WO2020164432A1

WO2020164432A1 - Communication method and apparatus

Info

Publication number: WO2020164432A1
Application number: PCT/CN2020/074406
Authority: WO
Inventors: 王瑞; 戴明增; 曾清海
Original assignee: 华为技术有限公司
Priority date: 2019-02-14
Filing date: 2020-02-06
Publication date: 2020-08-20
Also published as: CN111565391A; CN111565391B

Abstract

Disclosed are a communication method and apparatus, which relate to the technical field of communications. The method is applied to a dual connectivity communication system comprising a first access network device and a second access network device, wherein the first access network device acquires a first QoS flow and a first security result of a PDU session, bears the first QoS flow, and carries out security protection on the first QoS flow according to the first security result. The first QoS flow belongs to the PDU session, and the first security result is determined by the first access network device, or is determined by the second access network device; and the first security result is used for indicating whether the security protection has been carried out on the PDU session, wherein the security protection comprises at least one of integrity protection and encryption protection, thus realizing security protection for an air interface user plane in the 5G dual connectivity communication system.

Description

Communication method and device

This application claims the priority of a Chinese patent application filed with the State Intellectual Property Office on February 14, 2019, the application number is 201910115213.1, and the invention title is "a communication method and device", the entire content of which is incorporated into this application by reference .

Technical field

The embodiments of the present application relate to the field of communication technologies, and in particular, to a communication method and device.

Background technique

In order to improve data security, the 5th generation mobile communication technology (5G) system introduces security protection for the air interface user plane, where security protection refers to integrity protection (referred to as complete protection) and/or Encryption protection. Specifically, when a certain protocol data unit (PDU) session (session) is established for the terminal, the core network device sends a request message to the base station to request the allocation of resources for the PDU session, and at the same time, the core network device sends A security instruction indicating that the PDU session must, or is not required, or recommended to protect the PDU session; if the security instruction is used to indicate that the PDU session is recommended to be secured, the base station can determine whether to protect the PDU session by itself, that is, the base station You can determine the safety results yourself.

However, for dual connectivity (DC) communication systems, for example, gNB (a base station that uses a new radio (NR) in a 5G system) and a next generation base station (next generation eNB, ng-eNB) cooperative group For the Internet, there is currently no security protection method for the air interface user plane.

Summary of the invention

The embodiments of the present application provide a communication method and device, and provide a security protection method for an air interface user plane in a 5G dual-connection communication system.

In order to achieve the foregoing objectives, the following technical solutions are adopted in the embodiments of this application:

In a first aspect, a communication method is provided. The communication method is applied to a dual-connection communication system including a first access network device and a second access network device. The first access network device obtains a first quality of service. service, QoS) flow and the first security result of the protocol data unit (protocol data unit, PDU) session. After that, the first access network device carries the first QoS flow, and performs the first QoS flow according to the first security result. safety protection. The first QoS flow here belongs to the PDU session, the first security result is determined by the first access network device or the second access network device, and the first security result is used to indicate whether to perform security protection on the PDU session. The security protection includes complete At least one of sexual protection and encryption protection.

The first access network device is the primary or secondary station of the dual-connection communication system. The first access network device performs security protection on the first QoS flow according to the first security result determined by itself/the second access network device to achieve In order to protect the security of the air interface user plane.

In addition, if the first security result is determined by the second access network device, the first access network device and the second access network device of this application use the same security result to securely protect QoS flows belonging to the same PDU session , To ensure the consistency of the security protection of the air interface user plane by the first access network device and the second access network device.

Optionally, in a possible implementation manner of the present application, the foregoing PDU session includes a second QoS flow, and the second QoS flow is carried by a second access network device. That is, before the first access network device carries the first QoS flow, the second access network device carries the second QoS flow.

In an implementation manner, before the first access network device carries the first QoS flow, all QoS flows of the PDU session can be carried on the second access network device. In this way, the first security result is determined by the second access network device. Equipment OK.

In another implementation manner, before the first access network device carries the first QoS flow, the second access network device carries the second QoS flow, and the first access network device carries other QoS flows of the PDU session, In this case, the first safety result is determined by the master station of the dual-connection communication system.

Optionally, in another possible implementation manner of the present application, before the first access network device obtains the first QoS flow, all QoS flows of the PDU session are carried on the second access network device; the first security result It is determined by the second access network device.

Optionally, in another possible implementation manner of the present application, the first access network device also carries the third QoS flow in the PDU session. In this way, if the first access network device is the master of the dual connectivity communication system Station, the first security result is determined by the first access network device; if the second access network device is the master station of the dual-connection communication system, the first security result is determined by the second access network device.

Optionally, in another possible implementation manner of the present application, if the first security result is determined by the second access network device, before the second access network device determines the first security result, the first security result The access network device carries all QoS flows in the PDU session, and determines the second security result of the PDU session. The second security result is used to indicate whether to protect the PDU session. The second security result is the same as the first security result. Same or different; subsequently, the first access network device releases all QoS flows in the PDU session, and sends the first request message to the second access network device; if the first access network device is the master station of the dual-connection communication system , The second access network device is a secondary station of the communication system, the first request message is used to request the allocation of resources for the PDU session, and the first security result is determined according to the first security indication information; if the first access network device is dual connectivity The secondary station of the communication system, the second access network device is the primary station of the communication system, and the first request message is used to request the release of all QoS flows in the PDU session. The first security indication information is used to indicate to perform security protection on the QoS flow released by the first access network device, or to indicate whether to perform security protection on the QoS flow released by the first access network device by itself.

After the first access network device releases all QoS flows of the PDU session, the second access network device can determine the security result of the PDU session by itself.

Optionally, in another possible implementation manner of this application, if the first access network device is the master station of the dual-connection communication system, and the second access network device is the auxiliary station of the communication system, After the access network device determines the first security result, the first access network device also receives the first security result from the second access network device. If the first security result is different from the second security result, the first access network device also sends the first security result to the core network device for the core network device to determine that the security result of the PDU session has changed.

It is easy to understand that in a scenario where the first access network device is the primary station and the second access network device is the secondary station, if the security result of the PDU session is changed from the second security result to the first security result, and the second security result is If a security result is determined by the second access network device, the first access network device needs to communicate with the second access network device so that the first access network device sends the first security result to the core network device so that The core network device completes the corresponding configuration according to the first security result.

Optionally, in another possible implementation manner of this application, after obtaining the first security result, the first access network device further stores the first security result. Correspondingly, the above-mentioned method of "the first access network device obtaining the first security result of the PDU session" is: the first access network device obtains the first security result locally.

If the first access network device itself determines the first security result, the first access network device may obtain the first security result locally. If the first security result is determined by the second access network device, after the first access network device obtains the first security result from the second access network device, the first security result may or may not be stored. A safe result. If the first access network device stores the first security result, the first access network device can obtain the first security result locally.

Optionally, in another possible implementation manner of the present application, if the first security result is determined by the second access network device, after performing security protection on the first QoS flow according to the first security result, the first security result is An access network device also releases the fourth QoS flow, and sends a second request message to the second access network device for requesting security protection for the fourth QoS flow according to the first security result, and the fourth QoS flow belongs to the PDU Conversation.

In the scenario where the first access network device and the second access network device both carry the QoS flow of the PDU session, if both of them perform security protection on the QoS flow carried by each according to the first security result, the first access After the network device releases the fourth QoS flow carried by itself, the second access network device can carry the fourth QoS flow and protect it according to the first security result.

In a second aspect, a communication device is provided, which can implement the functions in the first aspect and any one of its possible implementation manners. These functions can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In a possible manner of the present application, the communication device may include a processing unit, and the processing unit may perform the corresponding function in the communication method of the foregoing first aspect and any one of its possible implementation manners. For example: a processing unit for obtaining a first quality of service QoS flow, which belongs to a PDU session; and for obtaining a first security result of the PDU session, the first security result being determined by the first access network device , Or determined for the second access network device, the security result of the PDU session here is used to indicate whether to perform security protection on the PDU session, and the security protection includes at least one of integrity protection and encryption protection; A QoS flow, and security protection is performed on the first QoS flow according to the first security result.

In a third aspect, a communication device is provided. The communication device includes a processor, the processor is configured to be coupled with a memory, read and execute instructions in the memory, so as to implement the first aspect and any one of its possibilities. Implement the communication method described in the mode.

Optionally, the communication device may further include a memory for storing program instructions and data of the communication device. Further optionally, the communication device may further include a transceiver, which is used to execute the communication method described in the first aspect and any one of its possible implementations under the control of the processor of the communication device The step of sending and receiving data, signaling or information, for example, receiving a first request message and sending a second request message.

Optionally, the communication device may be the first access network device, or a part of the devices in the first access network device, such as a chip system in the first access network device. The chip system is used to support the first access network device to implement the functions involved in the first aspect and any one of its possible implementations, for example, receiving, sending or processing the data and/or information involved in the aforementioned communication methods . The chip system includes a chip, and may also include other discrete devices or circuit structures.

In a fourth aspect, a computer-readable storage medium is also provided, the computer-readable storage medium stores instructions; when it runs on a communication device, the communication device is caused to execute the above-mentioned first aspect and various possible implementations thereof The communication method described in the method.

In a fifth aspect, a computer program product including instructions is also provided, which when running on a communication device, causes the communication device to execute the communication method as described in the first aspect and various possible implementations thereof.

It should be noted that the above instructions may be stored in whole or in part on the first computer storage medium, where the first computer storage medium may be packaged with the processor or separately packaged with the processor. This application will not specifically describe this. limited.

For the specific description of the second aspect, third aspect, fourth aspect, fifth aspect and various implementation manners of this application, reference may be made to the detailed description in the first aspect and various implementation manners; and, the second aspect, For the beneficial effects of the third aspect, the fourth aspect, the fifth aspect and their various implementation manners, reference may be made to the analysis of the beneficial effects in the first aspect and the various implementation manners, which will not be repeated here.

In a sixth aspect, a communication method is provided. The first access network device obtains from the core network device and indicates that a preset QoS flow or a preset evolved packet system (EPS) bearer is carried according to the first security result. Instruction information for security protection (at least one of integrity protection and encryption protection); then, the first access network device determines the target DRB, and performs security protection on the target DRB according to the first security result, where the target DRB is The preset QoS flow is carried, or the target DRB corresponds to the preset EPS bearer.

Generally, the basic granularity of the QoS control of the 4G system is the EPS bearer. The data streams of the same EPS bearer get the same QoS guarantee, and the DRB and EPS bearers are mapped one by one. In the 5G system, multiple QoS flows of PDU sessions are mapped to one or more DRBs. If the core network device instructs to perform security protection on the specified QoS flow or the specified EPS bearer according to the first security result, the first access network device performs security protection on the target DRB according to the instruction. Compared with the prior art, it achieves Security protection with a smaller granularity can effectively reduce the power consumption of the terminal and increase the data transmission and reception rate.

Optionally, in a possible implementation manner of the present application, after the first access network device performs security protection on the target DRB according to the first security result, it may also release the preset QoS flow or the preset EPS bearer , And send a security request message to the second access network device, which is used to request security protection for the released object (the preset QoS flow or the preset EPS bearer) according to the first security result.

Even if in the subsequent process, the first access network device transfers the preset QoS flow or the preset EPS bearer to the second access network device, it needs to instruct the second access network device according to the first security result Protect it safely.

In a seventh aspect, a communication device is provided, which can implement the functions in the first aspect and any one of its possible implementation manners. These functions can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

In a possible manner of the present application, the communication device may include a processing unit, and the processing unit may perform the corresponding function in the communication method of the foregoing first aspect and any one of its possible implementation manners. For example: the processing unit is used to obtain indication information from the core network device, the indication information is used to indicate the security protection of the preset QoS flow or the preset EPS bearer according to the first security result, and the security protection includes integrity protection and encryption At least one of protection; and used to determine a target DRB that carries a preset QoS flow, or the target DRB corresponds to a preset EPS bearer; and used to secure the target DRB according to the first security result protection.

According to an eighth aspect, a communication device is provided. The communication device includes a processor configured to couple with a memory, read and execute instructions in the memory, so as to implement the sixth aspect and any one of the possibilities thereof. Implement the communication method described in the mode.

Optionally, the communication device may further include a memory, and the memory is used to store program instructions and data of the communication device. Further, optionally, the communication device may further include a transceiver, which is configured to perform the communication described in the sixth aspect and any one of its possible implementation manners under the control of the processor of the communication device. The step of sending and receiving data, signaling or information in the method, for example, sending a security request message.

Optionally, the communication device may be the first access network device, or a part of the devices in the first access network device, such as a chip system in the first access network device. The chip system is used to support the first access network device to implement the functions involved in the sixth aspect and any one of its possible implementations, such as receiving, sending or processing the data and/or information involved in the aforementioned communication methods . The chip system includes a chip, and may also include other discrete devices or circuit structures.

In a ninth aspect, a computer-readable storage medium is also provided, the computer-readable storage medium stores instructions; when it runs on a communication device, the communication device executes the sixth aspect and various possible implementations as described above The communication method described in the method.

In a tenth aspect, a computer program product including instructions is also provided, which when running on a communication device, causes the communication device to execute the communication method as described in the sixth aspect and various possible implementations thereof.

For specific descriptions of the seventh aspect, eighth aspect, ninth aspect, tenth aspect and various implementation manners of this application, reference may be made to the detailed description in the sixth aspect and various implementation manners; and, the seventh aspect, For the beneficial effects of the eighth aspect, the ninth aspect, the tenth aspect and various implementation manners thereof, reference may be made to the analysis of the beneficial effects in the sixth aspect and various implementation manners, which will not be repeated here.

In an eleventh aspect, a communication system is provided. The communication system includes the communication device according to any one of the second to fifth aspects, and a second access network device, the communication device and the second access The connected devices are dual-connected. Alternatively, the communication system includes the communication device according to any one of the seventh aspect to the tenth aspect, and a core network device. Optionally, the communication system further includes a second access network device, and the second access The network equipment is dual-connected to the communication device.

In a twelfth aspect, a chip system is provided, and the chip system is applied to a communication device. Specifically, the chip system includes one or more interface circuits and one or more processors. The interface circuit and the processor are interconnected by wires. The interface circuit is used to receive a signal from the memory of the communication device and send the signal to the processor, and the signal includes a computer instruction stored in the memory. When the processor executes the computer instruction, the communication device executes the communication method described in the first aspect and various possible implementations thereof, or executes the sixth aspect and various possible implementations thereof The communication method described in the method.

In this application, the name of the aforementioned communication device does not constitute a limitation on the device or functional module itself. In actual implementation, these devices or functional modules may appear under other names. As long as the function of each device or functional module is similar to that of this application, it falls within the scope of the claims of this application and equivalent technologies.

These and other aspects of the application will be more concise and understandable in the following description.

Description of the drawings

Figure 1 is a schematic diagram of a network structure in which a 4G system and a 5G system coexist;

Figure 2 is a schematic diagram of the communication system structure of the ENDC scenario;

Figure 3 is a schematic diagram of the communication system structure of the NEDC scenario;

Figure 4 is a schematic diagram of the communication system structure of the NG-ENDC scenario;

5 is a schematic diagram of the hardware structure of a communication device provided by an embodiment of the application;

FIG. 6 is a first schematic flowchart of a communication method provided by an embodiment of this application;

FIG. 7 is a second schematic diagram of the flow of a communication method provided by an embodiment of this application;

FIG. 8 is a third schematic flowchart of a communication method provided by an embodiment of this application;

FIG. 9 is a fourth flowchart of a communication method provided by an embodiment of this application;

FIG. 10 is a flow diagram of the communication method provided by an embodiment of the application; FIG.

FIG. 11 is a sixth flowchart of a communication method provided by an embodiment of this application;

FIG. 12 is a seventh schematic flowchart of a communication method provided by an embodiment of this application;

FIG. 13 is an eighth flowchart of a communication method provided by an embodiment of this application;

FIG. 14 is a first structural diagram of a communication device provided by an embodiment of this application;

FIG. 15 is a second structural diagram of a communication device provided by an embodiment of this application.

detailed description

In the embodiments of the present application, words such as "exemplary" or "for example" are used as examples, illustrations, or illustrations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferable or advantageous than other embodiments or design solutions. To be precise, words such as "exemplary" or "for example" are used to present related concepts in a specific manner.

Hereinafter, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

In the embodiments of this application, the evolved node base station (eNB) in the fourth generation mobile communication technology (4G) system is called 4G eNB, and the user equipment in the 4G system is referred to as 4G eNB. UE) is called 4G UE, and UE in 5G system is called 5G UE.

In the 4G system, the evolved UMTS terrestrial radio access network (E-UTRAN) equipment is an access network equipment, which can be a 4G eNB that provides a radio network interface for 4G UEs. Specifically, the 4G UE accesses the network through an E-UTRAN device, and the E-UTRAN device is connected to a mobility management entity (MME) in the 4G system. In addition to the MME, the core network equipment of the 4G system also includes a serving gateway (serving gateway, SGW) and a public data network gateway (public data network gateway, PGW). The PGW is connected to an external data network (data network, DN).

Generally, in a 4G system, in order to communicate with a peer entity, a 4G UE will establish an end-to-end service with the peer entity. The evolved packet core (EPC) network establishes a connection with the Internet through an external bearer, and establishes a connection with a 4G UE through an EPS bearer (bearer). In other words, the data communication between EPC and 4G UE is carried on the EPS bearer. A data radio bearer (DRB) transmits data of an EPS bearer between the 4G UE and the 4G eNB (Uu interface). If there is a DRB, there is a one-to-one mapping relationship between the DRB and the EPS bearer.

The basic granularity of QoS control in the 4G system is EPS bearer, and data streams of the same EPS bearer get the same QoS guarantee.

In a 5G system, a radio access network (RAN) device is an access network device of the 5G network, and may be a base station that provides an interface for 5G UEs to access the wireless network. Specifically, the 5G UE accesses the network through a RAN device, and the RAN device is connected to an access management function (AMF) entity in the 5G system. In addition to the AMF entity, the core network equipment of the 5G system also includes a session management function (SMF) entity and a user plane function (UPF) entity, and the UPF is connected to an external DN.

The 5G system introduces the concept of PDU session (session), each PDU session contains one or more QoS flows (flow). If the RAN device accepts the establishment of a certain PDU session, the RAN device can map multiple QoS flows in the PDU session to one or more DRBs, that is, one or more DRBs are associated with the same PDU session .

The basic granularity of QoS control in the 5G system is PDU session, and QoS flows in the same PDU session get the same QoS guarantee.

QoS guarantee is also called security protection, and may include at least one of integrity protection (IP) and encryption protection (confidentiality protection, CP). Integrity protection can also be referred to as complete protection for short. All subsequent security protections include at least one of integrity protection and encryption protection.

Currently, the security protection of a PDU session in the 5G system can be achieved by performing the following steps:

Step 1: When a new PDU session needs to be established for the 5G UE, the core network device sends a request message to the RAN device through the interface between the core network device and the RAN device (such as the NG interface) to request the RAN device to be a 5G UE The PDU session allocates resources, and at the same time, the core network device sends security indication (security indication) information, which is used to indicate whether to perform security protection for the PDU session.

Wherein, the security indication information includes integrity protection indication (integrity protection indication) information and/or encryption protection indication (confidentiality protection indication) information.

Optionally, the integrity protection indication information and the encryption protection indication information have three values, which are required, recommended, and not needed.

Exemplarily, if the value of the integrity protection indication information is required, the integrity protection indication information is used to indicate that the integrity protection of the PDU session must be performed; if the value of the integrity protection indication information is recommended, the The integrity protection indication information is used to indicate whether to perform integrity protection for the PDU session by itself; if the value of the integrity protection indication information is not required, the integrity protection indication information is used to indicate that there is no need to perform integrity protection on the PDU session protection.

Step 2: If the RAN device accepts (admit) the PDU session, the RAN device determines the security result of the PDU session according to the security indication information.

The security result here is used to indicate whether to perform security protection on the PDU session. Specifically, the security result includes an integrity protection result and/or an encryption protection result.

If the value of the security indication information is necessary, the RAN device will protect the PDU session; if the value of the security indication information is not required, the RAN device will not protect the PDU session; if the value of the security indication information is recommended, Then the RAN device determines by itself whether to perform security protection on the PDU session, and sends the determined security result to the core network device.

It can be seen that the security result determined by the RAN device may be: security protection is required, and security protection is not required.

Correspondingly, both the integrity protection result and the encryption protection result can be: required and not needed.

Exemplarily, if the RAN device determines to perform integrity protection on the PDU session, that is, the integrity protection result is that integrity protection must be performed, the RAN device sends to the core network device information indicating that integrity protection is performed on the PDU session.

Step 3: The RAN device allocates one or more DRBs for air interface transmission for the PDU session, and sends the security result of the DRB to the 5G UE.

One or more DRBs in the 5G system are associated with the same PDU session. Therefore, when the RAN device determines the security result of the PDU session, it can determine the security result of the DRB associated with the PDU session. Subsequently, the RAN device sends the security result of the DRB to the 5G UE, so that the 5G UE subsequently performs integrity check and/or decryption on the downlink data according to the security result, and performs integrity protection on the uplink data according to the security result/ Encryption protection.

In practical applications, in the process of 4G system evolution to 5G system, there will be scenarios where 4G system and 5G system coexist. Fig. 1 shows the structure of a communication system in which a 4G system and a 5G system coexist. For each device shown in FIG. 1, reference may be made to the above description, which will not be described in detail here. N2, S1, S11, N11, and N4 in FIG. 1 are all interfaces. You can refer to the definition and description in the existing standard protocol, which will not be described in detail here.

Specifically, in a scenario where a 4G system and a 5G system coexist, there will be multiple RATs dual connectivity (MR-DC) communication systems of multiple wireless access technologies.

Optionally, the MR-DC communication system includes ENDC (E-UTRA NR DC), NEDC (NR E-UTRA DC), and NG-ENDC (next generation E-UTRA NR DC).

Among the three communication systems, the evolved node base station (eNB) (or next generation eNB, ng-eNB) in the long term evolution (LTE) system and gNB (through The new radio (NR) technology provides wireless transmission resources for the terminal for dual connection.

Among them, the ng-eNB can provide the terminal with the 5th generation core network (the 5th generation core network, 5GCN) service, and can also provide the terminal with the EPC service. In actual deployment, the ng-eNB can only connect with 5GCN/EPC, or connect with 5GCN and EPC at the same time. 5GCN can also be called 5GC.

The above-mentioned ENDC is also called Option 3/3A/3X. In the ENDC communication system, LTE eNB is a master node (master node, MN), gNB is a secondary node (secondary node, SN), MN is connected to EPC, and both MN and SN provide air interface transmission resources for data between UE and EPC.

As shown in Figure 2, (a) in Figure 2 is a schematic structural diagram of the Option 3 communication system, and (b) in Figure 2 is a schematic structural diagram of the Option 3A communication system. In the Option 3 communication system, the LTE eNB is connected to the EPC through the S1 interface (including the S1-C interface and the S1-U interface), and the LTE eNB is connected to the gNB through the X2 interface. Different from the Option 3 communication system, in the Option 3A communication system, the gNB is also connected to the EPC through the S1-U interface. In order to facilitate the distinction, the dashed line in Figure 2 indicates the connection of the control plane.

NEDC is also called Option 4/4A. In the NEDC communication system, gNB is MN, ng-eNB is SN, and MN is connected to 5GC, MN and SN provide air interface transmission resources for data between the terminal and 5GC.

As shown in FIG. 3, (a) in FIG. 3 is a schematic diagram of the structure of the Option 4 communication system, and (b) in FIG. 3 is a schematic diagram of the structure of the Option 4A communication system. In Option 4 communication system, gNB is connected to 5GC through NG interface (including NG-C interface and NG-U interface), and ng-eNB is connected to gNB through Xn interface. Different from the Option 4 communication system, in the Option 4A communication system, the ng-eNB is also connected to the 5GC through the NG-U interface. In order to facilitate the distinction, the dashed line in Figure 3 indicates the connection of the control plane.

NG-ENDC is also called Option 7/7A/7X. In the NG-ENDC communication system, ng-eNB is MN, gNB is SN, and MN is connected to 5GC. Different from the above-mentioned ENDC communication system, in the NG-ENDC communication system, MN and SN provide air interface transmission resources for data between the terminal and 5GC.

As shown in FIG. 4, (a) in FIG. 4 is a schematic structural diagram of the Option 7 communication system, and (b) in FIG. 4 is a schematic structural diagram of the Option 7A communication system. In Option 7 communication system, ng-eNB is connected to 5GC through NG interface (including NG-C interface and NG-U interface), ng-eNB is connected to gNB through Xn interface. Different from the Option 7 communication system, in the Option 7A communication system, the gNB is also connected to the 5GC through the NG-U interface. In order to facilitate the distinction, the dashed line in Figure 4 indicates the connection of the control plane.

Of course, the dual-connection communication system may also include a scenario where the gNB and gNB are dual-connected.

However, for the aforementioned dual-connection communication system, there is currently no security protection method for the air interface user plane.

In response to this problem, embodiments of the present application provide a communication method and device. In a dual-connection communication system including a first access network device and a second access network device, the first access network device (dual-connection communication system After obtaining the first QoS flow belonging to the PDU session and the first security result of the PDU session (the primary station/secondary station in the dual-connectivity communication system), it bears the first QoS flow, and The security protection (at least one of integrity protection and encryption protection) is performed on the first QoS flow according to the first security result, and the security protection of the user plane of the air interface in the communication system is realized. Among them, the first security result is used to indicate whether to perform security protection on the PDU session.

The communication method provided by the embodiment of the present application is applicable to the communication system shown in FIG. 1 to FIG. 4. Each device in Figure 1 to Figure 4 is a communication device. In specific implementation, the communication device has the components shown in FIG. 5. FIG. 5 is a schematic diagram of the composition of a communication device provided by an embodiment of the application. As shown in FIG. 5, the communication device may include at least one processor 51, a memory 52, a transceiver 53, and a bus 54. In the following, each component of the communication device is specifically introduced in conjunction with FIG. 5:

The processor 51 is the control center of the communication device, and may be a processor or a collective name for multiple processing elements. For example, the processor 51 is a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application For example: one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).

Among them, the processor 51 can execute various functions of the communication device by running or executing a software program stored in the memory 52 and calling data stored in the memory 52.

In a specific implementation, as an embodiment, the processor 51 may include one or more CPUs, such as CPU 0 and CPU 1 shown in FIG. 5.

In specific implementation, as an embodiment, the communication device may include multiple processors, such as the processor 51 and the processor 55 shown in FIG. 5. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).

The memory 52 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions The dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, disk storage The medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structure and that can be accessed by the computer, but is not limited thereto. The memory 52 may exist independently and is connected to the processor 51 through a bus 54. The memory 52 may also be integrated with the processor 51.

Among them, the memory 52 is used to store a software program for executing the solution of the present application, and the processor 51 controls the execution.

The transceiver 53 uses any device such as a transceiver to communicate with other equipment or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. . The transceiver 53 may include a receiving unit to implement a receiving function, and a transmitting unit to implement a transmitting function.

The bus 54 may be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of presentation, only one thick line is used in FIG. 5 to represent, but it does not mean that there is only one bus or one type of bus.

It should be pointed out that the device structure shown in FIG. 5 does not constitute a limitation on the communication device. In addition to the components shown in FIG. 5, the communication device may include more or less components than those shown in the figure, or a combination Certain components, or different component arrangements.

The communication method provided by the embodiment of the present application will be described below in conjunction with the communication system shown in FIGS. 1 to 4 and the communication device shown in FIG. 5. Among them, each device mentioned in the following method embodiments may have the component parts shown in FIG. 5, which will not be repeated.

FIG. 6 is a schematic flowchart of a communication method provided by an embodiment of this application. Referring to Fig. 6, the communication method includes the following steps.

S601. The first access network device acquires the first QoS flow belonging to the PDU session.

The first access network device is the master station or the auxiliary station in the dual-connection communication system.

If the second access network device has accepted (admit) the PDU session when the first access network device acquires the first QoS flow, it is said that the second access network device bears the PDU session. If the second access network device does not admit (admit) the PDU session when the first access network device acquires the first QoS flow, it is said that the second access network device does not carry the PDU session.

The above-mentioned "accepting a PDU session" refers to successfully allocating resources for the PDU session and using the allocated resources for data transmission for the PDU session. Refer to this description for all subsequent "admission of PDU sessions".

The first QoS flow acquired by the first access network device may be newly allocated by the core network device. In addition, if the second access network device bears the PDU session, the first QoS flow acquired by the first access network device may also be released by the second access network device.

Of course, if the first access network device is the master station of the dual-connection communication system, the first QoS flow can be specifically obtained by the master station from the auxiliary station request or released by the auxiliary station itself.

If the first QoS flow is newly allocated by the core network device and the first access network device is the master station, the first access network device obtains the first QoS flow from the core network device. If the first QoS flow is newly allocated by the core network device and the first access network device is the secondary station, the first access network device obtains the first QoS flow from the second access network device (in this case, the master station) .

The "obtaining the first QoS flow" referred to in the embodiments of the present application refers to obtaining the instruction information for establishing the QoS flow.

S602. The first access network device obtains the first security result of the PDU session.

The first security result is used to indicate whether to perform security protection on the PDU session, and the security protection includes at least one of integrity protection and encryption protection.

The first security result in the embodiment of the present application is determined by the first access network device or the second access network device.

Specifically, if the second access network device does not carry the PDU session, the first security result is determined by the first access network device, and accordingly, the first access network device directly obtains the first security result locally.

If when the first access network device acquires the first QoS flow, the second access network device also carries the PDU session, and the remaining QoS flows in the PDU session except the first QoS flow are all carried on the second access network Device (that is, before the first access network device acquires the first QoS flow, the second access network device carries all QoS flows of the PDU session), the first security result can be determined by the second access network device. Correspondingly, the first access network device may receive the first security result sent from the second access network device to obtain the first security result.

Optionally, after the second access network device accepts the PDU session, determines the first security result, and sends the first security result to the first access network device, the first access network device may store the first security result, and subsequently After obtaining the first QoS flow, the first access network device obtains the first security result locally. This process can refer to the description of FIG. 7, FIG. 8, or FIG. 9 below.

If in the initial process, the first access network device also carries the third QoS flow belonging to the PDU session, and the second access network device also carries part of the QoS flow of the PDU session (for example, the second QoS flow), then the session The first safety result is determined by the master station of the dual-connection communication system. If the first access network device is the master station of the dual-connection communication system, the first access network device obtains the first security result locally after obtaining the first QoS flow. If the second access network device is the master station of the dual-connection communication system, the first access network device communicates with the second access network device to obtain the first security result.

S603. The first access network device carries the first QoS flow, and performs security protection on the first QoS flow according to the first security result.

Generally, the security processing process is completed by the packet data convergence protocol (PDCP) entity. Therefore, "the first access network device performs security protection on the first QoS flow according to the first security result" is specifically "the PDCP entity of the first access network device performs security protection on the first QoS flow according to the first security result". Correspondingly, "the QoS flow is carried by the first access network device" means that the PDCP entity corresponding to the QoS flow is deployed on the first access network device.

In the same way, the subsequent "QoS flow carried by the second access network device" means that the PDCP entity corresponding to the QoS flow is deployed on the second access network device.

The first access network device is the primary station or the secondary station in the dual-connection communication system, and the security protection of the first QoS flow is realized by executing the above S601-S603.

It is easy to understand that if the first security result is determined by the first access network device, the first access network device only needs to execute the above S601~S603 to realize the security protection of the air interface user plane, which is not described in detail here. .

If the first security result is determined by the second access network device, and the second access network device carries the second QoS flow in the PDU session, the first access network device needs to communicate with the second access network device. Get the first safety result.

The following content of the embodiment of the present application mainly describes a scenario where the first security result is determined by the second access network device.

Now, the case where the first access network device is the master station and the second access network device is the auxiliary station is described.

If the first access network device is the primary station, the second access network device is the secondary station, and the second access network device determines the first security result, before the first access network device obtains the first QoS flow, the first The second access network device can carry the remaining QoS flows except the first QoS flow in the PDU session, determine the first security result, and send the first security result to the first access network device.

With reference to FIG. 6 above, as shown in FIG. 7, before S601, the communication method provided by the embodiment of the present application further includes:

S700. The second access network device carries all QoS flows in the PDU session, and determines the first security result.

In the first optional implementation manner, when the PDU session is initially established, the first access network device does not carry the QoS flow in the PDU session, and the second access network device obtains the QoS flow through the first access network device. All QoS flows in the PDU session, and carry the acquired QoS flows, and determine the first security result. Optionally, the second access network device receives the first security indication information from the first access network device, and determines the first security result. The first security indication information is obtained by the first access network device from the core network.

In the second optional implementation manner, the first access network device carries all QoS flows of the PDU session, and subsequently, under certain conditions (such as the first access network device releasing all QoS flows in the PDU session or The first access network device obtains a new QoS flow belonging to the PDU session from the core network device), and the first access network device sends to the second access network device a first request message for requesting admission of the PDU session, specifically Is used to request the allocation of resources for the PDU session, and determine the first security result according to the first security indication information. Correspondingly, the second access network device accepts the PDU session, bears all QoS flows in the PDU session, and determines the first security result. For the specific process of this implementation, refer to the description of FIG. 8 or FIG. 9 below.

S701. The second access network device sends a first security result to the first access network device.

S702 (optional): The first access network device sends the first security result to the core network device.

Optionally, after obtaining the first security result, the first access network device may store the first security result.

For the first optional implementation in S700, after S701, the first access network device also sends the first security result to the core network device, so that the core network device can learn the latest security result of the PDU session , Complete the corresponding configuration according to the first safety result.

For the second optional implementation manner in S700, after S701, the first access network device may send the first security result to the core network device. In addition, for the second optional implementation manner in S700, after S701, the first access network device may not send the first security result to the core network device.

Since S702 is an optional step, Figure 7 is represented by a dotted line.

The second optional implementation in S700 will now be described. Specifically, in conjunction with the foregoing FIG. 7, as shown in FIG. 8, before S700, the communication method provided in the embodiment of the present application further includes:

S800. The first access network device carries all QoS flows of the PDU session.

In this embodiment of the application, all QoS flows carried by the first access network device at this moment are referred to as the first QoS flow set.

S801. The first access network device determines a second security result.

The second safety result here is the same or different from the first safety result.

It is easy to understand that after S800 and S801, the first access network device sends the second security result to the core network device, so that the core network device can complete the corresponding configuration according to the second security result.

S802. The first access network device sends a first request message for requesting admission of the PDU session to the second access network device.

Optionally, after the first access network device releases all QoS flows in the PDU session, that is, after releasing the first QoS flow set, the first access network device sends the first request message to the second access network device; or, After the first access network device obtains a new QoS flow (such as QoS flow 1) belonging to the PDU session from the core network, the first access network device releases the QoS flow of the PDU session carried by it, and sends it to the second access network. The network device sends the first request message.

The first request message includes a first identifier and first safety indication information. The first identifier is used to indicate the first QoS flow set, or used to indicate the first QoS flow set and QoS flow 1. The first security indication information is used to indicate to perform security protection on the QoS flow indicated by the first identifier, or to indicate whether to perform security protection on the QoS flow indicated by the first identifier.

In the embodiment of the present application, "the first access network device releases all QoS flows in the PDU session" can also be described as "the first access network device transfers all QoS flows in the PDU session to the second access network device".

In the scenario shown in FIG. 8, after S701, if the first security result is different from the second security result, the first access network device will send the first security result to the core network device, so that the core network device can complete the process again. Related configuration, in addition, the first access network device may also store the first security result, that is, execute S803.

S803 (optional): If the first security result is different from the second security result, the first access network device stores the first security result.

It is easy to understand that if the first security result is the same as the second security result, the core network device does not need to reconfigure related information. Therefore, the first access network device does not need to send the first security result to the core network device.

Specifically, if the first access network device performs S803, the above S602 is specifically that the first access network device obtains the first security result locally; if the first access network device does not perform S803, the above S602 is specifically the first The access network device communicates with the second access network device to obtain the first security result. That is, in the scenario where the first access network device performs S803, the above S602 can be replaced with S602a; in the scenario where the first access network device does not perform S803, the above S602 can be replaced with S602b.

S602a. The first access network device obtains a first security result locally.

S602b. The first access network device communicates with the second access network device to obtain the first security result.

Further, in the scenario shown in FIG. 8, after S603, the first access network device may also release all/part of the QoS flow (for example, the fourth QoS flow) in the PDU session carried by it, and subsequently, the second access The network access device bears the QoS flow released by the first access network device.

With reference to Figure 8 above, as shown in Figure 9, after S603, the communication method provided by the embodiment of the present application includes:

S900. The first access network device releases the fourth QoS flow belonging to the PDU session.

The fourth QoS flow may be all QoS flows in the PDU session carried by the first access network device, or part of the QoS flows in the PDU session carried by the first access network device, which is not specifically limited here.

Optionally, the first access network device may decide to release the fourth QoS flow by itself, or it may release the fourth QoS flow after acquiring a new QoS flow belonging to the PDU session from the core network device. This is not specifically limited.

S901: The first access network device sends a second request message to the second access network device.

The second request message is used to instruct to perform security protection on the fourth QoS flow according to the first security result.

It is easy to understand that in the method flow shown in FIG. 8, at the moment of S603, the first access network device and the second access network device simultaneously carry the QoS flow of the PDU session, and both are based on the first security result. Security protection is performed on the QoS flows carried by each, and the first security result is determined by the second radio access network device. Therefore, after the first access network device releases the fourth QoS flow, the fourth QoS flow also needs to adopt the first A safety result is to protect it safely.

S902. The second access network device performs security protection on the fourth QoS flow according to the first security result.

In the same way, after S603, the second access network device may also release part of the QoS flow in the PDU session carried by it. Subsequently, the first access network device bears the QoS flow released by the second access network device, and according to The first security result performs security protection on the QoS flow. This process is similar to the above S900-S902, and will not be described in detail here.

In summary, if the primary station determines the second security result of the PDU session, after the primary station releases all QoS flows of the PDU session, the secondary station can change the security result of the PDU session to the first security result. If after the secondary station determines the first security result of the PDU session, the primary station obtains part of the QoS flow belonging to the PDU session (such as the first QoS flow), the primary station needs to use the first security result to protect the first QoS flow , That is, the master station cannot change the security result of the PDU session.

In the case where the first access network device is the master station and the second access network device is the auxiliary station, both the first access network device and the second access network device can protect the QoS flow in the PDU session. Realize the security protection of the air interface user plane. Moreover, when the first access network device and the second access network device both carry the QoS flow of the PDU session, the first access network device and the second access network device use the same security result to belong to the same PDU session The security protection of the QoS flow realizes the consistency of the security protection of the first access network device and the second access network device.

It can be seen from the above description that the first access network device can also be a secondary station, and the second access network device can be a master station. The following describes the case where the first access network device is the secondary station and the second access network device is the primary station.

If the first access network device is the secondary station, the second access network device is the master station, and the second access network device determines the first security result, the second access network device will accept the PDU session before the first access network device The network access device can carry the remaining QoS flows except the first QoS flow in the PDU session, and determine the first security result.

With reference to FIG. 6 above, as shown in FIG. 10, before S601, the communication method provided by the embodiment of the present application further includes:

S1000. The second access network device carries all QoS flows in the PDU session, and determines the first security result.

In optional implementation A, when the PDU session is initially established, the first access network device does not carry the QoS flow in the PDU session, and the second access network device carries all QoS flows in the PDU session, and determines The first safety result.

In optional implementation B, the first access network device carries all QoS flows of the PDU session, and subsequently, under certain conditions (for example, the first access network device releases all QoS flows in the PDU session), the first The access network device sends to the second access network device a request message including a second identifier used to indicate all second QoS flows in the PDU session. Correspondingly, the second access network device accepts the PDU session and bears the PDU session. All QoS flows, and determine the first safety result. For the specific process of this implementation, refer to the description of FIG. 11 or FIG. 12 below.

Optionally, after determining the first security result, the second access network device sends the first security result to the core network device, so that the core network device can complete related configurations according to the first security result.

S1001. The second access network device performs security protection on all QoS flows in the PDU session according to the first security result.

After performing S1001, the second access network device may determine to release the first QoS flow by itself, or may determine to release the first QoS flow after acquiring a new QoS flow belonging to the PDU session from the core network device. Subsequently, the second access network device sends the first QoS flow and the first security result to the first access network device. Correspondingly, the first access network device obtains the first QoS flow and the first security result.

That is, in the scenario shown in FIG. 10, S601 and S602 can be replaced with the following S601a and S601b.

S601a. The first access network device releases the first QoS flow.

S601b. The second access network device sends the first QoS flow and the first security result to the second access network device.

It can be seen from the above description that in alternative implementation B of S1000, before the second access network device carries all QoS flows in the PDU session, the first access network device carries all QoS flows in the PDU session.

Now the optional implementation B of S1000 will be described in detail. Specifically, with reference to FIG. 10, as shown in FIG. 11, before S1000, the communication method provided in the embodiment of the present application further includes:

S1100. The first access network device carries all QoS flows of the PDU session.

S1101. The first access network device determines a second security result, and performs security protection on the QoS flow in the first QoS flow set according to the second security result.

The second security result is used to indicate whether to perform security protection on the PDU session. Among them, the second safety result is the same or different from the first safety result.

S1102. The first access network device sends a second security result to the second access network device.

S1103. The second access network device sends a second security result to the core network device.

After receiving the second security result, the core network device completes the corresponding configuration according to the second security result.

Optionally, after receiving the second security result sent by the first access network device, the second access network device may store the second security result. That is, after S1102, the second access network device can perform S1104.

S1104 (optional): The second access network device stores the second security result.

Since S1104 is an optional step, it is represented by a dashed frame in FIG. 11.

S1105. The first access network device releases all QoS flows in the PDU session, and sends a first request message to the second access network device.

The first request message includes a second identifier, and the second identifier is used to indicate all QoS flows in the PDU session, that is, the second identifier is used to indicate the first QoS flow set.

Optionally, the first request message may also include at least one of the second security result and second security indication information, where the second security indication information is used to indicate security protection for the QoS flow indicated by the second identifier, or to indicate Determine by itself whether to perform security protection on the QoS flow indicated by the second identifier.

It is easy to understand that if the second access network device does not perform S1104, the second request message includes the second security result. In this way, the subsequent second access network device can determine whether it is the same as the first security result and the second security result. Core network equipment communication.

In the process shown in FIG. 11, if the first security result is different from the second security result, and the second access network device stores the second security result, the second access network device determines the first security result , The first security result is also sent to the core network device, that is, after S1000, S1106 is also executed.

S1106: If the first security result is different from the second security result, the second access network device sends the first security result to the core network device.

Further, in the scenario shown in FIG. 11, after S603, the first access network device may also release all/part of the QoS flow (for example, the fourth QoS flow) in the PDU session carried by it, and subsequently, the second access The network access device bears the QoS flow released by the first access network device.

With reference to FIG. 11, as shown in FIG. 12, after S603, the communication method provided in the embodiment of the present application includes:

S1200. The first access network device releases the fourth QoS flow belonging to the PDU session.

Optionally, the first access network device may determine to release the fourth QoS flow by itself, or it may release the fourth QoS flow after receiving the request sent by the second access network device, which is not specifically limited in the embodiment of the application .

S1201. The first access network device sends a second request message to the second access network device.

The second request message is used to instruct to perform security protection on the fourth QoS flow according to the first security result. Correspondingly, after receiving the second request message, the second access network device performs security protection on the fourth QoS flow according to the first security result.

It is easy to understand that in the method flow shown in FIG. 11, at the moment of S603, the first access network device and the second access network device simultaneously carry the QoS flow of the PDU session, and both are based on the first security result. Security protection is performed on the QoS flows carried by each, and the first security result is determined by the second radio access network device. Therefore, after the first access network device releases the fourth QoS flow, the fourth QoS flow also needs to adopt the first A safety result is to protect it safely.

S1202. The second access network device performs security protection on the fourth QoS flow according to the first security result.

In the same way, after S603, the second access network device may also release part of the QoS flow in the PDU session carried by it. Subsequently, the first access network device bears the QoS flow released by the second access network device, and according to The first security result performs security protection on the QoS flow. This process is similar to the above S1200~S1202, and will not be described in detail here.

In summary, if the secondary station determines the second security result of the PDU session, after the secondary station releases all QoS flows of the PDU session, the primary station can change the security result of the PDU session to the first security result. If after the primary station determines the first security result of the PDU session, the secondary station obtains part of the QoS flow belonging to the PDU session (such as the first QoS flow), the secondary station needs to use the first security result to protect the first QoS flow , That is, the secondary station cannot change the security result of the PDU session.

When the first access network device is the auxiliary station and the second access network device is the master station, both the first access network device and the second access network device can protect the QoS flow in the PDU session. Realize the security protection of the air interface user plane. Moreover, when the first access network device and the second access network device both carry the QoS flow of the PDU session, the first access network device and the second access network device use the same security result to belong to the same PDU session The security protection of the QoS flow realizes the consistency of the security protection of the first access network device and the second access network device.

In practical applications, when a certain UE communicates with the opposite end, it may only need to protect part of the data. For this scenario, the core network device in the embodiment of the present application may send instruction information to the access network device (such as the first access network device) connected to the core network device, so that the access network device can respond to the corresponding instruction information DRB performs security protection.

For ease of description, take the first access network device as the master station as an example for description. Specifically, as shown in FIG. 13, the communication method provided by the embodiment of the present application includes:

S1300. The core network device sends instruction information to the first access network device, where the instruction information is used to instruct to perform security protection on the preset QoS flow or the preset EPS bearer according to the first security result.

Here, the first security result is mandatory, that is, the indication information is used to indicate that the preset QoS flow or EPS bearer must be secured.

Optionally, the preset QoS flow is a QoS flow designated for security protection by the core network device, and the preset EPS bearer may be a default bearer or an EPS bearer designated for security protection for the core network device.

S1301. The first access network device determines the target DRB, and performs security protection on the target DRB according to the first security result.

Optionally, the target DRB is a DRB carrying a preset QoS flow, and the preset QoS flow is a QoS flow designated by the core network device for security protection; or, the target DRB corresponds to a preset EPS bearer.

S1302. The first access network device releases the preset QoS flow/preset EPS bearer, and sends a security request message to the second access network device.

Specifically, when the first access network device transfers the preset QoS flow/preset EPS bearer to the second access network device, the first access network device sends a security request message to the second access network device. The security request message includes identification information (used to identify the preset QoS flow/used to identify the preset EPS bearer), the first security result, and security indication information, and the security indication information is used to indicate that the identification is performed according to the first security result. The object (preset QoS flow/preset EPS bearer) identified by the information is secured.

S1303. The second access network device determines the DRB corresponding to the object identified by the identification information, and performs security protection on the determined DRB according to the first security result.

It should be noted that steps S1300 to S1301 can be used individually in a single connection scenario or a dual connection scenario, and steps S1302 to S1303 are omitted at this time.

An embodiment of the present application provides a communication device 14, which may be a first access network device, or may be a part of the device in the first access network device, such as a chip system in the first access network device. Optionally, the chip system is used to support the first access network device to implement the functions involved in the method embodiments shown in FIGS. 6 to 12, such as receiving, sending, or processing data involved in the above methods And/or information. The chip system includes a chip, and may also include other discrete devices or circuit structures.

The communication device 14 is used to execute the steps performed by the first access network device in the methods shown in FIGS. 6 to 12 above. The communication device 14 provided in the embodiment of the present application may include modules corresponding to corresponding steps.

The embodiment of the present application may divide the communication device 14 into functional modules according to the foregoing method examples. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. The division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

In the case of dividing each functional module corresponding to each function, FIG. 14 shows a possible structural schematic diagram of the communication device 14 in this embodiment. As shown in FIG. 14, the communication device 14 includes a processing unit 141.

The processing unit 141 is used to support the communication device 14 to perform operations such as acquisition, bearing, security protection, and determination shown in FIGS. 6-12, such as: S601, S602, S603, S800, S801, S900, S1000, S1001, S1105, S1200, etc., and/or other processes used in the techniques described herein.

Among them, all relevant content of each step involved in the above method embodiment can be cited in the function description of the corresponding function module, and will not be repeated here.

Of course, the communication device 14 provided in the embodiment of the present application includes but is not limited to the aforementioned modules. For example, the communication device 14 may also include a sending unit 142, a receiving unit 143, and a storage unit 144.

The sending unit 142 is used to support the communication device 14 to perform the sending operations shown in FIGS. 6-12, such as: S802, S702, S901, S1105, S1201, etc., and/or other processes used in the technology described herein .

The receiving unit 143 is configured to support the communication device 14 to perform the receiving operations shown in FIGS. 6-12, such as S601b, S602b, S701, etc., and/or other processes used in the technology described herein.

The storage unit 144 can be used to store the program code of the communication device 14 and can also be used to store the first security result.

For the physical block diagram of the communication device 14 provided in this application, reference may be made to FIG. 5 above. The above-mentioned processing unit 141 may be the processor 51 in FIG. 5, the sending unit 142 and the receiving unit 143 may be the transceiver 53 in FIG. 5, and the storage unit 144 may be the memory 52 in FIG. 5.

Another embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium stores instructions. When the instructions run on the communication device 14, the communication device 14 executes the instructions shown in FIGS. 6-12. The step of the first access network device in the communication method of the embodiment.

In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer-executable instructions that are stored in a computer-readable storage medium; the processor of the communication device 14 can be accessed from a computer The reading storage medium reads the computer-executed instruction, and the processor executes the computer-executed instruction to cause the communication device 14 to execute the steps of the first access network device in the communication method of the embodiments shown in FIGS. 6-12.

An embodiment of the present application provides a communication device 15. The communication device 15 may be a first access network device, or may be a part of the first access network device, such as a chip system in the first access network device. Optionally, the chip system is used to support the first access network device to implement the functions involved in the method embodiment shown in FIG. 13, for example, receiving, sending, or processing the data and/or data involved in the above method information. The chip system includes a chip, and may also include other discrete devices or circuit structures.

The communication device 15 is used to execute the steps executed by the first access network device in the method shown in FIG. 13. The communication device 15 provided by the embodiment of the present application may include modules corresponding to corresponding steps.

The embodiment of the present application may divide the communication device 15 into functional modules according to the foregoing method examples. For example, each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. The division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.

In the case of dividing each functional module corresponding to each function, FIG. 15 shows a possible structural schematic diagram of the communication device 15. As shown in FIG. 15, the communication device 15 includes a processing unit 151.

The processing unit 151 is configured to support the communication device 15 to perform operations such as determination and security protection shown in FIG. 13, such as S1301, S1302, etc., and/or other processes used in the technology described herein.

Of course, the communication device 15 provided by the embodiment of the present application includes but is not limited to the aforementioned modules. For example, the communication device 15 may also include a sending unit 152, a receiving unit 153, and a storage unit 154.

The sending unit 152 is used to support the communication device 15 to perform the sending operation shown in FIG. 13, for example: S1302, etc., and/or other processes used in the technology described herein.

The receiving unit 153 is used to support the communication device 15 to perform the receiving operation shown in FIG. 13, for example: S1300, etc., and/or other processes used in the technology described herein.

The storage unit 154 can be used to store the program code of the communication device 15 and can also be used to store the first security result.

When the communication device 15 is the first access network device, the aforementioned processing unit 152 may be the processor 41 in FIG. 4, the sending unit 153 and the receiving unit 151 may be the transceiver 43 in FIG. 4, and the storage unit 154 may be 4 in the memory 42.

Another embodiment of the present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium. When the instructions run on the communication device 15, the communication device 15 executes the embodiment shown in FIG. 13 The step of the first access network device in the communication method.

In another embodiment of the present application, a computer program product is also provided. The computer program product includes computer-executable instructions stored in a computer-readable storage medium; the processor of the communication device 15 can be accessed from the computer The storage medium reads the computer-executable instruction, and the processor executes the computer-executed instruction to cause the communication device 15 to execute the steps of the first access network device in the communication method of the embodiment shown in FIG. 13.

In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it may appear in the form of a computer program product in whole or in part. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a dedicated computer, a computer network, or other programmable devices. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from a website, computer, server, or data center through a cable (such as Coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data first access network device such as a server or a data center integrated with one or more available media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), or a semiconductor medium (for example, a solid state disk (SSD)).

Through the description of the above embodiments, those skilled in the art can clearly understand that for the convenience and brevity of the description, only the division of the above-mentioned functional modules is used as an example for illustration. In practical applications, the above-mentioned functions can be allocated as required. It is completed by different functional modules, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above.

In the several embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be It can be combined or integrated into another device, or some features can be omitted or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate parts may or may not be physically separate. The parts displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of software products, which are stored in a storage medium There are several instructions to make a device (which may be a single-chip microcomputer, a chip, etc.) or a processor (processor) execute all or part of the steps of the methods described in the embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any change or replacement within the technical scope disclosed in this application shall be covered by the protection scope of this application . Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

A communication method, characterized in that it is applied to a dual-connection communication system including a first access network device and a second access network device, and includes:

Acquiring, by the first access network device, a first quality of service QoS flow, where the first QoS flow belongs to a protocol data unit PDU session;

Acquiring, by the first access network device, a first security result of the PDU session, where the first security result is determined by the first access network device or determined by the second access network device, The first security result is used to indicate whether to perform security protection on the PDU session, and the security protection includes at least one of integrity protection and encryption protection;

The first access network device carries the first QoS flow, and performs security protection on the first QoS flow according to the first security result.
The communication method according to claim 1, wherein the PDU session further includes a second QoS flow, and the second QoS flow is carried by the second access network device.
The communication method according to claim 2, wherein before the first access network device acquires the first QoS flow, all QoS flows in the PDU session are carried by the second access network device , The first security result is determined by the second access network device.
The communication method according to claim 2, wherein the first access network device also carries the third QoS flow in the PDU session;

If the first access network device is the master station of the dual-connection communication system, the first security result is determined by the first access network device;

If the second access network device is the master station of the dual connectivity communication system, the first security result is determined by the second access network device.
The communication method according to claim 3, wherein the communication method further comprises:

Before the second access network device determines the first security result, the first access network device carries all QoS flows in the PDU session;

The first access network device determines a second security result of the PDU session, where the second security result is used to indicate whether to perform security protection on the PDU session, and the second security result is identical to the first security result. Same or different results;

The first access network device releases all QoS flows in the PDU session, and sends a first request message to the second access network device, if the first access network device is the dual-connection communication The primary station of the system, the second access network device is the secondary station of the communication system, the first request message is used to request the allocation of resources for the PDU session, and the first request message is determined according to the first security indication information A security result; if the first access network device is the secondary station of the dual-connection communication system, and the second access network device is the primary station of the communication system, the first request message is used to request Release all QoS flows in the PDU session;

Wherein, the first security indication information is used to indicate to perform security protection on the QoS flow released by the first access network device, or to indicate to determine whether to perform security protection on the QoS flow released by the first access network device. safety protection.
The communication method according to claim 5, wherein if the first access network device is the primary station of the dual-connection communication system, the second access network device is the secondary station of the communication system , The communication method further includes:

Receiving, by the first access network device, the first security result from the second access network device;

If the first security result is different from the second security result, the first access network device sends the first security result to the core network device.
The communication method according to any one of claims 1-6, wherein the communication method further comprises:

Storing the first security result by the first access network device;

The acquiring, by the first access network device, the first security result of the PDU session includes:

The first access network device obtains the first security result locally.
The communication method according to any one of claims 1-7, wherein the first security result is determined by the second access network device, and the communication method further comprises:

After performing security protection on the first QoS flow according to the first security result, the first access network device releases a fourth QoS flow, and the fourth QoS flow belongs to the PDU session;

The first access network device sends a second request message to the second access network device, where the second request message is used to request security protection for the fourth QoS flow according to the first security result.
A communication method, characterized in that it comprises:

The first access network device obtains indication information from the core network device, where the indication information is used to indicate that the preset quality of service QoS flow or the preset evolved packet system EPS bearer is secured according to the first security result. Protection includes at least one of integrity protection and encryption protection;

The first access network device determines a target DRB, the target DRB carries the preset QoS flow, or the target DRB corresponds to the preset EPS bearer;

The first access network device performs security protection on the target DRB according to the first security result.
The communication method according to claim 9, wherein the communication method further comprises:

Releasing the preset QoS flow or the preset EPS bearer by the first access network device;

The first access network device sends a security request message to the second access network device, where the security request message is used to request security protection of the released object according to the first security result.
A communication device, characterized in that it is applied to a dual-connection communication system including a first access network device and a second access network device, the communication device is a first access network device, and the communication device includes processing The processor is used to couple with the memory, read and execute the instructions in the memory, to realize:

Acquiring a first quality of service QoS flow, the first QoS flow belonging to a protocol data unit PDU session;

Acquire a first security result of the PDU session, where the first security result is determined by the first access network device or determined for the second access network device; the first security result is used for Indicating whether to perform security protection on the PDU session, where the security protection includes at least one of integrity protection and encryption protection;

Carrying the first QoS flow, and performing security protection on the first QoS flow according to the first security result.
The communication device according to claim 11, wherein the PDU session includes a second QoS flow, and the second QoS flow is carried by the second access network device.
The communication device according to claim 12, wherein, before the processor acquires the first QoS flow, all QoS flows in the PDU session are carried by the second access network device; A security result is determined by the second access network device.
The communication device according to claim 12, wherein the processor also carries a third QoS flow in the PDU session;

If the communication device is the master station of the dual-connection communication system, the first security result is determined by the processor;

If the second access network device is the master station of the dual connectivity communication system, the first security result is determined by the second access network device.
The communication device according to claim 13, wherein the processor is further configured to:

Before the second access network device determines the first security result, bear all QoS flows in the PDU session;

Determining a second security result of the PDU session, where the second security result is used to indicate whether to perform security protection on the PDU session, and the second security result is the same as or different from the first security result;

Release all QoS flows in the PDU session, and send a first request message to the second access network device; if the communication device is the master station of the dual connectivity communication system, the second access network The device is a secondary station of the communication system, and the first request message is used to request the allocation of resources for the PDU session, and the first security result is determined according to the first security indication information; if the communication device is the A secondary station of a dual-connection communication system, the second access network device is the primary station of the communication system, and the first request message is used to request the release of all QoS flows in the PDU session;

Wherein, the first security indication information is used to instruct to perform security protection on the QoS flow released by the processor, or to indicate whether to perform security protection on the QoS flow released by the processor by itself.
The communication device according to claim 15, wherein if the communication device is the master station of the dual-connection communication system and the second access network device is the auxiliary station of the communication system, the processing The device is also used for:

Receiving the first security result from the second access network device;

If the first security result is different from the second security result, sending the first security result to the core network device.
The communication device according to any one of claims 11-16, wherein:

The memory is also used to store the first security result;

The processor is specifically configured to obtain the first security result from the memory.
The communication device according to any one of claims 11-17, wherein the first security result is determined by the second access network device, and the processor is further configured to:

After performing security protection on the first QoS flow according to the first security result, release a fourth QoS flow, where the fourth QoS flow belongs to the PDU session;

Send a second request message to the second access network device, where the second request message is used to request security protection for the fourth QoS flow according to the first security result.
A communication device, characterized in that, the communication device is a first access network device, and the communication device includes a processor for coupling with a memory, reading and executing instructions in the memory, and achieve:

Obtain indication information from the core network device, the indication information is used to indicate the security protection of the preset quality of service QoS flow or the preset evolved packet system EPS bearer according to the first security result, and the security protection includes integrity protection and At least one of encryption protection;

Determine a target DRB, where the target DRB carries the preset QoS flow, or the target DRB corresponds to the preset EPS bearer;

Perform security protection on the target DRB according to the first security result.
The communication device according to claim 19, wherein the processor is further configured to:

Releasing the preset QoS flow or the preset EPS bearer;

Send a security request message to the second access network device, where the security request message is used to request security protection of the released object according to the first security result.
A computer-readable storage medium in which instructions are stored, characterized in that, when the instructions are run on a communication device, the communication device is caused to execute any one of claims 1-8 The communication method, or the communication method according to any one of claims 9-10.
A communication device, characterized in that it is applied to a dual-connection communication system including a first access network device and a second access network device. The communication device includes a storage unit and a processing unit; the storage unit is used for storing Computer program code, the computer program code includes computer instructions; when the processing unit executes the computer instructions, the communication device executes the communication method according to any one of claims 1-8.
A communication device, characterized in that the communication device includes a storage unit and a processing unit; the storage unit is used to store computer program code, and the computer program code includes computer instructions; when the processing unit executes the computer instructions When the communication device executes the communication method according to claim 9 or 10.
A chip system, characterized in that the chip system is applied to a communication device; the chip system includes one or more interface circuits, and one or more processors; the interface circuit and the processor are interconnected by wires The interface circuit is used to receive a signal from the memory of the communication device and send the signal to the processor, and the signal includes a computer instruction stored in the memory; when the processor executes the computer When instructed, the communication device executes the communication method according to any one of claims 1-8, or executes the communication method according to any one of claims 9-10.
A computer program product, characterized by comprising computer instructions, which when the computer instructions run on a communication device, cause the communication device to execute the communication method according to any one of claims 1-8, or execute The communication method according to any one of claims 9-10.
A communication system, characterized in that the communication system includes a first access network device and a second access network device; the first access network device and the second access network device are dual-connected, Wherein, the first access network device is used to execute the communication method according to any one of claims 1-8.
A communication system, wherein the communication system comprises a first access network device and a core network device, wherein the first access network device is used to execute the communication method according to claim 9 or 10. .
The communication system according to claim 27, wherein the communication system further comprises a second access network device; the second access network device is dual-connected to the first access network device.