启，另外一个比特位指示完整性保护开启还是不开启。
安全算法，可以包括用户面使用的安全算法和信令面使用的安全算法。用户面使用的安全算法用于保护用户面数据，可以包括用户面加密算法和用户面完整性算法。信令面使用的安全算法用于保护信令，可以包括信令面加密算法和信令面完整性算法。用户面使用的安全算法与信令面使用的安全算法可以相同，也可以不相同。相同的具体含义是，如果用户面完整性保护开启，则用户面使用的完整性算法和信令面使用的完整性算法相同；如 果用户面加密保护开启，则用户面使用的加密算法和信令面使用的加密算法相同。信令面使用的安全算法和用户面使用的安全算法有不一样的即不同，例如用户面使用加密算法为加密算法A，信令面使用的加密算法为加密算法B，但是用户面和信令面都使用完整性算法C，此时用户面使用的安全算法和信令面使用的安全算法不相同。
安全密钥，可以包括保护用户面数据的密钥和保护信令面的密钥。其中，保护用户面数据的密钥用于保护用户面数据，可以包括用户面加密密钥和用户面完整性保护密钥。保护信令面的密钥用于保护信令，例如可以是保护RRC信令的密钥，保护RRC信令的密钥可以包括保护RRC信令的完整性保护密钥和加密密钥。
安全保护，对于执行安全功能的节点而言，用户面/信令面安全算法和保护用户面/信令面数据的密钥一起用于保护用户面数据。具体地，使用加密密钥和加密算法对用户面/信令面数据进行加密保护；使用完整性保护密钥和完整性保护算法对用户面/信令面数据进行完整性保护。本发明实施例不限定加密保护和完整性保护的顺序关系，即可以先对用户面/信令面数据进行加密保护，再做完整性保护；也可以先对用户面/信令面进行完整性保护，再对用户面/信令面数据进行加密保护。当然，用户面和信令面可以不使用相同的执行顺序。
解安全保护，对于执行安全功能的节点而言，用户面/信令面安全算法和保护用户面/信令面数据的密钥一起用于获得原始的用户面数据。具体地，使用加密密钥和加密算法对加密的用户面/信令面数据进行解密；使用完整性保护密钥和完整性保护算法对用户面数据进行完整性保护验证。本发明实施例不限定解密和验证完整性保护的顺序。但需要理解的是，如果是用户面/信令面数据先被加密保护，再被完整性保护，则解安全保护是先验证完整性保护、再对加密后的用户面数据进行解密；如果用户面/信令面数据先被完整性保护，再被加密，则解安全保护的顺序为先解密加密后的数据，再进行完整性保护验证。
激活用户面/信令面安全保护方法，指的是在确定出用户面/信令面安全保护方法的情况下，使用用户面/信令面安全算法和保护用户面/信令面数据的密钥来激活该用户面/信令面安全保护方法，即使用用户面/信令面安全保护方法、用户面/信令面安全算法和保护用户面/信令面数据的密钥来对将要传输的用户面/信令面数据进行安全保护。例如，确定的用户面安全保护方法为用户面加密保护开，用户面完整性保护关，用户面加密算法为加密算法A，用户面加密密钥为密钥K，则对于将要传输的用户面数据，采用加密算法A和密钥K对该用户面数据进行用户面加密保护。激活用户面安全保护方法可以达到的效果是激活执行用户面安全保护的节点可以开始对用户面数据进行安全保护和开始对用户面数据进行解安全保护。需要理解的是，安全保护和解安全保护这两个动作可能是进一步分开激活的。比如基站在发送安全激活消息后，则基站激活解安全保护；基站再收到安全激活确认消息后，基站激活安全保护。
请参见图1，为LTE双连接通信的流程示意图，该流程可以包括如下步骤：
步骤1，用户终端与主基站建立RRC连接。
步骤2，主基站确定启动双连接，向辅基站发送辅基站管理请求。
主基站使用KeNB计算得到S-KeNB，该KeNB是主基站与用户终端共享的根密钥，用户终端和主基站可以根据KeNB计算得到S-KeNB、生成用户终端与主基站之间的保护RRC信令的密钥和保护用户面数据的密钥。其中，S-KeNB是辅基站与用户终端之间的根 密钥，用户终端和辅基站可以根据S-KeNB生成用户终端与辅基站之间的保护用户面数据的密钥。保护RRC信令的密钥，例如RRC信令面的完整性密钥或RRC信令面的加密密钥；保护用户面数据的密钥，例如用户面加密密钥。
主基站在确定启动双连接的情况下，向辅基站发送辅基站管理请求以启动双连接。该辅基站管理请求可以是辅基站添加请求，也可以是辅基站修改请求。该辅基站管理请求包括S-KeNB以及用户终端的安全能力，用户终端的安全能力包括用户终端支持的安全算法，即用户终端支持哪些加密算法和哪些完整性保护算法。该辅基站管理请求包括S-KeNB，以便辅基站根据S-KeNB生成保护用户面数据的密钥。
步骤3，辅基站选择一个加密算法，所选的加密算法和由S-KeNB生成的保护用户面数据的密钥一起保护用户终端与辅基站之间用户面数据的传输。
步骤4，辅基站向主基站发送辅基站管理响应，该辅基站管理响应包括辅基站所选的加密算法。
其中，辅基站管理响应用于响应辅基站管理请求，若辅基站管理请求为辅基站添加请求，则辅基站管理响应为辅基站添加响应；若辅基站管理请求为辅基站修改请求，则辅基站管理响应为辅基站修改响应。
步骤5，主基站向用户终端发送RRC连接重配置请求，该RRC连接重配置请求包括从属小区群(secondary cell group，SCG)计数器(counter)和辅基站所选的加密算法。SCG计数器用于用户终端生成S-KeNB，该S-KeNB与主基站计算得到S-KeNB相同，进而用户终端可以根据该S-KeNB生成保护用户面数据的密钥，由于该S-KeNB与主基站计算得到S-KeNB相同，因此用户终端生成的保护用户面数据的密钥与辅基站生成的保护用户面数据的密钥相同，以便用户终端与辅基站采用相同的密钥对用户面数据进行保护。
步骤6，用户终端向主基站发送RRC连接重配置响应。
步骤7，主基站向辅基站发送辅基站重配置完成消息。
在上述流程中，通过主基站将其确定的S-KeNB告知辅基站，以便辅基站采用所选的加密算法和由S-KeNB生成的保护用户面数据的密钥对用户终端与辅基站之间传输的用户面数据进行保护，用户终端采用相同的加密算法和保护用户面数据的密钥对用户终端与辅基站之间传输的用户面数据进行保护，从而实现用户终端与辅基站之间的用户面加密保护。
但是，上述流程只有加密保护没有5G新引入的用户面完整性保护，并且目前只提供了5G单连接场景下的用户面完整性保护，因此，在5G双连接场景下，如何开启用户终端与辅基站之间的用户面加密保护和用户面完整性保护是亟待解决的技术问题，即如何开启用户终端与辅基站之间的用户面安全是亟待解决的技术问题。
鉴于此，本申请实施例提供双连接通信方法及其装置，可以解决5G双连接场景下，如何开启用户终端与辅基站之间的用户面安全的技术问题，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。本申请实施例提供的双连接通信方法及其装置，也可以解决5G双连接场景下，如何开启用户终端与主基站之间，以及用户终端与辅基站之间的用户面安全的技术问题。
请参见图2，为应用本申请实施例的网络架构示意图，该网络架构示意图为双连接网络架构示意图，包括主基站、辅基站和用户终端。在图2所示的网络架构示意图中，黑色 实线表示信令面数据传输路径，黑色虚线表示用户面数据传输路径，由图2可知，用户终端与辅基站之间无信令面消息传递，只用辅基站传递用户面消息。本架构不排除随着标准化演进，用户终端和辅基站间有信令面消息传递，即不排除未来用户终端和辅基站间的信令面消息拥有安全协商、安全激活等现有技术中只可以通过主基站进行的安全相关的流程。
主基站为发起双连接的基站，可以是5G网络中的下一代基站节点(next generation Node Basestation，gNB)，也可以是LTE网络中的演进型基站节点(evolved Node Basestation，eNB或eNodeB)，还可以是升级后的eNB，即下一代演进型基站节点(next generation eNodeB，ng-eNB)，还可以是未来通信系统中的基站。主基站与核心网网元连接，例如与移动管理网元连接，移动管理网元可以是第四代移动通信(4 th-generation，4G)核心网中的移动性管理实体(mobility management entity，MME)，也可以是5G核心网中的接入和移动性管理功能(access and mobility management function，AMF)，还可以是未来核心网中与MME或AMF具有相同功能的网元；再例如，与用户面网元连接，用于传输用户面数据，用户面网元可以是4G核心网中的服务网关(serving gateway，SGW)，也可以是5G核心网中的用户面功能(user plane function，UPF)，还可以是未来核心网中与SGW或UPF具有相同功能的网元。
辅基站为主基站选择的另一个协同为用户终端服务的基站，可以是eNB，也可以是gNB，还可以是ng-eNB，还可以是未来通信系统中的基站。在4G双连接场景下，即用户终端所连接的两个网络节点为eNB，辅基站通常只与主基站有直接的X2接口，在特殊情况下，辅基站可以与MME、SGW有直接的接口。在5G双连接场景下，即用户终端所连接的两个网络节点中至少一个网络节点为gNB，辅基站与主基站有直接的接口，辅基站与UPF可以有直接的接口，在特殊情况下，辅基站可以与AMF有直接的接口。
本申请实施例所涉及的用户终端可以包括各种具有无线通信功能的手持设备、车载设备、可穿戴设备、计算设备或连接到无线调制解调器的其它处理设备；还可以包括用户设备(user equipment，UE)、用户单元(subscriber unit)、蜂窝电话(cellular phone)、智能电话(smart phone)、无线数据卡、个人数字助理(personal digital assistant，PDA)电脑、平板型电脑、无线调制解调器(modem)、手持设备(handheld)、膝上型电脑(laptop computer)、无绳电话(cordless phone)或者无线本地环路(wireless local loop，WLL)台、机器类型通信(machine type communication，MTC)终端、UE，移动台(mobile station，MS)，终端设备(terminal device)或者中继用户设备等。其中，中继用户设备例如可以是5G家庭网关(residential gateway，RG)。为方便描述，本申请实施例中，上面提到的设备统称为用户终端。
用户终端中存储有长期密钥和相关函数。用户终端在与核心网网元(例如AMF或认证服务功能(Authentication Server Function，AUSF)等)进行双向鉴权时，会使用长期密钥和相关函数验证网络的真实性。
请参见图3a和图3b，为应用本申请实施例的两种5G双连接架构示意图。在图3a和图3b中，主基站为gNB，辅基站为ng-eNB；或者主基站为ng-eNB，辅基站为gNB；或者主基站为gNB，辅基站为gNB等，本申请实施例主要介绍辅基站为ng-eNB或为gNB的情况。图3a和图3b所示的5G双连架构示意图并不构成对本申请实施例的限定。
在图3a和图3b中，接入管理网元负责移动性管理，可以是5G核心网中的AMF，也可以是未来核心网中负责移动性管理的网元，在本申请实施例中，接入管理网以AMF为例进行介绍。用户面网元为用户面数据出口，与外部网络(例如数据网络(data network，DN))连接，可以是5G核心网中的UPF，也可以是未来核心网中作为用户面数据出口，与外部网络连接的网元，在本申请实施例中，用户面网元以UPF为例进行介绍。会话管理网元用于为用户面分配会话资源，可以是5G核心网中的会话管理功能(session management function，SMF)，也可以是未来核心网中为用户面分配会话资源的网元，在本申请实施例中，会话管理网元以SMF为例进行介绍。
在图3a和图3b中，在特殊情况下，辅基站与核心网网元之间可以存在信令面路径，辅基站与用户终端之间可以存在信令面路径，可参见图3a和图3b中灰实线所示。
图3a与图3b的不同之处在于，图3a中用户面安全终结点在辅基站(SN)上，SN与用户面网元进行用户面数据交互，图3b中用户面安全终结点在主基站(MN)上，MN与用户面网元进行用户面数据交互。
其中，用户面安全终结点在哪个基站上，便由哪个基站对用户面数据进行安全保护/解安全保护。例如，用户面安全终结点在SN上，由SN对用户面数据进行安全保护，对于上行用户面数据，UE根据UE与SN之间的用户面安全保护方法对上行用户面数据进行安全保护，通过两路向SN发送安全保护后的上行用户面数据；一路直接向SN发送安全保护后的上行用户面数据，另一路通过MN向SN发送安全保护后的上行用户面数据(即MN对UE发送的安全保护后的上行用户面数据透传至SN)，SN在接收到安全保护后的上行用户面数据时根据SN与UE之间的用户面安全保护方法对上行用户面数据进行解安全保护。对于下行用户面数据，SN根据SN与UE之间的用户面安全保护方法对下行用户面数据进行安全保护，通过两路向UE发送安全保护后的下行用户面数据，一路直接向UE发送安全保护后的下行用户面数据；另一路通过MN向UE发送安全保护后的下行用户面数据，UE在接收到安全保护后的下行用户面数据时根据UE与SN之间的用户面安全保护方法对下行用户面数据进行解安全保护。需要理解的是，两路不一定同时存在。当用户面安全终结点在SN上，SN也可以在加密后将所有数据都通过MN发给UE。比如当SN的资源利用率达到一定门阀值后，SN就会将所有消息都通过MN发送给UE。
下面将对本申请实施例提供的双连接通信方法进行具体阐述。
需要说明的是，本申请下述实施例中各个网元之间的消息名字或消息中各参数的名字等只是一个示例，具体实现中也可以是其他的名字，本申请实施例对此不作具体限定。
以本申请实施例应用于图3a所示的双连接网络架构示意图为例，如图4所示，为本申请实施例一提供的双连接通信方法的流程示意图，在该实施例中，用户终端以UE为例，接入管理网元以AMF为例，会话管理网元以SMF为例，用户面网元以UPF为例进行介绍。该方法可以包括但不限于如下步骤：
步骤S401，MN获取第一用户面安全策略。
其中，第一用户面安全策略为原始的用户面安全策略。“原始的”相对“映射的”而言，“映射的”可在“原始的”基础上处理得到。
可选地，图4所示实施例还包括分组数据单元(packet data unit，PDU)会话建立过程。 PDU会话建立过程可包括：UE通过MN向AMF发送PDU会话建立请求；AMF在接收到该PDU会话建立请求时，向SMF发送该PDU会话建立请求中的会话建立请求相关的内容；SMF在接收到会话建立请求相关的内容时，可从统一数据管理(unified data management，UDM)获取会话相关的签约信息，SMF可以从会话相关的签约信息获取用户面安全策略，或者SMF从SMF的本地配置信息中获取用户面安全策略；SMF通过AMF和MN向UE发送PDU会话建立完成消息，该PDU会话建立完成消息包括用户面安全策略。
其中，SMF获取的用户面安全策略为UE的用户面安全策略，具体可以为UE的PDU会话的用户面安全策略，针对不同的PDU会话，用户面安全策略有所不同，可以采用PDU会话标识进行区分。UE的用户面安全策略除了可以与PDU会话相对应外，还可以与其他粒度相对应，比如与网络切片标识相对应、与服务质量流标识(quality of service flow identity，QFI)相对应、与5G服务质量流指示符(5G QoS indicator，5QI)相对应、与数据无线承载标识(data radio bearer identity，DRB ID)相对应的。
MN可在PDU会话建立完成后发起双连接流程，也可在PDU会话建立过程中发起双连接流程。若MN在PDU会话建立完成后发起双连接流程，则步骤S401可在PDU会话建立完成后执行；若MN在PDU会话建立过程中发起双连接流程，则SMF通过AMF向MN发送PDU会话建立完成消息，MN在接收到来自UE的RRC连接重配置响应时，向UE发送PDU会话建立完成消息。
MN可通过接收来自SMF的PDU会话建立完成消息获取第一用户面安全策略，即将PDU会话建立完成消息所携带的用户面安全策略作为第一用户面安全策略。
MN也可以通过AMF向SMF发送获取会话相关的签约信息的请求，SMF在接收到该请求时向UDM请求获取会话相关的签约信息，SMF在接收到UDM的响应并且会话相关的签约信息中包含有用户面安全策略的情况下，SMF可以从会话相关的签约信息获取用户面安全策略。或SMF从SMF的本地配置信息中获取用户面安全策略。然后SMF通过AMF向MN发送获取的用户面安全策略。MN在接收到该用户面安全策略时，将该用户面安全策略作为第一用户面安全策略。
MN在基站切换过程中作为目标基站时，可将源基站发送的或AMF发送的用户面安全策略作为第一用户面安全策略。
可选地，步骤S401之后还包括步骤S402，MN生成第二用户面安全策略。
其中，第二用户面安全策略为映射的用户面安全策略。
进一步地，第二用户面安全策略不包含偏好开启的情况。即用户面加密保护指示信息是“required”或“not needed”、用户面加密保护是“required”或“not needed”。
MN可根据第一用户面安全策略，参考SN的能力和UE当前状态信息等内容生成第二用户面安全策略。其中，SN的能力可以包括SN是否支持开启用户面加密保护以及是否支持开启用户面完整性保护；SN的资源；SN的配置信息和SN支持的安全算法等中的一种或多种。SN的配置信息，例如SN为ng-eNB时，其配置信息为固定配置的用户面安全保护方法，例如所配置的用户面安全保护方法为用户面加密保护开，用户面完整性保护关。SN支持的安全算法包括SN支持的加密算法和完整性保护算法，SN支持的安全算法视SN所属通信系统的不同而有所不同，例如SN为ng-eNB时所支持的安全算法与SN为gNB时 所支持的安全算法有所不同，或者SN为ng-eNB时所支持的安全算法与SN为gNB时所支持的安全算法相同，但是代表算法的标识符不同。例如ng-eNB只识别以字母“E”开头的算法，比如EIA1，EEA1等；gNB只识别以字母“N”开头的算法，比如NIA1，NEA1等。其中，虽然EEA1和NEA1是不同的标识符，但是其代表的具体的安全算法是相同的。NEA1和EEA1都代表基于SNOW 3G的安全算法。UE当前状态信息可以包括UE当前的速率情况、UE的电量和UE的能力受限信息等信息中的一个或多个。UE的能力受限信息用于指示UE是一个能力是受限的UE(例如物联网设备)还是一个能力不受限的UE。
在MN或SN生成映射的用户面安全策略时，生成映射的用户面安全策略的基站需要综合考虑MN的配置、MN当前的状态、SN的配置、SN当前的状态、UE当前状态信息等信息中的一个或多个。其中，MN/SN的配置是MN/SN支持哪种用户面安全保护方法，MN/SN当前的状态是指MN/SN当前的资源使用情况，MN/SN可以根据当前资源使用情况决定是否激活某种偏好激活的用户面安全保护，UE当前状态信息可以包括UE当前的速率情况、UE的电量和UE的能力受限信息等信息中的一个或多个。UE的能力受限信息用于指示UE是一个能力是受限的UE(例如物联网设备)还是一个能力不受限的UE。
MN生成映射的用户面安全策略的具体方法可以为：
在SN为ng-eNB，MN为gNB的情况下，MN可通过如下几种方式生成第二用户面安全策略：
方式一，MN在获知SN(ng-eNB)所配置的用户面安全保护方法的情况下，可结合第一用户面安全策略和SN(ng-eNB)所配置的用户面安全保护方法生成第二用户面安全策略。
其中，SN(ng-eNB)所配置的用户面安全保护方法可以是固定地配置在SN(ng-eNB)上的，即SN(ng-eNB)只能采用所配置的用户面安全保护方法，SN(ng-eNB)所配置的用户面安全保护方法也可以配置在MN上，以便MN可以获知SN(ng-eNB)所配置的用户面安全保护方法，MN也可以通过其他方式获知SN(ng-eNB)所配置的用户面安全保护方法，例如SN(ng-eNB)主动将其所配置的用户面安全保护方式告知MN。
举例来说，SN(ng-eNB)所配置的用户面安全保护方法可以是开启用户面加密保护，关闭用户面完整性保护，MN结合第一用户面安全策略和SN(ng-eNB)所配置的用户面安全保护方法生成第二用户面安全策略具体可包括：A，若第一用户面安全策略所包括的用户面完整性保护指示信息为“preferred”，则生成的第二用户面安全策略所包括的用户面完整性保护指示信息为“not needed”；若第一用户面安全策略所包括的用户面完整性保护指示信息为“not needed”，则生成的第二用户面安全策略所包括的用户面完整性保护指示信息依然为“not needed”；B，若第一用户面安全策略所包括的用户面加密保护指示信息为“preferred”，则生成的第二用户面安全策略所包括的用户面加密保护指示信息为“required”；若第一用户面安全策略所包括的用户面加密保护指示信息为“required”，则生成的第二用户面安全策略所包括的用户面加密保护指示信息依然为“required”。其中，MN所生成的第二用户面安全策略是按照SN(ng-eNB)所配置的用户面安全保护方法为开启用户面加密保护，关闭用户面完整性保护得到的，若SN(ng-eNB)所配置的用户面安全保护方法为其它类型，则MN所生成的第二用户面安全策略也会有所变化，具体视SN(ng-eNB)所配置的用户面安全保护方法而定。
可以理解的是，MN在获知SN(ng-eNB)所配置的用户面安全保护方法的情况下，所生成第二用户面安全策略与SN(ng-eNB)所配置的用户面安全保护方法相对应，即所生成第二用户面安全策略与SN所配置的用户面安全保护方法对应的用户面安全策略相同。
方式二，MN在未获知SN(ng-eNB)所配置的用户面安全保护方法的情况下，可根据第一用户面安全策略，结合运营商的要求或网络部署的需求，以及UE当前状态信息生成第二用户面安全策略，此时MN所生成第二用户面安全策略可以与SN(ng-eNB)所配置的用户面安全保护方法相对应。
方式三，MN可根据SN是否支持开启用户面加密保护以及是否支持开启用户面完整性保护，结合第一用户面安全策略生成第二用户面安全策略。例如，SN(ng-eNB)不支持开启用户面完整性保护，则生成的第二用户面安全策略中的用户面完整性保护指示信息为“not needed”。
方式四，MN可根据SN是否支持开启用户面加密保护以及是否支持开启用户面完整性保护，以及MN的配置信息，结合第一用户面安全策略生成第二用户面安全策略。例如，SN(ng-eNB)不支持开启用户面完整性保护，则生成的第二用户面安全策略中的用户面完整性保护指示信息为“not needed”；SN(ng-eNB)的加密保护既支持开启又支持关闭，则MN根据MN的配置信息、UE的资源情况等内容确定用户面加密保护指示为“required”或“not needed”。
可以理解的是，若MN生成第二用户面安全策略，则MN需要先根据原始的用户面安全策略并结合MN的配置、MN当前的状态、SN的配置、SN当前的状态、UE的当前状态信息等信息中的一个或多个内容确定用户面安全保护方法。该用户面安全保护方法可以进一步转变成用户面安全开启类型指示信息。MN可以在获得用户面安全开启类型指示信息后，将用户面安全开启类型指示信息的内容转换成第二用户面安全策略；也可以直接将用户面安全开启类型指示信息作为第二用户面安全策略，此时可以理解为第二用户面安全策略就是用户面安全开启类型指示信息。
在SN为gNB，MN为ng-eNB的情况下，MN(ng-eNB)可通过如下几种方式生成第二用户面安全策略：
方式一，MN(ng-eNB)在获知其用户面安全保护方法的情况下，结合其用户面安全保护方法和第一用户面安全策略生成第二用户面安全策略。由于MN是ng-eNB，MN很清楚其用户面安全保护方法是什么，因此MN可直接结合其用户面安全保护方法和第一用户面安全策略生成第二用户面安全策略。例如，若MN的用户面加密保护可以动态开启并且MN不支持用户面完整性保护，则MN可以根据MN配置、MN当前资源使用情况、UE当前状态信息等信息确定用户面加密保护为“required”或者“not needed”，因为MN不支持用户面完整性保护，因此用户面完整性保护为“not needed”。具体生成方法还可参考SN为ng-eNB，MN为gNB的情况下，MN生成第二用户面安全策略的方式一。
其中，UE当前状态信息可以包括UE当前的速率情况、UE的电量和UE的能力受限信息等信息中的一个或多个。UE的能力受限信息用于指示UE是一个能力是受限的UE(例如物联网设备)还是一个能力不受限的UE。
方式二，MN(ng-eNB)上固定配置有用户面安全保护方法，MN(ng-eNB)可结合其 所配置的用户面安全保护方法和第一用户面安全策略生成第二用户面安全策略。在此方式下，生成的第二用户面安全策略也是固定的。具体生成方法可参考SN为ng-eNB，MN为gNB的情况下，MN生成第二用户面安全策略的方式一。
方式三，MN(ng-eNB)可根据第一用户面安全策略，结合运营商的要求或网络部署的需求以及UE当前状态信息生成第二用户面安全策略。
方式四，MN(ng-eNB)根据第一用户面安全策略所包括的用户面加密保护指示信息动态决定是否开启用户面加密保护，例如MN(ng-eNB)始终不开启用户面加密保护。在此方式下，第二用户面安全策略所包括的用户面加密保护指示信息可以与第一用户面安全策略所包括的用户面加密保护指示信息一样；第二用户面安全策略所包括的用户面完整性保护指示信息不可以是“required”。
方式五，MN(ng-eNB)可根据SN(gNB)的是否支持开启用户面加密保护以及是否支持开启用户面完整性保护，结合第一用户面安全策略生成第二用户面安全策略。例如，SN(gNB)不支持开启用户面完整性保护，则生成的第二用户面安全策略中的用户面完整性保护指示信息为“not needed”。
MN在生成了第二用户面安全策略的情况下，可根据第二用户面安全策略确定MN与UE之间的用户面安全保护方法。
MN在决定用户面安全终结点在SN上的情况下，MN不需要激活MN与UE之间的用户面安全保护方法。
可选地，在MN决定安全终结点是否可以在SN之前，MN可根据第一信息判断是否可以将用户面安全终结点放在SN上。其中，第一信息可以是MN本地配置的信息，也可以是第一用户面安全策略。例如，SN为ng-eNB，MN为gNB，第一用户面安全策略所包括的用户面完整性保护指示信息为“required”，则MN只能将用户面安全终结点放在MN上(即不将MN的PDU会话分流至SN上)，进而可判断出用户面安全终结点在MN上。除了这种情况，用户面安全终结点都可以在SN上。即若第一用户面安全策略所包括的用户面完整性保护指示信息不为“required”，则MN可确定将用户面安全终结点放在SN上，进而可判断出用户面安全终结点在SN上，适用于SN为gNB或SN为ng-eNB的场景。
进一步地，因为同一个PDU会话的用户面安全策略在PDU存活期内是不可以改变的，同时在双连接场景下对于同一个PDU会话的用户面安全终结点可以灵活的一会放在MN，一会放在SN，因此MN或SN在生成映射的用户面安全策略的时候，需要考虑另一个基站的能力。例如，如果其中一个是ng-eNB，ng-eNB不可以开启完整性保护，则映射的用户面安全策略中的完整性保护必须是关闭的，即不可以被激活的。
在双连接场景中，两个基站协同为一个UE提供服务，UE的同一PDU会话的用户面安全策略保持不变，因此MN与UE之间的用户面安全保护方法与SN与UE之间的用户面安全保护方法相同。因此映射的用户面安全策略可以由MN生成也可以由SN生成。但需要注意的是，当用户面安全终结点在SN上的时候，MN只生成映射的用户面安全策略，不需要激活MN与UE之间的用户面安全保护方法。当用户面安全终结点在SN上的时候，并且映射的用户面安全策略由SN决定的时候，SN既要生成映射的用户面安全策略，又要激活UE与SN之间的用户面安全保护方法。此时MN只需要将原始的安全策略传递给SN 即可。
步骤S403，MN向SN发送第一消息，该第一消息包括用户面安全策略和UE的安全能力。相应地，SN接收来自MN的第一消息。
其中，第一消息可以是SN添加请求(SN addition request)，例如初始将无线承载分流至SN时，第一消息为SN添加请求。第一消息也可以是SN修改请求(SN modification request)。
其中，UE的安全能力包括UE在LTE系统中所支持的安全算法和/或在5G系统中所支持的安全算法。具体地，UE的安全能力以标识符的形式在接入网和核心网之间传递。UE的安全能力指的是UE支持哪些加密算法和哪些完整性保护算法。第一消息携带UE的安全能力，以便SN根据其是哪种系统下的基站从UE的安全能力中选择SN与UE之间的将要使用的安全算法，例如SN为gNB，SN便根据UE在5G系统中所支持的安全算法，即SN在以“N”开头的标识符所代表的算法中进行选择。再例如SN为ng-eNB，SN根据UE在LTE系统中所支持的安全算法选择SN与UE之间的安全算法，即SN在以“E”开头的标识符所代表的算法中进行选择。
在MN未执行步骤S402的情况下，第一消息所携带的用户面安全策略为第一用户面安全策略。该第一消息还包括第一用户面安全策略对应的用户面信息，该用户面信息可以包括PDU会话标识，即UE请求建立的PDU会话的标识。该用户面信息可以使UE知道从MN和SN收到的用户面数据是同一个会话的，即MN和SN可能直接使用用户面信息或者对用户面信息进行转换、处理后使用，使得UE可以关联两个基站发送的用户面数据。可选地，该用户面信息还可以包括网络切片标识、服务质量流标识(quality of service flow identity，QFI)、5QI、DRB ID等中的一种或多种。
在MN执行了步骤S402的情况下，该第一消息所携带的用户面安全策略为第二用户面安全策略，以便SN根据第二用户面安全策略激活SN与UE之间的用户面安全保护方法。该第一消息还包括第二用户面安全策略对应的用户面信息，该用户面信息包括PDU会话标识，还包括网络切片标识、QFI、5QI、DRB ID等中的一种或多种。
可选地，该第一消息还包括Ksn，该Ksn由MN使用Kmn计算得到。Ksn是SN与UE之间的根密钥，SN和UE可根据Ksn生成UE与SN之间的保护用户面数据的密钥，例如用户面加密密钥和用户面完整性保护密钥。在SN与UE之间可以存在信令面路径的情况下，SN还可根据Ksn生成UE与SN之间的保护信令面的密钥。保护信令面的密钥，例如RRC信令面的完整性密钥和RRC信令面的加密密钥。
可选地，该第一消息还包括标识信息，该标识信息用于指示第一消息所携带的用户面安全策略是第一用户面安全策略还是第二用户面安全策略。例如，该标识信息可采用一个比特位来指示，例如“0”指示该用户面安全策略为第一用户面安全策略，“1”指示该用户面安全策略为第二用户面安全策略。该比特位可以是在第一用户面安全策略或第二用户面安全策略的比特长度上增加的一比特位，也可以是独立于第一用户面安全策略或第二用户面安全策略的一比特位。
步骤S404，SN确定SN与UE之间的用户面安全保护方法。
SN确定SN与UE之间的用户面安全保护方法，即SN可以采用SN与UE之间的用户 面安全保护方法对用户面数据进行安全保护。例如，SN与UE之间的用户面安全保护方法为开启用户面加密保护，不开启用户面完整性保护，那么SN可以对用户面数据开启用户面加密保护，不开启用户面完整性保护。
在SN为ng-eNB，MN为gNB的情况下，SN(ng-eNB)配置了用户面安全保护方法，SN可直接将所配置的用户面安全保护方法确定为SN与UE之间的用户面安全保护方法。此时，SN可不在乎第一消息携带的是第一用户面安全策略还是第二用户面安全策略。
在第一消息包括第一用户面安全策略的情况下，SN可根据第一用户面安全策略，确定SN与UE之间的用户面安全保护方法。
在一种可能的实现方式中，SN根据第一用户面安全策略所包括的用户面加密保护指示信息，确定用户面加密保护的开启方法。具体地，若用户面加密保护指示信息为“required”，则SN开启SN与UE之间的用户面加密保护；若用户面加密保护指示信息为“not needed”，则SN不开启SN与UE之间的用户面加密保护；若用户面加密保护指示信息为“preferred”，则SN根据某些条件判断是否开启SN与UE之间的用户面加密保护，例如在SN资源充足的情况下，SN可以开启SN与UE之间的用户面加密保护。SN根据其所配置的用户面安全保护方法中的用户面完整性保护方法确定SN与UE之间的用户面完整性保护的开启方法，即将SN所配置的用户面完整性保护方法确定为SN与UE之间的用户面完整性保护的开启方法，例如，SN所配置的用户面完整性保护方法为不开启用户面完整性保护，那么SN不开启SN与UE之间的用户面完整性保护。或者，SN在不支持用户面完整性保护的情况下，直接将SN与UE之间的用户面完整性保护设置为不开启。
在一种可能的实现方式中，SN根据第一用户面安全策略所包括的用户面完整性保护指示信息，确定完整性保护的开启方法。具体地，若用户面完整性保护指示信息是“preferred”，则SN根据某些条件判断是否开启SN与UE之间的用户面完整性保护，例如在SN不支持用户面完整性保护的情况下，则不开启SN与UE之间的用户面完整性保护；再例如，在UE的安全能力可以支持开启用户面完整性保护，并且SN支持用户面完整性保护的情况下，SN开启用户面完整性保护；若用户面完整性保护指示信息是“not needed”，则SN不开启SN与UE之间的用户面完整性保护。SN根据其所配置的用户面安全保护方法中的用户面加密保护方法确定并激活SN与UE之间的用户面加密保护的开启方法，即将SN所配置的用户面加密保护方法确定为SN与UE之间的用户面加密保护的开启方法，例如，SN所配置的用户面加密保护方法为开启用户面加密保护，那么SN开启SN与UE之间的用户面加密保护。
在第一消息只包括第一用户面安全策略的情况下，SN结合第一用户面安全策略和MN的能力生成第三用户面安全策略，并根据第三用户面安全策略确定SN与UE之间的用户面安全保护方法。第三用户面安全策略为SN生成的映射的用户面安全策略。SN结合第一用户面安全策略和MN的能力生成第三用户面安全策略，与MN结合第一用户面安全策略和SN的能力生成第三用户面安全策略类似。SN根据第三用户面安全策略确定SN与UE之间的用户面安全保护方法，即SN根据第三用户面安全策略所包括的用户面加密保护指示信息确定是否开启用户面加密保护，所包括的用户面完整性保护指示信息确定是否开启用户面完整性保护。
若MN为ng-eNB，则SN可结合第一用户面安全策略和MN(ng-eNB)所配置的用户面安全保护方法来生成第三用户面安全策略，进而根据第三用户面安全策略确定SN与UE之间的用户面安全保护方法。
在第一消息包括第二用户面安全策略的情况下，SN根据第二用户面安全策略确定SN与UE之间的用户面安全保护方法，即SN根据第二用户面安全策略所包括的用户面加密保护指示信息确定是否开启用户面加密保护，所包括的用户面完整性保护指示信息确定是否开启用户面完整性保护。若第二用户面安全策略就是用户面安全开启类型指示信息，那么SN直接根据用户面安全开启类型指示信息确定用户面安全保护方法。
在一种可能的实现方式中，SN根据第一用户面安全策略所包括的用户面加密保护指示信息，确定用户面加密保护的开启方法。具体地，若用户面加密保护指示信息为“required”，则SN开启SN与UE之间的用户面加密保护；若用户面加密保护指示信息为“not needed”，则SN不开启SN与UE之间的用户面加密保护；
在一种可能的实现方式中，SN根据第一用户面安全策略所包括的用户面完整性保护指示信息，确定完整性保护的开启方法。具体地，若用户面完整性保护指示信息是“not needed”，则SN不开启SN与UE之间的用户面完整性保护。SN根据其所配置的用户面安全保护方法中的用户面加密保护方法确定并激活SN与UE之间的用户面加密保护的开启方法，即将SN所配置的用户面加密保护方法确定为SN与UE之间的用户面加密保护的开启方法，例如，SN所配置的用户面加密保护方法为开启用户面加密保护，那么SN开启SN与UE之间的用户面加密保护。
步骤S405，SN选择SN与UE之间的安全算法。
SN可根据第一消息所携带的UE的安全能力选择SN与UE之间的安全算法。例如，SN为gNB，则SN可根据UE在5G系统中所支持的安全算法选择SN与UE之间的安全算法。
在一种可能的实现方式中，步骤S405在步骤S404之后执行，即SN先确定SN与UE之间的用户面安全保护方法，再选择SN与UE之间的安全算法，那么此时SN只需要选择用户面使用的安全算法，信令面使用的安全算法则需要重新选择。这种情况下，信令面安全算法和用户面安全算法使用的算法可以相同，也可以不相同。相同的具体含义是，如果用户面加密保护开启，则使用的用户面安全算法和使用的信令面安全算法相同；如果用户面完整性保护开启，则用户面使用的完整性算法和信令面使用的完整性算法相同。如果不相同，信令面使用的安全算法和用户面使用的安全算法有不一样的即不同，例如用户面加密算法使用加密算法A，信令面使用的加密算法为加密算法B，但是用户面和信令面都使用完整性算法C。
在一种可能的实现方式中，步骤S405在步骤S404之前执行，即SN先选择SN与UE之间的安全算法，再确定SN与UE之间的用户面安全保护方法。由于SN先选择SN与UE之间的安全算法，则选择出来的安全算法既用于信令面保护，又用于用户面保护。当SN确定出SN与UE之间的用户面安全保护方法后，则SN根据所确定的用户面安全保护方法，确定使用哪一个选择出来的安全算法用于用户面安全保护。例如，SN先选择了一个加密算法和一个完整性保护算法，之后SN确定的用户面安全保护方法为用户面加密开启，用户 面完整性保护不开启，则SN确定在用户面使用加密保护算法，不使用用户面完整性保护算法。
SN根据第一消息所携带的Ksn生成UE与SN之间的保护用户面数据的密钥。在SN与UE之间可以存在信令面路径的情况下，SN还可根据Ksn生成UE与SN之间的保护信令面的密钥。
SN在确定SN与UE之间的用户面安全保护方法、SN与UE之间的安全算法以及保护用户面数据的密钥的情况下，激活SN与UE之间的用户面安全保护方法。即SN可以使用SN与UE之间的用户面安全保护方法、SN与UE之间的安全算法以及保护用户面数据的密钥来对下行用户面数据进行安全保护，对上行用户面数据进行解安全保护。例如，确定的用户面安全保护方法为用户面加密保护开，用户面完整性保护关，用户面加密算法为加密算法A，用户面加密密钥为密钥K，则对于下行用户面数据，采用加密算法A和密钥K对该下行用户面数据进行用户面加密保护。
步骤S406，SN向MN发送第二消息，该第二消息包括用户面安全开启类型指示信息和SN选择的SN与UE之间的安全算法。相应地，MN接收来自SN的第二消息。
其中，第二消息用于响应第一消息，可以是SN添加响应，也可以是SN修改响应。即若第一消息为SN添加请求，则第二消息为SN添加响应。
其中，用户面安全开启类型指示信息用于指示SN所激活的SN与UE之间的用户面安全保护方法。用户面安全开启类型指示信息可以采用2比特位来指示，1个比特位指示加密保护是开启还是不开启，另外一个比特位指示完整性保护开启还是不开启。例如，第一个比特位为“1”时指示用户面加密保护开启，第二个比特位为“1”时指示用户面完整性保护开启，假设SN所确定的SN与UE之间的用户面安全保护方法为用户面加密保护开启，用户面完整性保护不开启，那么此时用户面安全开启类型指示信息可表示为“10”。第二消息中携带用户面安全开启类型指示信息，以便MN将其携带在RRC连接重配置响应中发送至UE，从而便于UE获知与SN之间的用户面安全保护方法。
在SN生成了第三用户面安全策略的情况下，SN向MN发送该第三用户面安全策略，SN根据该第三用户面安全策略确定了SN与UE之间的用户面安全保护方法，换言之，该第三用户面安全策略可以指示SN与UE之间的用户面安全保护方法，可以是SN自己确定的映射的用户面安全策略。SN向MN发送第三用户面安全策略，以便MN获知SN与UE之间的用户面安全保护方法。该第三用户面安全策略可独立于第二消息，不在同一消息中发送至MN，即第三用户面安全策略不携带在第二消息中。
若第二用户面安全策略就是用户面安全开启类型指示信息，那么SN直接根据用户面安全开启类型指示信息确定用户面安全保护方法。
可选地，MN在获知SN与UE之间的用户面安全保护方法的情况下，可确定MN与UE之间的用户面安全保护方法，与SN与UE之间的用户面安全保护方法相同。假设SN与UE之间的用户面安全保护方法为用户面加密保护开，用户面完整性保护开，但是MN不支持开启用户面完整性保护，则MN与UE之间的用户面安全保护方法为用户面加密保护开，用户面完整性保护关。换言之，最终确定的用户面安全保护方法视具体情况而定。
可选地，步骤S406之后，还包括步骤S407，UE与MN进行接入层(access stratum， AS)安全模式命令(security mode command，SMC)流程。
需要说明的是，步骤S407并不一定在步骤S406之后执行，可以在双连接流程之前执行，即在需要激活UE和MN之间的信令面安全的时候执行。
AS SMC包括MN选择的MN与UE之间的安全算法，该安全算法可以包括信令面安全算法和用户面安全算法，信令面安全算法与用户面安全算法可以相同，也可以不相同。如果相同，则传递的选择的安全算法既用于控制面又用于用户面。MN在确定MN与UE之间的用户面安全保护方法的情况下，可根据信令面使用的安全算法确定出用户面安全算法。
可选地，步骤S406之后，还包括步骤S408和步骤S409。
步骤S409a，MN向AMF或SMF发送第五消息，该第五消息包括第四用户面安全策略。相应地，AMF或SMF接收来自MN的第五消息。
需要理解的是，如果MN发送第五消息给SMF，则第五消息的中的内容需要经过AMF转发给SMF。
其中，第五消息可以是安全结果(security result)消息。此消息用于告知AMF或SMF用户面安全开启结果。
在MN接收到第三用户面安全策略的情况下，安全结果消息所包括的第四用户面安全策略即为第三用户面安全策略，该第三用户面安全策略可以指示SN与UE之间的用户面安全保护方法。
在MN未接收到第二用户面安全策略的情况下，MN可根据SN与UE之间的用户面安全保护方法生成一个用户面安全策略，将其作为第四用户面安全策略，该第四用户面安全策略可以指示SN与UE之间的用户面安全保护方法。
第五消息所包括的第四用户面安全策略也可以是MN生成的映射的用户面安全策略，该映射的用户面安全策略可以指示SN与UE之间的用户面安全保护方法。
第五消息还包括第四用户面安全策略对应的用户面信息，该用户面信息可包括PDU会话标识，还包括网络切片标识、QFI、5QI、DRB ID等中的一种或多种。
步骤S409，AMF向MN发送第六消息。相应地，MN接收来自AMF的第六消息。
其中，第六消息用于响应第五消息，第六消息可以是安全结果(security result)响应消息，用于告知MN，AMF或SMF接收到安全结果消息。
步骤S410，MN向UE发送第三消息，该第三消息包括SN确定的安全算法和用户面安全开启类型指示信息。相应地，UE接收来自MN的第三消息。
其中，第三消息可以是RRC连接重配置请求。
其中，用户面安全开启类型指示信息用于指示SN所激活的SN与UE之间的用户面安全保护方法。
可选地，第三消息还包括SN计数器，SN计数器用于UE生成Ksn，该Ksn与MN计算得到的Ksn相同，进而UE可以根据该Ksn生成保护用户面数据的密钥，由于该Ksn与MN计算得到的Ksn相同，因此UE生成的保护用户面数据的密钥与SN生成的保护用户面数据的密钥相同，以便UE与SN采用相同的密钥对用户面数据进行保护。在SN与UE之间可以存在信令面路径的情况下，UE还可以根据该Ksn生成保护信令面的密钥，与SN生 成的保护信令面的密钥相同。
步骤S411，UE使用SN确定的安全算法，激活与SN之间的用户面安全保护方法。
UE在接收到第三消息的情况下，可获知SN选择的SN与UE之间的安全算法，UE使用该安全算法对上行用户面数据进行安全保护。
UE在接收到第三消息的情况下，可获知SN与UE之间的用户面安全保护方法，UE激活UE与SN之间的用户面安全保护方法，即根据该用户面安全保护方法对与SN之间的用户面数据进行保护。此时，UE不激活与MN之间的用户面安全保护方法。
在第三消息包括SN计数器的情况下，UE根据SN计数器生成Ksn，该Ksn与MN计算得到的Ksn相同，进而UE可以根据该Ksn生成保护用户面数据的密钥，由于该Ksn与MN计算得到的Ksn相同，因此UE生成的保护用户面数据的密钥与SN生成的保护用户面数据的密钥相同，以便UE与SN采用相同的密钥对用户面数据进行保护。在SN与UE之间可以存在信令面路径的情况下，UE还可以根据该Ksn生成保护信令面的密钥，与SN生成的保护信令面的密钥相同。
步骤S412，UE向MN发送第四消息。相应地，MN接收来自UE的第四消息。
其中，第四消息可以是RRC连接重配置响应，RRC连接重配置响应用于响应RRC连接重配置请求。
UE根据UE与SN之间的用户面安全保护方法对上行用户面数据进行安全保护，可包括UE使用UE与SN之间的用户面安全保护方法、UE与SN之间的安全算法以及保护用户面数据的密钥对上行用户面数据进行安全保护。UE根据UE与SN之间的用户面安全保护方法对上行用户面数据进行解安全保护。进行安全保护是指进行加密保护和/或进行完整性保护。解安全保护是指解密和/或验证完整性保护。
步骤S413，UE向MN发送根据UE与SN之间的用户面安全保护方法进行安全保护的第一上行用户面数据。相应地，MN接收来自UE的第一上行用户面数据。
UE使用SN激活的用户面安全保护方法、SN选择的安全算法以及生成的保护用户面数据的密钥对上行用户面数据进行安全保护，并向MN发送安全保护后第一上行用户面数据。
例如，SN激活的用户面安全保护方法为用户面加密保护开启，用户面完整性保护关闭，SN确定的安全算法为使用用户面加密保护算法A，不使用用户面完整性保护算法，则UE使用用户面加密保护算法A和生成的保护用户面数据的密钥对上行用户面数据进行加密保护，向MN发送使用加密保护算法A和该密钥加密的上行用户面数据，并不对加密保护的上行用户面数据进行完整性保护。
步骤S414，MN向SN发送根据UE与SN之间的用户面安全保护方法进行安全保护的第一上行用户面数据。相应地，SN接收来自MN的第一上行用户面数据。
MN转发UE收到的安全保护后的第一上行用户面数据给SN。
在步骤S413和步骤S414中，MN根据SN与UE之间的用户面安全保护方法将UE发送的上行用户面数据转发至SN，即MN透传UE安全保护后的上行用户面数据。由于UE只激活了与SN之间的用户面安全保护方法，并且UE根据UE与SN之间的用户面安全保护方法向MN发送上行用户面数据，因此MN在接收到该上行用户面数据时，只能将其转 发至SN。
由于用户面安全终结点在SN，所以MN不做任何安全操作，直接将收到的数据转发给SN。
步骤S415，UE向SN发送根据UE与SN之间的用户面安全保护方法进行安全保护的第二上行用户面数据。相应地，SN接收来自UE的第二上行用户面数据。
UE使用SN激活的用户面安全保护方法、SN选择的安全算法以及生成的保护用户面数据的密钥对上行用户面数据进行安全保护，并向SN发送安全保护后的第二上行用户面数据。
步骤S416，SN对上行用户面数据进行解安全保护。
SN在接收到MN转发的上行用户面数据时，根据SN激活的用户面安全保护方法对该上行用户面数据进行解安全保护，包括根据SN激活的用户面安全保护方法对该上行用户面数据进行完整性保护验证，根据SN选择的安全算法和生成的保护用户面数据的密钥对该上行用户面数据进行解密。
SN在接收到来自UE的上行用户面数据时，根据SN激活的用户面安全保护方法对该上行用户面数据进行解安全保护验，包括根据SN激活的用户面安全保护方法对该上行用户面数据进行完整性保护验证，根据SN选择的安全算法和生成的保护用户面数据的密钥对该上行用户面数据进行解密。
若UE发出的上行用户面数据是先加密保护，再完整性保护，则SN在接收到上行用户面数据时先完整性保护验证，再解密。若UE发出的上行用户面数据是先完整性保护，再加密保护，则SN在接收到上行用户面数据时先解密，再完整性保护验证。
步骤S417，SN向UPF发送解安全保护后的上行用户面数据。
SN向UPF发送解密和完整性保护验证后的上行用户面数据，以便UPF将该上行用户面数据发送至相应的数据网络。
步骤S413-步骤S417是针对上行用户面数据的安全保护，对于下行用户面数据，SN接收来自UPF的下行用户面数据，使用SN与UE之间的用户面安全保护方法、SN与UE之间的安全算法以及生成的保护用户面数据的密钥对下行用户面数据进行安全保护，一路直接向UE发送安全保护后的下行用户面数据；另一路通过MN向UE发送安全保护后的下行用户面数据，UE在接收到安全保护后的下行用户面数据时根据UE与SN之间的用户面安全保护方法对下行用户面数据进行解安全保护，以便UE获取下行用户面数据。
在图4所示的实施例中，MN判断出用户面安全终结点在SN上，SN激活其与UE之间的用户面安全保护方法和安全算法，并将其通知至MN，由MN告知UE，SN激活的用户面安全保护方法和SN选择的安全算法，进而UE可根据该用户面安全保护方法和该安全算法对上行用户面数据进行安全保护，实现UE与SN之间的用户面安全保护，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。
作为一种可选的实施例，若SN为gNB，SN与UE之间可以存在信令面路径的情况下，SN在确定其与UE之间的用户面安全保护方法和安全算法的情况下，可直接通过RRC连接重配置消息向UE发送用户面安全开启类型指示信息和SN选择的安全算法。UE在接收到来自SN的RRC连接重配置消息的情况下，根据SN激活的用户面安全保护方法和选择 的安全算法对上行用户面数据进行安全保护，向SN发送上行用户面数据。
以本申请实施例应用于图3b所示的双连接网络架构示意图为例，如图5所示，为本申请实施例二提供的双连接通信方法的流程示意图，在该实施例中，用户终端以UE为例，接入管理网元以AMF为例，会话管理网元以SMF为例，用户面网元以UPF为例进行介绍。该方法可以包括但不限于如下步骤：
步骤S501，MN获取第一用户面安全策略。
步骤S501的实现过程可参见图4所示实施例中步骤S401的具体描述，在此不再赘述。
步骤S502，若用户面安全终结点在MN上，则MN不需要为SN生成Ksn。
在用户面安全终结点在MN上的情况下，由MN对用户面数据进行安全保护，此时MN不需要为SN生成Ksn，即不需要使用Kmn计算得到Ksn。
若MN为ng-eNB，ng-eNB上可固定配置有用户面安全保护方法，则MN可将其所配置的用户面安全保护方法确定并激活MN与UE之间的用户面安全保护方法。
可选地，步骤S502之后，还包括步骤S503，MN生成第二用户面安全策略。
步骤S503的实现过程可参见图4所示实施例中步骤S402的具体描述，在此不再赘述。
MN可根据生成的第二用户面安全策略确定MN与UE之间的用户面安全保护方法，可与图4所示实施例中SN根据生成的第二用户面安全策略确定SN与UE之间的用户面安全保护方法类似。MN在确定MN与UE之间的用户面安全保护方法的情况下，激活MN与UE之间的用户面安全保护方法。
步骤S504，MN向SN发送第一消息。相应地，SN接收来自MN的第一消息。
与步骤S403不同之处在于，步骤S504中第一消息不携带任何用户面安全策略，由于MN不生成Ksn，那么第一消息也不携带Ksn。步骤S504中的第一消息可携带PDU会话标识，还可以携带其他用户面信息，例如DRB标识等。
步骤S505，SN向MN发送第二消息。相应地，MN接收来自SN的第二消息。
可选地，步骤S505之后，还包括步骤S506，UE与MN进行AS SMC流程。
步骤S506的实现过程可参见图4所示实施例中步骤S407的具体描述，在此不再赘述。
可选地，步骤S505之后，还包括步骤S507和步骤S508。
步骤S507，MN向AMF发送第五消息，该第五消息包括第三用户面安全策略。相应地，AMF接收来自MN的第五消息。
其中，第五消息可以是安全结果消息。
在MN生成了第二用户面安全策略的情况下，安全结果消息所携带的第三用户面安全策略即为MN生成的第二用户面安全策略。在MN未生成第二用户面安全策略的情况下，N2请求所携带的第三用户面安全策略即为获取的第一用户面安全策略。
步骤S508，AMF向MN发送第六消息。相应地，MN接收来自AMF的第六消息。
步骤S509，MN向UE发送第三消息，该第三消息求包括用户面安全开启类型指示信息。相应地，UE接收来自MN的第三消息。
其中，第三消息可以是RRC连接重配置请求。
其中，用户面安全开启类型指示信息用于指示MN激活的MN与UE之间的用户面安 全保护方法。
步骤S510，UE确定安全算法，激活UE与MN之间的用户面安全保护方法。
UE可从AS SMC中获知MN与UE之间的安全算法。
UE在接收到第三消息的情况下，可获知MN与UE之间的用户面安全保护方法，UE激活与MN之间的用户面安全保护方法，即根据用户面安全保护方法对与MN之间的用户面数据进行安全保护。此时，UE不激活与SN之间的用户面安全保护方法。
步骤S511，UE向MN发送第四消息。相应地，MN接收来自UE的第四消息。
UE根据UE与MN之间的用户面安全保护方法对上行用户面数据进行安全保护，可包括UE使用UE与MN之间的用户面安全保护方法、UE与MN之间的安全算法以及保护用户面数据的密钥对上行用户面数据进行安全保护。
步骤S512，UE向SN发送根据UE与MN之间的用户面安全保护方法进行安全保护的第一上行用户面数据。相应地，SN接收来自UE的第一上行用户面数据。
步骤S513，SN向MN发送根据UE与MN之间的用户面安全保护方法进行安全保护的第一上行用户面数据。相应地，MN接收来自SN的第一上行用户面数据。
在步骤S512和步骤S513中，SN根据MN与UE之间的用户面安全保护方法将UE发送的上行用户面数据转发至MN，即SN透传UE安全保护后的上行用户面数据。
步骤S514，UE向MN发送根据UE与MN之间的用户面安全保护方法进行安全保护的第二上行用户面数据。相应地，MN接收来自UE的第二上行用户面数据。
步骤S515，MN对上行用户面数据进行解安全保护。
步骤S516，MN向UPF发送解安全保护后的上行用户面数据。
在图5所示的实施例中，MN判断出用户面安全终结点在MN上，MN将MN与UE之间的用户面安全保护方法通知至MN，由MN告知UE，UE与MN之间的用户面安全保护方法，进而UE可根据该用户面安全保护方法对上行用户面数据进行安全保护，实现UE与MN之间的用户面安全保护，从而可以保证5G双连接场景下用户面数据传输的机密性和完整性。
上述详细阐述了本申请实施例的方法，下面提供了本申请实施例的装置。
请参见图6，是本申请实施例提供的双连接通信装置的逻辑结构示意图，该双连接通信装置60可以包括收发单元601和处理单元602。该双连接通信装置60可以是主基站，也可以是辅基站，还可以是用户终端。
针对该双连接通信装置60为主基站的情况：
收发单元601，用于向辅基站发送第一消息，该第一消息包括用户面安全策略，该用户面安全策略用于辅基站确定辅基站与用户终端之间的用户面安全保护方法；还用于接收来自辅基站的第二消息，该第二消息包括用户面安全开启类型指示信息，该用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；还用于向用户终端发送第三消息，该第三消息包括该用户面安全开启类型指示信息。该主基站还可以包括处理单元，用于生成第二用户面安全策略。
在一种可能的实现方式中，处理单元602，用于在辅基站不支持用户面完整性保护的情况下，确定用户面安全策略中的用户面完整性保护指示信息不是开启的。
在一种可能的实现方式中，处理单元602，还用于获取用户终端的第一用户面安全策略。
在一种可能的实现方式中，处理单元602，还用于根据用户终端的第一用户面安全策略生成第二用户面安全策略。
在一种可能的实现方式中，处理单元602，还用于根据第二用户面安全策略确定主基站与用户终端之间的用户面安全保护方法，在用户面安全终结点在辅基站的情况下，不激活主基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，收发单元601，还用于接收来自用户终端的上行用户面数据，该上行用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的数据，并向辅基站发送该上行用户面数据。
该双连接通信装置60为主基站时，除了可以实现图4所述方法实施例中MN的功能外，还能实现图5所示实施例中MN的功能，该双连接通信装置60中各个单元执行详细过程可以参见前述方法实施例中MN的执行步骤，此处不在赘述。
针对该双连接通信装置60为辅基站的情况：
收发单元601，用于接收来自主基站的第一消息，第一消息包括用户面安全策略；
处理单元602，根据用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法；
处理单元602，还用于激活辅基站与用户终端之间的用户面安全保护方法；
收发单元602，还用于向主基站发送第二消息，第二消息包括用户面安全开启类型指示信息，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，用户面安全策略为用户终端的第一用户面安全策略；处理单元601用于用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法时，具体用于根据第一用户面安全策略生成第三用户面安全策略，根据第三用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，用户面安全策略为主基站根据第一用户面安全策略生成的第二用户面安全策略；处理单元602用于用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法时，具体用于根据第二用户面安全策略确定辅基站与用户终端之间的用户面安全保护方法。
在一种可能的实现方式中，收发单元601，还用于分别接收来自主基站以及用户终端的第一上行用户面数据和第二上行用户面数据；其中，第一上行用户面数据和第二用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的用户面数据；处理单元602，还用于对第一上行用户面数据和第二用户面数据进行解安全保护，得到解安全保护后的用户面数据；收发单元601，还用于向用户面网元发送解安全保护后的用户面数据。
该双连接通信装置60为辅基站时，除了可以实现图4所述方法实施例中SN的功能外，还能实现图5所示实施例中SN的功能，该双连接通信装置60中各个单元执行详细过程可以参见前述方法实施例中SN的执行步骤，此处不在赘述。
针对该双连接通信装置60为用户终端的情况：
收发单元601，用于接收来自主基站的第三消息，第三消息包括用户面安全开启类型指示信息和辅基站选择的安全算法，用户面安全开启类型指示信息用于指示辅基站与用户终端之间的用户面安全保护方法；
处理单元602，用于根据用户面安全开启类型指示信息和辅基站选择的安全算法，激活与辅基站之间的用户面安全保护方法；
处理单元602，还用于根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
在一种可能的实现方式中，处理单元602用于根据用户终端与辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护时，具体用于控制收发单元601分别向辅基站以及主基站发送第一上行用户面数据和第二上行用户面数据；其中，第一上行用户面数据和第二用户面数据为用户终端根据用户终端与辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
该双连接通信装置60为用户终端时，除了可以实现图4所述方法实施例中UE的功能外，还能实现图5所示实施例中UE的功能，该双连接通信装置60中各个单元执行详细过程可以参见前述方法实施例中UE的执行步骤，此处不在赘述。
请参见图7，是本申请实施例提供的双连接通信装置的实体结构简化示意图。该双连接通信装置70可以是主基站，也可以是辅基站，还可以是用户终端。
该双连接通信装置70包括收发器701、处理器702和存储器703。收发器701、处理器702和存储器703可以通过总线704相互连接，也可以通过其它方式相连接。图6所示的收发单元601所实现的相关功能可以由收发器701来实现。图6所示的处理单元602所实现的相关功能可以通过一个或多个处理器702来实现。
存储器703包括但不限于是随机存储记忆体(random access memory，RAM)、只读存储器(read-only memory，ROM)、可擦除可编程只读存储器(erasable programmable read only memory，EPROM)、或便携式只读存储器(compact disc read-only memory，CD-ROM)，该存储器703用于相关指令及数据。
收发器701用于发送数据和/或信令，以及接收数据和/或信令。
若该双连通信装置70是图4和图5所示实施例中的MN，则收发器701可用于与UE、SN、AMF和UPF进行通信，例如执行图4所示实施例中的步骤S403、步骤S406、步骤S407、步骤S408、步骤S409、步骤S410、步骤S413和步骤S414；执行图5所示实施例中的步骤S504、步骤S505、步骤S506、步骤S507、步骤S508、步骤S509、步骤S511、步骤S513、步骤S514和步骤S516。需要说明的是，在用户面安全终结点在MN上的情况下，收发器701与UPF进行用户面数据传输。
若该通信装置70是图4和图5所示实施例中的SN，则收发器701可用于与MN、UE和UPF进行通信，例如执行图4所示实施例中的步骤S403、步骤S406、步骤S414、步骤S415和步骤S417；执行图5所示实施例中的步骤S504、步骤S505、步骤S512和步骤S513。需要说明的是，在用户面安全终结点在SN上的情况下，收发器701与UPF进行用户面数据传输。
若该通信装置70是图4和图5所示实施例中的UE，则收发器701可用于与MN和SN进行通信，例如执行图4所示实施例中的步骤S407、步骤S410、步骤S412、步骤S413和步骤S415；执行图5所示实施例中的步骤S506、步骤S509、步骤S511、步骤S512和步骤S514。
处理器702可以包括是一个或多个处理器，例如包括一个或多个中央处理器(central processing unit，CPU)，在处理器702是一个CPU的情况下，该CPU可以是单核CPU，也可以是多核CPU。
若该通信装置70是图4和图5所示实施例中的MN，则处理器702可用于执行控制MN的操作，例如执行图4所示实施例中的步骤S401和步骤S402；执行图5所示实施例中的步骤S501、步骤S502、步骤S503和步骤S515。
若该通信装置70是图4和图5所示实施例中的SN，则处理器702可用于执行控制SN的操作，例如执行图4所示实施例中的步骤S404、步骤S405和步骤S416。
若该通信装置70是图4和图5所示实施例中的UE，则处理器702可用于执行控制MN的操作，例如执行图4所示实施例中的步骤S411；执行图5所示实施例中的步骤S510。
存储器703用于存储双连接通信装置70的程序代码和数据。
关于处理器702和收发器701所执行的步骤，具体可参见图4和图5所示实施例的描述，在此不再赘述。
可以理解的是，图7仅仅示出了双连接通信装置的简化设计。在实际应用中，双连接通信装置还可以分别包含必要的其他元件，包含但不限于任意数量的收发器、处理器、控制器、存储器、通信单元等，而所有可以实现本申请的设备都在本申请的保护范围之内。
本申请实施例还提供一种双连接通信系统，可以包括主基站和辅基站，该主基站和该辅基站可以用于实现图4所示实施例中MN和SN的功能，还可以用于实现图5所示实施例中MN和SN的功能。
该双连接通信系统还可以包括用户终端，该用户终端可以用于实现图4所示实施例中UE的功能，还可以用于实现图5所示实施例中UE的功能。
该双连接通信系统还可以包括用户面网元，该用户面网元可用于与辅基站交互，接收来自辅基站的上行用户面数据以及向辅基站发送下行用户面数据，实现图4所示实施例中UPF的功能；该用户面网元可用于与主基站交互，接收来自主基站的上行用户面数据以及向主基站发送下行用户面数据，实现图5所示实施例中UPF的功能。
该双连接通信系统还可以包括接入管理网元，该接入管理网元可用于与主基站交互，实现图4所示实施例中AMF的功能，还可以实现图5所示实施例中AMF的功能。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，该流程可以由计算机程序来指令相关的硬件完成，该程序可存储于计算机可读取存储介质中，该程序在执行时，可包括如上述各方法实施例的流程。而前述的存储介质包括：ROM或随机存储记忆体RAM、磁碟或者光盘等各种可存储程序代码的介质。因此，本申请又一实施例提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述各方面所述的方法。
本申请又一实施例还提供了一种包含指令的计算机程序产品，当其在计算机上运行时， 使得计算机执行上述各方面所述的方法。
本领域普通技术人员可以意识到，结合本申请中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。

Claims (69)

  1. 一种双连接通信方法，其特征在于，包括：
    主基站向辅基站发送第一消息，第一消息包括第二用户面安全策略，所述第二用户面安全策略用于所述辅基站确定所述辅基站与所述用户终端之间的用户面安全保护方法；
    所述主基站接收来自所述辅基站的第二消息，所述第二消息包括用户面安全开启类型指示信息，所述用户面安全开启类型指示信息用于指示所述辅基站与所述用户终端之间的用户面安全保护方法；
    所述主基站向所述用户终端发送第三消息，所述第三消息包括所述用户面安全开启类型指示信息。
  2. 根据权利要求1所述的方法，其特征在于，所述主基站向辅基站发送第一消息之前，所述方法还包括：
    在所述辅基站不支持用户面完整性保护的情况下，所述主基站确定所述第二用户面安全策略中的用户面完整性保护指示信息不是开启的。
  3. 根据权利要求1所述的方法，其特征在于，所述第二消息还包括所述辅基站与所述用户终端之间的安全算法，所述第三消息还包括所述辅基站与所述用户终端之间的安全算法。
  4. 根据权利要求1所述的方法，其特征在于，在所述主基站向辅基站发送第一消息之前，所述方法还包括：
    所述主基站获取所述用户终端的第一用户面安全策略。
  5. 根据权利要求4所述的方法，其特征在于，所述第二用户面安全策略为所述用户终端的第一用户面安全策略。
  6. 根据权利要求4所述的方法，其特征在于，
    在所述主基站向辅基站发送第一消息之前，所述方法还包括：
    所述主基站根据所述用户终端的第一用户面安全策略，生成所述第二用户面安全策略。
  7. 根据权利要求6所述的方法，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  8. 根据权利要求6所述的方法，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  9. 根据权利要求6所述的方法，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  10. 根据权利要求8或9所述的方法，其特征在于，所述辅基站为下一代演进型基站节点ng-eNB。
  11. 根据权利要求6所述的方法，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面 完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  12. 根据权利要求6所述的方法，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  13. 根据权利要求11或12所述的方法，其特征在于，所述主基站为ng-eNB，所述辅基站为下一代基站节点gNB。
  14. 一种双连接通信方法，其特征在于，包括：
    辅基站接收来自主基站的第一消息，所述第一消息包括第二用户面安全策略；
    所述辅基站根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法；
    所述辅基站激活所述辅基站与用户终端之间的用户面安全保护方法；
    所述辅基站向所述主基站发送第二消息，所述第二消息包括用户面安全开启类型指示信息，所述用户面安全开启类型指示信息用于指示所述辅基站与所述用户终端之间的用户面安全保护方法。
  15. 根据权利要求14所述的方法，其特征在于，所述第二消息还包括所述辅基站与所述用户终端之间的安全算法。
  16. 根据权利要求14所述的方法，其特征在于，所述第二用户面安全策略为所述用户终端的第一用户面安全策略，其中，所述第一用户面安全策略来自会话管理网元；
    所述辅基站根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法，包括：
    所述辅基站根据所述第一用户面安全策略生成第三用户面安全策略；
    所述辅基站根据所述第三用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法。
  17. 根据权利要求14所述的方法，其特征在于，所述辅基站根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法，包括：
    当所述第二用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述辅基站确定是否开启所述辅基站与用户终端之间的用户面完整性保护。
  18. 根据权利要求17所述的方法，其特征在于，所述辅基站确定是否开启用户面完整性保护，包括：
    在所述辅基站不支持用户面完整性保护的情况下，所述辅基站确定不开启所述辅基站与用户终端之间的用户面完整性保护。
  19. 一种双连接通信方法，其特征在于，包括：
    用户终端接收来自主基站的第三消息，所述第三消息包括用户面安全开启类型指示信息和所述辅基站选择的安全算法，所述用户面安全开启类型指示信息用于指示辅基站与所述用户终端之间的用户面安全保护方法；
    所述用户终端根据所述用户面安全开启类型指示信息和所述辅基站选择的安全算法， 激活与所述辅基站之间的用户面安全保护方法；
    所述用户终端根据所述用户终端与所述辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
  20. 根据权利要求19所述的方法，其特征在于，所述用户终端根据所述用户终端与所述辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护，包括：
    所述用户终端分别向所述辅基站以及所述主基站发送第一上行用户面数据和第二上行用户面数据；其中，所述第一上行用户面数据和所述第二用户面数据为所述用户终端根据所述用户终端与所述辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
  21. 一种主基站，其特征在于，包括收发单元；
    所述收发单元，用于向辅基站发送第一消息，第一消息包括第二用户面安全策略，所述第二用户面安全策略用于所述辅基站确定所述辅基站与所述用户终端之间的用户面安全保护方法；
    所述收发单元，还用于接收来自所述辅基站的第二消息，所述第二消息包括用户面安全开启类型指示信息，所述用户面安全开启类型指示信息用于指示所述辅基站与所述用户终端之间的用户面安全保护方法；
    所述收发单元，还用于向所述用户终端发送第三消息，所述第三消息包括所述用户面安全开启类型指示信息。
  22. 根据权利要求21所述的主基站，其特征在于，所述主基站还包括处理单元，
    在所述辅基站不支持用户面完整性保护的情况下，所述处理单元，用于确定所述第二用户面安全策略中的用户面完整性保护指示信息不是开启的。
  23. 根据权利要求21所述的主基站，其特征在于，所述第二消息还包括所述辅基站与所述用户终端之间的安全算法，所述第三消息还包括所述辅基站与所述用户终端之间的安全算法。
  24. 根据权利要求21所述的主基站，其特征在于，所述主基站还包括处理单元，
    所述处理单元，用于获取所述用户终端的第一用户面安全策略。
  25. 根据权利要求24所述的主基站，其特征在于，所述第二用户面安全策略为所述用户终端的第一用户面安全策略。
  26. 根据权利要求24所述的主基站，其特征在于，所述处理单元，还用于根据所述用户终端的第一用户面安全策略，生成所述第二用户面安全策略。
  27. 根据权利要求26所述的主基站，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  28. 根据权利要求26所述的主基站，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  29. 根据权利要求26所述的主基站，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  30. 根据权利要求28或29所述的方法，其特征在于，所述辅基站为ng-eNB。
  31. 根据权利要求26所述的主基站，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  32. 根据权利要求26所述的主基站，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  33. 根据权利要求31或32所述的方法，其特征在于，所述主基站为ng-eNB，所述辅基站为gNB。
  34. 一种通信装置，其特征在于，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求1-13任一所述的方法。
  35. 一种辅基站，其特征在于，所述辅基站包括收发单元和处理单元，
    所述收发单元，用于接收来自主基站的第一消息，所述第一消息包括第二用户面安全策略；
    所述处理单元，用于根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法；
    所述处理单元，还用于激活所述辅基站与用户终端之间的用户面安全保护方法；
    所述收发单元，还用于向所述主基站发送第二消息，所述第二消息包括用户面安全开启类型指示信息，所述用户面安全开启类型指示信息用于指示所述辅基站与所述用户终端之间的用户面安全保护方法。
  36. 根据权利要求35所述的辅基站，其特征在于，所述第二消息还包括所述辅基站与所述用户终端之间的安全算法。
  37. 根据权利要求35所述的辅基站，其特征在于，所述第二用户面安全策略为所述用户终端的第一用户面安全策略；其中，所述第一用户面安全策略来自会话管理网元；
    所述处理单元用于根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法，具体为根据所述第一用户面安全策略生成第三用户面安全策略；根据所述第三用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法。
  38. 根据权利要求35所述的辅基站，其特征在于，所述处理单元用于根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法，具体为当所述第二用户面安全策略中的用户面完整性保护指示信息为倾向开启时，确定是否开启所述辅基站与用户终端之间的用户面完整性保护。
  39. 根据权利要求38所述的辅基站，其特征在于，所述处理单元用于确定是否开启用户面完整性保护，具体为在所述辅基站不支持用户面完整性保护的情况下，确定不开启所述辅基站与用户终端之间的用户面完整性保护。
  40. 一种通信装置，其特征在于，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求14-18任一所述的方法。
  41. 一种用户终端，其特征在于，包括收发单元和处理单元，
    所述收发单元，用于接收来自主基站的第三消息，所述第三消息包括用户面安全开启类型指示信息和所述辅基站选择的安全算法，所述用户面安全开启类型指示信息用于指示辅基站与所述用户终端之间的用户面安全保护方法；
    所述处理单元，用于根据所述用户面安全开启类型指示信息和所述辅基站选择的安全算法，激活与所述辅基站之间用户面安全保护方法；
    所述收发单元，还用于根据所述用户终端与所述辅基站之间的用户面安全保护方法对上行用户面数据进行安全保护。
  42. 根据权利要求41所述的用户终端，其特征在于，所述处理单元用于根据所述用户面安全开启类型指示信息和所述辅基站选择的安全算法，激活与所述辅基站之间的用户面安全保护方法，具体为控制所述收发单元分别向所述辅基站以及所述主基站发送第一上行用户面数据和第二上行用户面数据；其中，所述第一上行用户面数据和所述第二用户面数据为所述用户终端根据所述用户终端与所述辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
  43. 一种通信装置，其特征在于，所述通信装置包括存储器以及与所述存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求19-20任一所述的方法。
  44. 根据权利要求43所述的装置，其特征在于，所述装置为用户终端或者用户终端中的芯片。
  45. 一种双连接通信系统，其特征在于，包括主基站和辅基站；
    所述主基站，用于向所述辅基站发送第一消息，所述第一消息包括第二用户面安全策略；
    所述辅基站，用于接收所述主基站发送的第一消息，根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法；向所述主基站发送第二消息，所述第二消息包括用户面安全开启类型指示信息，所述用户面安全开启类型指示信息用于指示所述辅基站与所述用户终端之间的用户面安全保护方法；
    所述主基站，还用于接收来自所述辅基站发送的第二消息，并向用户终端发送第三消息，所述第三消息包括所述用户面安全开启类型指示信息。
  46. 根据权利要求45所述的系统，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，所述主基站，还用于确定所述第二用户面安全策略中的用户面完整性保护指示信息不是开启的。
  47. 根据权利要求45所述的系统，其特征在于，所述第二消息还包括所述辅基站与所述用户终端之间的安全算法，所述第三消息还包括所述辅基站与所述用户终端之间的安全 算法。
  48. 根据权利要求45所述的系统，其特征在于，所述主基站，还用于获取所述用户终端的第一用户面安全策略；其中，所述第一用户面安全策略来自会话管理网元。
  49. 根据权利要求48所述的系统，其特征在于，所述第二用户面安全策略为所述用户面设备的第一用户面安全策略；
    所述辅基站，用于根据所述第二用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法，具体为：
    根据所述第一用户面安全策略生成第三用户面安全策略；根据所述第三用户面安全策略确定所述辅基站与用户终端之间的用户面安全保护方法。
  50. 根据权利要求48所述的系统，其特征在于，所述主基站，还用于根据所述用户终端的第一用户面安全策略，生成所述第二用户面安全策略。
  51. 根据权利要求50所述的系统，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  52. 根据权利要求50所述的系统，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  53. 根据权利要求50所述的系统，其特征在于，在所述辅基站不支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  54. 根据权利要求52或53所述的系统，其特征在于，所述辅基站为ng-eNB。
  55. 根据权利要求50所述的系统，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  56. 根据权利要求50所述的系统，其特征在于，在所述主基站不支持用户面完整性保护且所述辅基站支持用户面完整性保护的情况下，当所述第一用户面安全策略中的用户面完整性保护指示信息为不开启时，所述主基站生成的所述第二用户面安全策略中的用户面完整性保护指示信息为关闭。
  57. 根据权利要求55或56所述的系统，其特征在于，所述主基站为ng-eNB，所述辅基站为gNB。
  58. 根据权利要求45所述的系统，其特征在于，当所述第二用户面安全策略中的用户面完整性保护指示信息为倾向开启时，所述辅基站用于确定是否开启所述辅基站与用户终端之间的用户面完整性保护。
  59. 根据权利要求58所述的系统，其特征在于，所述辅基站用于确定是否开启所述辅基站与用户终端之间的用户面完整性保护，具体为：在所述辅基站不支持用户面完整性保护的情况下，确定不开启所述辅基站与用户终端之间的用户面完整性保护。
  60. 根据权利要求45-59任一项所述的系统，其特征在于，所述系统还包括用户面网 元；
    所述主基站，还用于接收来自所述用户终端发送的所述第一上行用户面数据，并将所述第一上行用户面数据发送给所述辅基站；
    所述辅基站，还用于接收来自所述用户终端发送的所述第二上行用户面数据以及所述主基站发送的第一用户面上行数据；对所述第一上行用户面数据和所述第二用户面数据进行解安全保护，得到解安全保护后的用户面数据；向所述用户面网元发送所述解安全保护后的用户面数据；其中，所述第一上行用户面数据和所述第二用户面数据为所述用户终端根据所述用户终端与所述辅基站之间的用户面安全保护方法进行安全保护后的用户面数据。
  61. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1到13任一项所述的方法。
  62. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求14到18任一项所述的方法。
  63. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求19到20任一项所述的方法。
  64. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求1到13任一项所述的方法。
  65. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求14到18任一项所述的方法。
  66. 一种包含指令的计算机程序产品，其特征在于，当其在计算机上运行时，使得计算机执行如权利要求19到20任一项所述的方法。
  67. 一种计算机芯片，其特征在于，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行如权利要求1到13任一项所述的方法。
  68. 一种计算机芯片，其特征在于，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行如权利要求14到18任一项所述的方法。
  69. 一种计算机芯片，其特征在于，所述芯片与存储器相连，所述芯片用于读取并执行所述存储器中存储的软件程序，执行如权利要求19到20任一项所述的方法。
PCT/CN2019/100095 2018-08-10 2019-08-09 双连接通信方法及其装置、系统 WO2020030153A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
KR1020207021911A KR102346419B1 (ko) 2018-08-10 2019-08-09 이중 연결 통신을 위한 방법, 장치 및 시스템
EP19847452.0A EP3731550A4 (en) 2018-08-10 2019-08-09 DUAL CONNECTION COMMUNICATION PROCESS, ASSOCIATED DEVICE, AND SYSTEM
US16/916,481 US11665535B2 (en) 2018-08-10 2020-06-30 Method, apparatus, and system for dual-connectivity communication

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810911030.6 2018-08-10
CN201810911030.6A CN110830992B (zh) 2018-08-10 2018-08-10 双连接通信方法及其装置、系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/916,481 Continuation US11665535B2 (en) 2018-08-10 2020-06-30 Method, apparatus, and system for dual-connectivity communication

Publications (1)

Publication Number Publication Date
WO2020030153A1 true WO2020030153A1 (zh) 2020-02-13

Family

ID=69414027

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/100095 WO2020030153A1 (zh) 2018-08-10 2019-08-09 双连接通信方法及其装置、系统

Country Status (5)

Country Link
US (1) US11665535B2 (zh)
EP (1) EP3731550A4 (zh)
KR (1) KR102346419B1 (zh)
CN (2) CN110830992B (zh)
WO (1) WO2020030153A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110167018B (zh) * 2018-02-11 2021-12-10 华为技术有限公司 一种安全保护的方法、装置及接入网设备
CN111194032B (zh) * 2018-11-14 2021-08-13 华为技术有限公司 一种通信方法及其装置
CN113660665A (zh) * 2020-04-30 2021-11-16 华为技术有限公司 一种通信方法及装置
US20220312520A1 (en) * 2020-10-29 2022-09-29 Apple Inc. User plane integrity protection configuration in en-dc
CN115396879B (zh) * 2021-01-10 2023-11-28 华为技术有限公司 安全策略处理方法、接入设备、安全策略处理装置以及计算机可读存储介质
JP2022114391A (ja) * 2021-01-26 2022-08-05 京セラドキュメントソリューションズ株式会社 電子機器
CN115209397B (zh) * 2021-04-12 2023-08-15 中国移动通信集团河北有限公司 潜在用户终端的确定方法、装置、设备及计算机存储介质
WO2022237699A1 (zh) * 2021-05-08 2022-11-17 华为技术有限公司 一种激活安全的方法及通信装置
CN115885572A (zh) * 2021-07-28 2023-03-31 北京小米移动软件有限公司 一种通信方法、装置、用户设备、基站、核心网设备及存储介质
CN116419234A (zh) * 2021-12-31 2023-07-11 华为技术有限公司 通信方法及装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015047051A1 (en) * 2013-09-30 2015-04-02 Lg Electronics Inc. Method for determining radio resource control configuration in wireless communication system supporting dual connectivity and apparatus thereof
CN106941700A (zh) * 2016-01-04 2017-07-11 中兴通讯股份有限公司 一种数据传输方法及装置和基站及ue

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR102078866B1 (ko) * 2013-08-09 2020-02-19 삼성전자주식회사 듀얼 커넥티비티 지원을 위한 pdcp 분산 구조의 보안 키 생성 및 관리 방안
WO2015037926A1 (en) 2013-09-11 2015-03-19 Samsung Electronics Co., Ltd. Method and system to enable secure communication for inter-enb transmission
CN104519487A (zh) * 2013-09-30 2015-04-15 中兴通讯股份有限公司 一种pdcp计数值的处理方法和装置
KR101802157B1 (ko) 2013-10-28 2017-12-28 엘지전자 주식회사 이종 네트워크에서 이중 연결 동작을 수행하기 위한 방법 및 장치
JP2018137495A (ja) 2015-07-10 2018-08-30 シャープ株式会社 端末装置、基地局装置および通信方法
CN108307389A (zh) * 2016-09-26 2018-07-20 中兴通讯股份有限公司 数据安全保护方法、网络接入设备及终端
US10750410B2 (en) * 2016-09-30 2020-08-18 Huawei Technologies Co., Ltd. Ultra reliable low latency connection support in radio access networks
CN110248382B (zh) * 2017-01-05 2020-09-08 华为技术有限公司 信息传输的方法和装置
CN110167018B (zh) * 2018-02-11 2021-12-10 华为技术有限公司 一种安全保护的方法、装置及接入网设备
KR102567666B1 (ko) * 2018-04-04 2023-08-16 지티이 코포레이션 무결성 보호를 관리하기 위한 기술
US20210153286A1 (en) * 2018-04-05 2021-05-20 Lg Electronics Inc. Method for controlling protocol data unit session in wireless communication system, and apparatus for same
US11546765B2 (en) * 2018-05-14 2023-01-03 Telefonaktiebolaget Lm Ericsson (Publ) Master gNodeBs and method of operating master gNodeB

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015047051A1 (en) * 2013-09-30 2015-04-02 Lg Electronics Inc. Method for determining radio resource control configuration in wireless communication system supporting dual connectivity and apparatus thereof
CN106941700A (zh) * 2016-01-04 2017-07-11 中兴通讯股份有限公司 一种数据传输方法及装置和基站及ue

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
3 GPP TSG SA: "Security Architecture and Procedures for 5G system (Release 15", 3GPP TS 33.501 V15.1.0, 21 June 2018 (2018-06-21), pages 54 55 77 - 79, XP051453195 *
3GPP TSG SA.: "Study on the Security for 5G URLLC (Release 16", 3GPP TR 33.825, 28 May 2019 (2019-05-28), XP051742920 *
ERICSSON: "DC-Handling of UP Security Policy in SN", S 3-182356 , 3GPP TSG-SA WG3 MEETING #92, 24 August 2018 (2018-08-24), pages 2 - 3, XP051541450 *
ERICSSON: "Handling of Maximum Supported Data Rate per UE for Integrity Protection", S 2-184765 , 3GPP TSG-SA WG2 MEETING #127-BIS, 1 June 2018 (2018-06-01), XP051448288 *
See also references of EP3731550A4

Also Published As

Publication number Publication date
KR102346419B1 (ko) 2022-01-03
US11665535B2 (en) 2023-05-30
US20200336899A1 (en) 2020-10-22
EP3731550A4 (en) 2021-09-01
KR20200100826A (ko) 2020-08-26
CN110830992B (zh) 2021-03-02
CN113068180A (zh) 2021-07-02
EP3731550A1 (en) 2020-10-28
CN110830992A (zh) 2020-02-21

Similar Documents

Publication Publication Date Title
WO2020030153A1 (zh) 双连接通信方法及其装置、系统
US11659393B2 (en) Method, apparatus, and system for performing an establishment of a security context between user equipment and an access node
CN110493774B (zh) 密钥配置方法、装置以及系统
US11917054B2 (en) Network key processing method and system and related device
US20170359719A1 (en) Key generation method, device, and system
CN110830993B (zh) 一种数据处理的方法、装置和计算机可读存储介质
US11564099B2 (en) RRC connection resume method and apparatus
CN111148245A (zh) 通信方法、网络设备、用户设备和通信系统
US11882433B2 (en) Communication method and communications apparatus
JPWO2018079692A1 (ja) システム、基地局、コアネットワークノード、及び方法
WO2019033905A1 (zh) 数据流传输安全控制方法及装置
WO2020098719A1 (zh) 一种通信方法及其装置
KR20200013053A (ko) 통신 방법 및 장치
WO2019029255A1 (zh) 密钥、参数发送方法及装置、用户面实体、控制面实体
US20230092744A1 (en) Ckey obtaining method and apparatus
CN113395697A (zh) 传输寻呼信息的方法和通信装置
EP4336884A1 (en) Communication method and communication apparatus
CN107925874B (zh) 超密集网络安全架构和方法
EP3614709B1 (en) Key generation method and related devices
WO2021073382A1 (zh) 注册方法及装置
WO2024031699A1 (zh) 连接建立方法及设备
WO2022198671A1 (zh) 一种通信方法及装置
CN113810903A (zh) 一种通信方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19847452

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019847452

Country of ref document: EP

Effective date: 20200722

ENP Entry into the national phase

Ref document number: 20207021911

Country of ref document: KR

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE