WO2020078184A1 - 用户面数据完整性保护方法、装置、电子设备及介质 - Google Patents

用户面数据完整性保护方法、装置、电子设备及介质 Download PDF

Info

Publication number
WO2020078184A1
WO2020078184A1 PCT/CN2019/107884 CN2019107884W WO2020078184A1 WO 2020078184 A1 WO2020078184 A1 WO 2020078184A1 CN 2019107884 W CN2019107884 W CN 2019107884W WO 2020078184 A1 WO2020078184 A1 WO 2020078184A1
Authority
WO
WIPO (PCT)
Prior art keywords
user plane
plane data
data packet
packet
integrity protection
Prior art date
Application number
PCT/CN2019/107884
Other languages
English (en)
French (fr)
Inventor
刘福文
彭晋
Original Assignee
中国移动通信有限公司研究院
中国移动通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国移动通信有限公司研究院, 中国移动通信集团有限公司 filed Critical 中国移动通信有限公司研究院
Publication of WO2020078184A1 publication Critical patent/WO2020078184A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/34—Flow control; Congestion control ensuring sequence integrity, e.g. using sequence numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/55—Prevention, detection or correction of errors
    • H04L49/552—Prevention, detection or correction of errors by ensuring the integrity of packets received through redundant connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to a user plane data integrity protection method, device, electronic equipment, and storage medium.
  • data can be divided into user plane data and control plane data.
  • User plane data refers to real business data, such as voice data or packet service data.
  • the control plane data is usually Refers to signaling.
  • the user plane protocol stacks of the 4G network and the 5G network are different.
  • the 5G network has Packet Data Convergence Protocol (PDCP) and Radio Link Control (Radio Link) Control, RLC), Medium Access Control (MAC), and Port Physical Layer (PHY) have added Service Data Adaptation Protocol (SDAP) to provide users with a 4G network More fine-grained management of quality of service (QoS) of face data. Therefore, as shown in FIGS.
  • PDCP Packet Data Convergence Protocol
  • RLC Radio Link Control
  • MAC Medium Access Control
  • PHY Port Physical Layer
  • the user plane data packet of the 5G network includes a data payload (Data Payload), a data payload packet header (H data ), and a PDCP packet header (H PDCP ) compared to the user plane data packet of the 4G network.
  • Added SDAP packet header H SDAP .
  • Relevant user plane data integrity protection is usually performed at the PDCP layer, which is to use the PDCP layer service data unit (Service Duty Unit, SDU) in the user plane data packet, that is, PDCP SDU, as a message requiring integrity protection (MESSAGE) Specifically, the packet header and data payload in PDCP SDU are used as input parameters of the set integrity protection function, and a message verification code (MAC-I) is generated based on the set integrity protection function to achieve the integrity protection of user plane data .
  • SDU Service Duty Unit
  • MESSAGE message requiring integrity protection
  • MAC-I message verification code
  • the calculation load of MAC-I generated by electronic devices is heavy, and as the network continues to speed up Simply improving the hardware level of electronic equipment can no longer effectively solve the problem of computing load brought by electronic data protection of user plane data integrity. Therefore, a user plane data integrity protection scheme that can reduce the computing load is needed.
  • the present disclosure provides a user plane data integrity protection method, device, electronic equipment, and storage medium, to solve the problem that the related art brings a large calculation load to electronic equipment.
  • the present disclosure discloses a method for protecting the integrity of user plane data, which is applied to an electronic device.
  • the method includes:
  • For the user plane data packet identify the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packet;
  • Integrity protection is only performed on the packet header included in the PDCP SDU, and the message verification code MAC-I of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the MAC-I of the user plane data packet is generated only based on the header included in the user plane data packet and the set integrity protection function, and the data in the user plane data packet is not
  • the load participates in the generation and calculation of MAC-I, which reduces the calculation load brought to the electronic device by the user plane data integrity protection.
  • the generating the MAC-I of the user plane data packet according to the header included in the PDCP SDU and the set integrity protection function includes:
  • the MAC-I of the user plane data packet is generated according to all the packet headers included in the PDCP SDU and the set integrity protection function.
  • the MAC of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function I includes:
  • the MAC-I of the user plane data packet is generated according to the SDAP header included in the PDCP SDU and the set integrity protection function.
  • the MAC of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function Before I, the method further includes:
  • the method further includes:
  • the method before adding the MAC-I to the user plane data packet, the method further includes:
  • the adding the MAC-I to the user plane data packet includes:
  • the COUNT and MAC-I are added between the data payload header and the data payload in the user plane data packet, or added to the tail of the user plane data packet.
  • the user plane data protection can be performed at the application layer for the 4G network without upgrading the hardware of related equipment.
  • the protection strategy of user plane data integrity supported by the electronic device includes:
  • the packet header of all traffic on the PDU session must be integrity protected; or,
  • Integrity protection is preferred for the packet header of all traffic on the PDU session.
  • Integrity protection is preferred for the initial packet header on the PDU session.
  • a user plane data integrity protection device which is applied to electronic equipment and includes:
  • An identification module for identifying user plane data packets, identifying the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packets;
  • the generating module is used for integrity protection of only the header included in the PDCP SDU, and generates a message verification code MAC-I of the user plane data packet according to the header included in the PDCP SDU and the integrity protection function set .
  • the present disclosure discloses an electronic device, including: a memory and a processor;
  • the processor is used to read the program in the memory and perform the following processes: for the user plane data packet, identify the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packet; and, only for the PDCP SDU Integrity protection is performed on the packet header included in the packet header, and the message verification code MAC-I of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the processor is specifically configured to generate the MAC-I of the user plane data packet according to all the packet headers included in the PDCP SDU and the set integrity protection function.
  • the processor is specifically configured to identify whether the user plane data packet is the initial user plane data of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 5G network Packet; if it is, generate the MAC-I of the user plane data packet according to the service data adaptation protocol SDAP header and data payload header contained in the PDCP SDU and the set integrity protection function; if not, according to all The SDAP packet header included in the PDCP SDU and the set integrity protection function are used to generate the MAC-I of the user plane data packet.
  • the processor is specifically configured to identify whether the user plane data packet is the initial user plane data of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network Packet; if it is, perform the step of generating the MAC-I of the user plane data packet according to the header and the integrity protection function set in the PDCP SDU; if not, end.
  • the processor is further configured to add the MAC-I to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network.
  • the processor is specifically used to identify the PDCP sequence number in the PDCP header in the user plane data packet, and generate a data packet count value COUNT according to the PDCP sequence number; or, when an AS security context is established After that, set COUNT to 0, and add 1 to the value of COUNT every time a data packet is sent or received; add the COUNT and MAC-I between the data payload header and data payload in the user plane data packet, or add it to all Describe the tail of the user plane packet.
  • the present disclosure discloses an electronic device, including: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus;
  • a computer program is stored in the memory, and when the program is executed by the processor, the processor is caused to perform the steps of any of the above methods.
  • the present disclosure discloses a computer-readable storage medium that stores a computer program executable by an electronic device, and when the program runs on the electronic device, causes the electronic device to perform any of the above The steps of the method.
  • the electronic device only generates the MAC-I of the user plane data packet based on the header included in the user plane data packet and the set integrity protection function, and does not The data load in the plane data packet participates in the MAC-I generation calculation, which reduces the calculation load of the MAC-I generation, and provides a user plane data integrity protection scheme that can reduce the calculation load.
  • Figure 1 is a schematic diagram of the protocol stack of the 4G network user plane
  • Figure 2 is a schematic diagram of the protocol stack of the 5G network user plane
  • Figure 3 is a schematic diagram of a 4G network user plane data packet
  • Figure 4 is a schematic diagram of a 5G network user plane data packet
  • FIG. 5 is a schematic diagram of a user plane data integrity protection process provided by some embodiments of the present disclosure.
  • FIG. 6 is a schematic diagram of a user plane data packet encapsulation process provided by some embodiments of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a user plane data packet provided by some embodiments of the present disclosure.
  • FIG. 8 is a schematic structural diagram of a user plane data integrity protection device provided by some embodiments of the present disclosure.
  • FIG. 10 is the second electronic device provided by some embodiments of the present disclosure.
  • Related user plane data protection methods include integrity protection of PDCP layer H PDCP and PDCP SDU.
  • User plane data integrity protection is achieved by using the integrity protection function to generate MAC-I.
  • the input parameters of the integrity protection function include: packet count (COUNT), MESSAGE, data transmission direction (DIRECTION), BEARER (carrier identification ), Integrity key (KEY);
  • COUNT packet count
  • MESSAGE data transmission direction
  • BEARER carrier identification
  • Integrity key Among them, PDCP serial number (PDCP SN) in H PDCP is used to form COUNT, MESSAGE is PDCP SDU, DIRECTION and BEARER are the values assigned by the electronic device, KEY is generated based on the root key of.
  • the existing 5G network supports the integrity protection of user plane data between the user terminal (UE) and the base station, but the calculation load of generating MAC-I is very large, which gives the UE and the base station in the 5G network that supports user plane data integrity protection Brings a huge computing burden; in addition, in the existing 4G network, in order to avoid the computational burden imposed on the UE and the base station by user plane data integrity protection, and to ensure the maximum throughput efficiency and minimum delay of the 4G network, The 4G network does not support user plane data integrity protection between the UE and the base station. Therefore, a user plane data integrity protection scheme that can reduce the calculation load is required.
  • the supported user plane data integrity protection strategies include: (1) Must 1: All traffic on the protocol data unit (Protocol Data Unit, PDU) session must be user plane complete Sexual protection; (2) Preference 1: User plane integrity protection is preferred for all traffic on a PDU session; (3) No need: User plane integrity protection is not performed on all traffic on a PDU session.
  • PDU Protocol Data Unit
  • the base station chooses to perform user plane integrity protection on all traffic on the PDU session, but the UE does not support it, the PDU session establishment fails; if used In the "preference" strategy, if the terminal agrees with the UE, the user plane data packets of the PDU session are integrity protected. Otherwise, the PDU session is established but there is no user plane integrity protection. User traffic integrity protection is performed on all traffic on the PDU session.
  • the input parameter MESSAGE of the integrity protection function is PDCP SDU.
  • FIG. 5 is a schematic diagram of a user plane data integrity protection process provided by some embodiments of the present disclosure. The process includes:
  • the user plane data integrity protection method provided by some embodiments of the present disclosure is applied to an electronic device, which may be a user terminal (UE) or a base station.
  • UE user terminal
  • base station a base station
  • the electronic device identifies the PDCP SDU in the user plane data packet, and generates the MAC-I of the user plane data packet according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the electronic device may generate the MAC-I of the user plane data packet according to all the packet headers included in the PDCP SDU and the set integrity protection function.
  • Scenario 1 User plane data integrity protection of the 5G network, the electronic device is a UE or base station (gNB) in the 5G network.
  • gNB base station
  • the integrity protection of user plane data is performed at the PDCP layer.
  • FIG 6 it is a schematic diagram of the user plane data packet encapsulation process of the 5G network.
  • the initial user plane data packet (Data packet) includes: Data Payload and H data .
  • the Data packet is used as the SDU of the SDAP layer at the SDAP layer, that is, the SDAP SDU.
  • Data packet and H SDAP are used as PDCP SDUs at the PDCP layer.
  • the electronic device recognizes the PDCP SDU in the user plane data packet, and specifically uses the header of the PDCP SDU, that is, the cascade of H SDAP and H data as the integrity protection function MESSAGE, through the integrity protection function Generate MAC-I, and add the generated MAC-I to the end of the user plane data packet.
  • the electronic device uses the cascade of H SDAP and H data as the MESSAGE of the integrity protection function, and generates MAC-I by combining other parameter values of the integrity protection function such as COUNT, DIRECTION, BEARER, and KEY.
  • Scenario 2 User plane data integrity protection of the 4G network, the electronic device is a UE or a base station (eNB) in the 4G network.
  • eNB base station
  • the relevant 4G network does not support the user plane data integrity protection between the UE and the eNB at the PDCP layer, and the hardware of the UE and eNB can be improved so that the PDCP layer of the UE and eNB supports the user plane data integrity protection, preferably,
  • the user plane data integrity protection of the 4G network can be implemented on the PDCP upper layer, that is, the application layer.
  • the description will be made with reference to the user plane data packet of the 4G network shown in FIG. 3.
  • the electronic device recognizes the PDCP SDU in the user plane data packet, and specifically uses the header of the PDCP SDU, that is, H data as MESSAGE.
  • the MAC-I is generated through the integrity protection function, and the generated MAC-I can be added to the end of the user plane data packet, or the generated MAC-I can be inserted between the H data and Data Payload of the user plane data packet.
  • the electronic device uses H SDAP as the MESSAGE of the integrity protection function, and generates MAC-I by combining other parameter values of the integrity protection function such as COUNT, DIRECTION, BEARER, and KEY.
  • the following user plane data integrity protection policies can be added on the basis of related user plane data integrity protection policies (1) Must 2: For all traffic data on the PDU session The packet header must be integrity protected; (2) Preference 2: Integrity protection is preferred for the data packet header of all traffic on the PDU session; where, user plane integrity protection is performed on the data packet header of all traffic on the PDU session ,
  • the input parameter MESSAGE of the integrity protection function is the header of the PDCP SDU.
  • the electronic device only generates the MAC-I of the user plane data packet based on the header included in the user plane data packet and the set integrity protection function, and does not The data load in the plane data packet participates in the MAC-I generation calculation, which reduces the calculation load of the MAC-I generation, and provides a user plane data integrity protection scheme that can reduce the calculation load.
  • the PDCP layer can also compress the packet header.
  • the Robust Header Compression (ROHC) method is used to compress the packet header to save wireless loan resources.
  • the principle of ROHC is that after the header of the initial data packet of the conversation is transmitted between the UE and the base station, only the changed part of the header is transmitted in the header of the corresponding data packet that is transmitted later, because most of the content in the header is unchanged, such as the network
  • IP Internet Protocol
  • the header of VOLTE includes IP header, User Datagram Protocol (UDP) header, Real-time Transport Protocol (Real-time Transport Protocol, header), a total of 40 bytes, after using ROHC compression, the entire VOLTE packet
  • the packet header is only 5 bytes.
  • the PDCP layer uses the ROHC method to compress the H data in the user plane data packet.
  • the user plane data packet is a user plane data packet of a 5G network
  • the user plane is generated according to the packet header included in the PDCP SDU and the set integrity protection function
  • the MAC-I of the packet includes:
  • the MAC-I of the user plane data packet is generated according to the SDAP header included in the PDCP SDU and the set integrity protection function.
  • the electronic device identifies whether the user plane data packet is the initial user of the session corresponding to the user plane data packet for the user plane data packet Face data packet, if it is, it means that the H data of the user plane data packet is not compressed, and H SDAP and H data are used as the integrity protection function MESSAGE to generate the MAC-I of the user plane data packet; if not , It means that the H data of the user plane data packet is compressed, and H SDAP is used as the MESSAGE of the integrity protection function to generate the MAC-I of the user plane data packet.
  • the user plane data packet is a user plane data packet of a 4G network
  • the user plane is generated according to the packet header included in the PDCP SDU and the set integrity protection function
  • the method further includes:
  • the PDCP SDU in the user plane data packet of the 4G network contains only H data .
  • the ROHC method is used to compress the user plane data packet header, if the user plane data packet corresponds to the session of the user plane data packet The initial user plane data packet, the H data in the user plane data packet is not compressed, and H data is used as the integrity protection function of MESSAGE to generate the MAC-I of the user plane data packet; if not, explain The H data of the user plane data packet is compressed, and the MAC-I of the user plane data packet is not generated.
  • the following user plane data integrity protection policies can be added to the above user plane data integrity protection strategy (1) Must 3: Only for the initial data packet header on the PDU session Integrity protection; (2) Preference 3: Integrity protection is preferred for the initial data packet header on the PDU session; where integrity protection is applied to the initial data packet header on the PDU session, if the user plane data packet is a session
  • the initial user plane data packet integrity protection function input parameter MESSAGEPDCP header in the SDU if the user plane data packet is not the initial user plane data packet of the session, the integrity protection function input parameter MESSAGEPDCP SDU non-data payload header .
  • the method further includes:
  • the method Before adding the MAC-I to the user plane data packet, the method further includes:
  • COUNT is set to 0, and the value of COUNT is increased by 1 for each data packet sent or received;
  • the adding the MAC-I to the user plane data packet includes:
  • the COUNT and MAC-I are added between the data payload header and the data payload in the user plane data packet, or added to the tail of the user plane data packet.
  • the integrity of the user plane data can be protected by inserting an authentication entity (AE) in the user plane data packet.
  • AE authentication entity
  • FIG. 7 AE can be inserted in the H data and data of the user plane data packet. Between payloads, it can also be appended to the tail of the user plane data packet.
  • AE is composed of COUNT and MAC-I, and COUNT is generated according to the PDCP sequence number as related technology, which will not be repeated here.
  • the supportable user plane data integrity protection strategies include: (1) MUST 1: All plane traffic on the PDU session must be user plane integrity protected; (2) MUST 2: For all traffic on the PDU session The data packet header of the traffic must be integrity-protected; (3) MUST 3: Only the initial data packet header on the PDU session must be integrity-protected; (4) Preference 1: User traffic is preferred for all traffic on the PDU session Integrity protection; (5) Preference 2: Integrity protection is preferred for the packet header of all traffic on the PDU session; (6) Preference 3: Integrity protection is preferred for the initial packet header on the PDU session; (7 ) No need: user plane integrity protection is not performed on all traffic on the PDU session.
  • FIG. 8 is a schematic structural diagram of a device for protecting integrity of user plane data provided by some embodiments of the present disclosure, which is applied to electronic equipment, and the device includes:
  • the identification module 81 is used to identify the PDCP SDU in the user plane data packet for the user plane data packet;
  • the generating module 82 is configured to perform integrity protection only on the packet header included in the PDCP SDU, and generate the MAC-I of the user plane data packet according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the generating module 82 is specifically configured to generate the MAC-I of the user plane data packet according to all the packet headers included in the PDCP SDU and the set integrity protection function.
  • the generating module 82 is specifically configured to identify whether the user plane data packet is the initial user plane data packet of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 5G network; if Yes, the MAC-I of the user plane data packet is generated according to the service data adaptation protocol SDAP header and data payload header included in the PDCP SDU and the set integrity protection function; if not, according to the PDCP SDU
  • the SDAP packet header included in the packet and the set integrity protection function generate the MAC-I of the user plane data packet.
  • the device also includes:
  • the judging module 83 is used to identify whether the user plane data packet is the initial user plane data packet of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network; if the judgment result is If yes, the generation module 82 is triggered, and if the judgment result is no, it ends.
  • the device also includes:
  • the insertion module 84 is configured to add the MAC-I to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network.
  • the insertion module 84 is specifically used to identify the PDCP sequence number in the PDCP header of the user plane data packet, and generate a data packet count value COUNT according to the PDCP sequence number; or, when the AS security context is established, set COUNT is 0, and the value of COUNT is increased by 1 for each data packet sent or received; the COUNT and MAC-I are added between the data payload header and the data payload in the user plane data packet, or added to the user plane The end of the packet.
  • some embodiments of the present disclosure also provide an electronic device. Since the principle of the above electronic device to solve the problem is similar to the user plane data integrity protection method, the implementation of the above electronic device can refer to the implementation of the method. The repetition is not repeated here.
  • the bus architecture may include any number of interconnected buses and bridges, specifically represented by a processor 91 or Various processors 91 and various circuits of the memory 92 represented by the memory 92 are linked together.
  • the bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, etc., which are well known in the art, and therefore, they will not be further described in this article.
  • the bus interface provides an interface.
  • the processor 91 is responsible for managing the bus architecture and general processing, and the memory 92 may store data used by the processor 91 when performing operations.
  • the processor 91 is used to read the program in the memory 92 and perform the following process: for the user plane data packet, identify the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packet; only for the PDCP SDU Integrity protection is performed on the packet header included in the packet header, and the message verification code MAC-I of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the processor 91 is specifically configured to generate the MAC-I of the user plane data packet according to all the packet headers included in the PDCP SDU and the set integrity protection function.
  • the processor 91 is specifically configured to identify whether the user plane data packet is the initial user plane of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 5G network Data packet; if it is, generate the MAC-I of the user plane data packet according to the service data adaptation protocol SDAP header and data payload header included in the PDCP SDU and the set integrity protection function; if not, according to The SDAP header included in the PDCP SDU and the set integrity protection function generate the MAC-I of the user plane data packet.
  • the processor 91 is specifically configured to identify whether the user plane data packet is the initial user plane of the session corresponding to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network Data packet; if it is, perform the step of generating the MAC-I of the user plane data packet according to the packet header included in the PDCP SDU and the set integrity protection function; if not, end.
  • the processor 91 is further configured to add the MAC-I to the user plane data packet if the user plane data packet is a user plane data packet of a 4G network.
  • the processor 91 is specifically configured to identify the PDCP sequence number in the PDCP header in the user plane data packet, and generate a data packet count value COUNT according to the PDCP sequence number; or, when AS security is established After the context, set COUNT to 0 and add 1 to the value of COUNT every time a data packet is sent or received; add the COUNT and MAC-I between the data payload header and data payload in the user plane data packet, or add to The tail of the user plane data packet.
  • the protection strategy of user plane data integrity supported by the electronic device includes:
  • the packet header of all traffic on the PDU session must be integrity protected; or,
  • Integrity protection is preferred for the packet header of all traffic on the PDU session.
  • Integrity protection is preferred for the initial packet header on the PDU session.
  • some embodiments of the present disclosure also provide an electronic device, as shown in FIG. 10, including: a processor 101, a communication interface 102, a memory 103, and a communication bus 104, where the processor 101, a communication interface 102, and a memory 103 complete communication with each other through a communication bus 104;
  • a computer program is stored in the memory 103, and when the program is executed by the processor 101, the processor 101 is caused to perform the following steps:
  • For the user plane data packet identify the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packet;
  • Integrity protection is only performed on the packet header included in the PDCP SDU, and the message verification code MAC-I of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function.
  • some embodiments of the present disclosure also provide a computer storage readable storage medium.
  • the computer readable storage medium stores a computer program executable by the electronic device. When the program is in When running on the electronic device, the following steps are implemented when the electronic device is executed:
  • For the user plane data packet identify the packet data aggregation protocol layer service data unit PDCP SDU in the user plane data packet;
  • Integrity protection is only performed on the packet header included in the PDCP SDU, and the message verification code MAC-I of the user plane data packet is generated according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the present disclosure discloses a user plane data integrity protection method, device, electronic equipment, and storage medium.
  • the method includes: for a user plane data packet, identifying the PDCP SDU in the user plane data packet; only for the PDCP SDU The included packet header performs integrity protection, and generates the MAC-I of the user plane data packet according to the packet header included in the PDCP SDU and the set integrity protection function.
  • the electronic device only generates the MAC-I of the user plane data packet based on the header included in the user plane data packet and the set integrity protection function, and does not The data load in the plane data packet participates in the MAC-I generation calculation, which reduces the calculation load of the MAC-I generation, and provides a user plane data integrity protection scheme that can reduce the calculation load.
  • the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.
  • computer usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the embodiments described in the embodiments of the present disclosure may be implemented by hardware, software, firmware, middleware, microcode, or a combination thereof.
  • the processing unit can be implemented in one or more application specific integrated circuits (Application Specific Integrated Circuits, ASIC), digital signal processor (Digital Signal Processing, DSP), digital signal processing device (DSP Device, DSPD), programmable Logic Device (Programmable Logic Device, PLD), Field Programmable Gate Array (Field-Programmable Gate Array, FPGA), general-purpose processor, controller, microcontroller, microprocessor, others for performing the functions described in this disclosure Electronic unit or its combination.
  • ASIC Application Specific Integrated Circuits
  • DSP Digital Signal Processing
  • DSP Device digital signal processing device
  • DPD digital signal processing device
  • PLD programmable Logic Device
  • Field Programmable Gate Array Field-Programmable Gate Array
  • FPGA Field-Programmable Gate Array
  • the technology described in the embodiments of the present disclosure may be implemented through modules (eg, procedures, functions, etc.) that perform the functions described in the embodiments of the present disclosure.
  • the software codes can be stored in the memory and executed by the processor.
  • the memory may be implemented in the processor or external to the processor.
  • These computer program instructions may also be stored in a computer readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instructions The device implements the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operating steps are performed on the computer or other programmable device to produce computer-implemented processing, which is executed on the computer or other programmable device
  • the instructions provide steps for implementing the functions specified in one block or multiple blocks of the flowchart one flow or multiple flows and / or block diagrams.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本公开公开了一种用户面数据完整性保护方法、装置、电子设备及介质，所述方法包括：针对用户面数据包，识别所述用户面数据包中的PDCP SDU；仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。

Description

用户面数据完整性保护方法、装置、电子设备及介质
相关申请的交叉引用
本申请主张在2018年10月16日在中国提交的中国专利申请号No.201811202994.X的优先权，其全部内容通过引用包含于此。
技术领域
本公开涉及通信技术领域，尤其涉及一种用户面数据完整性保护方法、装置、电子设备及存储介质。
背景技术
在通信技术领域，按照数据类型进行划分，通常可以将数据划分为用户面数据和控制面数据，用户面数据指的是真正的业务数据，例如：语音数据或者分组业务数据等，控制面数据通常指的是信令。如图1和图2所示，4G网络和5G网络的用户面的协议堆栈不同，5G网络相较于4G网络的包数据聚合协议(Packet Data Convergence Protocol，PDCP)、无线链路控制(Radio Link Control，RLC)、媒介接入控制(Medium Access control，MAC)、物理层(Port Physical Layer，PHY)增加了业务数据适配协议(Service Data Adaptation Protocol，SDAP)，用以提供比4G网络的用户面数据的服务质量(Quality of Service，QoS)更细粒度的管理。因此，如图3和图4所示，5G网络的用户面数据包相较于4G网络的用户面数据包包括数据载荷(Data Payload)、数据载荷包头(H data)和PDCP包头(H PDCP)增加了SDAP包头(H SDAP)。
相关用户面数据完整性保护通常是在PDCP层执行，是将用户面数据包中PDCP层业务数据单元(Service Data Unit，SDU)，即PDCP SDU，作为需要完整性保护的消息(MESSAGE)，并具体将PDCP SDU中的包头和数据载荷作为设定的完整性保护函数的输入参数，基于设定的完整性保护函数生成消息验证码(MAC-I)，来实现对用户面数据的完整性保护。
然而，根据PDCP SDU生成MAC-I，尤其是对于高速接入的用户面数据，如高清视频的用户面数据等，电子设备生成MAC-I的计算负载很大，并且随 着网络的不断提速，单纯的提升电子设备硬件水平，已经不能有效的解决用户面数据完整性保护给电子设备带来的计算负载的问题，因此，需要一种能降低计算负载的用户面数据完整性保护方案。
发明内容
本公开提供一种用户面数据完整性保护方法、装置、电子设备及存储介质，用以解决相关技术中存在给电子设备带来很大计算负载的问题。
第一方面，本公开公开了一种用户面数据完整性保护方法，应用于电子设备，所述方法包括：
针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及
仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
通过本公开的用户面数据完整性保护方法，仅根据用户面数据包中包含的包头及设定的完整性保护函数，生成用户面数据包的MAC-I，不将用户面数据包中的数据载荷参与到MAC-I的生成计算中，降低了用户面数据完整性保护给电子设备带来的计算负载。
可选的，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I包括：
根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选的，如果所述用户面数据包为5G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I包括：
识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选的，如果所述用户面数据包为4G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I之前，所述方法还包括：
识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
如果是，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
如果否，则结束。
通过上述可选方式，只对会话上的初始数据包包头进行完整性保护，进一步降低了用户面数据完整性保护给电子设备带来的计算负载。
可选的，如果所述用户面数据包为4G网络的用户面数据包，所述方法还包括：
将所述MAC-I添加至所述用户面数据包中。
可选的，所述将所述MAC-I添加至所述用户面数据包中之前，所述方法还包括：
识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，
当建立了接入层(Access Stratum，AS)安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；
所述将所述MAC-I添加至所述用户面数据包中包括：
将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
通过上述可选方式，对于4G网络可以在应用层，进行用户面数据保护，无需对相关设备的硬件进行升级即可实现。
可选的，所述电子设备支持的用户面数据完整性的保护策略包括：
对于协议数据单元PDU会话上的所有流量必须进行用户面完整性保护；或，
对于PDU会话上的所有流量的数据包包头必须进行完整性保护；或，
只对PDU会话上的初始数据包包头必须进行完整性保护；或，
对于PDU会话上的所有流量首选进行用户面完整性保护；或，
对于PDU会话上的所有流量的数据包包头首选进行完整性保护；或，
对PDU会话上的初始数据包包头首选进行完整性保护；或，
对于PDU会话上的所有流量不进行用户面完整性保护。
第二方面，本公开公开了一种用户面数据完整性保护装置，应用于电子设备，所述装置包括：
识别模块，用于针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及
生成模块，用于仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
第三方面，本公开公开了一种电子设备，包括：存储器和处理器；
所述处理器，用于读取存储器中的程序，执行下列过程：针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及，仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
可选的，所述处理器，具体用于根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选的，所述处理器，具体用于如果所述用户面数据包为5G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选的，所述处理器，具体用于如果所述用户面数据包为4G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用 户面数据包；如果是，进行根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I的步骤；如果否，则结束。
可选的，所述处理器，还用于如果所述用户面数据包为4G网络的用户面数据包，将所述MAC-I添加至所述用户面数据包中。
可选的，所述处理器，具体用于识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，当建立了AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
第四方面，本公开公开了一种电子设备，包括：处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
所述存储器中存储有计算机程序，当所述程序被所述处理器执行时，使得所述处理器执行上述任一项所述方法的步骤。
第五方面，本公开公开了一种计算机可读存储介质，其存储有可由电子设备执行的计算机程序，当所述程序在所述电子设备上运行时，使得所述电子设备执行上述任一项所述方法的步骤。
本公开有益效果如下：
由于在本公开的一些实施例中，电子设备针对用户面数据包，仅根据用户面数据包中包含的包头及设定的完整性保护函数，生成用户面数据包的MAC-I，不将用户面数据包中的数据载荷参与到MAC-I的生成计算中，降低了生成MAC-I的计算负载，提供了一种能降低计算负载的用户面数据完整性保护方案。
附图说明
为了更清楚地说明本发明的一些实施例或相关技术中的技术方案，下面将对实施例或相关技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为4G网络用户面的协议堆栈示意图；
图2为5G网络用户面的协议堆栈示意图；
图3为4G网络用户面数据包示意图；
图4为5G网络用户面数据包示意图；
图5为本公开的一些实施例提供的用户面数据完整性保护过程示意图；
图6为本公开的一些实施例提供的用户面数据包封装过程示意图；
图7为本公开的一些实施例提供的用户面数据包结构示意图；
图8为本公开的一些实施例提供的用户面数据完整性保护装置结构示意图；
图9为本公开的一些实施例提供的电子设备之一；以及
图10为本公开的一些实施例提供的电子设备之二。
具体实施方式
为了使本公开的目的、技术方案和优点更加清楚，下面将结合附图本公开作进一步地详细描述，显然，所描述的实施例仅仅是本公开的一部分实施例，而不是全部的实施例。基于本公开中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本公开保护的范围。
相关用户面数据保护方法，包括对PDCP层的H PDCP和PDCP SDU进行完整性保护。用户面数据完整性保护，通过使用完整性保护函数生成MAC-I来实现，完整性保护函数的输入参数包括：数据包计数值(COUNT)、MESSAGE、数据传输方向(DIRECTION)、BEARER(载波标识)、完整性密钥(KEY)；其中，H PDCP中的PDCP序列号(PDCP SN)用于构成COUNT、MESSAGE为PDCP SDU、DIRECTION和BEARER是电子设备分配的值、KEY是根据根密钥生成的。现有5G网络支持用户终端(UE)与基站之间支持用户面数据的完整性保护，但是生成MAC-I的计算负载很大，给支持用户面数据完整性保护的5G网络中的UE和基站带来了极大的计算负担；此外，现有4G网络中为了避免用户面数据完整性保护给UE和基站带来的计算负担，并为了保证4G网络的吞吐效率最大化和时延最小化，4G网络中不支持UE和基站间进行用户面数据完整性保护，因此，需要一种能降低计算负载的用户面数据完整性保护方案。
基于相关的用户面数据完整性保护方法，可支持的用户面数据完整性保护 策略包括：(1)必须1：对于协议数据单元(Protocol Data Unit，PDU)会话上的所有流量必须进行用户面完整性保护；(2)偏好1：对于PDU会话上的所有流量首选进行用户面完整性保护；(3)不需要：对于PDU会话上的所有流量不进行用户面完整性保护。其中使用必须策略时，如果基站和UE无法达成一致，PDU会话建立失败，例如基站选择对于PDU会话上的所有流量必须进行用户面完整性保护，但是UE不支持，则PDU会话建立失败；如果使用“偏好”策略时，如果终端与UE达成一致，则对PDU会话的用户面数据包进行完整性保护，否则，PDU会话建立但没有用户面完整性保护，在相关用户面数据完整性保护策略对于PDU会话上的所有流量进行用户面完整性保护，指完整性保护函数的输入参数MESSAGE为PDCP SDU。
图5为本公开的一些实施例提供的一种用户面数据完整性保护过程示意图，所述过程包括：
S501：针对用户面数据包，识别所述用户面数据包中的PDCP SDU。
S502：仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
本公开的一些实施例提供的用户面数据完整性保护方法应用于电子设备，该电子设备可以是用户终端(UE)，也可以是基站。
具体的，电子设备针对用户面数据包，识别用户面数据包中的PDCP SDU，根据PDCP SDU中包含的包头及设定的完整性保护函数，生成用户面数据包的MAC-I。
较佳的，电子设备可以根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
下面结合具体网络场景进行说明：
场景一：5G网络的用户面数据完整性保护，电子设备为5G网络中的UE或基站(gNB)。
在5G网络中，用户面数据的完整性保护在PDCP层执行。如图6所示，为5G网络的用户面数据包封装过程示意图，初始用户面数据包(Data packet)包括：Data Payload和H data，Data packet在SDAP层作为SDAP层的SDU，即SDAP SDU，为Data packet添加H SDAP，Data packet和H SDAP在PDCP层作为 PDCP SDU，为PDCP SDU添加H PDCP封装成可用于用户面数据完整性保护的用户面数据包。具体的，在5G网络中，电子设备识别用户面数据包中的PDCP SDU，并具体将PDCP SDU中的包头，即将H SDAP和H data级联作为完整性保护函数的MESSAGE，通过完整性保护函数生成MAC-I，并将生成的MAC-I添加至用户面数据包的尾部。具体的，电子设备将H SDAP和H data级联作为完整性保护函数的MESSAGE，结合完整性保护函数的其它参数值如COUNT、DIRECTION、BEARER、KEY生成MAC-I。
场景二：4G网络的用户面数据完整性保护，电子设备为4G网络中的UE或基站(eNB)。
相关4G网络不支持UE和eNB间的用户面数据完整性保护在PDCP层实现，可以对UE和eNB的硬件进行改进，使UE和eNB的PDCP层支持用户面数据完整性保护，较佳的，为了避免对UE和eNB的硬件进行改进，4G网络的用户面数据完整性保护可以在PDCP上层，即应用层实现。结合图3所示的4G网络的用户面数据包进行说明，具体的，在4G网络中电子设备识别用户面数据包中的PDCP SDU，并具体将PDCP SDU中的包头，即将H data作为MESSAGE，通过完整性保护函数生成MAC-I，并可以将生成的MAC-I添加至用户面数据包的尾部，也可以将生成的MAC-I插入到用户面数据包的H data与Data Payload之间。具体的，电子设备将H SDAP作为完整性保护函数的MESSAGE，结合完整性保护函数的其它参数值如COUNT、DIRECTION、BEARER、KEY生成MAC-I。
通过本实施例提供的用户面数据完整性保护方法，可以在相关用户面数据完整性保护策略基础上增加以下用户面数据完整性保护策略(1)必须2：对于PDU会话上的所有流量的数据包包头必须进行完整性保护；(2)偏好2：对于PDU会话上的所有流量的数据包包头首选进行完整性保护；其中，对于PDU会话上的所有流量的数据包包头进行用户面完整性保护，指完整性保护函数的输入参数MESSAGE为PDCP SDU中的包头。
由于在本公开的一些实施例中，电子设备针对用户面数据包，仅根据用户面数据包中包含的包头及设定的完整性保护函数，生成用户面数据包的MAC-I，不将用户面数据包中的数据载荷参与到MAC-I的生成计算中，降低了生成 MAC-I的计算负载，提供了一种能降低计算负载的用户面数据完整性保护方案。
PDCP层除了能对用户面数据进行加密和完整性保护外，还可以对包头进行压缩，一般采用健壮头压缩(RObust Header Compression，ROHC)方法对包头进行压缩，以节省无线贷款资源。ROHC的原理是UE和基站间在传输完对话的初始数据包的包头后，后面传输对应的数据包的包头中只传输包头中变化的部分，因包头中的绝大部分内容不变，如网络之间互连的协议(Internet Protocol，IP)IP地址，因此，ROHC能把包头压缩得很小。例如，对于VOLTE的包头包括IP包头，用户数据报协议(User Datagram Protocol，UDP)包头，实时传输协议(Real-time Transport Protocol，包头，共计40字节，使用ROHC压缩后，整个VOLTE的数据包的包头只有5个字节。具体的，在本法实施例中，PDCP层采用ROHC方法对用户面数据包中的H data进行压缩。
为了进一步减少电子设备的计算负载，如果所述用户面数据包为5G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I包括：
识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
具体的，如果采用了ROHC方法对用户面数据包包头进行压缩，在5G网络中，电子设备针对用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包，如果是，则说明所述用户面数据包的H data未被压缩，将H SDAP和H data作为完整性保护函数的MESSAGE，生成所述用户面数据包的MAC-I；如果否，则说明所述用户面数据包的H data被压缩，将H SDAP作为完整性保护函数的MESSAGE，生成所述用户面数据包的MAC-I。
为了进一步减少电子设备的计算负载，如果所述用户面数据包为4G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I之前，所述方法还包括：
识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
如果是，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
如果否，则结束。
具体的，4G网络的用户面数据包中的PDCP SDU中仅包含H data，如果采用了ROHC方法对用户面数据包包头进行了压缩，则如果用户面数据包为所述用户面数据包对应会话的初始用户面数据包，则所述用户面数据包中的H data未被压缩，将H data作为完整性保护函数的MESSAGE，生成所述用户面数据包的MAC-I；如果否，则说明所述用户面数据包的H data被压缩，不生成所述用户面数据包的MAC-I。
通过本实施例提供的用户面数据完整性保护方法，可以在上述用户面数据完整性保护策略增加以下用户面数据完整性保护策略(1)必须3：只对PDU会话上的初始数据包包头必须进行完整性保护；(2)偏好3：对PDU会话上的初始数据包包头首选进行完整性保护；其中，对于PDU会话上的初始数据包包头进行完整性保护，指如果用户面数据包为会话的初始用户面数据包完整性保护函数的输入参数MESSAGEPDCP SDU中的包头，如果用户面数据包不是会话的初始用户面数据包，完整性保护函数的输入参数MESSAGEPDCP SDU中的非数据载荷包头的包头。
为了实现4G网络的用户面数据完整性保护，如果所述用户面数据包为4G网络的用户面数据包，所述方法还包括：
将所述MAC-I添加至所述用户面数据包中。
所述将所述MAC-I添加至所述用户面数据包中之前，所述方法还包括：
如果在PDCP层实现用户面数据完整性保护，识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，
如果在PDCP层上层，如应用层实现用户面数据完整性保护，当建立了AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；
所述将所述MAC-I添加至所述用户面数据包中包括：
将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
具体的，可以通过在用户面数据包中插入认证实体(Authentication Entity，AE)来实现对用户面数据的完整性保护，如图7所示，AE可以插入在用户面数据包的H data和Data payload之间，也可以附加到用户面数据包的尾部，其中，AE由COUNT和MAC-I组成，根据PDCP序列号生成COUNT为相关技术，不再进行赘述。
基于上述实施例，可支持的用户面数据完整性保护策略包括：(1)必须1：对于PDU会话上的所有流量必须进行用户面完整性保护；(2)必须2：对于PDU会话上的所有流量的数据包包头必须进行完整性保护；(3)必须3：只对PDU会话上的初始数据包包头必须进行完整性保护；(4)偏好1：对于PDU会话上的所有流量首选进行用户面完整性保护；(5)偏好2：对于PDU会话上的所有流量的数据包包头首选进行完整性保护；(6)偏好3：对PDU会话上的初始数据包包头首选进行完整性保护；(7)不需要：对于PDU会话上的所有流量不进行用户面完整性保护。
图8为本公开的一些实施例提供的一种用户面数据完整性保护装置结构示意图，应用于电子设备，所述装置包括：
识别模块81，用于针对用户面数据包，识别所述用户面数据包中的PDCP SDU；
生成模块82，用于仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
所述生成模块82，具体用于根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
所述生成模块82，具体用于如果所述用户面数据包为5G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I； 如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
所述装置还包括：
判断模块83，用于如果所述用户面数据包为4G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果判断结果为是，触发生成模块82，如果判断结果为否，则结束。
所述装置还包括：
插入模块84，用于如果所述用户面数据包为4G网络的用户面数据包，将所述MAC-I添加至所述用户面数据包中。
所述插入模块84，具体用于识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，当建立了AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
基于同一发明构思，本公开的一些实施例中还提供了一种电子设备，由于上述电子设备解决问题的原理与用户面数据完整性保护方法相似，因此上述电子设备的实施可以参见方法的实施，重复之处不再赘述。
如图9所示，其为本公开的一些实施例提供的电子设备的结构示意图，其中在图9中，总线架构可以包括任意数量的互联的总线和桥，具体有处理器91代表的一个或多个处理器91和存储器92代表的存储器92的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。处理器91负责管理总线架构和通常的处理，存储器92可以存储处理器91在执行操作时所使用的数据。
在本公开的一些实施例提供的电子设备中：
所述处理器91，用于读取存储器92中的程序，执行下列过程：针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码 MAC-I。
可选地，所述处理器91，具体用于根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选地，所述处理器91，具体用于如果所述用户面数据包为5G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
可选地，所述处理器91，具体用于如果所述用户面数据包为4G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，进行根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I的步骤；如果否，则结束。
可选地，所述处理器91，还用于如果所述用户面数据包为4G网络的用户面数据包，将所述MAC-I添加至所述用户面数据包中。
可选地，所述处理器91，具体用于识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，当建立了AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
可选地，所述电子设备支持的用户面数据完整性的保护策略包括：
对于协议数据单元PDU会话上的所有流量必须进行用户面完整性保护；或，
对于PDU会话上的所有流量的数据包包头必须进行完整性保护；或，
只对PDU会话上的初始数据包包头必须进行完整性保护；或，
对于PDU会话上的所有流量首选进行用户面完整性保护；或，
对于PDU会话上的所有流量的数据包包头首选进行完整性保护；或，
对PDU会话上的初始数据包包头首选进行完整性保护；或，
对于PDU会话上的所有流量不进行用户面完整性保护。
在上述各实施例的基础上，本公开的一些实施例还提供了一种电子设备，如图10所示，包括：处理器101、通信接口102、存储器103和通信总线104，其中，处理器101，通信接口102，存储器103通过通信总线104完成相互间的通信；
所述存储器103中存储有计算机程序，当所述程序被所述处理器101执行时，使得所述处理器101执行以下步骤：
针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；
仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
在上述各实施例的基础上，本公开的一些实施例还提供了一种计算机存储可读存储介质，所述计算机可读存储介质内存储有可由电子设备执行的计算机程序，当所述程序在所述电子设备上运行时，使得所述电子设备执行时实现如下步骤：
针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；
仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
本公开公开了一种用户面数据完整性保护方法、装置、电子设备及存储介质，所述方法包括：针对用户面数据包，识别所述用户面数据包中的PDCP SDU；仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。由于在本公开的一些实施例中，电子设备针对用户面数据包，仅根据用户面数据包中包含的包头及设定的完整性保护函数，生成用户面数据包的MAC-I，不将用户面数据包中的数据载荷参与到MAC-I的生成计算中，降低了生成MAC-I的计算负载，提供了一种能降低计算负载的用户面数据完整性保护方案。
对于系统/装置实施例而言，由于其基本相似于方法实施例，所以描述的比 较简单，相关之处参见方法实施例的部分说明即可。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
可以理解的是，本公开实施例描述的这些实施例可以用硬件、软件、固件、中间件、微码或其组合来实现。对于硬件实现，处理单元可以实现在一个或多个专用集成电路(Application Specific Integrated Circuits，ASIC)、数字信号处理器(Digital Signal Processing，DSP)、数字信号处理设备(DSP Device，DSPD)、可编程逻辑设备(Programmable Logic Device，PLD)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)、通用处理器、控制器、微控制器、微处理器、用于执行本公开所述功能的其它电子单元或其组合中。
对于软件实现，可通过执行本公开实施例所述功能的模块(例如过程、函数等)来实现本公开实施例所述的技术。软件代码可存储在存储器中并通过处理器执行。存储器可以在处理器中或在处理器外部实现。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处 理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的可选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例做出另外的变更和修改。所以，所附权利要求意欲解释为包括可选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本公开进行各种改动和变型而不脱离本公开的精神和范围。这样，倘若本公开的这些修改和变型属于本公开权利要求及其等同技术的范围之内，则本公开也意图包含这些改动和变型在内。

Claims (17)

  1. 一种用户面数据完整性保护方法，应用于电子设备，所述方法包括：
    针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及
    仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
  2. 如权利要求1所述的方法，其中，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I包括：
    根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
  3. 如权利要求1所述的方法，其中，如果所述用户面数据包为5G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I包括：
    识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
    如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
    如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
  4. 如权利要求1所述的方法，其中，如果所述用户面数据包为4G网络的用户面数据包，所述根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I之前，所述方法还包括：
    识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；
    如果是，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；
    如果否，则结束。
  5. 如权利要求1所述的方法，其中，如果所述用户面数据包为4G网络的用户面数据包，所述方法还包括：
    将所述MAC-I添加至所述用户面数据包中。
  6. 如权利要求5所述的方法，其中，所述将所述MAC-I添加至所述用户面数据包中之前，所述方法还包括：
    识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，
    当建立了接入层AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；
    其中，所述将所述MAC-I添加至所述用户面数据包中包括：
    将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
  7. 如权利要求1-6任一项所述的方法，其中，所述电子设备支持的用户面数据完整性的保护策略包括：
    对于协议数据单元PDU会话上的所有流量必须进行用户面完整性保护；或，
    对于PDU会话上的所有流量的数据包包头必须进行完整性保护；或，
    只对PDU会话上的初始数据包包头必须进行完整性保护；或，
    对于PDU会话上的所有流量首选进行用户面完整性保护；或，
    对于PDU会话上的所有流量的数据包包头首选进行完整性保护；或，
    对PDU会话上的初始数据包包头首选进行完整性保护；或，
    对于PDU会话上的所有流量不进行用户面完整性保护。
  8. 一种用户面数据完整性保护装置，应用于电子设备，所述装置包括：
    识别模块，用于针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及
    生成模块，用于仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
  9. 一种电子设备，包括：存储器和处理器；
    所述处理器，用于读取存储器中的程序，执行下列过程：针对用户面数据包，识别所述用户面数据包中的包数据聚合协议层业务数据单元PDCP SDU；以及，仅对PDCP SDU中包含的包头进行完整性保护，根据所述PDCP SDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的消息验证码MAC-I。
  10. 如权利要求9所述的电子设备，其中，所述处理器，具体用于根据所述PDCP SDU中包含的所有包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
  11. 如权利要求9所述的电子设备，其中，所述处理器，具体用于如果所述用户面数据包为5G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，根据所述PDCP SDU中包含的业务数据适配协议SDAP包头和数据载荷包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I；如果否，根据所述PDCP SDU中包含的SDAP包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I。
  12. 如权利要求9所述的电子设备，其中，所述处理器，具体用于如果所述用户面数据包为4G网络的用户面数据包，识别所述用户面数据包是否为所述用户面数据包对应会话的初始用户面数据包；如果是，进行根据所述PDCPSDU中包含的包头及设定的完整性保护函数，生成所述用户面数据包的MAC-I的步骤；如果否，则结束。
  13. 如权利要求9所述的电子设备，其中，所述处理器，还用于如果所述用户面数据包为4G网络的用户面数据包，将所述MAC-I添加至所述用户面数据包中。
  14. 如权利要求13所述的电子设备，其中，所述处理器，具体用于识别所述用户面数据包中PDCP包头中的PDCP序列号，并根据所述PDCP序列号生成数据包计数值COUNT；或，当建立了接入层AS安全上下文后，设置COUNT为0，每发送或接受一个数据包COUNT的值加1；将所述COUNT和MAC-I添加至所述用户面数据包中数据载荷包头与数据载荷之间，或添加至所述用户面数据包的尾部。
  15. 如权利要求9-14中任一项所述的电子设备，其中，所述电子设备支 持的用户面数据完整性的保护策略包括：
    对于协议数据单元PDU会话上的所有流量必须进行用户面完整性保护；或，
    对于PDU会话上的所有流量的数据包包头必须进行完整性保护；或，
    只对PDU会话上的初始数据包包头必须进行完整性保护；或，
    对于PDU会话上的所有流量首选进行用户面完整性保护；或，
    对于PDU会话上的所有流量的数据包包头首选进行完整性保护；或，
    对PDU会话上的初始数据包包头首选进行完整性保护；或，
    对于PDU会话上的所有流量不进行用户面完整性保护。
  16. 一种电子设备，包括：处理器、通信接口、存储器和通信总线，其中，处理器，通信接口，存储器通过通信总线完成相互间的通信；
    所述存储器中存储有计算机程序，当所述程序被所述处理器执行时，使得所述处理器执行权利要求1-7中任一项所述方法的步骤。
  17. 一种计算机可读存储介质，其存储有可由电子设备执行的计算机程序，当所述程序在所述电子设备上运行时，使得所述电子设备执行权利要求1-7中任一项所述方法的步骤。
PCT/CN2019/107884 2018-10-16 2019-09-25 用户面数据完整性保护方法、装置、电子设备及介质 WO2020078184A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811202994.X 2018-10-16
CN201811202994.XA CN111064673B (zh) 2018-10-16 2018-10-16 一种用户面数据完整性保护方法、装置、电子设备及介质

Publications (1)

Publication Number Publication Date
WO2020078184A1 true WO2020078184A1 (zh) 2020-04-23

Family

ID=70283531

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/107884 WO2020078184A1 (zh) 2018-10-16 2019-09-25 用户面数据完整性保护方法、装置、电子设备及介质

Country Status (2)

Country Link
CN (1) CN111064673B (zh)
WO (1) WO2020078184A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115209397B (zh) * 2021-04-12 2023-08-15 中国移动通信集团河北有限公司 潜在用户终端的确定方法、装置、设备及计算机存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101651949A (zh) * 2009-08-17 2010-02-17 中兴通讯股份有限公司 一种安全模式建立的方法及无线网络控制器
US20110188408A1 (en) * 2010-02-02 2011-08-04 Lg Electronics Inc. Method of selectively applying a pdcp function in wireless communication system
CN102638328A (zh) * 2011-02-15 2012-08-15 电信科学技术研究院 一种数据传输的方法及装置
CN102932767A (zh) * 2011-08-11 2013-02-13 中兴通讯股份有限公司 一种信息传输方法、分组数据网关及策略和计费规则功能
CN105873038A (zh) * 2016-06-07 2016-08-17 武汉邮电科学研究院 一种lte基站用户面数据安全处理方法
WO2017136071A1 (en) * 2016-02-05 2017-08-10 Intel Corporation Packet data convergence protocol (pdcp) operation in a transparent mode

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9215731B2 (en) * 2007-12-19 2015-12-15 Qualcomm Incorporated Method and apparatus for transfer of a message on a common control channel for random access in a wireless communication network
JP6548348B2 (ja) * 2015-08-13 2019-07-24 ホアウェイ・テクノロジーズ・カンパニー・リミテッド メッセージ保護方法、ならびに関連デバイスおよびシステム

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101651949A (zh) * 2009-08-17 2010-02-17 中兴通讯股份有限公司 一种安全模式建立的方法及无线网络控制器
US20110188408A1 (en) * 2010-02-02 2011-08-04 Lg Electronics Inc. Method of selectively applying a pdcp function in wireless communication system
CN102638328A (zh) * 2011-02-15 2012-08-15 电信科学技术研究院 一种数据传输的方法及装置
CN102932767A (zh) * 2011-08-11 2013-02-13 中兴通讯股份有限公司 一种信息传输方法、分组数据网关及策略和计费规则功能
WO2017136071A1 (en) * 2016-02-05 2017-08-10 Intel Corporation Packet data convergence protocol (pdcp) operation in a transparent mode
CN105873038A (zh) * 2016-06-07 2016-08-17 武汉邮电科学研究院 一种lte基站用户面数据安全处理方法

Also Published As

Publication number Publication date
CN111064673B (zh) 2022-04-01
CN111064673A (zh) 2020-04-24

Similar Documents

Publication Publication Date Title
US11159361B2 (en) Method and apparatus for providing notification of detected error conditions in a network
WO2018196491A1 (zh) 上行数据解压缩、压缩的方法和装置
US9166921B2 (en) Selective packet sequence acceleration in a network environment
US9246825B2 (en) Accelerated processing of aggregate data flows in a network environment
US20180227798A1 (en) Methods and Apparatus for Optimizing Tunneled Traffic
US8792353B1 (en) Preserving sequencing during selective packet acceleration in a network environment
US9722933B2 (en) Selective packet sequence acceleration in a network environment
WO2021037216A1 (zh) 一种报文传输方法及设备、计算机存储介质
US20190312938A1 (en) Data Transmission Method And Apparatus
WO2020233249A1 (zh) 一种报文传输方法以及相关装置
CN111107581B (zh) Pdcp复制功能的确定、指示方法及装置、基站、终端
WO2022017529A1 (zh) 数据传输方法、系统、电子设备及存储介质
WO2020135011A1 (zh) 传输方法、装置、报文发送端和接收端
TW201836328A (zh) 一種協定資料單元傳輸資料的方法及裝置
US9819730B2 (en) System and method for network access based on application layer data
CN102025742A (zh) 一种ike报文的协商方法和设备
WO2020078184A1 (zh) 用户面数据完整性保护方法、装置、电子设备及介质
US11382022B2 (en) Method, apparatus, and computer program product for packet forwarding control protocol messages bundling
WO2020140842A1 (zh) 数据传输方法、设备与系统
CN106416356A (zh) 上行数据包处理方法、装置和基站
KR20170043634A (ko) 데이터 패킷의 전송 처리 방법 및 장치
US9955380B2 (en) Method and system for optimizing radio resources between UE and ENB during VoLTE call
WO2018053685A1 (zh) 数据封装方法、装置以及通信系统
TW201132081A (en) Techniques for supporting multiple protocols in wireless networks
US10715495B2 (en) Congestion control during communication with a private network

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19873274

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 29/07/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 19873274

Country of ref document: EP

Kind code of ref document: A1