WO2020151614A1 - 用户面安全保护的方法和装置 - Google Patents

用户面安全保护的方法和装置 Download PDF

Info

Publication number
WO2020151614A1
WO2020151614A1 PCT/CN2020/072961 CN2020072961W WO2020151614A1 WO 2020151614 A1 WO2020151614 A1 WO 2020151614A1 CN 2020072961 W CN2020072961 W CN 2020072961W WO 2020151614 A1 WO2020151614 A1 WO 2020151614A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
security
information
user plane
network
Prior art date
Application number
PCT/CN2020/072961
Other languages
English (en)
French (fr)
Inventor
李飞
张博
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020151614A1 publication Critical patent/WO2020151614A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels

Definitions

  • This application relates to the field of communications, and more specifically, to a method and device for user plane security protection.
  • 3GPP (3rd generation partnership project, 3GPP) defines the security gateway SEPP (security edge protection proxy, SEPP) of the control plane of the roaming interface to protect the security of the control plane. It also defines the direct connection between the vSEPP of the visited network and the hSEPP of the home network. Security policy negotiation mechanism.
  • SEPP security edge protection proxy
  • PLMN public land mobile network
  • the present application provides a method and device for user plane security protection, which can implement flexible user plane data security protection between a visited network and a home network.
  • a method for user plane security protection including: a first session management function SMF network element receives session creation request information sent by a second SMF network element, where the session creation request information includes first service information; The first SMF network element determines security policy information according to the first service information; the first SMF network element sends security policy information to the first user plane security network element; the security policy information is used for the first user plane. The security network element generates security context information according to the security policy information; wherein the first SMF network element and the first user plane security network element belong to a home network, and the second SMF network element belongs to a visited network.
  • the first user plane security network element may be a user plane SEPP-U network element or a user plane function UPF network element.
  • the home network SMF network element can reuse the RAN side security policy information in the UE subscription data obtained from the unified data manager (UDM), or the newly added UE is on the SEPP-U side of UDM Security policy subscription data, or the home network SMF network element determines the security policy information according to the first service information, or vSMF sends the UE's new application layer related parameters to hSMF, and hSMF makes security policy decisions based on the UE's new application layer related parameters .
  • UDM unified data manager
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • the first service information includes data network name DNN information and/or network slice selection NSSAI information.
  • the security policy information includes first indication information and second indication information, wherein the first indication information is used to indicate the first user plane safety net Whether the element uses an encryption algorithm for data encryption protection, and the second indication information is used to indicate whether the first user plane security network element uses an integrity protection algorithm for data integrity protection.
  • the security policy information includes security context information, and the security context information is used to indicate whether the user plane security network element performs encryption protection and/or whether to perform integrity protection.
  • the security context information may instruct the user plane security network element to perform user plane data encryption, or user plane data integrity protection, or user plane data encryption and user plane data integrity protection, or not to perform user plane data encryption and user plane data. Integrity protection.
  • the security context information includes a first security context and a second security context; the first security context and the first tunnel identification information have a mapping relationship, and the first security context The second security context has a mapping relationship with the second tunnel identification information.
  • the first user plane security network element is a first user plane function UPF network element
  • the method further includes: the first SMF network element transmits to the second SMF network element Send session creation response information, where the session creation response information is used to instruct the second SMF network element to send security policy information to the second UPF network element, where the first UPF network element belongs to the home network, and the second UPF network element Belongs to the access network.
  • the home network SMF network element determines the security policy information according to the first service information, the home network SMF network element sends the security policy information to the user plane security network element, and the user plane security network element generates a security context based on the security policy information Information, the security context information and the tunnel identification information have a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context and the tunnel identification information.
  • a method for user plane security protection including: a first user plane security network element receives security policy information sent by a first SMF network element; the first user plane security network element is based on the security policy The information generates security context information, the security context information has a mapping relationship with tunnel identification information, and the security context information is used for data security protection of a first user plane security network element; wherein, the first user plane security network element, The first SMF network element belongs to the home network.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • the first service information includes data network name DNN information and/or network slice selection NSSAI information.
  • the security policy information includes first indication information and second indication information, wherein the first indication information is used to indicate the first user plane safety net Whether the element uses an encryption algorithm for data encryption protection, and the second indication information is used to indicate whether the first user plane security network element uses an integrity protection algorithm for data integrity protection.
  • the security policy information includes security context information, and the security context information is used to indicate whether the user plane security network element performs encryption protection and/or whether to perform integrity protection.
  • the security context information may instruct the user plane security network element to perform user plane data encryption, or user plane data integrity protection, or user plane data encryption and user plane data integrity protection, or not to perform user plane data encryption and user plane data. Integrity protection.
  • the first user plane security network element is a first UPF network element
  • the method further includes: the first UPF network element and the The mapping relationship of the first security context uses the first security context to perform data security protection on the first downlink data.
  • the security context information includes a first security context and a second security context; the first security context and the first tunnel identification information have a mapping relationship, and the first security context The second security context has a mapping relationship with the second tunnel identification information.
  • the first user plane security network element is a first security boundary protection agent SEPP-U network element
  • the method further includes: the first SEPP-U network element
  • the second SEPP-U network element sends security policy information, where the security policy information is used to instruct the second SEPP-U network element to generate security context information according to the mapping relationship between security policy information and service information; the security context information is used for the first
  • the second SEPP-U network element performs data security protection, where the first SEPP-U network element belongs to a home network, and the second SEPP-U network element belongs to a visited network.
  • the first user plane security network element is a first security boundary protection agent SEPP-U network element
  • the method further includes: the first SEPP-U network element receives The first downlink data sent by the first UPF network element in the first tunnel; according to the mapping relationship between the first tunnel identification information and the first security context, the first security context is used to perform data security on the first downlink data protection.
  • the home network SMF network element determines the security policy information according to the first service information, the home network SMF network element sends the security policy information to the user plane security network element, and the user plane security network element generates a security context based on the security policy information Information, the security context information and the tunnel identification information have a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context and the tunnel identification information.
  • the present application provides a device for user plane security protection, which can implement the functions performed by the SMF in the method involved in the first aspect above.
  • the functions can be implemented by hardware, or by hardware.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the structure of the device includes a processor and a communication interface, and the processor is configured to support the device to perform corresponding functions in the foregoing method.
  • the communication interface is used to support communication between the device and other devices.
  • the device may also include a memory, which is used for coupling with the processor, and stores the program instructions and data necessary for the device to realize the above-mentioned functions.
  • the device includes a processing unit and a communication unit, and the communication unit is configured to receive session creation request information sent by a second SMF network element, where the session creation request information includes first service information; the processing unit Used for determining security policy information according to the first service information; the communication unit sends security policy information to the first user plane security network element; the security policy information is used by the first user plane security network element according to the security policy information Generate security context information; wherein the first user plane security network element belongs to the home network, and the second SMF network element belongs to the visited network.
  • the first service information includes data network name DNN information and/or network slice selection NSSAI information.
  • the business information #E and the security policy information #S have a mapping relationship
  • the security policy information #S and the security context information #A have a mapping relationship
  • the security context information #A and the tunnel identification information #T There is a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context #A and the tunnel identification information #T.
  • the security policy information includes first indication information and second indication information, where the first indication information is used to indicate whether the first user plane security network element adopts an encryption algorithm for data encryption protection, and the second indication information is used to indicate whether the first user plane security network element adopts an integrity protection algorithm for data integrity protection.
  • the security policy information includes security context information, and the security context information is used to indicate whether the user plane security network element performs encryption protection and/or whether to perform integrity protection.
  • the security context information may instruct the user plane security network element to perform user plane data encryption, or user plane data integrity protection, or user plane data encryption and user plane data integrity protection, or not to perform user plane data encryption and user plane data. Integrity protection.
  • the communication unit is further configured to: send session creation response information to the second SMF network element, where the session creation response information is used to instruct the second SMF network element to send security policy information to the second UPF network element, where The second UPF network element belongs to the visited network.
  • the present application provides a device for user plane security protection, which can implement the functions performed by the UPF in the methods involved in the above aspects.
  • the functions can be implemented by hardware, or corresponding software can be executed by hardware.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the structure of the device includes a processor and a communication interface, and the processor is configured to support the device to perform corresponding functions in the foregoing method.
  • the communication interface is used to support communication between the device and other devices.
  • the device may also include a memory, which is used for coupling with the processor, and stores the program instructions and data necessary for the device to realize the above-mentioned functions.
  • the device includes a processing unit and a communication unit.
  • the communication unit is configured to receive security policy information sent by a first SMF network element, where the security policy information has a mapping relationship with the first service information;
  • the security policy information generates security context information, and the security context information is used for the first user plane security network element to perform data security protection; wherein, the first user plane security network element and the first SMF network element belong to a home network.
  • the home network SMF network element can reuse the RAN side security policy information in the UE subscription data obtained from UDM, or add new UE security policy subscription data on the SEPP-U side of UDM, or the home network SMF network
  • the element determines the security policy information according to the first service information, or the vSMF sends the UE's new application layer related parameters to the hSMF, and the hSMF makes the security policy decision based on the UE's new application layer related parameters.
  • the first service information includes data network name DNN information and/or network slice selection NSSAI information.
  • the business information #E and the security policy information #S have a mapping relationship
  • the security policy information #S and the security context information #A have a mapping relationship
  • the security context information #A and the tunnel identification information #T There is a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context #A and the tunnel identification information #T.
  • the security policy information #S includes first indication information and second indication information, where the first indication information is used to indicate whether the first user plane security network element adopts an encryption algorithm for data encryption protection, The second indication information is used to indicate whether the first user plane security network element adopts an integrity protection algorithm for data integrity protection.
  • the security policy information includes security context information, and the security context information is used to indicate whether the user plane security network element performs encryption protection and/or whether to perform integrity protection.
  • the security context information can instruct the user plane security network element to perform user plane data encryption, or user plane data integrity protection, or user plane data encryption and user plane data integrity protection, or not to perform user plane data encryption and user plane data. Integrity protection.
  • the communication unit is further configured to: send security policy information to the second user plane security network element, where the security policy information is used to instruct the second user plane security network element to map the security policy information to the service information
  • the relationship generates security context information; the security context information is used for a second user plane security network element to perform data security protection, wherein the second user plane security network element belongs to an access network.
  • the communication unit is further configured to: receive the first downlink data sent by the first UPF network element in the first tunnel; and adopt the first security according to the mapping relationship between the first tunnel identification information and the first security context.
  • the context performs data security protection on the first downlink data.
  • the communication unit is further configured to: use the first security context to perform data security protection on the first downlink data according to the mapping relationship between the first tunnel identification information and the first security context; and send data to the second UPF network element Send the first downlink data, where the second UPF network element belongs to a visited network.
  • the present application provides a computer storage medium for storing computer software instructions used for the above-mentioned SMF, which contains the program designed for executing the above-mentioned first aspect.
  • this application provides a computer storage medium for storing computer software instructions used for the above UPF or SEPP-U, which contains the program designed for executing the above second aspect.
  • the present application provides a communication chip in which instructions are stored, and when it runs on the SMF, the communication chip controls the SMF to execute the method of the first aspect.
  • the present application provides a communication chip in which instructions are stored, and when it runs on UPF or SEPP-U, the communication chip controls the UPF to execute the method of the second aspect.
  • the present application provides a computer program product, the computer program product comprising: computer program code, when the computer program code is executed by the communication unit and the processing unit of the communication device, the communication device executes the first aspect The methods involved.
  • this application provides a computer program product, the computer program product comprising: computer program code, when the computer program code is executed by the communication unit and the processing unit of the communication device, the communication device executes the second aspect The methods involved.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • FIG. 1 is a schematic diagram of a network architecture of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 2 is a schematic interaction diagram of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a user plane security protection method provided by an embodiment of the present application.
  • Fig. 5 is a schematic interaction diagram of a user plane security protection method provided by an embodiment of the present application.
  • Fig. 6 is a schematic interaction diagram of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 7 is a schematic interaction diagram of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 8 is a schematic interaction diagram of a user plane security protection method provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of a possible SMF network element provided by an embodiment of the present application.
  • Fig. 10 is a schematic structural diagram of another possible SMF network element provided by an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a possible user plane security network element according to an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of another possible user plane security network element according to an embodiment of the present application.
  • GSM global system for mobile communications
  • CDMA code division multiple access
  • WCDMA broadband code division multiple access
  • GPRS general packet radio service
  • LTE long term evolution
  • FDD frequency division duplex
  • TDD LTE Time division duplex
  • UMTS universal mobile telecommunication system
  • WiMAX worldwide interoperability for microwave access
  • the embodiments of the application do not specifically limit the specific structure of the execution body of the method provided in the embodiments of the application, as long as the program that records the code of the method provided in the embodiments of the application can be executed according to the embodiments of the application.
  • the provided method is sufficient for communication.
  • the execution subject of the method provided in the embodiment of the present application may be a terminal or a network device, or a functional module in a UE or a network device that can call and execute the program.
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided in the embodiment of the present application.
  • the network architecture may be a home routed architecture, for example.
  • the network architecture may specifically include the following network elements:
  • User equipment it can be called terminal equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, wireless communication equipment, User agent or user device.
  • the UE can also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), and a wireless communication function Handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the future 5G network or terminals in the future evolved public land mobile network (PLMN) Devices, etc., can also be end devices, logical entities, smart devices, such as mobile phones, smart terminals and other terminal devices, or servers, gateways, base stations, controllers and other communication devices, or IoT devices, such as sensors, electricity meters, water meters, etc. Internet of things (IoT) devices. This embodiment of the application does not limit this.
  • IoT Internet of things
  • the UE stores a long-term key (long-term key).
  • long-term key When the UE performs two-way authentication with core network elements (for example, the AMF entity and the AUSF entity described below), the long-term key and related functions are used to verify the authenticity of the network, thereby ensuring the security of data transmission.
  • Access network Provides network access functions for authorized users in a specific area, and can use transmission tunnels of different qualities according to user levels and service requirements.
  • the access network may be an access network using different access technologies.
  • 3rd Generation Partnership Project 3rd Generation Partnership Project, 3GPP
  • 3GPP access technologies such as those used in 3G, 4G or 5G systems
  • non-3GPP non-third-generation cooperation Partnership Project
  • 3GPP access technology refers to the access technology that conforms to the 3GPP standard specifications.
  • the access network that adopts the 3GPP access technology is called the radio access network (Radio Access Network, RAN).
  • the access network equipment in the 5G system is called Next generation Node Base station (gNB).
  • gNB Next generation Node Base station
  • a non-3GPP access technology refers to an access technology that does not comply with the 3GPP standard specifications, for example, an air interface technology represented by an access point (AP) in wifi.
  • AP access point
  • An access network that implements access network functions based on wireless communication technology may be called a radio access network (RAN).
  • the wireless access network can manage wireless resources, provide access services for the terminal, and then complete the forwarding of control signals and user data between the terminal and the core network.
  • the radio access network may be, for example, a base station (NodeB), an evolved NodeB (eNB or eNodeB), a base station (gNB) in a 5G mobile communication system, a base station in a future mobile communication system, or an AP in a WiFi system, etc. It can also be a wireless controller in a cloud radio access network (CRAN) scenario, or the access network device can be a relay station, an access point, a vehicle-mounted device, a wearable device, and a network in the future 5G network Equipment or network equipment in the future evolved PLMN network, etc.
  • CRAN cloud radio access network
  • the embodiment of the present application does not limit the specific technology and specific device form adopted by the radio access network device.
  • Access and mobility management function (AMF) entities mainly used for mobility management and access management, etc., and can be used to implement mobility management entity (mobility management entity, MME) functions in addition to sessions Functions other than management, such as lawful interception, or access authorization (or authentication) functions. In the embodiment of this application, it can be used to realize the functions of access and mobility management network elements.
  • MME mobility management entity
  • Session management function (SMF) entity mainly used for session management, UE's Internet Protocol (IP) address allocation and management, selection of manageable user plane functions, policy control, or charging function interfaces End point and downlink data notification, etc. In the embodiment of this application, it can be used to realize the function of the session management network element.
  • IP Internet Protocol
  • User plane function (UPF) entity that is, data plane gateway. It can be used for packet routing and forwarding, or quality of service (QoS) processing of user plane data, etc.
  • User data can be connected to a data network (DN) through this network element. In the embodiment of this application, it can be used to realize the function of the user plane gateway.
  • DN data network
  • Data network a network used to provide data transmission.
  • DN Data network
  • the network of the operator's business the Internet network
  • the business network of a third party the network of a third party.
  • Authentication server function authentication server function, AUSF
  • AUSF authentication server function
  • Network exposure function (NEF) entity used to safely open services and capabilities provided by 3GPP network functions to the outside.
  • Network storage function (NF) repository function (NRF) entity used to store network function entities and description information of the services they provide, and support service discovery, network element entity discovery, etc.
  • PCF Policy control function
  • Unified data management (UDM) entity used to process user identification, access authentication, registration, or mobility management, etc.
  • Application function (AF) entity used to route data affected by applications, access network open function network elements, or interact with policy frameworks for policy control, etc.
  • the N1 interface is the reference point between the terminal and the AMF entity
  • the N2 interface is the reference point of the SMF and UPF entities, used for non-access stratum (NAS) message transmission, etc.
  • N3 The interface is the reference point between the (R)AN and the UPF entity, used to transmit user plane data, etc.
  • the N4 interface is the reference point between the SMF entity and the UPF entity, used to transmit, for example, the tunnel identification information and data of the N3 connection Cache indication information, downlink data notification message and other information
  • N6 interface is the reference point between UPF entity and DN, used to transmit user plane data, etc.
  • the above-mentioned network architecture applied to the embodiment of the present application is only an example of a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture, and the network architecture applicable to the embodiment of the present application is not limited to this. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiments of the present application.
  • AMF entity, SMF entity, UPF entity, NSSF entity, NEF entity, AUSF entity, NRF entity, PCF entity, and UDM entity shown in Figure 1 can be understood as network elements used to implement different functions in the core network. , For example, can be combined into network slices on demand. These core network elements may be independent devices, or they may be integrated in the same device to implement different functions, which is not limited in this application.
  • the entity used to implement AMF is referred to as the access and mobility management network element
  • the entity used to implement SMF is referred to as the session management network element
  • the entity used to implement UPF is referred to as the user plane gateway.
  • the entity used to implement the UDM function is recorded as a unified data management network element
  • the entity used to implement the PCF is recorded as a policy control network element.
  • the name of the interface between the various network elements in FIG. 1 is only an example, and the name of the interface in a specific implementation may be other names, which is not specifically limited in this application.
  • the name of the message (or signaling) transmitted between the various network elements is only an example, and does not constitute any limitation on the function of the message itself.
  • 3GPP defines the security gateway SEPP-U of the roaming interface control plane to protect the security of the control plane. It also defines the direct security policy negotiation mechanism between vSEPP-U of the visited network and hSEPP-U of the home network. In the home-routed roaming scenario, there is no similar security mechanism between vUPF and hUPF across PLMN for protection.
  • the N9 interface between UPF in 3GPP 33.501 adopts the NDS/IP protection method, and the user plane security protection method Single, it is impossible to adopt corresponding security protection strategies according to business needs. Therefore, how to adopt a flexible user plane security protection strategy has become an urgent problem to be solved. Therefore, how to select and transfer user-plane security policies, determine user-plane security keys and algorithm negotiation, and establish a mapping relationship between user-plane security policies and user-plane session identification information has become an important issue to be solved urgently.
  • the access network user plane function UPF network element and the home network user plane function UPF network element are respectively denoted as vUPF network element and hUPF network element
  • the functional SMF network elements are respectively denoted as vSMF network elements and hSMF network elements.
  • the visiting network security boundary protection agent SEPP-U network element and the home network security boundary protection agent SEPP-U network element are respectively recorded as vSEPP-U network element and hSEPP- U network element, among which SEPP-U network element is used for roaming interface security.
  • the user plane security protection method of this application can be applied to 5G Home-routed scenarios, the user plane security protection between the visiting network vPLMN and the home network hPLMN mainly includes the following situations:
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the user plane function UPF network element (vUPF network element, hUPF network element) does not introduce a user plane security gateway, the user plane function UPF network element can generate security context information #A according to the security policy information #S.
  • the user plane UPF network element when the user plane UPF network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • Fig. 2 shows a schematic interaction diagram of a security protection method according to an embodiment of the present application.
  • SMF network element #2 sends protocol data unit PDU (Protocol Data Unit, PDU) session creation request information to SMF network element #1, and the PDU session creation request information includes service information #E.
  • PDU Protocol Data Unit
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the SMF network element #2 determines the security policy information #S according to the service information #E, and the service information #E includes data network name information DNN and network slice selection information NSSAI.
  • the home network SMF network element can reuse the RAN side security policy information in the UE subscription data obtained from the unified data manager (UDM), or the newly added UE is on the SEPP-U side of UDM Security policy subscription data, or the home network SMF network element determines the security policy information according to the first service information, or vSMF sends the UE's new application layer related parameters to hSMF, and hSMF makes security policy decisions based on the UE's new application layer related parameters .
  • UDM unified data manager
  • the SMF network element #1 sends the security policy information #S to the user plane security network element #1.
  • the security policy information includes user plane encryption instruction information and user plane integrity protection instruction information.
  • the user plane encryption instruction information is used to indicate whether the user plane security network element #1 adopts an encryption algorithm
  • the user plane integrity protection algorithm is used to indicate whether the user plane security network element #1 adopts an integrity protection algorithm.
  • the security policy information #S includes security context information #A, which is used to indicate whether the user plane security network element performs encryption protection, and/or whether to perform integrity protection.
  • the user plane security network element #1 In S204, the user plane security network element #1 generates security context information #A according to the security policy information #S, and the security context information #A is used for the user plane security network element #1 to use the corresponding encryption algorithm and integrity protection algorithm for data safety protection.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the data security protection method of the present application can be applied to 5G Home-routed scenarios to realize user plane security protection between the visited network vPLMN and the home network hPLMN.
  • the user plane security network element #1 and user plane security network element #2 are home network UPF network elements and access network UPF network elements respectively; or, the user plane security network element #1, user plane security network elements #2 are the home network SEPP-U network element and the visited network SEPP-U network element respectively.
  • the SEPP-U network element (SEPP-U network element #1, SEPP-U network element #2) can be used according to the security policy Information #S generates security context information #A.
  • SEPP-U network element #1 belongs to the home network
  • SEPP-U network element #2 belongs to the visited network.
  • SEPP-U network element #1 generates security context information #A according to security policy information #S, and the security context information #A is used for user plane security network element #1 to use corresponding encryption algorithms and integrity protection algorithms for data safety protection.
  • SEPP-U network element #1 generates security context information #A according to security policy #S, and SEPP-U network element #1 sends security context information #A to SEPP-U network element #2; or, SEPP-U Network element #1 generates security context information #A according to security policy #S, SEPP-U network element #1 sends security policy information #S to SEPP-U network element #2, and SEPP-U network element #2 according to security policy #S Generate security context information #A.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information #A and the tunnel identification information to perform security protection during data transmission.
  • the SEPP-U network element of the home network receives the downlink data #1, and uses the security context information #A1 to perform data on the downlink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information H-CN-Tunnel#1 safety protection.
  • the SEPP-U network element of the access network receives upper and lower data #1, and uses the security context information #A1 to perform data on the uplink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information V-CN-Tunnel#1 safety protection.
  • SMF network element #1 sends a session creation response message to SMF network element #2.
  • the user plane function UPF network element (UPF network element #1, UPF network element #2) does not introduce a user plane security gateway
  • the user plane function UPF network element can generate security context information #A according to the security policy information #S.
  • UPF network element #1 In S204, UPF network element #1 generates security context information #A based on security policy information #S, and the security context information #A is used for user plane security network element #1 to use corresponding encryption algorithms and integrity protection algorithms for data security protection .
  • SMF network element #1 sends session creation response information to SMF network element #2, and the session creation response information is used to instruct SMF network element #2 to send security policy information #S to UPF network element #2, where UPF network element #2 belongs to the access network.
  • UPF network element #2 generates security context information #A according to security policy information #S, and the security context information #A is used for user plane security network element #2 to use corresponding encryption algorithms and integrity protection algorithms for data security protection .
  • the UPF network element when the user-plane function UPF network element receives user-plane UPF data, the UPF network element activates user-plane security and enables downstream data encryption and/or integrity protection; or, uses the corresponding security context to enable upstream data decryption And/or integrity protection verification. That is, the UPF network element selects the corresponding security context according to the mapping relationship between the security context information #A and the tunnel identification information, and performs security protection during data transmission.
  • the SEPP-U network element of the home network receives the downlink data #1, and uses the security context information #A1 to perform data on the downlink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information H-CN-Tunnel#1 safety protection.
  • the SEPP-U network element of the access network receives upper and lower data #1, and uses the security context information #A1 to perform data on the uplink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information V-CN-Tunnel#1 safety protection.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • the security policy forwarding path of the access network includes the following situations:
  • hSMF-hSEPP-vSEPP that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to vSEPP through hSEPP.
  • hSMF—hSEPP-C—vSEPP-C—vSMF—vSEPP-U that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to vSEPP through hSEPP-C—vSEPP-C—vSMF.
  • hSMF-hUPF-hSEPP-U-vSEPP-U that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to vSEPP through hSEPP.
  • hSMF—hSEPP-C—vSEPP-C—vSMF—vUPF—vSEPP-U that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to vSEPP through hSEPP-C—vSEPP-C—vSMF—vUPF .
  • the security policy forwarding path of the home network includes the following situations:
  • hSMF-hSEPP that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to hSEPP.
  • hSMF-hUPF-hSEPP-U that is, the user plane security policy is decided by hSMF, and hSMF forwards the security policy to hSEPP.
  • Fig. 3 shows a schematic flowchart of a security protection method according to an embodiment of the present application.
  • SMF network element #2 receives the session creation request information sent by SMF network element #1, where the session creation request information includes service information #E. Among them, SMF network element #2 belongs to the home network, and SMF network element #1 belongs to the visited network.
  • the service information #E includes data network name information (data network name, DNN), network slice selection information (network slice selection assistance information, NSSAI).
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the SMF network element #2 determines the security policy information #S according to the service information #E.
  • the security policy information #S is sent to the home network user plane security network element; the security policy information is used by the home network user plane security network element to generate security context information #A according to the security policy information #S.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • FIG. 4 shows a schematic flowchart of a security protection method according to an embodiment of the present application.
  • the security policy information #S sent by the SMF network element of the home network is received, and the security policy information #S and the service information #E have a mapping relationship.
  • the security policy information #S includes indication information #1 and indication information #2, where the indication information #1 is used to indicate whether the user plane security network element #1 adopts an encryption algorithm for data encryption protection, so The indication information #2 is used to indicate whether the user plane security network element #1 adopts an integrity protection algorithm for data integrity protection.
  • the security context information #A is generated according to the mapping relationship between the security policy information #S and the business information #E, and the security context information #E is used for the home network user plane security network element to perform data security protection.
  • the security context information #A is used for user plane security network element #1 to use corresponding encryption algorithms and integrity protection algorithms for data security protection.
  • the security context information may instruct the user plane security network element to perform user plane data encryption, or user plane data integrity protection, or user plane data encryption and user plane data integrity protection, or not to perform user plane data encryption and user plane data. Integrity protection.
  • the SEPP-U network element (SEPP-U network element #1, SEPP-U network element #2) can be used according to the security policy Information #S generates security context information #A.
  • SEPP-U network element #1 belongs to the home network
  • SEPP-U network element #2 belongs to the visited network.
  • the SEPP-U network element #1 generates security context information #A according to the security policy information #S, and the security context information #A is used for the user plane security network element #1 to use corresponding encryption algorithms and integrity protection algorithms for data security protection.
  • SEPP-U network element #1 generates security context information #A according to security policy #S, and SEPP-U network element #1 sends security context information #A to SEPP-U network element #2; or, SEPP-U Network element #1 generates security context information #A according to security policy #S, SEPP-U network element #1 sends security policy information #S to SEPP-U network element #2, and SEPP-U network element #2 according to security policy #S Generate security context information #A.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information #A and the tunnel identification information to perform security protection during data transmission.
  • the SEPP-U network element of the home network receives the downlink data #1, and uses the security context information #A1 to perform data on the downlink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information H-CN-Tunnel#1 safety protection.
  • the SEPP-U network element of the access network receives upper and lower data #1, and uses the security context information #A1 to perform data on the uplink data #1 according to the mapping relationship between the security context information #A1 and the tunnel identification information V-CN-Tunnel#1 safety protection.
  • the user plane function UPF network element (UPF network element #1, UPF network element #2) does not introduce a user plane security gateway
  • the user plane function UPF network element can generate security context information #A according to the security policy information #S.
  • UPF network element #1 generates security context information #A according to security policy information #S, and the security context information #A is used for user plane security network element #1 to use corresponding encryption algorithms and integrity protection algorithms for data security protection.
  • UPF network element #2 generates security context information #A according to security policy information #S, and the security context information #A is used for user plane security network element #2 to use corresponding encryption algorithms and integrity protection algorithms for data security protection.
  • the UPF network element when the user-plane function UPF network element receives user-plane UPF data, the UPF network element activates user-plane security and turns on downstream data encryption and/or integrity protection; or, uses the corresponding security context to turn on upstream data decryption And/or integrity protection verification. That is, the UPF network element selects the corresponding security context according to the mapping relationship between the security context information #A and the tunnel identification information, and performs security protection during data transmission.
  • UPF network element #1 uses security context information #A1 to protect downlink data #1 according to the mapping relationship between security context information #A1 and tunnel identification information H-CN-Tunnel#1, and UPF network element #1 UPF network element #2 sends downlink data #1.
  • UPF network element #2 uses the security context information #A1 to perform data security protection for downlink data #1 according to the mapping relationship between security context information #A1 and tunnel identification information H-CN-Tunnel#1, and UPF network element #2 UPF network element #1 sends uplink data #1.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • FIG. 5 shows a schematic interaction diagram of a security protection method according to an embodiment of the present application.
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the vSMF network element obtains V-CN-Tunnel information of the vUPF network element, and the V-CN-Tunnel information is tunnel identification information used by the vUPF network element for uplink data transmission.
  • the tunnel identification information may also become the tunnel identification information.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the PDU session creation request information includes: PDU session identification information and V-CN-Tunnel information of the vUPF network element.
  • the PDU session creation request information is used to establish vUPF. The secure session between the network element and the hUPF network element.
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the vSMF network element and the hSMF network element belong to the visited network and the home network respectively; the vUPF network element and the hUPF network element belong to the visited network and the home network respectively.
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the hSMF network element determines the security policy information #S of the vUPF network element and the hUPF network element.
  • the hSMF network element obtains the tunnel information H-CN-Tunnel of the hUPF network element, and the tunnel information H-CN-Tunnel is used for the hUPF network element to send downlink data to the vUPF network element.
  • the hSMF network element determines the security policy information #S of the vUPF network element and the hUPF network element, including the security algorithm and the security key.
  • the security policy information #S is used to instruct the SEPP-U network element to select a corresponding security context to determine whether to enable user plane encryption protection and/or user plane integrity protection.
  • the SEPP-U network element determines the security context #A according to the security policy information #S, selects an encryption algorithm to enable user plane encryption protection, and selects an integrity protection algorithm to enable user plane integrity protection.
  • the security policy information #S is used by the SEPP-U network element to select a corresponding security context according to the mapping relationship between the security context #A and the tunnel identification information to enable different types of security protection.
  • the security policy information #S is used by the SEPP-U network element to select corresponding security context identification information according to the mapping relationship between the security context #A and the tunnel identification information to enable different types of security protection.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the SEPP-U network element activates user plane security and turns on downlink data encryption and/or integrity protection; or, adopts corresponding security
  • the context enables upstream data decryption and/or integrity protection verification.
  • the embodiments of the present application do not limit the user plane security policy to only include whether user plane integrity protection needs to be activated, and user plane encryption protection needs to be activated, that is, the security policy can include more content, such as suggestions The algorithm strength and so on.
  • the home network SMF network element may reuse the RAN side security policy information in the UE subscription data obtained from UDM, or add new UE security policy subscription data on the SEPP-U side of UDM, or the home network
  • the SMF network element determines the security policy information according to the service information #E, or the vSMF sends the UE's new application layer related parameters to the hSMF, and the hSMF makes the security policy decision based on the UE's new application layer related parameters.
  • the hSMF network element sends the security policy information #S to the hSEPP-U network element.
  • the hSMF network element sends the security policy information #S to the hSEPP-U network element, and the security policy information #A stores the mapping relationship between the security policy information #S and the V-CN-Tunnel and H-CN-Tunnel.
  • V-CN-Tunnel information is used for uplink data transmission between vUPF network elements and hUPF network elements
  • H-CN-Tunnel information is used for downlink data transmission between vUPF network elements and hUPF network elements.
  • the hSEPP-U network element sends security policy information #S to the vSEPP-U network element.
  • the hSEPP-U network element sends the security policy information #S to the vSEPP-U network element, and the security policy information #A stores the mapping relationship between the security policy information #S and V-CN-Tunnel and H-CN-Tunnel.
  • the hSEPP-U network element and the vSEPP-U network element determine the security context information according to the security policy information #S.
  • the vSEPP-U network element and hSEPP-U network element determine the security context information according to the security policy information #S.
  • the security context information includes security context A#1, security context A#2, and security context A#1 for vUPF network elements.
  • V-CN-Tunnel transmits downlink data
  • security context A#2 is used for hUPF network elements to transmit uplink data in H-CN-Tunnel.
  • security context A#1 and security context A#2 are used for security protection during data transmission between vUPF network elements and hUPF network elements.
  • hSEPP and vSEPP respectively establish the mapping relationship between security context information and H-CN-Tunnel-Info and V-CN-Tunnel-Info, so as to select the corresponding security context for data transmission during downlink data transmission or uplink data transmission. safety protection.
  • the SEPP-U negotiates the security context information, it allocates the corresponding security context content (context) for the security context information, and establishes the security context identification information (context ID) and tunnel information H-CN-Tunnel-Info, V-CN -Tunnel-Info mapping relationship.
  • SEPP-U when SEPP-U receives UPF data, SEPP-U selects the corresponding security context for data security protection according to the UPF tunnel information CN-Tunnel-Info, or according to CN-Tunnel-Info and security context identification information ( context ID) mapping relationship, select the corresponding security context (context) for data security protection.
  • the hSMF network element sends a PDU session creation response message to the vSMF network element to establish a secure session between the vUPF network element and the hUPF network element.
  • the hSMF network element sends PDU session creation response information to the vSMF network element.
  • the PDU session creation request information includes: PDU session identification information and H-CN-Tunnel information of the hUPF network element.
  • the PDU session creation request information is used to establish the vUPF network element. Secure conversation with hUPF network element.
  • data security protection is performed according to the mapping relationship between the security context information and the tunnel identification information.
  • the vUPF network element sends uplink data #1 to the vSEPP-U network element.
  • vSEPP-U uses security context A#1 to uplink data# 1 Perform data security protection;
  • vSEPP-U network element sends uplink data #1 to hSEPP-U network element, and
  • hSEPP-U network element sends uplink data #1 to hUPF network element.
  • the hUPF network element sends downlink data #1 to the hSEPP-U network element.
  • hSEPP-U uses security context A#1 to downlink data# 1 Perform data security protection;
  • hSEPP-U network element sends downlink data #1 to vSEPP-U network element, and
  • vSEPP-U network element sends downlink data #1 to vUPF network element.
  • SEPP-U when SEPP-U receives UPF data, SEPP-U selects the corresponding security context for data security protection according to the UPF tunnel information CN-Tunnel-Info, or according to CN-Tunnel-Info and security context identification information (context ID) mapping relationship, select the corresponding security context (context) for data security protection.
  • UPF tunnel information CN-Tunnel-Info or according to CN-Tunnel-Info and security context identification information (context ID) mapping relationship, select the corresponding security context (context) for data security protection.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • Fig. 6 shows a schematic interaction diagram of a security protection method according to an embodiment of the present application.
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the vSMF network element obtains V-CN-Tunnel information of the vUPF network element, and the V-CN-Tunnel information is tunnel identification information used by the vUPF network element for uplink data transmission.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the PDU session creation request information includes: PDU session identification information and V-CN-Tunnel information of the vUPF network element.
  • the PDU session creation request information is used to establish vUPF. The secure session between the network element and the hUPF network element.
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the vSMF network element and the hSMF network element belong to the visited network and the home network respectively; the vUPF network element and the hUPF network element belong to the visited network and the home network respectively.
  • the hSMF network element obtains the tunnel information H-CN-Tunnel of the hUPF network element.
  • the hSMF network element obtains the H-CN-Tunnel information of the hUPF network element.
  • the hSMF network element sends service information #E to the hSEPP-U network element, and the service information #E includes: NSSAI information and or DNN information, V-CN-Tunnel information, and H-CN-Tunnel information.
  • V-CN-Tunnel information is used for uplink data transmission between vUPF network elements and hUPF network elements
  • H-CN-Tunnel information is used for downlink data transmission between vUPF network elements and hUPF network elements.
  • the hSMF network element can forward service information #E, tunnel information V-CN-Tunnel, H-CN-Tunnel to the hSEPP network element; hSEPP determines the security policy information according to the service information #E S.
  • the hSMF network element may forward the newly added parameters of the UE to the hSEPP network element, and the hSEPP network element determines the security policy information #S according to the newly added parameters of the UE.
  • the hSEPP-U network element determines the security policy information #S according to the service information #E, including the security algorithm and the security key.
  • the security policy information #S is used to instruct the SEPP-U network element to select a corresponding security context to determine whether to enable user plane encryption protection and/or user plane integrity protection.
  • the SEPP-U network element determines the security context #A according to the security policy information #S, selects an encryption algorithm to enable user plane encryption protection, and selects an integrity protection algorithm to enable user plane integrity protection.
  • the security policy information #S is used by the SEPP-U network element to select the corresponding security context according to the mapping relationship between the security context #A and the tunnel identification information to enable different types of security protection.
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element activates user plane security and enables downlink data encryption and/or integrity protection; or, uses the corresponding security context to enable the uplink Data decryption and/or integrity protection verification.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • hSEPP-U determines security policy information #S according to business information #E
  • hSEPP-U returns security policy information #S to hSMF
  • hSMF sends security policy information #S to vSEPP-U
  • hSEPP -U After determining the security policy information #S according to the business information #E, hSEPP-U sends the security policy information #S to vSEPP-U.
  • the hSEPP-U network element sends the security policy information #S to the vSEPP-U network element.
  • the security policy information #A stores the mapping relationship between the security policy information #S and the V-CN-Tunnel and H-CN-Tunnel.
  • the hSEPP-U network element and the vSEPP-U network element determine the security context information according to the security policy information #S.
  • the vSEPP-U network element and hSEPP-U network element determine the security context information according to the security policy information #S.
  • the security context information includes security context A#1, security context A#2, and security context A#1 for vUPF network elements.
  • V-CN-Tunnel transmits downlink data
  • security context A#2 is used for hUPF network elements to transmit uplink data in H-CN-Tunnel.
  • mapping relationship between the security context information and the V-CN-Tunnel and H-CN-Tunnel is established.
  • hSEPP and vSEPP respectively establish the mapping relationship between security context information and H-CN-Tunnel-Info and V-CN-Tunnel-Info, so as to select the corresponding security context for data transmission during downlink data transmission or uplink data transmission. safety protection.
  • the SEPP-U negotiates the security context information, it allocates the corresponding security context content (context) for the security context information, and establishes the security context identification information (context ID) and tunnel information H-CN-Tunnel-Info, V-CN -Tunnel-Info mapping relationship.
  • SEPP-U when SEPP-U receives UPF data, SEPP-U selects the corresponding security context for data security protection according to the UPF tunnel information CN-Tunnel-Info, or according to CN-Tunnel-Info and security context identification information ( context ID) mapping relationship, select the corresponding security context (context) for data security protection.
  • the hSMF network element sends a PDU session creation response message to the vSMF network element to establish a secure session between the vUPF network element and the hUPF network element.
  • the hSMF network element sends PDU session creation response information to the vSMF network element.
  • the PDU session creation request information includes: PDU session identification information and H-CN-Tunnel information of the hUPF network element.
  • the PDU session creation request information is used to establish the vUPF network element. Secure conversation with hUPF network element.
  • data security protection is performed according to the mapping relationship between the security context information and the tunnel identification information.
  • the vUPF network element sends uplink data #1 to the vSEPP-U network element.
  • vSEPP-U uses security context A#1 to uplink data# 1 Perform data security protection;
  • vSEPP-U network element sends uplink data #1 to hSEPP-U network element, and
  • hSEPP-U network element sends uplink data #1 to hUPF network element.
  • the hUPF network element activates user plane security, and uses the corresponding security context to enable uplink data decryption and/or integrity protection verification.
  • the hUPF network element sends downlink data #1 to the hSEPP-U network element.
  • hSEPP-U uses security context A#1 to downlink data# 1 Perform data security protection;
  • hSEPP-U network element sends downlink data #1 to vSEPP-U network element, and
  • vSEPP-U network element sends downlink data #1 to vUPF network element.
  • the vUPF network element activates user plane security, and uses the corresponding security context to enable uplink data decryption and/or integrity protection verification.
  • the SEPP-U network element when the user plane function UPF network element (vUPF network element, hUPF network element) is introduced into the user plane security gateway, the SEPP-U network element can generate security context information according to the security policy information #S #A.
  • the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the forwarding path of the home network security policy may be: hSMF-hSEPP-U; the forwarding path of the access network security policy may be: hSMF—hSEPP-C—vSEPP-C—vSMF—vSEPP- U, where the forwarding of the access network security policy needs to be forwarded by hSMF to vSMF through the control plane hSEPP-C and vSEPP-C, and then forwarded by vSMF to vSEPP-C.
  • the hSMF is forwarded to the vSMF via the control plane hSEPP-C and vSEPP-C, which can be forwarded by the PDU session creation response Nsmf_PDUSession_Create Response service.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • FIG. 7 shows a schematic interaction diagram of a security protection method according to an embodiment of the present application.
  • the SEPP-U network element can establish a mapping relationship between security context information and tunnel identification information.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the hSEPP-U network element and the vSEPP-U network element determine the security context information according to the security policy information #S.
  • the vSEPP-U network element and hSEPP-U network element determine the security context information according to the security policy information #S.
  • the security context information includes security context A1 and security context A2.
  • Security context A1 is used for vUPF network element transmission in V-CN-Tunnel Security protection in the process of downlink data
  • security context A2 is used for the security protection of the hUPF network element in the process of transmitting uplink data in the H-CN-Tunnel.
  • the vSEPP-U network element and the hSEPP-U network element determine the security policy information #S according to the service information #E, and the service information #E1 includes: NSSAI information and or DNN information.
  • the security policy information #S includes a security algorithm and a security key, and the security policy information #S is used to instruct the SEPP-U network element to select the corresponding security context to determine whether to enable user plane encryption protection and/or user plane integrity Sexual protection.
  • the SEPP-U network element selects the corresponding security context according to the mapping relationship between the security context and the tunnel identification information to enable different types of security protection.
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element activates user plane security and enables downlink data encryption and/or integrity protection; or, uses the corresponding security context to enable the uplink Data decryption and/or integrity protection verification.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the vSEPP-U network element and the hSEPP-U network element may negotiate security policy information #S according to the data network name information DNN and/or the network slice selection information NSSAI.
  • the vSMF and hSMF transfer the data network name information DNN and/or network slice selection information NSSAI and tunnel information to vSEPP and hSEEP, and SEPP can protect the uplink and downlink data according to the tunnel information.
  • the vSMF network element obtains V-CN-Tunnel information of the vUPF network element, and the V-CN-Tunnel information is tunnel identification information used by the vUPF network element for uplink data transmission.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the PDU session creation request information includes: PDU session identification information and V-CN-Tunnel information of the vUPF network element.
  • the PDU session creation request information is used to establish a secure session between the vUPF network element and the hUPF network element.
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the vSMF network element and the hSMF network element belong to the visited network and the home network respectively; the vUPF network element and the hUPF network element belong to the visited network and the home network respectively.
  • the hSMF network element obtains the tunnel information H-CN-Tunnel of the hUPF network element.
  • the hSMF network element obtains H-CN-Tunnel information of the hUPF network element, where the H-CN-Tunnel information is tunnel identification information used by the vUPF network element for downlink data transmission.
  • the hSMF network element sends service information #E to the hSEPP-U network element.
  • the service information #E includes: NSSAI information and/or DNN information, V-CN-Tunnel information, and H-CN-Tunnel information.
  • V-CN-Tunnel information is used for uplink data transmission between vUPF network elements and hUPF network elements
  • H-CN-Tunnel information is used for downlink data transmission between vUPF network elements and hUPF network elements.
  • hSEPP-U or hSEPP-U can establish a mapping relationship between business information #E and security context information
  • hSEPP-U or vSEPP-U After receiving the service information #E transmitted by the SMF, U establishes the mapping relationship between the security context information or the security context identification information and the tunnel information V-CN-Tunnel and H-CN-Tunnel.
  • the hSEPP-U network element establishes a mapping relationship between the security context information and the tunnel information H-CN-Tunnel.
  • the hSEPP-U network element establishes a mapping relationship between the security context A#1 and the H-CN-Tunnel, and the security context A#1 is used for the hUPF network element to transmit uplink data in the H-CN-Tunnel.
  • the hSEPP-U network element sends service information #E to the vSEPP-U network element, and the service information #E includes: NSSAI information and or DNN information, V-CN-Tunnel information, and H-CN-Tunnel information.
  • the vSEPP-U network element establishes the mapping relationship between the security context information and the V-CN-Tunnel.
  • the vSEPP-U network element establishes a mapping relationship between the security context A#2 and the V-CN-Tunnel, and the security context A#2 is used for the vUPF network element to transmit downlink data in the V-CN-Tunnel.
  • the hSMF network element sends a PDU session creation response message to the vSMF network element to establish a secure session between the vUPF network element and the hUPF network element.
  • the PDU session creation request information includes: PDU session identification information and H-CN-Tunnel information of the hUPF network element, and the PDU session creation request information is used to establish a secure session between the vUPF network element and the hUPF network element.
  • data security protection is performed according to the mapping relationship between the security context information and the tunnel identification information.
  • the vUPF network element sends uplink data #1 to the vSEPP-U network element.
  • vSEPP-U uses security context A#1 to uplink data# 1 Perform data security protection;
  • vSEPP-U network element sends uplink data #1 to hSEPP-U network element, and
  • hSEPP-U network element sends uplink data #1 to hUPF network element.
  • the hUPF network element sends downlink data #1 to the hSEPP-U network element.
  • hSEPP-U uses security context A#1 to downlink data# 1 Perform data security protection;
  • hSEPP-U network element sends downlink data #1 to vSEPP-U network element, and
  • vSEPP-U network element sends downlink data #1 to vUPF network element.
  • the vSEPP-U network element and the hSEPP-U network element may negotiate security policy information #S according to the data network name information DNN and/or the network slice selection information NSSAI.
  • the vSEPP-U network element and the hSEPP-U network element can select or negotiate corresponding security context information according to the security policy information #S for data security protection.
  • the SEPP-U network element when the user plane function UPF network element (vUPF network element, hUPF network element) is introduced into the user plane security gateway, the SEPP-U network element can generate security context information according to the security policy information #S #A.
  • the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • FIG. 8 shows a schematic interaction diagram of a security protection method according to an embodiment of the present application.
  • the user plane function UPF network element when the user plane function UPF network element (vUPF network element, hUPF network element) does not introduce a user plane security gateway, the user plane function UPF network element can generate security context information #A according to the security policy information #S.
  • the user plane UPF network element when the user plane UPF network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the vSMF network element obtains V-CN-Tunnel information of the vUPF network element, and the V-CN-Tunnel information is tunnel identification information used by the vUPF network element for uplink data transmission.
  • the vSMF network element sends a PDU session creation request message to the hSMF network element.
  • the vSMF network element sends PDU session creation request information to the hSMF network element.
  • the PDU session creation request information includes: PDU session identification information and V-CN-Tunnel information of the vUPF network element.
  • the PDU session creation request information is used to establish vUPF. The secure session between the network element and the hUPF network element.
  • vSMF sends session creation request information to hSMF through Nsmf_PDUSession_Create Request.
  • the vSMF network element and the hSMF network element belong to the visited network and the home network respectively; the vUPF network element and the hUPF network element belong to the visited network and the home network respectively.
  • the hSMF network element determines the security policy information #S of the vUPF network element and the hUPF network element.
  • the hSMF network element obtains the tunnel information H-CN-Tunnel of the hUPF network element, and the hSMF network element determines the security policy information #S of the vUPF network element and the hUPF network element, and the security policy information #S is used for the vUPF network element and hUPF Data transmission of network elements.
  • the security policy information #S includes a security algorithm and a security key.
  • the security policy information #S is used to instruct the UPF network element to select the corresponding security context to determine whether to enable user plane encryption protection and/or user plane integrity protection .
  • the UPF network element selects the corresponding security context according to the mapping relationship between the security context and the tunnel identification information to enable different types of security protection.
  • the security policy can be forwarded by the hSMF or vSMF network element to transmit it to the vUPF network element or hUPF network element Security policy, the vUPF network element or hUPF network element activates different protection mechanisms on the user plane according to the operator's strategy or business requirements.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the hSMF network element sends security policy information #S to the hUPF network element.
  • the hSMF network element sends the security policy information #S to the hUPF network element, and the security policy information #A stores the mapping relationship between the security policy information #S and the V-CN-Tunnel and H-CN-Tunnel.
  • V-CN-Tunnel information is used for uplink data transmission between vUPF network elements and hUPF network elements
  • H-CN-Tunnel information is used for downlink data transmission between vUPF network elements and hUPF network elements.
  • the hSMF network element sends a PDU session creation response message to the vSMF network element to establish a secure session between the vUPF network element and the hUPF network element.
  • the hSMF network element sends PDU session creation response information to the vSMF network element.
  • the PDU session creation request information includes: PDU session identification information and H-CN-Tunnel information of the hUPF network element.
  • the PDU session creation request information is used to establish the vUPF network element. Secure conversation with hUPF network element.
  • the vSMF network element sends the security policy information #S to the vUPF network element.
  • mapping relationship between the security context information and the V-CN-Tunnel and H-CN-Tunnel is established.
  • the vUPF network element and the hUPF network element respectively establish the mapping relationship between the security context information and H-CN-Tunnel-Info and V-CN-Tunnel-Info to select the corresponding one during downlink data transmission or uplink data transmission.
  • Security context for data security protection.
  • data security protection is performed according to the mapping relationship between the security context information and the tunnel identification information.
  • the vUPF network element sends uplink data #1 to the vSEPP-U network element.
  • vSEPP-U uses security context A#1 to uplink data# 1 Perform data security protection;
  • vSEPP-U network element sends uplink data #1 to hSEPP-U network element, and
  • hSEPP-U network element sends uplink data #1 to hUPF network element.
  • the hUPF network element sends downlink data #1 to the hSEPP-U network element.
  • hSEPP-U uses security context A#1 to downlink data# 1 Perform data security protection;
  • hSEPP-U network element sends downlink data #1 to vSEPP-U network element, and
  • vSEPP-U network element sends downlink data #1 to vUPF network element.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • SMF and UPF/SEPP-U include hardware structures and/or software modules corresponding to each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • FIG. 9 shows a schematic diagram of a possible structure of the SMF involved in the foregoing embodiment.
  • the SMF 900 includes a processing unit 902 and a communication unit 903.
  • the processing unit 902 is used to control and manage the actions of the SMF 900.
  • the communication unit 903 is used to support communication between the SMF 900 and other network entities, for example, communication with a user plane security network element.
  • the SMF900 may also include a storage unit 901 for storing program codes and data of the SMF900.
  • the processing unit 902 may be a processor or a controller, for example, a central processing unit (CPU), a general-purpose processor, a digital signal processor (digital signal processor, DSP), and an application-specific integrated circuit (application-specific integrated circuit). integrated circuit, ASIC), field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination for realizing computing functions, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication unit 903 may be a communication interface.
  • the storage unit 901 may be a memory.
  • the communication unit 903 may be configured to perform the following operations: receive session creation request information sent by SMF network element #2, where the session creation request information includes service information #E; determine security policy information #S according to the service information #E; The user plane security network element #1 sends security policy information #S; the security policy information #S is used for the user plane security network element #1 to generate security context information according to the security policy information #S; wherein the user plane security network Element #1 belongs to the home network, and the SMF network element #2 belongs to the visited network.
  • the home network SMF network element can reuse the RAN side security policy information in the UE subscription data obtained from UDM, or add new UE security policy subscription data on the SEPP-U side of UDM, or the home network SMF network
  • the meta determines the security policy information #S according to the service information #E, or the vSMF sends the UE's new application layer related parameters to the hSMF, and the hSMF makes security policy decisions based on the UE's new application layer related parameters.
  • the service information #E includes data network name DNN information and/or network slice selection NSSAI information.
  • the business information #E and the security policy information #S have a mapping relationship
  • the security policy information #S and the security context information #A have a mapping relationship
  • the security context information #A and the tunnel identification information #T There is a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context #A and the tunnel identification information #T.
  • the security policy information includes instruction information #1, instruction information #2, where the instruction information #1 is used to indicate whether the user plane security network element #1 uses an encryption algorithm for data encryption protection, and the instruction Information #2 is used to indicate whether the user plane security network element #1 adopts an integrity protection algorithm for data integrity protection.
  • the communication unit 903 is further configured to: send session creation response information to SMF network element #2, where the session creation response information is used to instruct SMF network element #2 to send a security policy to UPF network element #2 Information, where UPF network element #2 belongs to the visited network.
  • the SMF involved in this application may be the SMF shown in FIG. 10.
  • the SMF 1000 includes a processor 1002, a communication interface 1003, and a memory 1001. Among them, the communication interface 1003, the processor 1002, and the memory 1001 can communicate with each other through an internal connection path to transfer control and/or data signals.
  • FIG. 11 shows a schematic diagram of a possible structure of the user plane security network element involved in the foregoing embodiment.
  • the user plane security network element 1100 includes: a processing unit 1102 and a communication unit 1103.
  • the processing unit 1102 is configured to control and manage the actions of the user plane security network element 1100.
  • the communication unit 1103 is configured to support communication between the user plane security network element 1100 and other network entities, such as communication with SMF.
  • the user plane security network element 1100 may further include a storage unit 1101 for storing program codes and data of the user plane security network element 1100.
  • the processing unit 1102 may be a processor or a controller, for example, a CPU, a general-purpose processor, DSP, ASIC, FPGA or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination for realizing computing functions, for example, including a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and so on.
  • the communication unit 1103 may be a communication interface or the like.
  • the storage unit 1101 may be a memory.
  • the communication unit 1103 is configured to perform the following operations: receive the security policy information sent by the SMF network element #1, where the security policy information has a mapping relationship with business information #E; generate security context information #E according to the security policy information #S, The context information is used for user plane security network element #1 for data security protection; among them, user plane security network element #1 and SMF network element #1 belong to the home network.
  • the service information #E includes data network name DNN information and/or network slice selection NSSAI information.
  • the business information #E and the security policy information #S have a mapping relationship
  • the security policy information #S and the security context information #A have a mapping relationship
  • the security context information #A and the tunnel identification information #T There is a mapping relationship, so the user plane security network element can adopt the corresponding security context for data security protection according to the mapping relationship between the security context #A and the tunnel identification information #T.
  • the security context #A1 can be used to enable user plane encryption protection
  • the security context #A2 can be used to enable user plane integrity protection
  • the security context #A3 can be used to enable user plane encryption protection and user plane integrity protection.
  • the security context #A4 can be used to disable user-plane encryption protection and user-plane integrity protection.
  • the security policy information includes instruction information #1, instruction information #2, where the instruction information #1 is used to indicate whether the user plane security network element #1 uses an encryption algorithm for data encryption protection, and the instruction Information #2 is used to indicate whether the user plane security network element #1 adopts an integrity protection algorithm for data integrity protection.
  • the communication unit is further configured to: send security policy information to user-plane security network element #2, where the security policy information is used to instruct user-plane security network element #2 to interact with the service according to the security policy information
  • the mapping relationship of information generates security context information A#1; the security context information is used for user plane security network element #2 for data security protection, wherein the user plane security network element #2 belongs to the access network.
  • the communication unit is also used to: receive the downlink data #1 sent by the UPF network element #1 in the H-CN-Tunnel#1; according to the H-CN-Tunnel#1 and the security context A# The mapping relationship of 1, using security context A#1 to perform data security protection on the downlink data #1.
  • the communication unit is further configured to: according to the mapping relationship between the H-CN-Tunnel#1 and the security context A#1, use the security context A#1 to perform data security protection on the downlink data #1; Send the downlink data #1 to the UPF network element #2, where the UPF network element #2 belongs to the visited network.
  • the data security protection device of the present application can be applied to 5G Home-routed scenarios to protect the user plane security between the visited network vPLMN and the home network hPLMN.
  • the SEPP-U network element can generate security context information #A according to the security policy information #S.
  • the SEPP-U network element when the SEPP-U network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the user plane function UPF network element (vUPF network element, hUPF network element) does not introduce a user plane security gateway, the user plane function UPF network element can generate security context information #A according to the security policy information #S.
  • the user plane UPF network element when the user plane UPF network element receives the user plane UPF data, it selects the corresponding security context according to the mapping relationship between the security context information and the tunnel identification information to perform security protection during data transmission.
  • the user plane security network element Since the home network SMF network element can generate security policy information based on service information, the user plane security network element generates security context information based on the security policy information. When the service data is transmitted on the corresponding tunnel, the user plane security network element can target different The business uses different security contexts for data security protection, and realizes a flexible data security protection mechanism between the visited network and the home network.
  • the user plane security network element involved in this application may be the user plane security network element shown in FIG. 12.
  • the user plane security network element 1200 includes a processor 1202, a communication interface 1203, and a memory 1201. Among them, the communication interface 1203, the processor 1202, and the memory 1201 can communicate with each other through an internal connection path to transfer control and/or data signals.
  • the present application also provides a communication chip in which instructions are stored, and when it runs on the SMF900 or SMF1000, the communication chip is made to execute the methods corresponding to the SMF in the various implementations above.
  • This application also provides a communication chip in which instructions are stored. When it runs on the user-plane security network element 1100 or the user-plane security network element 1200, the communication chip is made to execute the UPF or SEPP in the various implementations above. -U corresponds to the method.
  • the size of the sequence number of each process does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application.
  • the steps of the method or algorithm described in conjunction with the disclosure of this application can be implemented in a hardware manner, or implemented in a manner in which a processor executes software instructions.
  • Software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read only memory (ROM), erasable programmable read-only memory (erasable programmable ROM (EPROM), electrically erasable programmable read-only memory (electrically EPROM, EEPROM), register, hard disk, mobile hard disk, CD-ROM or any other form of storage medium known in the art.
  • An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and can write information to the storage medium.
  • the storage medium may also be an integral part of the processor.
  • the processor and the storage medium may be located in the ASIC.
  • the ASIC can be located in SMF or UPF.
  • the processor and the storage medium may also exist as discrete components in the SMF and UPF.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种用户面安全保护的方法和装置，该方法包括：第一会话管理功能SMF网元接收第二SMF网元发送的会话创建请求信息，会话创建请求信息包括第一业务信息；第一SMF网元根据第一业务信息确定安全策略信息；第一SMF网元向第一用户面安全网元发送第一指示信息；第一指示信息用于指示第一用户面安全网元根据安全策略信息与第一业务信息的对应关系生成安全上下文信息；其中第一SMF网元、第一用户面安全网元属于归属网络，第二SMF网元属于访问网络。本申请的数据安全保护方法和装置，可以在访问网络与归属网络间实现灵活的用户面数据安全保护。

Description

用户面安全保护的方法和装置
本申请要求于2019年1月27日提交中国专利局、申请号为201910077025.4、申请名称为“用户面安全保护的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，更具体的，涉及一种用户面安全保护的方法和装置。
背景技术
3GPP(3rd generation partnership project，3GPP)定义了漫游接口控制面的安全网关SEPP(security edge protection proxy，SEPP)来进行控制面的安全保护，同时也定义了访问网络的vSEPP与归属网络的hSEPP直接的安全策略协商机制。在home-routed的漫游场景下，跨公共陆地移动网络PLMN(public land mobile network，PLMN)的访问网络vUPF与归属网络hUPF之间缺乏类似的安全机制进行保护，其中3GPP 33.501中用户面功能UPF(user plane function，UPF)之间的N9接口采用的保护方法无法根据业务需求采取相应的安全保护策略。因此，如何在访问网络与归属网络间实现灵活的用户面数据安全保护成为亟待解决的问题。
发明内容
本申请提供一种用户面安全保护的方法和装置，可以在访问网络与归属网络间实现灵活的用户面数据安全保护。
第一方面，提供了一种用户面安全保护的方法，包括：第一会话管理功能SMF网元接收第二SMF网元发送的会话创建请求信息，所述会话创建请求信息包括第一业务信息；所述第一SMF网元根据所述第一业务信息确定安全策略信息；所述第一SMF网元向第一用户面安全网元发送安全策略信息；所述安全策略信息用于第一用户面安全网元根据所述安全策略信息生成安全上下文信息；其中所述第一SMF网元、第一用户面安全网元属于归属网络，所述第二SMF网元属于访问网络。
在本申请实施例中，第一用户面安全网元可以是用户面SEPP-U网元或者用户面功能UPF网元。
可选的，归属网络SMF网元可以复用从统一数据管理平台(unified data manager，UDM)获取的UE签约数据中的的RAN侧安全策略信息，或者，新增UE在UDM的SEPP-U侧安全策略签约数据，或者归属网络SMF网元根据第一业务信息确定安全策略信息，或者vSMF向hSMF发送UE新增的应用层相关参数，由hSMF根据UE新增的应用层相关参数进行安全策略决策。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网 元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
结合第一方面，在第一方面的某些实现方式中，该第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
结合第一方面，在第一方面的某些实现方式中，该安全策略信息包括第一指示信息、第二指示信息，其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
或者，该安全策略信息包括安全上下文信息，该安全上下文信息用于指示用户面安全网元是否进行加密保护，和/或是否进行完整性保护。
例如，安全上下文信息可以指示用户面安全网元进行用户面数据加密，或者用户面数据完整性保护，或者用户面数据加密和用户面数据完整性保护，或者不进行用户面数据加密和用户面数据完整性保护。
结合第一方面，在第一方面的某些实现方式中，该安全上下文信息包括第一安全上下文、第二安全上下文；所述第一安全上下文与第一隧道标识信息具有映射关系，所述第二安全上下文与所述第二隧道标识信息具有映射关系。
结合第一方面，在第一方面的某些实现方式中，该第一用户面安全网元为第一用户面功能UPF网元，该方法还包括：第一SMF网元向第二SMF网元发送会话创建响应信息，所述会话创建响应信息用于指示第二SMF网元向第二UPF网元发送安全策略信息，其中所述第一UPF网元属于归属网络，所述第二UPF网元属于访问网络。
在本申请实施例中，归属网络SMF网元根据第一业务信息确定安全策略信息，归属网络SMF网元向用户面安全网元发送安全策略信息，用户面安全网元根据安全策略信息生成安全上下文信息，安全上下文信息与隧道标识信息具有映射关系，因此用户面安全网元可以根据安全上下文与隧道标识信息的映射关系采用相应的安全上下文进行数据安全保护。
第二方面，提供了一种用户面安全保护的方法，包括：第一用户面安全网元接收第一SMF网元发送的安全策略信息；所述第一用户面安全网元根据所述安全策略信息生成安全上下文信息，所述安全上下文信息与隧道标识信息具有映射关系，所述安全上下文信息用于第一用户面安全网元进行数据安全保护；其中，所述第一用户面安全网元、第一SMF网元属于归属网络。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
结合第二方面，在第二方面的某些实现方式中，该第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
结合第二方面，在第二方面的某些实现方式中，该安全策略信息包括第一指示信息、第二指示信息，其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
或者，该安全策略信息包括安全上下文信息，该安全上下文信息用于指示用户面安全网元是否进行加密保护，和/或是否进行完整性保护。
例如，安全上下文信息可以指示用户面安全网元进行用户面数据加密，或者用户面数据完整性保护，或者用户面数据加密和用户面数据完整性保护，或者不进行用户面数据加密和用户面数据完整性保护。
结合第二方面，在第二方面的某些实现方式中，该第一用户面安全网元为第一UPF网元，该方法还包括：第一UPF网元根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对第一下行数据进行数据安全保护。
结合第二方面，在第二方面的某些实现方式中，该安全上下文信息包括第一安全上下文、第二安全上下文；所述第一安全上下文与第一隧道标识信息具有映射关系，所述第二安全上下文与所述第二隧道标识信息具有映射关系。
结合第二方面，在第二方面的某些实现方式中，该第一用户面安全网元为第一安全边界防护代理SEPP-U网元，该方法还包括：第一SEPP-U网元向第二SEPP-U网元发送安全策略信息，所述安全策略信息用于指示第二SEPP-U网元根据安全策略信息与业务信息的映射关系生成安全上下文信息；所述安全上下文信息用于第二SEPP-U网元进行数据安全保护，其中所述第一SEPP-U网元属于归属网络、所述第二SEPP-U网元属于访问网络。
结合第二方面，在第二方面的某些实现方式中，该第一用户面安全网元为第一安全边界防护代理SEPP-U网元，该方法还包括：第一SEPP-U网元接收第一UPF网元在第一隧道发送的第一下行数据；根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对所述第一下行数据进行数据安全保护。
在本申请实施例中，归属网络SMF网元根据第一业务信息确定安全策略信息，归属网络SMF网元向用户面安全网元发送安全策略信息，用户面安全网元根据安全策略信息生成安全上下文信息，安全上下文信息与隧道标识信息具有映射关系，因此用户面安全网元可以根据安全上下文与隧道标识信息的映射关系采用相应的安全上下文进行数据安全保护。
第三方面，本申请提供了一种用户面安全保护的装置，该装置可以实现上述第一方面所涉及的方法中SMF所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的单元或模块。
在一种可能的设计中，该装置的结构中包括处理器和通信接口，该处理器被配置为支持该装置执行上述方法中相应的功能。该通信接口用于支持该装置与其它装置之间的通信。该装置还可以包括存储器，该存储器用于与处理器耦合，其保存该装置必要的程序指令和数据用于实现上述功能。
在一种可能的设计中，该装置包括处理单元和通信单元，该通信单元用于接收第二SMF网元发送的会话创建请求信息，所述会话创建请求信息包括第一业务信息；该处理单元用于根据所述第一业务信息确定安全策略信息；该通信单元向第一用户面安全网元发送安全策略信息；所述安全策略信息用于第一用户面安全网元根据所述安全策略信息生成安全上下文信息；其中所述第一用户面安全网元属于归属网络，所述第二SMF网元属于访问网络。
可选的，第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
应理解，在本申请实施例中，业务信息#E与安全策略信息#S具有映射关系，安全策 略信息#S与安全上下文信息#A具有映射关系，安全上下文信息#A与隧道标识信息#T具有映射关系，因此用户面安全网元可以根据安全上下文#A与隧道标识信息#T的映射关系采用相应的安全上下文进行数据安全保护。
可选的，该安全策略信息包括第一指示信息、第二指示信息，其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
或者，该安全策略信息包括安全上下文信息，该安全上下文信息用于指示用户面安全网元是否进行加密保护，和/或是否进行完整性保护。
例如，安全上下文信息可以指示用户面安全网元进行用户面数据加密，或者用户面数据完整性保护，或者用户面数据加密和用户面数据完整性保护，或者不进行用户面数据加密和用户面数据完整性保护。
可选的，该通信单元还用于：向第二SMF网元发送会话创建响应信息，所述会话创建响应信息用于指示第二SMF网元向第二UPF网元发送安全策略信息，其中所述第二UPF网元属于访问网络。
第四方面，本申请提供了一种用户面安全保护的装置，该装置可以实现上述方面所涉及的方法中UPF所执行的功能，所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个上述功能相应的单元或模块。
在一种可能的设计中，该装置的结构中包括处理器和通信接口，该处理器被配置为支持该装置执行上述方法中相应的功能。该通信接口用于支持该装置与其它装置之间的通信。该装置还可以包括存储器，该存储器用于与处理器耦合，其保存该装置必要的程序指令和数据用于实现上述功能。
在一种可能的设计中，该装置包括处理单元和通信单元，该通信单元用于接收第一SMF网元发送的安全策略信息，所述安全策略信息与第一业务信息具有映射关系；根据所述安全策略信息生成安全上下文信息，所述安全上下文信息用于第一用户面安全网元进行数据安全保护；其中，所述第一用户面安全网元、第一SMF网元属于归属网络。
可选的，归属网络SMF网元可以复用从UDM获取的UE签约数据中的的RAN侧安全策略信息，或者，新增UE在UDM的SEPP-U侧安全策略签约数据，或者归属网络SMF网元根据第一业务信息确定安全策略信息，或者vSMF向hSMF发送UE新增的应用层相关参数，由hSMF根据UE新增的应用层相关参数进行安全策略决策。
可选的，第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
应理解，在本申请实施例中，业务信息#E与安全策略信息#S具有映射关系，安全策略信息#S与安全上下文信息#A具有映射关系，安全上下文信息#A与隧道标识信息#T具有映射关系，因此用户面安全网元可以根据安全上下文#A与隧道标识信息#T的映射关系采用相应的安全上下文进行数据安全保护。
可选的，该安全策略信息#S包括第一指示信息、第二指示信息，其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
或者，该安全策略信息包括安全上下文信息，该安全上下文信息用于指示用户面安全网元是否进行加密保护，和/或是否进行完整性保护。
例如，安全上下文信息可以指示用户面安全网元进行用户面数据加密，或者用户面数据完整性保护，或者用户面数据加密和用户面数据完整性保护，或者不进行用户面数据加密和用户面数据完整性保护。
可选的，该通信单元还用于：向第二用户面安全网元发送安全策略信息，所述安全策略信息用于指示第二用户面安全网元根据所述安全策略信息与业务信息的映射关系生成安全上下文信息；所述安全上下文信息用于第二用户面安全网元进行数据安全保护，其中所述第二用户面安全网元属于访问网络。
可选的，该通信单元还用于：接收第一UPF网元在第一隧道发送的第一下行数据；根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对所述第一下行数据进行数据安全保护。
可选的，该通信单元还用于：根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对第一下行数据进行数据安全保护；向第二UPF网元发送所述第一下行数据，其中所述第二UPF网元属于访问网络。
第五方面，本申请提供了一种计算机存储介质，用于储存为上述SMF所用的计算机软件指令，其包含用于执行上述第一方面所设计的程序。
第六方面，本申请提供了一种计算机存储介质，用于储存为上述UPF或SEPP-U所用的计算机软件指令，其包含用于执行上述第二方面所设计的程序。
第七方面，本申请提供了一种通信芯片，其中存储有指令，当其在SMF上运行时，使得所述通信芯片控制SMF执行上述第一方面的方法。
第八方面，本申请提供了一种通信芯片，其中存储有指令，当其在UPF或SEPP-U上运行时，使得所述通信芯片控制UPF执行上第二方面的方法。
第九方面，本申请提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被通信装置的通信单元和处理单元运行时，使得通信装置执行第一方面所涉及的方法。
第十方面，本申请提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被通信装置的通信单元和处理单元运行时，使得通信装置执行第二方面所涉及的方法。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
附图说明
图1是本申请实施例提供的用户面安全保护方法的网络架构的示意图。
图2是本申请实施例提供的一种用户面安全保护方法的示意性交互图。
图3是本申请实施例提供的一种用户面安全保护方法的示意性流程图。
图4是本申请实施例提供的一种用户面安全保护方法的示意性流程图。
图5是本申请实施例提供的一种用户面安全保护方法的示意性交互图。
图6是本申请实施例提供的一种用户面安全保护方法的示意性交互图。
图7是本申请实施例提供的一种用户面安全保护方法的示意性交互图。
图8是本申请实施例提供的一种用户面安全保护方法的示意性交互图。
图9是本申请实施例提供的一种可能的SMF网元的结构示意图。
图10是本申请实施例提供的另一种可能的SMF网元的结构示意图。
图11是本申请实施例的一种可能的用户面安全网元的结构示意图。
图12是本申请实施例的另一种可能的用户面安全网元的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通信(global system for mobile communications，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、未来的第五代(5th generation，5G)系统或新无线(new radio，NR)等。
应理解，本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是终端或网络设备，或者，是UE或网络设备中能够调用程序并执行程序的功能模块。
为便于理解本申请实施例，首先结合图1详细说明本申请实施例的一个应用场景。
图1是适用于本申请实施例提供的方法的网络架构的示意图。如图所示，该网络架构例如可以是漫游(Home routed)架构。该网络架构具体可以包括下列网元：
1、用户设备(user equipment，UE)：可以称终端设备、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。UE还可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，还可以是端设备，逻辑实体，智能设备，如手机，智能终端等终端设备，或者服务器，网关，基站，控制器等通信设备，或者物联网设备，如传感器，电表，水表等物联网(Internet of things，IoT)设备。本申请实施例对此并不限定。
在本申请实施例中，UE存储有长期密钥(long term key)。UE在与核心网网元(例如下文所述的AMF实体、AUSF实体)进行双向鉴权的时候，会使用长期密钥和相关函数验证网络的真实性，从而可以保证数据传输的安全性。
2、接入网(access network，AN)：为特定区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等使用不同质量的传输隧道。接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如3G、4G或5G系统中采用的无线接入技术) 和非第三代合作伙伴计划(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网络称为无线接入网络(Radio Access Network，RAN)，其中，5G系统中的接入网设备称为下一代基站节点(next generation Node Base station，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi中的接入点(access point，AP)为代表的空口技术。
基于无线通信技术实现接入网络功能的接入网可以称为无线接入网(radio access network，RAN)。无线接入网能够管理无线资源，为终端提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网例如可以是基站(NodeB)、演进型基站(evolved NodeB，eNB或eNodeB)、5G移动通信系统中的基站(gNB)、未来移动通信系统中的基站或WiFi系统中的AP等，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该接入网设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等。本申请的实施例对无线接入网设备所采用的具体技术和具体设备形态不做限定。
3、接入和移动管理功能(access and mobility management function，AMF)实体：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听、或接入授权(或鉴权)等功能。在本申请实施例中，可用于实现接入和移动管理网元的功能。
4、会话管理功能(session management function，SMF)实体：主要用于会话管理、UE的网际协议(internet protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在本申请实施例中，可用于实现会话管理网元的功能。
5、用户平面功能(user plane function，UPF)实体：即，数据面网关。可用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过该网元接入到数据网络(data network，DN)。在本申请实施例中，可用于实现用户面网关的功能。
6、数据网络(DN)：用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络等。
7、认证服务功能(authentication server function，AUSF)实体：主要用于用户鉴权等。
8、网络开放功能(network exposure function，NEF)实体：用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
9、网络存储功能((network function(NF)repository function，NRF)实体：用于保存网络功能实体以及其提供服务的描述信息，以及支持服务发现，网元实体发现等。
10、策略控制功能(policy control function，PCF)实体：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
11、统一数据管理(unified data management，UDM)实体：用于处理用户标识、接入鉴权、注册、或移动性管理等。
12、应用功能(application function，AF)实体：用于进行应用影响的数据路由，接入网络开放功能网元，或，与策略框架交互进行策略控制等。
在该网络架构中，N1接口为终端与AMF实体之间的参考点；N2接口为SMF和UPF 实体的参考点，用于非接入层(non-access stratum，NAS)消息的发送等；N3接口为(R)AN和UPF实体之间的参考点，用于传输用户面的数据等；N4接口为SMF实体和UPF实体之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF实体和DN之间的参考点，用于传输用户面的数据等。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF实体、SMF实体、UPF实体、NSSF实体、NEF实体、AUSF实体、NRF实体、PCF实体、UDM实体可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对此不做限定。
下文中，为便于说明，将用于实现AMF的实体记作接入和移动管理网元，将用于实现SMF的实体记作会话管理网元，将用于实现UPF的实体记作用户面网关，将用于实现UDM功能的实体记作统一数据管理网元，将用于实现PCF的实体记作策略控制网元。应理解，上述命名仅为用于区分不同的功能，并不代表这些网元分别为独立的物理设备，本申请对于上述网元的具体形态不作限定，例如，可以集成在同一个物理设备中，也可以分别是不同的物理设备。此外，上述命名仅为便于区分不同的功能，而不应对本申请构成任何限定，本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。在此进行统一说明，以下不再赘述。
还应理解，图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
3GPP定义了漫游接口控制面的安全网关SEPP-U来进行控制面的安全保护，同时也定义了访问网络的vSEPP-U与归属网络的hSEPP-U直接的安全策略协商机制。在home-routed的漫游场景下，跨PLMN的vUPF与hUPF之间缺乏类似的安全机制进行保护，其中3GPP 33.501中UPF之间的N9接口采用的是NDS/IP的保护方法，用户面安全保护方式单一，无法根据业务需求采取相应的安全保护策略。因此，如何采用灵活的用户面安全保护策略成为亟待解决的问题。因此，如何进行用户面安全策略的选取以及传递、确定用户面安全密钥和算法协商、建立用户面安全策略与用户面会话标识信息的映射关系，成为亟待解决的重要问题。
为了易于理解本申请，以下将访问网络用户面功能UPF网元、归属网络用户面功能UPF网元分别记作vUPF网元、hUPF网元，将访问网络会话管理功能SMF网元、归属网络会话管理功能SMF网元分别记作vSMF网元、hSMF网元，将访问网络安全边界防护代理SEPP-U网元、归属网络安全边界防护代理SEPP-U网元分别记作vSEPP-U网元、hSEPP-U网元，其中SEPP-U网元用于漫游接口安全。
本申请的用户面安全保护方法可以应用于5G Home-routed场景，访问网络vPLMN与归属网络hPLMN之间的用户面安全保护，主要包括以下情况：
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
当用户面功能UPF网元(vUPF网元、hUPF网元)不引入用户面安全网关时，可以由用户面功能UPF网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，用户面UPF网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
图2示出了本申请实施例的一种安全保护方法的示意性交互图。
在S201，SMF网元#2向SMF网元#1发送协议数据单元PDU(Protocol Data Unit，PDU)会话创建请求信息，该PDU会话创建请求信息包括业务信息#E。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
在S202，SMF网元#2根据业务信息#E确定安全策略信息#S，该业务信息#E包括数据网络名称信息DNN、网络切片选择信息NSSAI。
可选的，归属网络SMF网元可以复用从统一数据管理平台(unified data manager，UDM)获取的UE签约数据中的的RAN侧安全策略信息，或者，新增UE在UDM的SEPP-U侧安全策略签约数据，或者归属网络SMF网元根据第一业务信息确定安全策略信息，或者vSMF向hSMF发送UE新增的应用层相关参数，由hSMF根据UE新增的应用层相关参数进行安全策略决策。
在S203，SMF网元#1向用户面安全网元#1发送安全策略信息#S，该安全策略信息包括用户面加密指示信息、用户面完整性保护指示信息。其中，该用户面加密指示信息用于指示用户面安全网元#1是否采用加密算法、该用户面完整性保护算法用于指示用户面安全网元#1是否采用完整性保护算法。或者，该安全策略信息#S包括安全上下文信息#A，该安全上下文信息用于指示用户面安全网元是否进行加密保护，和/或是否进行完整性保护。
在S204，用户面安全网元#1根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
作为示例而非限定，本申请的数据安全保护方法可以应用于5G Home-routed场景，实现访问网络vPLMN与归属网络hPLMN之间的用户面安全保护。
可选的，该用户面安全网元#1、用户面安全网元#2分别为归属网络UPF网元、访问网络UPF网元；或者，该用户面安全网元#1、用户面安全网元#2分别为归属网络SEPP-U网元、访问网络SEPP-U网元。
情况#A1
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元(SEPP-U网元#1、SEPP-U网元#2)根据安全策略信息#S生成安全上下文信息#A。其中，SEPP-U网元#1属于归属网络、SEPP-U网元#2属于访问网络。
在S204，SEPP-U网元#1根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
可选的，SEPP-U网元#1根据安全策略#S生成安全上下文信息#A，SEPP-U网元#1向SEPP-U网元#2发送安全上下文信息#A；或者，SEPP-U网元#1根据安全策略#S生成安全上下文信息#A，SEPP-U网元#1向SEPP-U网元#2发送安全策略信息#S，SEPP-U网元#2根据安全策略#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息#A与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
例如，归属网络的SEPP-U网元接收下行数据#1，根据安全上下文信息#A1与隧道标识信息H-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对下行数据#1进行数据安全保护。
例如，访问网络的SEPP-U网元接收上下数据#1，根据安全上下文信息#A1与隧道标识信息V-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对上行数据#1进行数据安全保护。
在S205，SMF网元#1向SMF网元#2发送会话创建响应信息。
情况#A2
当用户面功能UPF网元(UPF网元#1、UPF网元#2)不引入用户面安全网关时，可以由用户面功能UPF网元根据安全策略信息#S生成安全上下文信息#A。
在S204，UPF网元#1根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
在S205，SMF网元#1向SMF网元#2发送会话创建响应信息，该会话创建响应信息用于指示SMF网元#2向UPF网元#2发送安全策略信息#S，其中UPF网元#2属于访问网络。
相应地，UPF网元#2根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#2采用相应的加密算法、完整性保护算法进行数据安全保护。
在此情况下，用户面功能UPF网元在收到用户面UPF数据时，UPF网元激活用户面安全，开启下行数据加密和/或完整性保护；或者，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。即UPF网元根据安全上下文信息#A与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
例如，归属网络的SEPP-U网元接收下行数据#1，根据安全上下文信息#A1与隧道标识信息H-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对下行数据#1进行数据安全保护。
例如，访问网络的SEPP-U网元接收上下数据#1，根据安全上下文信息#A1与隧道标识信息V-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对上行数据#1进行数据安全保护。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
作为示例而非限定，在本申请实施例中，访问网络的安全策略转发路径包括以下情况：
例如，hSMF—hSEPP—vSEPP，即用户面安全策略由hSMF进行决策，hSMF将安全策略通过hSEPP转发给vSEPP。
再例如，hSMF—hSEPP-C—vSEPP-C—vSMF—vSEPP-U，即用户面安全策略由hSMF进行决策，hSMF将安全策略通过hSEPP-C—vSEPP-C—vSMF转发给vSEPP。
再例如，hSMF—hUPF—hSEPP-U—vSEPP-U，即用户面安全策略由hSMF进行决策，hSMF将安全策略通过hSEPP转发给vSEPP。
再例如，hSMF—hSEPP-C—vSEPP-C—vSMF—vUPF—vSEPP-U，即用户面安全策略由hSMF进行决策，hSMF将安全策略通过hSEPP-C—vSEPP-C—vSMF—vUPF转发给vSEPP。
作为示例而非限定，在本申请实施例中，归属网络的安全策略转发路径包括以下情况：
例如，hSMF—hSEPP，即用户面安全策略由hSMF进行决策，hSMF将安全策略转发给hSEPP。
再例如，hSMF—hUPF—hSEPP-U，即用户面安全策略由hSMF进行决策，hSMF将安全策略转发给hSEPP。
图3示出了本申请实施例的一种安全保护方法的示意性流程图。
在S301，SMF网元#2接收SMF网元#1发送的会话创建请求信息，该会话创建请求信息包括业务信息#E。其中，SMF网元#2属于归属网络，SMF网元#1属于访问网络。
可选的，该业务信息#E包括数据网络名称信息(data network name，DNN)、网络切片选择信息(network slice selection assistance information，NSSAI)。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
在S302，SMF网元#2根据业务信息#E确定安全策略信息#S。
在S303，向归属网络用户面安全网元发送安全策略信息#S；所述安全策略信息用于归属网络用户面安全网元根据安全策略信息#S生成安全上下文信息#A。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
图4示出了本申请实施例的一种安全保护方法的示意性流程图。
在S401，接收归属网络SMF网元发送的安全策略信息#S，安全策略信息#S与业务信息#E具有映射关系。
可选的，安全策略信息#S包括指示信息#1、指示信息#2，其中，所述指示信息#1用于指示所述用户面安全网元#1是否采用加密算法进行数据加密保护，所述指示信息#2用于指示所述用户面安全网元#1是否采用完整性保护算法进行数据完整性保护。
在S402，根据安全策略信息#S与业务信息#E的映射关系生成安全上下文信息#A，安全上下文信息#E用于归属网络用户面安全网元进行数据安全保护。
该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
例如，安全上下文信息可以指示用户面安全网元进行用户面数据加密，或者用户面数据完整性保护，或者用户面数据加密和用户面数据完整性保护，或者不进行用户面数据加密和用户面数据完整性保护。
情况#A1
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元(SEPP-U网元#1、SEPP-U网元#2)根据安全策略信息#S生成安全上下文信息#A。
其中，SEPP-U网元#1属于归属网络、SEPP-U网元#2属于访问网络。
SEPP-U网元#1根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
可选的，SEPP-U网元#1根据安全策略#S生成安全上下文信息#A，SEPP-U网元#1向SEPP-U网元#2发送安全上下文信息#A；或者，SEPP-U网元#1根据安全策略#S生成安全上下文信息#A，SEPP-U网元#1向SEPP-U网元#2发送安全策略信息#S，SEPP-U网元#2根据安全策略#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息#A与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
例如，归属网络的SEPP-U网元接收下行数据#1，根据安全上下文信息#A1与隧道标识信息H-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对下行数据#1进行数据安全保护。
例如，访问网络的SEPP-U网元接收上下数据#1，根据安全上下文信息#A1与隧道标识信息V-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对上行数据#1进行数据安全保护。
情况#A2
当用户面功能UPF网元(UPF网元#1、UPF网元#2)不引入用户面安全网关时，可以由用户面功能UPF网元根据安全策略信息#S生成安全上下文信息#A。
UPF网元#1根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#1采用相应的加密算法、完整性保护算法进行数据安全保护。
UPF网元#2根据安全策略信息#S生成安全上下文信息#A，该安全上下文信息#A用于用户面安全网元#2采用相应的加密算法、完整性保护算法进行数据安全保护。
在此情况下，用户面功能UPF网元在收到用户面UPF数据时，UPF网元激活用户面安全，开启下行数据加密和/或完整性保护；或者，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。即UPF网元根据安全上下文信息#A与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
例如，UPF网元#1根据安全上下文信息#A1与隧道标识信息H-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对下行数据#1进行数据安全保护，UPF网元#1向UPF网元#2发送下行数据#1。
例如，UPF网元#2根据安全上下文信息#A1与隧道标识信息H-CN-Tunnel#1的映射关系，采用安全上下文信息#A1对下行数据#1进行数据安全保护，UPF网元#2向UPF网元#1发送上行数据#1。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
图5示出了本申请实施例的一种安全保护方法的示意性交互图。
参见图5，当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
在S501、vSMF网元获取vUPF网元的隧道信息V-CN-Tunnel。
具体的，vSMF网元获取vUPF网元的V-CN-Tunnel信息，V-CN-Tunnel信息是vUPF网元用于上行数据传输的隧道标识信息。
应理解，在本申请实施例中，隧道标识信息也可以成为隧道标识信息。
在S502、vSMF网元向hSMF网元发送PDU会话创建请求信息。
具体的，vSMF网元向hSMF网元发送PDU会话创建请求信息，PDU会话创建请求信息包括：PDU会话标识信息、vUPF网元的V-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
其中，vSMF网元、hSMF网元分别属于访问网络、归属网络；vUPF网元、hUPF网元分别属于访问网络、归属网络。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
在S503、hSMF网元确定vUPF网元和hUPF网元的安全策略信息#S。
具体的，hSMF网元获取hUPF网元的隧道信息H-CN-Tunnel，该隧道信息H-CN-Tunnel用于hUPF网元向vUPF网元发送下行数据。
hSMF网元确定vUPF网元和hUPF网元的安全策略信息#S，包括安全算法和安全密钥。该安全策略信息#S用于指示SEPP-U网元选择相应的安全上下文，以确定是否开启用户面加密保护和/或用户面完整性保护。
相应地，SEPP-U网元根据安全策略信息#S确定安全上下文#A，选择加密算法开启用户面加密保护、选择完整性保护算法开启用户面完整性保护。
可选的，该安全策略信息#S用于SEPP-U网元根据安全上下文#A与隧道标识信息的映射关系选择相应的安全上下文，以开启不同类型的安全保护。
或者，该安全策略信息#S用于SEPP-U网元根据安全上下文#A与隧道标识信息的映射关系选择相应的安全上下文标识信息，以开启不同类型的安全保护。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2 可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
相应的，SEPP-U网元在接收到UPF网元发送的下行数据或上行数据后，SEPP-U网元激活用户面安全，开启下行数据加密和/或完整性保护；或者，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。
应理解，本申请实施例中并不限制用户面安全策略只包括用户面完整性保护是否需要激活、用户面加密保护是否需要激活，也就是说，安全策略中可以包括更多的内容，比如建议的算法强度等内容。
作为示例而非限定，归属网络SMF网元可以复用从UDM获取的UE签约数据中的的RAN侧安全策略信息，或者，新增UE在UDM的SEPP-U侧安全策略签约数据，或者归属网络SMF网元根据业务信息#E确定安全策略信息，或者vSMF向hSMF发送UE新增的应用层相关参数，由hSMF根据UE新增的应用层相关参数进行安全策略决策。
在S504、hSMF网元向hSEPP-U网元发送安全策略信息#S。
具体的，hSMF网元向hSEPP-U网元发送安全策略信息#S，该安全策略信息#A保存了安全策略信息#S与V-CN-Tunnel、H-CN-Tunnel的映射关系。
其中，V-CN-Tunnel信息用于vUPF网元和hUPF网元的上行数据传输，H-CN-Tunnel信息用于vUPF网元和hUPF网元的下行数据传输。
在S505、hSEPP-U网元向vSEPP-U网元发送安全策略信息#S。
具体的，hSEPP-U网元向vSEPP-U网元发送安全策略信息#S，该安全策略信息#A保存了安全策略信息#S与V-CN-Tunnel、H-CN-Tunnel的映射关系。
在S506、hSEPP-U网元和vSEPP-U网元根据安全策略信息#S确定安全上下文信息。
vSEPP-U网元和hSEPP-U网元根据安全策略信息#S确定安全上下文信息，该安全上下文信息包括安全上下文A#1、安全上下文A#2，安全上下文A#1用于vUPF网元在V-CN-Tunnel传输下行数据，安全上下文A#2用于hUPF网元在H-CN-Tunnel传输上行数据。
其中，安全上下文A#1、安全上下文A#2用于vUPF网元和hUPF网元的数据传输过程中的安全保护。
在S507、建立安全上下文信息和V-CN-Tunnel、H-CN-Tunnel的映射关系。
具体的，hSEPP、vSEPP分别建立安全上下文信息与H-CN-Tunnel-Info、V-CN-Tunnel-Info的映射关系，以用于在下行数据传输或上行数据传输时选择相应的安全上下文进行数据安全保护。
或者，SEPP-U在协商好安全上下文信息后，为安全上下文信息分配对应的安全上下文内容(context)，建立安全上下文标识信息(context ID)与隧道信息H-CN-Tunnel-Info、V-CN-Tunnel-Info映射关系。
相应的，SEPP-U在收到UPF数据时，SEPP-U根据UPF的隧道信息CN-Tunnel-Info，选择对应的安全上下文进行数据安全保护，或者根据CN-Tunnel-Info与安全上下文标识信息(context ID)的映射关系，选择相应的安全上下文(context)进行数据安全保护。
在S508、hSMF网元向vSMF网元发送PDU会话创建响应信息，以建立vUPF网元和hUPF网元的安全会话。
hSMF网元向vSMF网元发送PDU会话创建响应信息，该PDU会话创建请求信息包 括：PDU会话标识信息、hUPF网元的H-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
在S509，根据安全上下文信息与隧道标识信息的映射关系进行数据安全保护。
作为示例而非限定，vUPF网元向vSEPP-U网元发送上行数据#1，vSEPP-U根据V-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对上行数据#1进行数据安全保护；vSEPP-U网元向hSEPP-U网元发送上行数据#1，hSEPP-U网元向hUPF网元发送上行数据#1。
作为示例而非限定，hUPF网元向hSEPP-U网元发送下行数据#1，hSEPP-U根据H-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对下行数据#1进行数据安全保护；hSEPP-U网元向vSEPP-U网元发送下行数据#1，vSEPP-U网元向vUPF网元发送下行数据#1。
可选的，SEPP-U在收到UPF数据时，SEPP-U根据UPF的隧道信息CN-Tunnel-Info，选择对应的安全上下文进行数据安全保护，或者根据CN-Tunnel-Info与安全上下文标识信息(context ID)的映射关系，选择相应的安全上下文(context)进行数据安全保护。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
图6示出了本申请实施例的一种安全保护方法的示意性交互图。
参见图6，当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
在S601、vSMF网元获取vUPF网元的隧道信息V-CN-Tunnel。
具体的，vSMF网元获取vUPF网元的V-CN-Tunnel信息，V-CN-Tunnel信息是vUPF网元用于上行数据传输的隧道标识信息。
在S602、vSMF网元向hSMF网元发送PDU会话创建请求信息。
具体的，vSMF网元向hSMF网元发送PDU会话创建请求信息，PDU会话创建请求信息包括：PDU会话标识信息、vUPF网元的V-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
其中，vSMF网元、hSMF网元分别属于访问网络、归属网络；vUPF网元、hUPF网元分别属于访问网络、归属网络。
在S603、hSMF网元获取hUPF网元的隧道信息H-CN-Tunnel。
具体的，hSMF网元获取hUPF网元的H-CN-Tunnel信息。
在S604、hSMF网元向hSEPP-U网元发送业务信息#E，该业务信息#E包括：NSSAI信息和或DNN信息、V-CN-Tunnel信息、H-CN-Tunnel信息。
其中，V-CN-Tunnel信息用于vUPF网元和hUPF网元的上行数据传输，H-CN-Tunnel信息用于vUPF网元和hUPF网元的下行数据传输。
应理解，在本申请实施例中，hSMF网元可以向hSEPP网元转发业务信息#E、隧道信 息V-CN-Tunnel、H-CN-Tunnel；由hSEPP根据业务信息#E确定安全策略信息#S。
可选的，hSMF网元可以向hSEPP网元转发UE新增的参数，由hSEPP网元根据UE新增的参数确定安全策略信息#S。
在S605、hSEPP-U网元根据业务信息#E确定安全策略信息#S，包括安全算法和安全密钥。该安全策略信息#S用于指示SEPP-U网元选择相应的安全上下文，以确定是否开启用户面加密保护和/或用户面完整性保护。
相应地，SEPP-U网元根据安全策略信息#S确定安全上下文#A，选择加密算法开启用户面加密保护、选择完整性保护算法开启用户面完整性保护。
该安全策略信息#S用于SEPP-U网元根据安全上下文#A与隧道标识信息的映射关系选择相应的安全上下文，以开启不同类型的安全保护。
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。SEPP-U网元在接收到UPF网元发送的下行数据或上行数据后，SEPP-U网元激活用户面安全，开启下行数据加密和/或完整性保护；或者，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
可选的，hSEPP-U在根据业务信息#E确定安全策略信息#S后，hSEPP-U将安全策略信息#S返回给hSMF，由hSMF向vSEPP-U发送安全策略信息#S；或者，hSEPP-U在根据业务信息#E确定安全策略信息#S后，由hSEPP-U向vSEPP-U发送安全策略信息#S。
在S606、hSEPP-U网元向vSEPP-U网元发送安全策略信息#S，该安全策略信息#A保存了安全策略信息#S与V-CN-Tunnel、H-CN-Tunnel的映射关系。
在S607、hSEPP-U网元和vSEPP-U网元根据安全策略信息#S确定安全上下文信息。
vSEPP-U网元和hSEPP-U网元根据安全策略信息#S确定安全上下文信息，该安全上下文信息包括安全上下文A#1、安全上下文A#2，安全上下文A#1用于vUPF网元在 V-CN-Tunnel传输下行数据，安全上下文A#2用于hUPF网元在H-CN-Tunnel传输上行数据。
在S608、建立安全上下文信息和V-CN-Tunnel、H-CN-Tunnel的映射关系。
具体的，hSEPP、vSEPP分别建立安全上下文信息与H-CN-Tunnel-Info、V-CN-Tunnel-Info的映射关系，以用于在下行数据传输或上行数据传输时选择相应的安全上下文进行数据安全保护。
或者，SEPP-U在协商好安全上下文信息后，为安全上下文信息分配对应的安全上下文内容(context)，建立安全上下文标识信息(context ID)与隧道信息H-CN-Tunnel-Info、V-CN-Tunnel-Info映射关系。
相应的，SEPP-U在收到UPF数据时，SEPP-U根据UPF的隧道信息CN-Tunnel-Info，选择对应的安全上下文进行数据安全保护，或者根据CN-Tunnel-Info与安全上下文标识信息(context ID)的映射关系，选择相应的安全上下文(context)进行数据安全保护。
在S609、hSMF网元向vSMF网元发送PDU会话创建响应信息，以建立vUPF网元和hUPF网元的安全会话。
hSMF网元向vSMF网元发送PDU会话创建响应信息，该PDU会话创建请求信息包括：PDU会话标识信息、hUPF网元的H-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
在S610，根据安全上下文信息与隧道标识信息的映射关系进行数据安全保护。
作为示例而非限定，vUPF网元向vSEPP-U网元发送上行数据#1，vSEPP-U根据V-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对上行数据#1进行数据安全保护；vSEPP-U网元向hSEPP-U网元发送上行数据#1，hSEPP-U网元向hUPF网元发送上行数据#1。
相应的，hUPF网元在接收vUPF网元发送的上行数据后，hUPF网元激活用户面安全，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。
作为示例而非限定，hUPF网元向hSEPP-U网元发送下行数据#1，hSEPP-U根据H-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对下行数据#1进行数据安全保护；hSEPP-U网元向vSEPP-U网元发送下行数据#1，vSEPP-U网元向vUPF网元发送下行数据#1。
相应的，vUPF网元在接收hUPF网元发送的下行数据后，vUPF网元激活用户面安全，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。
应理解，在本申请实施例中，当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。当SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
应理解，在本申请实施例中，归属网络安全策略的转发路径可以是：hSMF—hSEPP-U；访问网络安全策略的转发路径可以是：hSMF—hSEPP-C—vSEPP-C—vSMF—vSEPP-U，其中，访问网络安全策略的转发需要由hSMF经过控制面hSEPP-C和vSEPP-C转发到vSMF，然后由vSMF转发给vSEPP-C。可选的，hSMF经过控制面hSEPP-C和vSEPP-C转发到vSMF可以由PDU会话创建响应Nsmf_PDUSession_Create Response服务进行转发。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据 该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
图7示出了本申请实施例的一种安全保护方法的示意性交互图。
参见图7，当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元建立安全上下文信息与隧道标识信息的映射关系。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
在S701、hSEPP-U网元和vSEPP-U网元根据安全策略信息#S确定安全上下文信息。
vSEPP-U网元和hSEPP-U网元根据安全策略信息#S确定安全上下文信息，该安全上下文信息包括安全上下文A1、安全上下文A2，安全上下文A1用于vUPF网元在V-CN-Tunnel传输下行数据过程中的安全保护，安全上下文A2用于hUPF网元在H-CN-Tunnel传输上行数据过程中的安全保护。
可选的，vSEPP-U网元和hSEPP-U网元根据业务信息#E确定安全策略信息#S，该业务信息#E1包括：NSSAI信息和或DNN信息。其中，该安全策略信息#S包括安全算法和安全密钥，该安全策略信息#S用于指示SEPP-U网元选择相应的安全上下文，以确定是否开启用户面加密保护和/或用户面完整性保护。
相应地，SEPP-U网元根据安全上下文与隧道标识信息的映射关系选择相应的安全上下文，以开启不同类型的安全保护。
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。SEPP-U网元在接收到UPF网元发送的下行数据或上行数据后，SEPP-U网元激活用户面安全，开启下行数据加密和/或完整性保护；或者，采用相应的安全上下文开启上行数据解密和/或完整性保护验证。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完 整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
应理解，在协议数据单元PDU会话建立前，vSEPP-U网元和hSEPP-U网元可以根据数据网络名称信息DNN和/或网络切片选择信息NSSAI协商安全策略信息#S。由vSMF、hSMF将数据网络名称信息DNN和/或网络切片选择信息NSSAI、隧道信息传递给vSEPP、hSEEP，SEPP可以根据隧道信息对上下行数据进行数据安全保护。
在S702、vSMF网元获取vUPF网元的隧道信息V-CN-Tunnel。
具体的，vSMF网元获取vUPF网元的V-CN-Tunnel信息，V-CN-Tunnel信息是vUPF网元用于上行数据传输的隧道标识信息。
在S703、vSMF网元向hSMF网元发送PDU会话创建请求信息。
具体的，PDU会话创建请求信息包括：PDU会话标识信息、vUPF网元的V-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
其中，vSMF网元、hSMF网元分别属于访问网络、归属网络；vUPF网元、hUPF网元分别属于访问网络、归属网络。
在S704、hSMF网元获取hUPF网元的隧道信息H-CN-Tunnel。
具体的，hSMF网元获取hUPF网元的H-CN-Tunnel信息，H-CN-Tunnel信息是vUPF网元用于下行数据传输的隧道标识信息。
在S705、hSMF网元向hSEPP-U网元发送业务信息#E，该业务信息#E包括：NSSAI信息和或DNN信息、V-CN-Tunnel信息、H-CN-Tunnel信息。
其中，V-CN-Tunnel信息用于vUPF网元和hUPF网元的上行数据传输，H-CN-Tunnel信息用于vUPF网元和hUPF网元的下行数据传输。
可选的，hSEPP-U或hSEPP-U在收到SMF传递的业务信息#E前，hSEPP-U或vSEPP-U可以建立业务信息#E与安全上下文信息的映射关系，hSEPP-U或vSEPP-U在收到SMF传递的业务信息#E后，建立安全上下文信息或安全上下文标识信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的映射关系。
在S706、hSEPP-U网元建立安全上下文信息和隧道信息H-CN-Tunnel的映射关系。
hSEPP-U网元建立安全上下文A#1和H-CN-Tunnel的映射关系，安全上下文A#1用于hUPF网元在H-CN-Tunnel传输上行数据。
在S707、hSEPP-U网元向vSEPP-U网元发送业务信息#E，该业务信息#E包括：NSSAI信息和或DNN信息、V-CN-Tunnel信息、H-CN-Tunnel信息。
在S708、vSEPP-U网元建立安全上下文信息和V-CN-Tunnel的映射关系。
vSEPP-U网元建立安全上下文A#2和V-CN-Tunnel的映射关系，安全上下文A#2用于vUPF网元在V-CN-Tunnel传输下行数据。
在S709、hSMF网元向vSMF网元发送PDU会话创建响应信息，以建立vUPF网元和hUPF网元的安全会话。
具体的，该PDU会话创建请求信息包括：PDU会话标识信息、hUPF网元的H-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
在S710，根据安全上下文信息与隧道标识信息的映射关系进行数据安全保护。
作为示例而非限定，vUPF网元向vSEPP-U网元发送上行数据#1，vSEPP-U根据 V-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对上行数据#1进行数据安全保护；vSEPP-U网元向hSEPP-U网元发送上行数据#1，hSEPP-U网元向hUPF网元发送上行数据#1。
作为示例而非限定，hUPF网元向hSEPP-U网元发送下行数据#1，hSEPP-U根据H-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对下行数据#1进行数据安全保护；hSEPP-U网元向vSEPP-U网元发送下行数据#1，vSEPP-U网元向vUPF网元发送下行数据#1。
可选的，在本申请实施例中，vSEPP-U网元和hSEPP-U网元可以根据数据网络名称信息DNN和/或网络切片选择信息NSSAI协商安全策略信息#S。在上下行数据传输时，vSEPP-U网元和hSEPP-U网元可以根据安全策略信息#S选择或协商相应的安全上下文信息以进行数据安全保护。
应理解，在本申请实施例中，当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。当SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
图8示出了本申请实施例的一种安全保护方法的示意性交互图。
参见图8，当用户面功能UPF网元(vUPF网元、hUPF网元)不引入用户面安全网关时，可以由用户面功能UPF网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，用户面UPF网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
在S801、vSMF网元获取vUPF网元的隧道信息V-CN-Tunnel。
具体的，vSMF网元获取vUPF网元的V-CN-Tunnel信息，V-CN-Tunnel信息是vUPF网元用于上行数据传输的隧道标识信息。
在S802、vSMF网元向hSMF网元发送PDU会话创建请求信息。
具体的，vSMF网元向hSMF网元发送PDU会话创建请求信息，PDU会话创建请求信息包括：PDU会话标识信息、vUPF网元的V-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
例如，vSMF通过Nsmf_PDUSession_Create Request向hSMF发送会话创建请求信息。
其中，vSMF网元、hSMF网元分别属于访问网络、归属网络；vUPF网元、hUPF网元分别属于访问网络、归属网络。
在S803、hSMF网元确定vUPF网元和hUPF网元的安全策略信息#S。
具体的，hSMF网元获取hUPF网元的隧道信息H-CN-Tunnel，hSMF网元确定vUPF网元和hUPF网元的安全策略信息#S，该安全策略信息#S用于vUPF网元和hUPF网元的数据传输。
其中，该安全策略信息#S包括安全算法和安全密钥，该安全策略信息#S用于指示UPF网元选择相应的安全上下文，以确定是否开启用户面加密保护和/或用户面完整性保护。
相应地，UPF网元根据安全上下文与隧道标识信息的映射关系选择相应的安全上下文，以开启不同类型的安全保护。
应理解，当用户面功能UPF网元(vUPF网元、hUPF网元)不引入用户面安全网关时，安全策略可以由hSMF或vSMF网元进行策略转发，以向vUPF网元或hUPF网元传递安全策略，由vUPF网元或hUPF网元根据运营商策略或者业务需求，在用户面开启不同的保护机制。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
在S804、hSMF网元向hUPF网元发送安全策略信息#S。
具体的，hSMF网元向hUPF网元发送安全策略信息#S，该安全策略信息#A保存了安全策略信息#S与V-CN-Tunnel、H-CN-Tunnel的映射关系。
其中，V-CN-Tunnel信息用于vUPF网元和hUPF网元的上行数据传输，H-CN-Tunnel信息用于vUPF网元和hUPF网元的下行数据传输。
在S805、hSMF网元向vSMF网元发送PDU会话创建响应信息，以建立vUPF网元和hUPF网元的安全会话。
hSMF网元向vSMF网元发送PDU会话创建响应信息，该PDU会话创建请求信息包括：PDU会话标识信息、hUPF网元的H-CN-Tunnel信息，该PDU会话创建请求信息用于建立vUPF网元和hUPF网元的安全会话。
在S806、vSMF网元向vUPF网元发送安全策略信息#S。
在S807、建立安全上下文信息和V-CN-Tunnel、H-CN-Tunnel的映射关系。
具体的，vUPF网元、hUPF网元分别建立安全上下文信息与H-CN-Tunnel-Info、V-CN-Tunnel-Info的映射关系，以用于在下行数据传输或上行数据传输时选择相应的安全 上下文进行数据安全保护。
在S808，根据安全上下文信息与隧道标识信息的映射关系进行数据安全保护。
作为示例而非限定，vUPF网元向vSEPP-U网元发送上行数据#1，vSEPP-U根据V-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对上行数据#1进行数据安全保护；vSEPP-U网元向hSEPP-U网元发送上行数据#1，hSEPP-U网元向hUPF网元发送上行数据#1。
作为示例而非限定，hUPF网元向hSEPP-U网元发送下行数据#1，hSEPP-U根据H-CN-Tunnel与安全上下文A#1的映射关系，采用安全上下文A#1对下行数据#1进行数据安全保护；hSEPP-U网元向vSEPP-U网元发送下行数据#1，vSEPP-U网元向vUPF网元发送下行数据#1。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
上文详细介绍了本申请提供的用户面安全保护的方法示例。可以理解的是，SMF和UPF/SEPP-U为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
图9示出了上述实施例中所涉及的SMF的一种可能的结构示意图。SMF900包括：处理单元902和通信单元903。处理单元902用于对SMF900的动作进行控制管理。通信单元903用于支持SMF900与其它网络实体的通信，例如与用户面安全网元之间的通信。SMF900还可以包括存储单元901，用于存储SMF900的程序代码和数据。
其中，处理单元902可以是处理器或控制器，例如可以是中央处理器(central processing unit，CPU)，通用处理器，数字信号处理器(digital signal processor，DSP)，专用集成电路(application-specific integrated circuit，ASIC)，现场可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元903可以是通信接口。存储单元901可以是存储器。
通信单元903可用于执行下述操作：接收SMF网元#2发送的会话创建请求信息，所述会话创建请求信息包括业务信息#E；根据所述业务信息#E确定安全策略信息#S；向用户面安全网元#1发送安全策略信息#S；所述安全策略信息#S用于用户面安全网元#1根据所述安全策略信息#S生成安全上下文信息；其中所述用户面安全网元#1属于归属网络，所述SMF网元#2属于访问网络。
可选的，归属网络SMF网元可以复用从UDM获取的UE签约数据中的的RAN侧安全策略信息，或者，新增UE在UDM的SEPP-U侧安全策略签约数据，或者归属网络SMF网元根据业务信息#E确定安全策略信息#S，或者vSMF向hSMF发送UE新增的应用层 相关参数，由hSMF根据UE新增的应用层相关参数进行安全策略决策。
可选的，业务信息#E包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
应理解，在本申请实施例中，业务信息#E与安全策略信息#S具有映射关系，安全策略信息#S与安全上下文信息#A具有映射关系，安全上下文信息#A与隧道标识信息#T具有映射关系，因此用户面安全网元可以根据安全上下文#A与隧道标识信息#T的映射关系采用相应的安全上下文进行数据安全保护。
可选的，安全策略信息包括指示信息#1、指示信息#2，其中，所述指示信息#1用于指示所述用户面安全网元#1是否采用加密算法进行数据加密保护，所述指示信息#2用于指示所述用户面安全网元#1是否采用完整性保护算法进行数据完整性保护。
在一种可能的设计中，通信单元903还用于：向SMF网元#2发送会话创建响应信息，所述会话创建响应信息用于指示SMF网元#2向UPF网元#2发送安全策略信息，其中UPF网元#2属于访问网络。
当处理单元902为处理器，通信单元903为通信接口，存储单元901为存储器时，本申请所涉及的SMF可以为图10所示的SMF。
参阅图10所示，该SMF1000包括：处理器1002、通信接口1003、存储器1001。其中，通信接口1003、处理器1002以及存储器1001可以通过内部连接通路相互通信，传递控制和/或数据信号。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不加赘述。
图11示出了上述实施例中所涉及的用户面安全网元的一种可能的结构示意图。用户面安全网元1100包括：处理单元1102和通信单元1103。处理单元1102用于对用户面安全网元1100的动作进行控制管理。通信单元1103用于支持用户面安全网元1100与其它网络实体的通信，例如与SMF之间的通信。用户面安全网元1100还可以包括存储单元1101，用于存储用户面安全网元1100的程序代码和数据。
其中，处理单元1102可以是处理器或控制器，例如可以是CPU，通用处理器，DSP，ASIC，FPGA或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，DSP和微处理器的组合等等。通信单元1103可以是通信接口等。存储单元1101可以是存储器。
通信单元1103用于执行下述操作：接收SMF网元#1发送的安全策略信息，所述安全策略信息与业务信息#E具有映射关系；根据安全策略信息#S生成安全上下文信息#E，安全上下文信息用于用户面安全网元#1进行数据安全保护；其中，用户面安全网元#1、SMF网元#1属于归属网络。
可选的，业务信息#E包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
应理解，在本申请实施例中，业务信息#E与安全策略信息#S具有映射关系，安全策略信息#S与安全上下文信息#A具有映射关系，安全上下文信息#A与隧道标识信息#T具有映射关系，因此用户面安全网元可以根据安全上下文#A与隧道标识信息#T的映射关系采用相应的安全上下文进行数据安全保护。
例如，在图1所示的场景下，安全上下文信息与隧道信息V-CN-Tunnel、H-CN-Tunnel的对应关系如下表所示：
表1 安全上下文与V-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 V-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 V-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 V-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 V-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
表2 安全上下文与H-CN-Tunnel的对应关系
业务信息 隧道标识信息 安全策略信息 安全上下文
业务信息#E1 H-CN-Tunnel#1 安全策略信息#S1 安全上下文A#1
业务信息#E2 H-CN-Tunnel#2 安全策略信息#S2 安全上下文A#2
业务信息#E3 H-CN-Tunnel#3 安全策略信息#S3 安全上下文A#3
业务信息#E4 H-CN-Tunnel#4 安全策略信息#S4 安全上下文A#4
作为示例而非限定，安全上下文#A1可用于开启用户面加密保护，该安全上下文#A2可用于开启用户面完整性保护，该安全上下文#A3可用于开启用户面加密保护、用户面完整性保护，该安全上下文#A4可用于不开启用户面加密保护、用户面完整性保护。
可选的，安全策略信息包括指示信息#1、指示信息#2，其中，所述指示信息#1用于指示所述用户面安全网元#1是否采用加密算法进行数据加密保护，所述指示信息#2用于指示所述用户面安全网元#1是否采用完整性保护算法进行数据完整性保护。
在一种可能的设计中，通信单元还用于：向用户面安全网元#2发送安全策略信息，所述安全策略信息用于指示用户面安全网元#2根据所述安全策略信息与业务信息的映射关系生成安全上下文信息A#1；所述安全上下文信息用于用户面安全网元#2进行数据安全保护，其中所述用户面安全网元#2属于访问网络。
在一种可能的设计中，通信单元还用于：接收UPF网元#1在H-CN-Tunnel#1发送的下行数据#1；根据所述H-CN-Tunnel#1与安全上下文A#1的映射关系，采用安全上下文A#1对所述下行数据#1进行数据安全保护。
在一种可能的设计中，通信单元还用于：根据所述H-CN-Tunnel#1与安全上下文A#1的映射关系，采用安全上下文A#1对下行数据#1进行数据安全保护；向UPF网元#2发送所述下行数据#1，其中所述UPF网元#2属于访问网络。
作为示例而非限定，本申请的数据安全保护装置可以应用于5G Home-routed场景，访问网络vPLMN与归属网络hPLMN之间的用户面安全保护。
当用户面功能UPF网元(vUPF网元、hUPF网元)引入用户面安全网关时，可以由SEPP-U网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，SEPP-U网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
当用户面功能UPF网元(vUPF网元、hUPF网元)不引入用户面安全网关时，可以由用户面功能UPF网元根据安全策略信息#S生成安全上下文信息#A。
在此情况下，用户面UPF网元在收到用户面UPF数据时，根据安全上下文信息与隧道标识信息的映射关系选取相应的安全上下文，进行数据传输过程中的安全保护。
由于归属网络SMF网元可以根据业务信息生成安全策略信息，用户面安全网元根据 该安全策略信息生成安全上下文信息，当业务数据在相应的隧道上传输时，用户面安全网元可以针对不同的业务采用不同的安全上下文进行数据安全保护，在访问网络与归属网络间实现灵活的数据安全保护机制。
当处理单元1102为处理器，通信单元1103为通信接口，存储单元1101为存储器时，本申请所涉及的用户面安全网元可以为图12所示的用户面安全网元。
参阅图12所示，该用户面安全网元1200包括：处理器1202、通信接口1203、存储器1201。其中，通信接口1203、处理器1202以及存储器1201可以通过内部连接通路相互通信，传递控制和/或数据信号。
本申请还提供了一种通信芯片，其中存储有指令，当其在SMF900或SMF1000上运行时，使得所述通信芯片执行上述各种实现方式中SMF对应的方法。
本申请还提供了一种通信芯片，其中存储有指令，当其在用户面安全网元1100或用户面安全网元1200上运行时，使得所述通信芯片执行上述各种实现方式中UPF或SEPP-U对应的方法。
在本申请各个实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请的实施过程构成任何限定。
另外，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(random access memory，RAM)、闪存、只读存储器(read only memory，ROM)、可擦除可编程只读存储器(erasable programmable ROM，EPROM)、电可擦可编程只读存储器(electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、只读光盘(CD-ROM)或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于SMF或UPF中。当然，处理器和存储介质也可以作为分立组件存在于SMF和UPF中。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间 接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (22)

  1. 一种用户面安全保护的方法，其特征在于，所述方法包括：
    第一会话管理功能SMF网元接收第二SMF网元发送的会话创建请求信息，所述会话创建请求信息包括第一业务信息；
    所述第一SMF网元根据所述第一业务信息确定安全策略信息；
    所述第一SMF网元向第一用户面安全网元发送安全策略信息；所述安全策略信息用于第一用户面安全网元根据所述安全策略信息生成安全上下文信息；其中所述第一SMF网元、第一用户面安全网元属于归属网络，所述第二SMF网元属于访问网络。
  2. 根据权利要求1所述的方法，其特征在于，所述第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述安全策略信息包括第一指示信息、第二指示信息，
    其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
  4. 根据权利要求3所述的方法，其特征在于，所述第一用户面安全网元为第一用户面功能UPF网元，所述方法还包括：
    第一SMF网元向第二SMF网元发送会话创建响应信息，所述会话创建响应信息用于指示第二SMF网元向第二UPF网元发送安全策略信息，其中所述第一UPF网元属于归属网络，所述第二UPF网元属于访问网络。
  5. 一种用户面安全保护的方法，其特征在于，所述方法包括：
    第一用户面安全网元接收第一SMF网元发送的安全策略信息；
    所述第一用户面安全网元根据所述安全策略信息生成安全上下文信息，所述安全上下文信息与隧道标识信息具有映射关系，所述安全上下文信息用于第一用户面安全网元进行数据安全保护；
    其中，所述第一用户面安全网元、第一SMF网元属于归属网络。
  6. 根据权利要求5所述的方法，其特征在于，所述第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
  7. 根据权利要求5或6所述的方法，其特征在于，所述安全策略信息包括第一指示信息、第二指示信息，
    其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
  8. 根据权利要求5或6所述的方法，其特征在于，所述安全上下文信息包括第一安全上下文、第二安全上下文；所述第一安全上下文与第一隧道标识信息具有映射关系，所述第二安全上下文与所述第二隧道标识信息具有映射关系。
  9. 根据权利要求5-8任一项所述的方法，其特征在于，所述第一用户面安全网元为第一UPF网元，所述方法还包括：
    所述第一UPF网元根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对第一下行数据进行数据安全保护。
  10. 根据权利要求5-8任一项所述的方法，其特征在于，所述第一用户面安全网元为第一安全边界防护代理SEPP网元，所述方法还包括：
    所述第一SEPP网元向第二SEPP网元发送安全策略信息，所述安全策略信息用于指示第二SEPP网元根据安全策略信息与业务信息的映射关系生成安全上下文信息；
    所述安全上下文信息用于第二SEPP网元进行数据安全保护，其中所述第一SEPP网元属于归属网络、所述第二SEPP网元属于访问网络。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述第一SEPP网元接收第一UPF网元在第一隧道发送的第一下行数据；
    根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对所述第一下行数据进行数据安全保护。
  12. 一种用户面安全保护的装置，其特征在于，包括通信单元，所述通信单元用于：
    接收第二SMF网元发送的会话创建请求信息，所述会话创建请求信息包括第一业务信息；
    根据所述第一业务信息确定安全策略信息；
    向第一用户面安全网元发送安全策略信息；所述安全策略信息用于第一用户面安全网元根据所述安全策略信息生成安全上下文信息，其中，所述第一用户面安全网元属于归属网络，所述第二SMF网元属于访问网络。
  13. 根据权利要求12所述的装置，其特征在于，所述第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
  14. 根据权利要求12或13所述的装置，其特征在于，所述安全策略信息包括第一指示信息、第二指示信息，
    其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算法进行数据完整性保护。
  15. 根据权利要求14所述的装置，其特征在于，所述通信单元还用于：
    向第二SMF网元发送会话创建响应信息，所述会话创建响应信息用于指示第二SMF网元向第二UPF网元发送安全策略信息，其中所述第二UPF网元属于访问网络。
  16. 一种用户面安全保护的装置，其特征在于，包括通信单元，所述通信单元用于：
    接收第一SMF网元发送的安全策略信息；
    根据所述安全策略信息生成安全上下文信息，所述安全上下文信息与隧道标识信息具有映射关系，所述安全上下文信息用于第一用户面安全网元进行数据安全保护；
    其中，所述第一用户面安全网元、第一SMF网元属于归属网络。
  17. 根据权利要求16所述的装置，其特征在于，所述第一业务信息包括数据网络名称DNN信息和/或网络切片选择NSSAI信息。
  18. 根据权利要求16或17所述的装置，其特征在于，所述安全策略信息包括第一指示信息、第二指示信息，
    其中，所述第一指示信息用于指示所述第一用户面安全网元是否采用加密算法进行数据加密保护，所述第二指示信息用于指示所述第一用户面安全网元是否采用完整性保护算 法进行数据完整性保护。
  19. 根据权利要求18所述的装置，其特征在于，所述通信单元还用于：
    向第二用户面安全网元发送安全策略信息，所述安全策略信息用于指示第二用户面安全网元根据所述安全策略信息与业务信息的映射关系生成安全上下文信息；
    所述安全上下文信息用于第二用户面安全网元进行数据安全保护，其中所述第二用户面安全网元属于访问网络。
  20. 根据权利要求18所述的装置，其特征在于，所述通信单元还用于：
    接收第一UPF网元在第一隧道发送的第一下行数据；
    根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对所述第一下行数据进行数据安全保护。
  21. 根据权利要求18所述的装置，其特征在于，所述通信单元还用于：
    根据所述第一隧道标识信息与第一安全上下文的映射关系，采用第一安全上下文对第一下行数据进行数据安全保护；
    向第二UPF网元发送所述第一下行数据，其中所述第二UPF网元属于访问网络。
  22. 一种网络设备，其特征在于，所述设备包括：存储器，用于存储指令；处理器，用于调用所述存储器中的指令，执行如权利要求1至4中任一项所述的方法或执行如权利要求5至11中任一项所述的方法。
PCT/CN2020/072961 2019-01-27 2020-01-19 用户面安全保护的方法和装置 WO2020151614A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910077025.4A CN111491394B (zh) 2019-01-27 2019-01-27 用户面安全保护的方法和装置
CN201910077025.4 2019-01-27

Publications (1)

Publication Number Publication Date
WO2020151614A1 true WO2020151614A1 (zh) 2020-07-30

Family

ID=71736735

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/072961 WO2020151614A1 (zh) 2019-01-27 2020-01-19 用户面安全保护的方法和装置

Country Status (2)

Country Link
CN (1) CN111491394B (zh)
WO (1) WO2020151614A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114362984B (zh) * 2020-10-13 2023-05-09 华为技术有限公司 一种接口安全性保护方法及装置
CN114286339A (zh) * 2021-12-21 2022-04-05 中国电信股份有限公司 安全策略的确定方法及系统
CN114339761A (zh) * 2021-12-30 2022-04-12 天翼物联科技有限公司 一种用于网络切片的用户面数据完整性保护方法和系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820234A (zh) * 2016-09-14 2018-03-20 华为技术有限公司 一种网络漫游保护方法、相关设备及系统
WO2018167307A1 (en) * 2017-03-17 2018-09-20 Telefonaktiebolaget Lm Ericsson (Publ) Security solution for switching on and off security for up data between ue and ran in 5g
CN108810884A (zh) * 2017-05-06 2018-11-13 华为技术有限公司 密钥配置方法、装置以及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101895605B (zh) * 2010-06-11 2014-12-10 中兴通讯股份有限公司 利用伪联系人信息进行通信的方法和装置
JP2019050435A (ja) * 2016-01-19 2019-03-28 シャープ株式会社 端末装置、ｃ−ｓｇｎおよび通信制御方法
CN114285570A (zh) * 2016-07-01 2022-04-05 华为技术有限公司 密钥配置及安全策略确定方法、装置
CN108347416B (zh) * 2017-01-24 2021-06-29 华为技术有限公司 一种安全保护协商方法及网元

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107820234A (zh) * 2016-09-14 2018-03-20 华为技术有限公司 一种网络漫游保护方法、相关设备及系统
WO2018167307A1 (en) * 2017-03-17 2018-09-20 Telefonaktiebolaget Lm Ericsson (Publ) Security solution for switching on and off security for up data between ue and ran in 5g
CN108810884A (zh) * 2017-05-06 2018-11-13 华为技术有限公司 密钥配置方法、装置以及系统

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
3RD GENERATION PARTNERSHIP PROJECT: "Technical Specification Group Services and System Aspects; Procedures for the 5G System; Stage 2 (Release 15)", 3GPP TS 23.502 V15.4.1 (2019-01), 7 January 2019 (2019-01-07), DOI: 20200407121041Y *
3RD GENERATION PARTNERSHIP PROJECT: "Technical Specification Group Services and System Aspects; Security Architecture and Procedures for 5G System (Release 15)", 3GPP TS 33.501 V15.3.1 (2018-12), 26 December 2018 (2018-12-26), DOI: 20200407104331Y *
3RD GENERATION PARTNERSHIP PROJECT: "Technical Specification Group Services and System Aspects; System Architecture for the 5G System; Stage 2 (Release 15)", 3GPP TS 23.501 V15.4.0 (2018-12), 18 December 2018 (2018-12-18), DOI: 20200407103702Y *

Also Published As

Publication number Publication date
CN111491394B (zh) 2022-06-14
CN111491394A (zh) 2020-08-04

Similar Documents

Publication Publication Date Title
US11778459B2 (en) Secure session method and apparatus
JP7187580B2 (ja) セッション管理の方法、装置、およびシステム
EP3442202B1 (en) Registration and session establishment methods, terminal, and amf entity
JP6438593B2 (ja) サービスｃプレーン手法のためにネットワークトークンを使用する効率的なポリシー実施
EP3764696A1 (en) Method and apparatus for transmitting data
EP3525545A1 (en) Method for selecting session and service continuity mode in wireless communication system and device therefor
CN101939968B (zh) 针对封装的数据流的策略控制
WO2019153766A1 (zh) 无线通信的方法、网络设备和终端设备
WO2018161796A1 (zh) 多接入场景中的连接处理方法和装置
WO2020151614A1 (zh) 用户面安全保护的方法和装置
CN113543233A (zh) 通信方法、网元、终端装置和系统
CN112020104B (zh) 用于背景数据传输的方法、通信装置和通信系统
JP2018508146A (ja) サービス−ユーザプレーン手法のためのネットワークトークンを使用した効率的なポリシー施行
WO2018161802A1 (zh) 一种业务流的控制方法及装置
CN111328112B (zh) 一种安全上下文隔离的方法、装置及系统
EP3813401A1 (en) User plane integrity protection method, apparatus and device
CN114071639A (zh) 接入网络的方法、通信系统和通信装置
WO2019174582A1 (zh) 一种消息传输方法和装置
EP3499922B1 (en) Method, device and computer-readable storage medium for applying qos based on user plane data mapping
WO2019100343A1 (zh) 接入无线局域网的方法、终端设备和网络设备
WO2020233496A1 (zh) 安全会话方法和装置
WO2023160390A1 (zh) 通信方法与装置
WO2022174802A1 (zh) 密钥更新的方法和装置
WO2022174729A1 (zh) 保护身份标识隐私的方法与通信装置
WO2022237857A1 (zh) 确定安全保护开启方式的方法、通信方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20745568

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20745568

Country of ref document: EP

Kind code of ref document: A1