WO2020233496A1 - 安全会话方法和装置 - Google Patents

安全会话方法和装置 Download PDF

Info

Publication number
WO2020233496A1
WO2020233496A1 PCT/CN2020/090240 CN2020090240W WO2020233496A1 WO 2020233496 A1 WO2020233496 A1 WO 2020233496A1 CN 2020090240 W CN2020090240 W CN 2020090240W WO 2020233496 A1 WO2020233496 A1 WO 2020233496A1
Authority
WO
WIPO (PCT)
Prior art keywords
rate
network element
access network
integrity protection
session
Prior art date
Application number
PCT/CN2020/090240
Other languages
English (en)
French (fr)
Inventor
李飞
张博
孙海洋
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020233496A1 publication Critical patent/WO2020233496A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Definitions

  • This application relates to the field of wireless communication, and more specifically, to a secure conversation method and device.
  • 5G 5th Generation
  • access network equipment such as base stations
  • integrity protection consumes a lot of network performance, it can be determined whether to perform integrity protection according to business characteristics. Generally, for service data with high accuracy requirements, integrity protection is required between terminal equipment and access network equipment; for service data with low accuracy requirements, the terminal equipment and access network equipment may not Perform integrity protection.
  • the present application provides a secure conversation method and device, in order to consider more application scenarios, meet different business requirements, and improve user experience.
  • a secure conversation method is provided.
  • the method may be executed by the access network device, or may also be executed by a chip or circuit configured in the access network device, which is not limited in this application.
  • the method may include: the access network device receives a session request message sent by the session management network element, the session request message carries the user plane security policy of the terminal device and the first rate information; In the case that the first rate executes the user plane security policy, the access network device activates integrity protection at a second rate, where the second rate is lower than the first rate.
  • the access network device in the case that the access network device cannot execute the user plane security policy at the first rate, in other words, the access network device’s capability cannot perform integrity protection on the session and is based on the rate required by the session (for example, In the case of performing services at the first rate, in other words, when the access network device cannot activate integrity protection at the first rate, the access network device can perform at a rate lower than the first rate (for example, record As the second rate), the integrity protection is activated, and then another solution is proposed by considering the application scenarios of various services, which can provide another option to meet the needs of different services as much as possible and match more applications Scene to improve user experience.
  • the inability of the access network device to execute the user plane security policy at the first rate includes: the access network device cannot simultaneously enable integrity protection and perform data transmission at the first rate. Then in this case, integrity protection can be turned on first; then, within the capability, data transmission is performed at the second rate, where the second rate is lower than the first rate.
  • the access network device activates integrity protection at a second rate, which may indicate that the access network device activates integrity protection at any rate lower than the first rate; or, it may also be expressed as, The access network device activates integrity protection and reduces the rate; or, it can also mean that the access network device activates integrity protection at a certain rate.
  • the second rate is less than or equal to the maximum transmission rate currently supported by the access network device.
  • the second rate is used to transmit service data with the terminal device.
  • the second rate is less than the rate required by the session (for example, recorded as the first rate), or the second rate may be the maximum transmission rate currently supported by the access network device, or the second rate may also be less than the current rate of the access network device The maximum transmission rate that can be supported.
  • the access network device activating integrity protection at a second rate includes: based on the user plane security policy, the access network device is The second rate activates integrity protection.
  • the access network device can activate integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate according to the user plane security policy of the terminal device.
  • the user plane security policy of the terminal device is used to instruct: in the case where the access network device cannot execute the user plane security policy at the first rate, the access network device is The second rate activates integrity protection.
  • the existing security policy can be improved, and a way to turn on the integrity protection when the integrity protection conflicts with the service rate is added.
  • the following examples are described in detail.
  • the user plane security policy of the terminal device is determined by the session management network element or the unified data management network element.
  • the user plane policy of the terminal device may be determined by the session management network element, or may be determined by the unified data management network element, which is not limited.
  • the session request message further includes indication information; the access network device activating integrity protection at a second rate includes: based on the indication information, The access network device activates integrity protection according to the second rate.
  • the access network device can activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate according to the instruction information.
  • the access network device receives instruction information from any one of the following devices: the session management network element, the unified data management network element, or the terminal device, wherein the instruction information is used to indicate:
  • the access network device activates integrity protection at the second rate.
  • the indication information may be indicated by any one of the session management network element, the unified data management network element, or the terminal device.
  • the access network device activating integrity protection at a second rate includes: when it is determined that the session meets a preset condition, the access The network device activates integrity protection at the second rate.
  • the access network device can determine by itself whether to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate. For example, it can be determined according to the session type or service type, whether to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate.
  • the secure session method further includes: the access network device receives rate information from a policy control network element, where the rate information is used to indicate the second Two rate.
  • the access network device can control the rate information of the network element based on the policy to determine the transmission rate when transmitting service data with the terminal device.
  • the secure session method further includes: the access network device sends the second rate information to the session management network element.
  • a secure conversation method is provided.
  • the method may be executed by the session management network element, or may also be executed by a chip or circuit configured in the session management network element, which is not limited in this application.
  • the method may include: the session management network element determines a user plane security policy of the terminal device, where the user plane security policy is used to indicate: when the access network device cannot execute the user plane security policy at the first rate, The access network device activates integrity protection at a second rate, where the second rate is lower than the first rate; the session management network element sends the user plane security policy to the access network device.
  • the session management network can determine the user plane security policy of the terminal device, and the user plane security policy can be used to indicate that when the access network device cannot execute the user plane security policy at the first rate, in other words .
  • the access network device When the access network device’s capabilities cannot protect the integrity of the session and provide services at the rate required by the session, in other words, when the access network device cannot activate integrity protection at the first rate, the access The network access device can activate integrity protection at a rate lower than the first rate (for example, denoted as the second rate), and then by considering the application scenarios of various services, another solution is proposed, which can provide yet another option. It is convenient to meet the needs of different businesses as much as possible, match more application scenarios, and improve user experience.
  • integrity protection must be performed for certain services, or integrity protection is not performed for certain services, or integrity protection is discarded when integrity protection conflicts with the service rate.
  • This method is too absolute. For some services, it is better to implement integrity protection. However, if integrity protection is really not possible, and occasional packet loss and tampering will not affect the service transmission, then for this service, the existing The regulations will affect user experience and reduce transmission performance.
  • the session management network element obtains the subscription information of the terminal device; the session management network element determines the user plane security policy of the terminal device, including: The session management network element determines the user plane security policy of the terminal device based on the subscription information of the terminal device.
  • the session management network element can determine the user plane security policy of the terminal device based on the subscription information of the terminal device, or, based on the subscription information of the terminal device, determine whether the access network device should execute the user at the first rate.
  • the integrity protection is activated at the second rate, so that the integrity protection policy can be dynamically adjusted to match more application scenarios.
  • the session management network element determining the user plane security policy of the terminal device includes: the session management network element according to the session request message of the terminal device , Determine the user plane security policy of the terminal device.
  • the session management network element can determine the user plane security policy of the terminal device based on the session request message of the terminal device, or, based on the session request message of the terminal device, determine whether the access network device is unable to follow the first rate
  • the integrity protection is activated at the second rate, so that the integrity protection policy can be dynamically adjusted according to the session request message, thereby improving data transmission performance as much as possible and improving user experience.
  • the secure session method further includes: the session management network element receives rate information provided by the policy control network element; based on the rate information, the The session management network element sends the information used to indicate the second rate to the access network device.
  • the secure session method further includes: the session management network element receiving the second rate information sent by the access network device.
  • a secure conversation method is provided.
  • the method may be executed by the session management network element, or may also be executed by a chip or circuit configured in the session management network element, which is not limited in this application.
  • the method may include: a session management network element receives a session creation session management context service request initiated by an access and mobility management network element; based on the session creation session management context service request, the session management network element returns the session to the AMF Create a session management context service response, the session creation session management context service response includes indication information used to indicate: when the access network device cannot execute the user plane security policy at the first rate, the access The network access device activates integrity protection at a second rate, where the second rate is lower than the first rate.
  • the session management network element can create a session management context service request based on the session provided by the invoking access and mobility management network element to determine whether to instruct the access network device, where the access network device cannot execute the user at the first rate
  • a security policy in other words, when the access network device’s capabilities cannot protect the integrity of the session and provide services at the rate required by the session, in other words, the access network device cannot perform the first
  • the access network device can activate integrity protection at a rate lower than the first rate (for example, recorded as the second rate), and then by considering the application scenarios of various services, another method is proposed.
  • the solution in turn, can provide another option to meet the needs of different services as much as possible, match more application scenarios, and improve user experience.
  • the session management network element receiving the session creation session management context service request initiated by the access and mobility management network element includes: the session management network element receives the packet data unit ( packet data unit, PDU) Session creation session management context service request.
  • the session management network element receives the packet data unit ( packet data unit, PDU) Session creation session management context service request.
  • the session management network element returning a session creation session management context service response to the access and mobility management network element includes: the session management network element returning a PDU session to the access and mobility management network element Create a session management context service response.
  • the session creation session management context service request includes notification information, and the notification information is used to notify that the access network device cannot follow the first rate
  • the access network device activates integrity protection at the second rate
  • the method further includes: based on the notification information, the session management network element determines the indication information.
  • the terminal device can determine by itself whether the access network device needs to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate, so as to better meet the requirements user experience.
  • the terminal device determines that the access network device needs to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate, it can notify the session management network element, and then the session The management network element notifies the access network device.
  • the session creation session management context service request includes information about the service type of the terminal device; the secure session method further includes: based on the service type Information, the session management network element determines the indication information.
  • the session management network element can determine whether the access network device needs to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate according to the service type. Meet the needs of different businesses.
  • the secure session method further includes: the session management network element receives rate information provided by the policy control network element; based on the rate information, the session management The network element determines the second rate.
  • the secure session method further includes: the session management network element receiving the second rate information sent by the access network device.
  • a secure conversation method is provided.
  • the method may be executed by a terminal device, or may also be executed by a chip or a circuit configured in the terminal device, which is not limited in this application.
  • the method may include: the terminal device determines indication information, the indication information is used to indicate: in the case that the access network device cannot execute the user plane security policy at the first rate, the access network device activates complete at the second rate Protection, wherein the second rate is lower than the first rate; the terminal device sends the indication information to the access and mobility management network element.
  • the terminal device can determine by itself whether the access network device needs to implement the user plane security policy at the first rate. In other words, determine whether the access network device needs to be on the access network.
  • the integrity protection is activated at a rate lower than the first rate (for example, the second rate), so that the user experience can be better satisfied.
  • the terminal device determines that the access network device needs to activate the integrity protection at the second rate when the access network device cannot activate the integrity protection at the first rate, it can notify the session management network element to facilitate the session management network element Notify the access network equipment.
  • a secure conversation device which includes various modules or units for executing the method in any one of the foregoing first to fourth aspects.
  • a secure conversation device including a processor.
  • the processor is coupled with the memory and can be used to execute instructions in the memory to implement the method in any one of the possible implementation manners of the first to fourth aspects.
  • the secure conversation device further includes a memory.
  • the secure conversation device further includes a communication interface, and the processor is coupled with the communication interface.
  • the secure session device is a communication device, such as a terminal device, a session management network element or an access network device in the embodiment of the present application.
  • the communication interface may be a transceiver, or an input/output interface.
  • the secure session device is a chip configured in a communication device, such as a chip configured in a terminal device, a session management network element, or an access network device in the embodiment of the present application.
  • the communication interface may be an input/output interface.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • a processor including: an input circuit, an output circuit, and a processing circuit.
  • the processing circuit is configured to receive a signal through the input circuit and transmit a signal through the output circuit, so that the processor executes the method in any one of the possible implementation manners of the first to fourth aspects.
  • the foregoing processor may be a chip
  • the input circuit may be an input pin
  • the output circuit may be an output pin
  • the processing circuit may be a transistor, a gate circuit, a flip-flop, and various logic circuits.
  • the input signal received by the input circuit may be received and input by, for example, but not limited to, a receiver
  • the signal output by the output circuit may be, for example, but not limited to, output to and transmitted by the transmitter
  • the circuit can be the same circuit, which is used as an input circuit and an output circuit at different times.
  • the embodiments of the present application do not limit the specific implementation manners of the processor and various circuits.
  • a processing device including a processor and a memory.
  • the processor is used to read instructions stored in the memory, and can receive signals through a receiver and transmit signals through a transmitter, so as to execute the method in any one of the possible implementation manners of the first to fourth aspects.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory and the processor may be provided separately.
  • the memory can be a non-transitory (non-transitory) memory, such as a read only memory (ROM), which can be integrated with the processor on the same chip, or can be set in different On the chip, the embodiment of the present application does not limit the type of memory and the setting mode of the memory and the processor.
  • ROM read only memory
  • sending instruction information may be a process of outputting instruction information from the processor
  • receiving capability information may be a process of the processor receiving input capability information.
  • the processed output data may be output to the transmitter, and the input data received by the processor may come from the receiver.
  • the transmitter and receiver can be collectively referred to as a transceiver.
  • the processing device in the above eighth aspect may be a chip, and the processor may be implemented by hardware or software.
  • the processor When implemented by hardware, the processor may be a logic circuit, an integrated circuit, etc.; when implemented by software
  • the processor may be a general-purpose processor, which is implemented by reading software codes stored in the memory.
  • the memory may be integrated in the processor, may be located outside the processor, and exist independently.
  • a computer program product includes: a computer program (also called code, or instruction), which when the computer program is run, causes the secure conversation device to execute the first to The method in any possible implementation manner in the fourth aspect.
  • a computer program also called code, or instruction
  • a computer-readable medium stores a computer program (also called code, or instruction) when it runs on a secure conversation device, so that the secure conversation device executes the first
  • a computer program also called code, or instruction
  • a system including the aforementioned terminal device, session management network element, and access network device.
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application
  • Fig. 2 is a schematic diagram of a secure session method provided according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a secure session method provided by another embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a secure session method provided by another embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a secure session method provided by still another embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a secure session method provided by another embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a secure session method provided by still another embodiment of the present application.
  • FIG. 8 is a schematic block diagram of a secure conversation device provided by an embodiment of the present application.
  • Fig. 9 is a schematic block diagram of a secure conversation device provided by an embodiment of the present application.
  • GSM Global System of Mobile Communication
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • GSM Global System of Mobile Communication
  • GPRS General Packet Radio Service
  • LTE Long Term Evolution
  • FDD Frequency Division Duplex
  • TDD Time Division Duplex
  • UMTS Universal Mobile Telecommunication System
  • WiMAX Worldwide Interoperability for Microwave Access
  • the embodiments of the application do not specifically limit the specific structure of the execution body of the method provided in the embodiments of the application, as long as the program that records the code of the method provided in the embodiments of the application can be executed according to the embodiments of the application.
  • the provided method can be used for communication.
  • the execution subject of the method provided in the embodiments of the present application may be a terminal or a network-side device, or a functional module in a UE or a network-side device that can call and execute the program.
  • FIG. 1 is a schematic diagram of a network architecture suitable for the method provided by the embodiment of the present application.
  • the network architecture may be a non-roaming architecture, for example.
  • the network architecture may specifically include the following network elements:
  • User equipment it can be called terminal equipment, terminal, access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, wireless communication equipment, User agent or user device.
  • the terminal device can also be a cellular phone, a cordless phone, a Session Initiation Protocol (SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital processing (Personal Digital Assistant, PDA), with wireless communication Functional handheld devices, computing devices, or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in the future 5G network, or future evolution of the public land mobile network (Public Land Mobile Network, PLMN) Terminal equipment, etc., this embodiment of the application does not limit this.
  • SIP Session Initiation Protocol
  • WLL Wireless Local Loop
  • PDA Personal Digital Assistant
  • Access network Provides network access functions for authorized users in a preset area, and can use transmission tunnels of different quality according to user levels and service requirements.
  • the access network may be an access network using different access technologies.
  • 3rd Generation Partnership Project 3rd Generation Partnership Project
  • 3GPP 3rd Generation Partnership Project
  • non-3GPP non-third generation Generation Partnership Project
  • 3GPP access technology refers to the access technology that complies with the 3GPP standard specifications.
  • the access network that adopts the 3GPP access technology is called the radio access network (Radio Access Network, RAN), among which the access network equipment in the 5G system Next generation Node Base station (gNB).
  • RAN radio access network
  • a non-3GPP access technology refers to an access technology that does not comply with the 3GPP standard specifications, for example, an air interface technology represented by an access point (AP) in wifi.
  • AP access point
  • An access network that implements access network functions based on wireless communication technology may be called a radio access network (RAN).
  • the wireless access network can manage wireless resources, provide access services for the terminal, and complete the forwarding of control signals and user data between the terminal and the core network.
  • the wireless access network can be, for example, the Global System of Mobile Communications (GSM) system or the Base Transceiver Station (BTS) in Code Division Multiple Access (CDMA), or it can be a broadband code division.
  • the base station (NodeB, NB) in the Wideband Code Division Multiple Access (WCDMA) system can also be the evolved base station (Evolutional NodeB, eNB or eNodeB) in the LTE system, or the cloud wireless access network (Cloud Radio Access Network, CRAN) scenario wireless controller, or the network device can be a relay station, access point, in-vehicle device, wearable device, network device in the future 5G network or network device in the future evolved PLMN network, etc.
  • the embodiments of this application are not limited.
  • Access and mobility management function (AMF) entities mainly used for mobility management and access management, etc., and can be used to implement mobility management entity (mobility management entity, MME) functions in addition to sessions Functions other than management, for example, lawful interception, or access authorization (or authentication) functions. In the embodiment of the present application, it can be used to realize the functions of accessing and mobility management network elements.
  • MME mobility management entity
  • Session management function (SMF) entity mainly used for session management, UE's Internet Protocol (IP) address allocation and management, selection of manageable user plane functions, policy control, or charging function interfaces End point and downlink data notification, etc. In the embodiment of this application, it can be used to realize the function of the session management network element.
  • IP Internet Protocol
  • User Plane Function (UPF) entity that is, the data plane gateway. It can be used for packet routing and forwarding, or quality of service (QoS) processing of user plane data, etc.
  • User data can be connected to the data network (DN) through this network element. In the embodiment of this application, it can be used to realize the function of the user plane gateway.
  • DN data network
  • Data network A network used to provide data transmission.
  • DN Data network
  • An operator s business network, an Internet network, a third-party business network, etc.
  • Authentication server function authentication server function, AUSF
  • AUSF authentication server function
  • Network exposure function (NEF) entity used to safely open services and capabilities provided by 3GPP network functions to the outside.
  • Network storage function (NF) repository function (NRF) entity used to store network function entities and description information of the services they provide, and support service discovery, network element entity discovery, etc.
  • PCF Policy control function
  • Unified data management (UDM) entity used for unified data management, 5G user data management, processing user identification, access authentication, registration, or mobility management, etc.
  • Application function (AF) entity used to route data affected by applications, access network open function network elements, or interact with policy frameworks for policy control, etc.
  • the N1 interface is the reference point between the terminal and the AMF entity;
  • the N2 interface is the reference point between the AN and AMF entities, used for non-access stratum (NAS) message transmission, etc.;
  • N3 The interface is the reference point between the (R)AN and the UPF entity, used to transmit user plane data, etc.;
  • the N4 interface is the reference point between the SMF entity and the UPF entity, used to transmit, for example, the tunnel identification information and data of the N3 connection Cache indication information, downlink data notification message and other information;
  • N6 interface is the reference point between UPF entity and DN, used to transmit user plane data, etc.
  • the above-mentioned network architecture applied to the embodiments of the present application is only an example of a network architecture described from the perspective of a traditional point-to-point architecture and a service-oriented architecture, and the network architecture applicable to the embodiments of the present application is not limited thereto. Any network architecture that can realize the functions of the above-mentioned network elements is applicable to the embodiments of the present application.
  • AMF entity, SMF entity, UPF entity, NSSF entity, NEF entity, AUSF entity, NRF entity, PCF entity, and UDM entity shown in Figure 1 can be understood as network elements used to implement different functions in the core network. , For example, can be combined into network slices on demand. These core network elements may be independent devices, or they may be integrated in the same device to implement different functions, which is not limited in this application.
  • the entity used to implement AMF is referred to as the access and mobility management network element
  • the entity used to implement SMF is referred to as the session management network element
  • the entity used to implement UPF is referred to as the user plane gateway.
  • the entity used to implement the UDM function is recorded as a unified data management network element
  • the entity used to implement the PCF is recorded as a policy control network element.
  • the name of the interface between the various network elements in FIG. 1 is only an example, and the name of the interface in a specific implementation may be other names, which is not specifically limited in this application.
  • the name of the message (or signaling) transmitted between the various network elements is only an example, and does not constitute any limitation on the function of the message itself.
  • Integrity protection The sender performs integrity protection on the plaintext or ciphertext according to the integrity protection algorithm and the integrity protection key.
  • the receiving end can perform integrity verification on the integrity-protected data according to the same integrity protection algorithm and integrity protection key.
  • the integrity protection key can be generated after the receiving end receives the access layer security mode command AS SMC (generated according to the user plane integrity protection algorithm carried in the AS SMC), or when integrity protection needs to be turned on Generated (generated according to the user plane integrity protection algorithm carried in the AS SMC).
  • Security capabilities including but not limited to: security algorithms, security parameters, keys, etc.
  • the security capability may include, for example, the security capability of the UE and the security capability of the user plane gateway.
  • Security algorithm the algorithm used for data security protection. For example, it may include: encryption/decryption algorithms, integrity protection algorithms, etc.
  • activating user plane security protection it can be understood as turning on the security protection function.
  • activating user plane security protection includes activating integrity protection. For example, when integrity protection is activated, the integrity protection function is turned on. On the contrary, the integrity protection is not activated, that is, the integrity protection function is not activated. When certain safety protection is activated, the corresponding safety protection can be directly activated.
  • activating user plane security protection may also include activating encryption/decryption protection, integrity verification, and the like.
  • the user plane gateway may be the integrity protection terminal, and activating the user plane security protection may include activating integrity protection; the terminal device may be the integrity verification terminal, and the activation User plane security protection may include activation integrity verification.
  • the terminal device may be an integrity protection terminal, and activating user plane security protection may include activating integrity protection; the user plane gateway may be an integrity verification terminal, and activating user plane security protection may include activating integrity verification.
  • the terminal device can serve as the integrity protection terminal and the integrity verification terminal at the same time;
  • the user plane gateway can serve as the integrity protection terminal and the integrity verification terminal at the same time. If integrity protection/verification is activated, the terminal device and the user plane gateway can both activate integrity protection and integrity verification.
  • Security policy at least can be used to indicate whether to activate encryption protection and/or integrity protection.
  • the security policy can also be used to indicate other more information, such as strength recommendations of the security algorithm, etc., the specific content of which is not limited in this embodiment of the application.
  • a security policy or it can also be called a user-plane security policy, and is described in a unified manner below.
  • the security policy may indicate the preference of security protection, for example, may indicate required (required), recommended (preferred) and not required (not needed) security protection. Based on the security protection preference, it can be determined whether to activate encryption protection and/or integrity protection.
  • integrity protection must be performed between the terminal equipment and the access network equipment (such as the base station). If the access network device does not support its own capabilities, it directly refuses the establishment of the corresponding service session. For example, for the business of reporting measurement data, the accuracy of the data is very important, and it will have a great impact if it is tampered with, so it is necessary to turn on the protection.
  • integrity protection is given priority between the terminal equipment and the access network equipment.
  • integrity protection will be used when the access network equipment’s capabilities can support integrity protection. It will not be done when integrity protection is not supported.
  • the access network device can support integrity protection, but it cannot be enabled due to load and other reasons.
  • a rate of 1 Mbps is also supported.
  • the access network device will choose to turn off the integrity protection to meet the 1Mbps rate requirement.
  • preferred means that the access network device can only enable integrity protection only when it can meet the service rate requirements and can also support integrity protection. Or, it can also be understood as when the rate and integrity protection When the two can only choose one, the rate will be satisfied first and the integrity protection will be turned off.
  • the security policy corresponding to required may be recorded as the first policy
  • the security policy corresponding to not needed may be recorded as the second policy
  • the security policy corresponding to preferred may be recorded as the third policy.
  • the first strategy, the second strategy, and the third strategy are only names for distinction, and do not limit the protection scope of the embodiments of the present application.
  • the existing security strategy basically considers three situations: integrity protection (for example, recorded as the first strategy), incomplete protection (for example, recorded as the second strategy), and integrity protection and service rate conflict Integrity protection is discarded from time to time to maintain the rate (for example, recorded as the third strategy).
  • the embodiment of the present application proposes a secure session method so as to be able to match more business scenarios.
  • the drawings are merely illustrative for ease of understanding, and should not constitute any limitation to the application.
  • the gNB shown in the figure can correspond to access network equipment
  • AMF can correspond to access and mobility management network elements
  • SMF can correspond to session management network elements
  • UDM can correspond to unified data management network elements
  • PCF can correspond to For policy management network elements.
  • the name of each network element is only defined for distinguishing different functions, and should not constitute any limitation in this application. This application does not exclude the possibility of defining other network elements to achieve the same or similar functions.
  • FIG. 2 is a schematic interaction diagram of a method 200 provided by an embodiment of the present application.
  • the method 200 may include the following steps.
  • the access network device receives a session request message sent by the session management network element, where the session request message carries the user plane security policy of the terminal device and the first rate information.
  • the first rate can be used to indicate the rate required by the session, or, in other words, it can be used to indicate the rate required by the session when the access network device executes the user plane security policy, or, in other words, can be used for Indicates the rate required by the session when the access network device activates integrity protection, or, in other words, can be used to indicate the transmission rate that the access network device needs to meet when the integrity protection of the session is performed, or, in other words, it can Used to indicate the transmission rate required by the terminal device when the access network device performs integrity protection on the session.
  • the first rate is used to express.
  • the user-plane security policy may include the user-plane security policy contained in the subscription information in the prior art, such as required, not needed, and preferred as described above.
  • the user-plane security policy may also include another policy. For distinction, Record this strategy as the fourth strategy.
  • the fourth strategy can be at least one of the following two forms.
  • Form 1 The fourth strategy can be used to indicate that integrity protection is preferred when the rate conflicts with integrity protection.
  • the fourth strategy can be used to indicate that when the capabilities of the access network device do not support the service required capabilities of the terminal device, or in other words, the capabilities of the access network device cannot protect the integrity of the session and are based on session
  • the access Network equipment chooses to turn on integrity protection.
  • the fourth strategy can be used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available.
  • the fourth strategy can be used to indicate that when the capabilities of the access network device do not support the service required capabilities of the terminal device, or in other words, the capabilities of the access network device cannot protect the integrity of the session and are based on session
  • the access network device chooses to enable integrity protection, and the access network device transmits data with the terminal device at the maximum rate currently available.
  • the access network device receives the session request message, or, alternatively, the access network device receives the service request message. Based on the session request message or service request message, the access network can perform corresponding data transmission with the terminal device.
  • the access network device When the access network device cannot execute the user plane security policy at the first rate, the access network device activates integrity protection at a second rate, where the second rate is lower than the first rate.
  • the access network device After the access network device receives the session request message, if the access network device’s capability is unable to protect the integrity of the session and the session is served at the rate (for example, the first rate), it will choose to activate integrity protection, but the service will be performed at a rate lower than the first rate.
  • the rate for example, the first rate
  • the access network device In the case that the access network device cannot execute the user plane security policy at the first rate, the access network device activates integrity protection at the second rate. It can also be understood that the access network device cannot execute the user plane security policy at the first rate. In the case of a security policy, the access network device reduces the rate and activates integrity protection; or, it can also be understood as, when the access network device cannot execute the user plane security policy at the first rate, the access network device activates Integrity protection; Or, it can also be understood that, in the case of a conflict between rate and integrity protection, the access network device chooses to implement integrity protection.
  • the second rate is used to indicate a rate lower than the first rate. That is to say, when the integrity protection is activated, the transmission rate of the access network device is lower than the first rate.
  • the second rate may be a rate determined by the access network device itself, or may be a rate indicated by other network elements, which is not limited.
  • the access network device In the case that the access network device cannot execute the user plane security policy according to the first rate, the access network device activates integrity protection, which can be implemented at least in any of the following three ways; in other words, the access network device Based on any one of the following methods, it may be determined whether to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate.
  • integrity protection can be implemented at least in any of the following three ways; in other words, the access network device Based on any one of the following methods, it may be determined whether to activate the integrity protection at the second rate when the access network device cannot execute the user plane security policy at the first rate.
  • the user plane security policy of the terminal device carried in the session request message is the fourth policy, and the fourth policy may be any of the foregoing forms.
  • the access network device determines based on the fourth policy that the integrity protection is activated when the access network device cannot execute the user plane security policy at the first rate.
  • the fourth policy may be determined by the session management network element.
  • the session management network element determines the fourth strategy, and sends information about the fourth strategy to the access network device.
  • the fourth strategy may be determined by a unified data management network element.
  • the unified data management network element determines the fourth policy and sends information about the fourth policy to the session management network element.
  • the session management network element receives the fourth policy provided by the unified data management network element.
  • the session management network element may directly send the information of the fourth strategy to the access network device.
  • the session management network element may also first determine whether to implement the fourth strategy, and when it is determined that the fourth strategy can be implemented, send the information of the fourth strategy to the access network device.
  • the session management network element may determine whether the fourth policy can be implemented based on the service type and/or the capabilities of the access network device.
  • Manner B When the access network device cannot execute the user plane security policy at the first rate, the access network device activates integrity protection based on the instruction information.
  • the instruction information is used to indicate: when the access network device cannot execute the user plane security policy at the first rate, the access network device activates integrity protection, or the access network device cannot execute the user plane security policy at the first rate. In the case of a security policy, integrity protection is activated at the second rate.
  • the indication information may be determined by the terminal device.
  • the terminal device determines whether the access network device wants to activate integrity protection when the access network device cannot execute the user plane security policy at the first rate, and instructs the access network device.
  • the instruction information may be sent to the access network device through separate signaling, for example, forwarded to the access network device through the session management network element; the instruction information may also be carried in the session request message, which is not limited.
  • the indication information may be determined by the session management network element.
  • the session management network element determines that when the access network device cannot execute the user plane security policy at the first rate, the access network device activates integrity protection, whether the access network device needs to activate the integrity protection, and reports Access network equipment instructions.
  • the instruction information can be sent to the access network device through separate signaling; the instruction information can also be carried in the session request message, such as the session management context returned by the session management network element to the access and mobility management network element. In the service response, this is not limited.
  • the indication information may be determined by a unified data management network element.
  • the unified data management network element determines whether the access network device activates integrity protection when the access network device cannot execute the user plane security policy at the first rate, and whether the access network device needs to activate integrity protection, and Instruct to the access network equipment.
  • the instruction information may be sent to the access network device through separate signaling, for example, forwarded to the access network device through the session management network element; the instruction information may also be carried in the session request message, which is not limited.
  • Manner C The access network device determines to activate the integrity protection when the user plane security policy cannot be executed at the first rate.
  • the access network device determines whether the session meets the preset condition, and when the session meets the preset condition, the access network device activates integrity protection.
  • the session meets the preset conditions, or it can also be understood that the service meets the preset conditions, for example, the service is a service such as small-capacity voice, or the service is this type of service, that is, the occasional packet loss and tampering have little impact, or The impact of packet loss is less than the preset threshold and so on.
  • the service is a service such as small-capacity voice, or the service is this type of service, that is, the occasional packet loss and tampering have little impact, or The impact of packet loss is less than the preset threshold and so on.
  • the preset condition or the preset threshold may be pre-defined, such as pre-defined by the protocol, or it may be pre-defined by the network device, or it may be notified by the terminal device to the network device, or it may be from The core network is not limited.
  • the access network device receives rate information from the policy control network element, where the rate information is used to indicate the second rate.
  • the access network device reports the second rate to the session management network element.
  • integrity protection can be preferentially selected by self-determination, and the session management network element can be notified, so that the integrity protection strategy can be dynamically adjusted according to the business to match different business scenarios as much as possible.
  • FIG. 3 is a schematic interaction diagram of a method 300 provided by an embodiment of the present application.
  • the method 300 may include the following steps.
  • the terminal device sends a service request message to the access and mobility management network element.
  • the access and mobility management network element receives the service request message from the terminal device.
  • the terminal device initiates a service request message to the access and mobility management network element.
  • the service request message may be used to request the establishment of a connection between the terminal device and the service server of the data network, and the connection with the service server of the data network requested by the service request message may be used to transmit data.
  • the data may be, for example, general data, small data, data corresponding to specific services, etc., which is not limited in this application.
  • the service request message sent by the terminal device to the access and mobility management network element is recorded as the first service request message, which is uniformly represented by the first service request message below.
  • the terminal device may send the first service request message to the access and mobility management network element via the access network device.
  • the first service request message is a service request (service request) message or a packet data unit (packet data unit, PDU) session establishment request (PDU session establishment request) message.
  • service request service request
  • PDU packet data unit
  • PDU session establishment request PDU session establishment request
  • the first service request message may carry slice or specific service-related information, such as service type, single network slice selection assistance information (S-NSSAI), etc., for example, the terminal may be instructed through S-NSSAI The slice information requested by the device.
  • the first service request message may carry a data network name (date network name, DNN) to indicate the data network name that the terminal device requests to access.
  • the first service request message may also be other messages transmitted between the terminal device and the access and mobility management network element.
  • the access and mobility management network element sends a second service request message to the session management network element.
  • the service request message sent by the access and mobility management network element to the session management network element is recorded as the second service request message, which is uniformly represented by the second service request message below.
  • the second service request message may create a session management context service request for the PDU session.
  • step 320 can also be understood as that the session management network element receives the PDU session creation session management context service request initiated by the access and mobility management network element.
  • each network element can transmit messages in a calling manner.
  • the access and mobility management network element sends the second service request message to the session management network element, which can be understood as access Call the session management network element to create a session management context service provided by the session management network element with the mobility management network element. I won't repeat it below.
  • the second service request message may carry the identification of the terminal device.
  • the identification of the terminal equipment may include, but is not limited to, for example: International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identification Number (IMSI), and IP Multimedia Subsystem Private User Identity (IMSI) (IP multimedia subsystem) private user identity, IMPI), temporary mobile subscriber identity (TMSI), IP multimedia public identity (IMPU), media access control (MAC) address , IP address, mobile phone number, globally unique temporary UE identity (GUTI) (for example, for 5G, it can be 5G GUTI), permanent identity (subscription permanent identifier, SUPI), hidden identity ( subscriber concealed identifier (SUCI) or permanent equipment identifier (PEI).
  • IMEI International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identification Number
  • IMSI IP Multimedia Subsystem Private User Identity
  • IP multimedia subsystem IP multimedia subsystem
  • IMPI temporary mobile subscriber identity
  • TMSI IP multimedia public identity
  • MAC media access control
  • IP address IP address
  • the second service request message may not carry the identification of the terminal device.
  • the previous registration request message has already carried the identification of the terminal device, such as SUPI, 5G GUTI, or PEI.
  • the second service request message may also include DNN, S-NSSAI and other information.
  • the second service request message may also be other messages transmitted between the access and mobility management network element and the session management network element.
  • the session management network element sends a third service request message to the unified data management network element.
  • the service request message sent by the session management network element to the unified data management network element is recorded as the third service request message, which is uniformly represented by the third service request message below.
  • the session management network element calls the user data management acquisition request service provided by the unified data management network element, and obtains the contract information of the terminal device from the unified data management network element.
  • the third service request message may be a subscription request message or a communication message (Nudm_SDM_Get_request) between the session management network element and the unified data management network element.
  • the third service request message may include the identification of the terminal device.
  • identification of the terminal device reference may be made to the description in step 320, which will not be repeated here.
  • the third service request message may also include DNN, S-NSSAI and other information.
  • the third service request message may also be other messages transmitted between the session management network element and the unified data management network element.
  • the unified data management network element sends a third service response message to the session management network element.
  • the third service response message is a response to the third service request message in step 330.
  • the service response message sent by the unified data management network element to the session management network element is recorded as the third service response message, which is uniformly represented by the third service response message below.
  • the unified data management network element finds the subscription information of the terminal device according to the identifier of the terminal device, such as SUPI, and notifies the session management network element of the subscription information through the third service response message. Or, it can also be understood that the unified data management network element returns a third service response message to the session management network element.
  • the third service response message may be a subscription response message or a communication message (Nudm_SDM_Get_response) between the session management network element and the unified data management network element.
  • the contract information of the terminal device may be pre-stored in the unified data management network element.
  • the subscription information may include a user plane (UP) security policy (UP security policy), and the user plane security policy may be used to indicate whether integrity protection needs to be activated.
  • UP security policy user plane security policy
  • the user plane security policy may include the user plane security policy contained in the subscription information in the prior art, such as required, not needed, and preferred as described above.
  • the user plane security policy may also include another Strategy, in order to distinguish, this strategy is recorded as the fourth strategy.
  • the fourth strategy can be at least one of the following two forms.
  • Form 1 The fourth strategy can be used to indicate that integrity protection is preferred when the rate conflicts with integrity protection.
  • the fourth strategy can be used to indicate that when the capabilities of the access network device do not support the service required capabilities of the terminal device, or in other words, the capabilities of the access network device cannot protect the integrity of the session and are based on session
  • the access Network equipment chooses to turn on integrity protection.
  • the subscription information of the terminal device may include a fourth policy, and the fourth policy may be used to indicate that integrity protection is preferentially selected when the rate conflicts with integrity protection.
  • the fourth strategy can be used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available.
  • the conflict between rate and integrity protection includes: integrity protection cannot be turned on when data transmission is performed at the first rate, or data transmission cannot be performed at the first rate when integrity protection is turned on.
  • the fourth strategy can be used to indicate that when the capabilities of the access network device do not support the service required capabilities of the terminal device, or in other words, the capabilities of the access network device cannot protect the integrity of the session and are based on session
  • the access network device chooses to enable integrity protection, and the access network device transmits at the maximum rate currently available.
  • the contract information of the terminal device may include a fourth policy, which may be used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and to instruct the access network device to use the currently available Maximum rate transmission.
  • the access network equipment cannot execute the user plane security policy at the first rate, which can be used to indicate that the access network equipment will not be able to meet service requirements if it implements integrity protection; or If the access network equipment implements integrity protection, its transmission rate will not meet the transmission rate required by the service; or the rate conflicts with the integrity protection; or the capability of the access network equipment does not support the service requirements of the terminal equipment, etc. .
  • the priority of integrity protection is mentioned many times, which can be used to indicate that in the case that the rate conflicts with the integrity protection, the access network device chooses to implement integrity protection.
  • the access Network equipment can also take some measures to implement integrity protection, such as reducing the transmission rate.
  • the unified data management network element may determine whether to indicate the fourth strategy according to the type of service. For example, for certain services, such as small-capacity voice services, it is of course better to be able to protect the integrity. If integrity protection is really not possible, occasional packet loss and tampering will not affect the understanding of the voice content. Therefore, it can be implemented for this type of service. Fourth strategy.
  • the third service request response may also be other messages transmitted between the session management network element and the unified data management network element.
  • the session management network element determines to implement the fourth policy according to the contract information and/or the local policy (local policy).
  • the session management network element can determine whether the access network device should implement the fourth strategy or determine whether to indicate the fourth strategy according to the subscription information and/or the local policy; The information and/or local strategy determines whether to instruct the access network device. In the case of a conflict between the rate and the integrity protection, the current terminal device requests the session to implement the priority of the integrity protection strategy.
  • the fourth strategy can be any one of Form 1 or Form 2 above.
  • the session management network element determines to implement the fourth strategy, which means that the session management network element indicates the fourth strategy to the access network device, and accordingly, the access network device receives the fourth strategy.
  • integrity protection will be selected first in the case of a conflict between rate and integrity protection.
  • the session management network element determines to implement the fourth strategy, which means that the session management network element indicates the fourth strategy to the access network device, and accordingly, the access network device receives the first strategy.
  • integrity protection will be selected first in the case of a conflict between rate and integrity protection, and the access network equipment will transmit at the maximum rate currently available.
  • the fourth strategy may be instructed by the unified data management network element, or may be instructed by the session management network element, which is not limited. Described below separately.
  • the session management network element obtains the fourth policy from the contract information of the terminal device obtained from the unified data management network element.
  • the session management network element determines whether to implement the fourth policy according to the user plane security policy contained in the subscription information of the terminal device; or, in other words, the fourth policy is instructed by the unified data management network element.
  • the management network element judges whether the fourth strategy can be implemented.
  • the session management network element may generate the first security policy based on the user plane security policy (that is, the fourth policy) contained in the subscription information of the terminal device.
  • the first security policy may include the user plane security policy (that is, the fourth policy), or in other words, the first security policy may be used to indicate that when the rate conflicts with integrity protection, the access network device preferentially selects to enable integrity Protection, or, the first security policy may be used to indicate that when the rate conflicts with integrity protection, the access network device preferentially selects to enable integrity protection, and the access network device transmits at the maximum rate currently available.
  • the session management network element may determine whether the fourth strategy can be implemented based on the service type and/or the capability of the access network device.
  • the session management network element obtains the fourth strategy according to other information.
  • the session management network element determines the fourth strategy according to other information of the terminal device; or, in other words, the fourth strategy is indicated by the session management network element, that is, the session management network element determines whether the fourth strategy can be implemented. If the strategy can be implemented, the session management network element indicates the fourth strategy.
  • the session management network element can also generate a second security policy based on one or more comprehensive judgments of other information, such as local policy, obtained slice-related information, and supported service types, or in other words, determine In the case of a conflict between rate and integrity protection, whether the access network device should give priority to turning on integrity protection.
  • the security requirements of the service type can be obtained from the contract information; it can also interact with other network elements, such as policy control network elements, application service network elements, and so on.
  • the first security policy determined by the session management network element and the user plane security policy obtained from the subscription information of the terminal device may be the same or different, which is not limited in this application.
  • the first security policy or the second security policy is only used to indicate the fourth policy. That is, the items are the same as the information indicated in the existing user plane security policy, but the specific information indicated may be the same or different. However, it should be understood that this application does not exclude the possibility that the first security policy or the second security policy includes other information, such as security capability information, user plane security endpoint information, etc.
  • FIG. 3 only shows a situation where the fourth strategy is determined to be implemented, and the embodiment of the present application is not limited thereto.
  • the session management network element may also determine to implement any of the following strategies: the first strategy, the second strategy, or the third strategy.
  • the method 300 may further include the following steps.
  • the session management network element sends a second service response message to the access and mobility management network element.
  • the second service response message is a response to the second service request message in step 320.
  • the service response message sent by the session management network element to the access and mobility management network element is recorded as the second service response message, which is uniformly represented by the second service response message below.
  • the second service response message may be a PDU session creation session management context service response.
  • step 360 can also be understood as that the session management network element returns a PDU session creation session management context service response to the access and mobility management network element.
  • the second service response message sent by the session management network element to the access and mobility management network element carries the generated first security policy or the second security policy.
  • the second service response message may include the fourth policy.
  • the fourth strategy is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, or the fourth strategy is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and access The network equipment transmits at the maximum rate currently available.
  • the access and mobility management network element sends information indicating the fourth strategy to the access network device.
  • the access and mobility management network element forwards the information received from the session management network element to the access network device. For example, the access and mobility management network element sends the information of the fourth strategy to the access network device.
  • the fourth policy may be carried in the N2 interface message of the access and mobility management network element and the access network device, such as an N2 interface PDU session request (N2PDU session request) message.
  • N2PDU session request N2 interface PDU session request
  • the access network equipment prioritizes integrity protection according to the fourth strategy.
  • the access network device receives the fourth policy, if the rate cannot meet the requirement or in the case that the rate conflicts with integrity protection, the integrity protection is preferred; or the access network device receives After the fourth strategy, when the rate cannot meet the requirement, or when the rate conflicts with integrity protection, integrity protection is selected first, and services are performed at the maximum rate currently provided by the access network device.
  • the access network device may notify the session management network element that the speed reduction process has been performed and the final speed.
  • the foregoing embodiment mainly introduces the situation in which the access network device implements the fourth strategy. It should be understood that the embodiment of the present application is not limited to this. For example, the above-mentioned embodiments can be applied to other strategies, such as scenarios of the first strategy, the second strategy, or the third strategy.
  • the access network device may implement integrity protection and perform transmission at the second rate.
  • the access network device can transmit data with the terminal device at the second rate.
  • the second rate may be the maximum rate currently provided by the access network device indicated in the fourth policy, or the second rate may be any rate lower than the maximum rate currently provided by the access network device, or
  • the second rate may also be a rate indicated by the policy control network element.
  • the access network device may report the second rate to the session management network element. The following will be described in detail with reference to the embodiment shown in FIG. 6.
  • the integrity protection is preferentially selected, so that it can be dynamically adjusted according to the service. Integrity protection strategy to match different business scenarios as much as possible.
  • the fourth strategy may be made and selected by the session management network element, or may be made and selected by the unified data management network element.
  • FIG. 4 is a schematic interaction diagram of a method 400 provided by an embodiment of the present application.
  • the method 400 may include the following steps.
  • the terminal device sends a service request message to the access and mobility management network element.
  • the access and mobility management network element receives the service request message from the terminal device.
  • the service request message sent by the terminal device to the access and mobility management network element is recorded as the first service request message, which is uniformly represented by the first service request message below.
  • step 310 is the same as step 310 in the method 300.
  • step 310 please refer to the above step 310, which will not be repeated here.
  • the access and mobility management network element sends a second service request message to the session management network element.
  • the service request message sent by the access and mobility management network element to the session management network element is recorded as the second service request message, which is uniformly represented by the second service request message below.
  • step 320 is the same as step 320 in method 300.
  • step 320 described above, which will not be repeated here.
  • the session management network element sends a third service request message to the unified data management network element.
  • the service request message sent by the session management network element to the unified data management network element is recorded as the third service request message, which is uniformly represented by the third service request message below.
  • step 330 is the same as step 330 in the method 300.
  • step 330 please refer to the above step 330, which will not be repeated here.
  • the unified data management network element sends a third service response message to the session management network element.
  • the third service response message is a response to the third service request message in step 430.
  • the service response message sent by the unified data management network element to the session management network element is recorded as the third service response message, which is uniformly represented by the third service response message below.
  • the unified data management network element finds the subscription information of the terminal device according to the identifier of the terminal device, such as SUPI, and notifies the session management network element of the subscription information through the third service response message. Or, it can also be understood that the unified data management network element returns a third service response message to the session management network element.
  • the third service response message may be a subscription response message or a communication message (Nudm_SDM_Get_response) between the session management network element and the unified data management network element.
  • the contract information of the terminal device may be pre-stored in the unified data management network element.
  • the subscription information may include a user plane security policy (UP security policy), and the user plane security policy may be used to indicate whether integrity protection needs to be activated.
  • UP security policy user plane security policy
  • the user plane security policy may include the user plane security policy included in the subscription information in the prior art, such as required, not needed, and preferred as described above.
  • the third service response message may include the first indication information.
  • the first indication information may be used to indicate that the integrity protection is preferentially selected when the rate conflicts with the integrity protection.
  • the first indication information may be used to indicate when the capability of the access network device does not support the service required capability of the terminal device, or the first indication information may be used to indicate that the access network device cannot comply with the first
  • the access network device preferentially chooses to enable integrity protection.
  • the first indication information may be used to indicate that integrity protection is preferentially selected when the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available.
  • the first indication information may be used to indicate when the capability of the access network device does not support the service required capability of the terminal device, or the first indication information may be used to indicate that the access network device cannot comply with the first
  • the access network device preferentially selects to enable integrity protection, and the access network device transmits at the maximum rate currently available.
  • the unified data management network element may determine whether to send the first indication information according to information such as the service type. For example, for certain services, such as small-capacity voice services, it is of course better to be able to protect integrity. If integrity protection is really not possible, occasional packet loss and tampering will not affect the understanding of the voice content, so for this type of service, you can send The first instruction information.
  • information such as the service type. For example, for certain services, such as small-capacity voice services, it is of course better to be able to protect integrity. If integrity protection is really not possible, occasional packet loss and tampering will not affect the understanding of the voice content, so for this type of service, you can send The first instruction information.
  • the first indication information may also be carried in other messages transmitted between the session management network element and the unified data management network element, or may also be sent through a single signaling.
  • the session management network element determines second indication information according to the subscription information and/or the local policy.
  • the second indication information may be used to indicate that the integrity protection is preferentially selected when the rate conflicts with the integrity protection.
  • the second indication information may be used to indicate that the access network device preferentially selects to enable integrity protection when the access network device cannot execute the user plane security policy at the first rate.
  • the session management network element determines the second indication information, which means that the session management network element indicates to the access network device that if the rate conflicts with the integrity protection, the integrity protection is preferred.
  • the second indication information may be used to indicate that the integrity protection is preferentially selected in the case where the rate conflicts with the integrity protection, and the access network device transmits at the maximum rate currently available.
  • the second indication information can be used to indicate that when the access network device cannot execute the user plane security policy at the first rate, the access network device prefers to enable integrity protection, and the access network device uses the current The maximum transmission rate that can be provided.
  • the session management network element determines the second indication information, which means that the session management network element indicates to the access network device that if the rate conflicts with the integrity protection, the integrity protection is preferred, and the access network is instructed
  • the device transmits at the maximum rate currently available.
  • the second indication information and the first indication information in step 440 may be the same or different, which is not limited. Described below separately.
  • the session management network element obtains the second indication information based on the first indication information obtained from the unified data management network element.
  • the session management network element determines whether to indicate to the access network device whether to instruct the access network device to preferentially select integrity when the rate conflicts with the integrity protection based on the first indication information obtained from the unified data management network element. Protection, or determine whether to indicate to the access network equipment that integrity protection should be preferentially selected when the rate conflicts with integrity protection, and the access network equipment transmits at the maximum rate currently available; or, in other words, the second If the indication information is indicated by the unified data management network element, the session management network element determines whether the second indication information can be indicated to the access network device.
  • the session management network element may generate the second indication information based on the first indication information.
  • the second indication information may include the first indication information or may also be the first indication information, or in other words, the second indication information may be used to indicate that the access network device preferentially turns on when the rate conflicts with integrity protection. Integrity protection, or the second indication information can be used to indicate that in the case of a rate conflict with integrity protection, the access network device preferentially selects to enable integrity protection, and the access network device transmits at the maximum rate currently available.
  • the session management network element may determine whether to indicate the second indication information based on the service type and/or the capability of the access network device. Alternatively, the session management network element may also determine to indicate the second indication information to the access network device directly according to the first indication information.
  • the session management network element may generate a third security policy according to the subscription information of the terminal device obtained from the unified data management network element, and the third security policy may include the user plane security policy in step 440, such as required, not need, or preferred.
  • the session management network element obtains the second indication information according to other information.
  • the session management network element determines whether the second indication information can be indicated to the access network device according to other information of the terminal device; or, in other words, the second indication information is indicated by the session management network element, namely The session management network element judges whether the access network device should preferentially select to enable integrity protection when the rate conflicts with the integrity protection, and if so, the session management network element indicates the second indication information.
  • the session management network element can also generate the second indication information based on one or more comprehensive judgments of other information, such as local policy, obtained slice-related information, supported service types, etc., or in other words, determine the speed and integrity In the case of a sexual protection conflict, whether the access network device should give priority to turning on integrity protection.
  • the security requirements of the service type can be obtained from the contract information; it can also interact with other network elements, such as policy control network elements, application service network elements, and so on.
  • the session management network element may also generate a fourth security policy based on other information, such as one or more comprehensive judgments of local policy, obtained slice related information, supported service types, and other information.
  • the fourth security policy may include, for example, required, not needed, or preferred. Among them, the security requirements of the service type can be obtained from the contract information; it can also interact with other network elements, such as policy control network elements, application service network elements, and so on.
  • the second indication information and the first indication information may be the same or different, which is not limited in this application.
  • FIG. 4 only shows the case where the second indication information is determined, that is, the case where the access network device prefers integrity protection, and the embodiment of the present application is not limited to this.
  • the method 400 may further include the following steps.
  • the session management network element sends a second service response message to the access and mobility management network element.
  • the second service response message is a response to the second service request message in step 420.
  • the service response message sent by the session management network element to the access and mobility management network element is recorded as the second service response message, which is uniformly represented by the second service response message below.
  • the second service response message may be a PDU session creation session management context service response.
  • step 460 can also be understood as that the session management network element returns a PDU session creation session management context service response to the access and mobility management network element.
  • the second service response message sent by the session management network element to the access and mobility management network element carries the second indication information in step 450.
  • the second service response message may include the second indication information.
  • the indication information is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, or the second indication information is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and access The network equipment transmits at the maximum rate currently available.
  • the access and mobility management network element sends information indicating the second indication information to the access network device.
  • the access and mobility management network element forwards the information received from the session management network element to the access network device.
  • the access and mobility management network element sends the second instruction information and the security policy to the access network device, and the security policy is the third security policy or the fourth security policy.
  • the second indication information and the security policy may be carried in the N2 interface message of the access and mobility management network element and the access network device, such as an N2 interface PDU session request (N2PDU session request) message.
  • N2PDU session request N2 interface PDU session request
  • the access network device preferentially implements integrity protection according to the second instruction information.
  • the access network device receives the second indication information, if the rate cannot meet the requirement or in the case that the rate conflicts with the integrity protection, the integrity protection is preferred; or the access network device receives After the second indication information, when the rate cannot meet the requirement or when the rate conflicts with the integrity protection, the integrity protection is selected first, and the service is performed at the maximum rate currently provided by the access network device.
  • the access network device may notify the session management network element that the speed reduction process has been performed and the final speed.
  • the access network device in the case of a conflict between the rate and the integrity protection, can implement integrity protection and transmit at the second rate, that is, the access network device can perform the transmission at the second rate.
  • the second rate may be the maximum rate currently provided by the access network device indicated in the second indication information, or the second rate may also be any rate lower than the maximum rate currently provided by the access network device, or,
  • the second rate may also be a rate indicated by the policy control network element.
  • the access network device may report the second rate to the session management network element. The following will be described in detail with reference to the embodiment shown in FIG. 6.
  • the instruction information when the capacity of the access network device does not meet the service capability requirements, that is, in the case of a conflict between the rate and the integrity protection, the integrity protection is preferred, so that the integrity can be adjusted dynamically according to the service.
  • the instruction information may be the second instruction information that is made by the session management network element to make a decision; or, the instruction information may also be the first instruction information that is made and generated by the unified data management network element.
  • FIG. 5 is a schematic interaction diagram of a method 500 provided by an embodiment of the present application.
  • the method 500 may include the following steps.
  • the terminal device sends a service request message to the access and mobility management network element.
  • the access and mobility management network element receives the service request message from the terminal device.
  • the terminal device initiates a service request message to the access and mobility management network element.
  • the service request message may be used to request the establishment of a connection between the terminal device and the service server of the data network, and the connection with the service server of the data network requested by the service request message may be used to transmit data.
  • the data may be, for example, general data, small data, data corresponding to specific services, etc., which is not limited in this application.
  • the service request message sent by the terminal device to the access and mobility management network element is recorded as the first service request message, which is uniformly represented by the first service request message below.
  • the terminal device may send the first service request message to the access and mobility management network element via the access network device.
  • the first service request message is a service request message or a PDU session establishment request message.
  • the first service request message may carry slices or specific service related information, such as service type, S-NSSAI, etc.
  • the S-NSSAI may indicate the slice information requested by the terminal device.
  • the first service request message may carry DNN to indicate the name of the data network that the terminal device requests to access.
  • the first service request message may include third indication information.
  • the third indication information may be used to indicate that the integrity protection is preferentially selected when the rate conflicts with the integrity protection.
  • the third indication information may be used to indicate that when the capability of the access network device does not support the service requirement capability of the terminal device, the access network device preferentially selects to enable integrity protection.
  • the third indication information may be used to indicate that integrity protection is preferentially selected in the case where the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available.
  • the third indication information can be used to indicate that when the access network device cannot execute the user plane security policy at the first rate, the access network device prefers to turn on integrity protection, and the access network device uses the current The maximum transmission rate that can be provided.
  • the terminal device may determine whether to send the third instruction information according to information such as the type of the service to be transmitted. For example, for certain services, such as small-capacity voice services, it is of course better to be able to protect integrity. If integrity protection is really not possible, occasional packet loss and tampering will not affect the understanding of the voice content, so for this type of service, you can send The third instruction information.
  • the third indication information sent by the terminal device may be session granularity, that is, indication information for different data networks (DNs) or applications.
  • the indication information for different DNs or applications can be pre-configured, such as specified in the protocol; or the terminal device itself can be configured; or it can be obtained from the core network during the registration process, etc., which is not limited.
  • this indication (that is, the third indication information) can be introduced in a user routing selection policy (UE routing selection policy, URSP).
  • UE routing selection policy UE routing selection policy
  • the relationship between the application and the PDU session attribute is defined through the URSP. For certain types of applications, if the rate does not meet the requirements, the session can not be rejected, and the maximum rate that can currently be transmitted is sufficient.
  • the third indication information may also be carried in other messages transmitted between the terminal device and the access and mobility management network element, or may also be sent through a single signaling.
  • the access and mobility management network element sends a second service request message to the session management network element.
  • the service request message sent by the access and mobility management network element to the session management network element is recorded as the second service request message, which is uniformly represented by the second service request message below. It can also be understood that the access and mobility management network element invokes the session creation session management context service provided by the session management network element.
  • step 320 is similar to step 320 in the method 300.
  • step 320 please refer to the above step 320, which will not be repeated here.
  • the second service request message includes third indication information, that is, the third indication information in step 510.
  • the session management network element determines fourth indication information according to the second service request message.
  • the session management network element determines, according to the received second service request message, whether to preferentially select integrity protection when the rate conflicts with integrity protection.
  • the fourth indication information may be used to indicate that the integrity protection is preferentially selected when the rate conflicts with the integrity protection.
  • the fourth indication information may be used to indicate that when the capability of the access network device does not support the service required capability of the terminal device, the access network device preferentially selects to enable integrity protection.
  • the session management network element determines the fourth indication information, which means that the session management network element indicates to the access network device that if the rate conflicts with the integrity protection, the integrity protection is preferentially selected.
  • the fourth indication information may be used to indicate that integrity protection is preferentially selected in the case where the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available.
  • the fourth indication information can be used to indicate that when the capability of the access network device does not support the service required capability of the terminal device, the access network device prefers to enable integrity protection, and the access network device can currently provide The maximum rate of transmission.
  • the session management network element determines the fourth indication information, which means that the session management network element indicates to the access network device that if the rate conflicts with the integrity protection, the integrity protection is preferred, and the access network is instructed The device transmits at the maximum rate currently available.
  • the fourth indication information and the third indication information in step 510 may be the same or different, which is not limited. Described below separately.
  • the session management network element obtains the fourth indication information based on the obtained third indication information.
  • the session management network element determines whether to instruct the access network device to preferentially select integrity protection when the rate conflicts with the integrity protection according to the third indication information obtained from the terminal device, or Determine whether to instruct the access network device to preferentially select integrity protection when the rate conflicts with integrity protection, and the access network device transmits at the maximum rate currently available; or, in other words, the fourth indication information is As indicated by the terminal device, the session management network element determines whether the fourth indication information can be indicated to the access network device.
  • the session management network element may generate fourth indication information based on the third indication information.
  • the fourth indication information may include the third indication information or may also be the third indication information, or in other words, the fourth indication information may be used to indicate that in the case of a rate conflict with integrity protection, the access network device preferentially turns on Integrity protection, or the fourth indication information may be used to indicate that in the case of a rate conflict with integrity protection, the access network device preferentially selects to turn on integrity protection, and the access network device transmits at the maximum rate currently available.
  • the session management network element may determine whether to indicate the fourth indication information based on the service type and/or the capability of the access network device. Alternatively, the session management network element may directly determine to indicate the fourth indication information to the access network device according to the third indication information.
  • the session management network element obtains the fourth indication information according to other information.
  • the session management network element determines whether the fourth indication information can be indicated to the access network device according to other information of the terminal device; or, in other words, the fourth indication information is indicated by the session management network element, namely The session management network element determines whether the access network device should preferentially select to enable integrity protection when the rate conflicts with the integrity protection, and if so, the session management network element indicates the fourth indication information.
  • the session management network element may also generate the fourth indication information based on one or more comprehensive judgments of other information, such as local policy, obtained slice-related information, supported service types, etc., or in other words, determine whether the rate and integrity In the case of a sexual protection conflict, whether the access network device should give priority to turning on integrity protection.
  • the security requirements of the service type can be obtained from the contract information; it can also interact with other network elements, such as policy control network elements, application service network elements, and so on.
  • the fourth indication information and the third indication information may be the same or different, which is not limited in this application.
  • the session management network element may generate a security policy, and the security policy may be required, not needed, or preferred.
  • FIG. 5 only shows the case where the fourth indication information is determined, that is, the case where the access network device prefers integrity protection, and the embodiment of the present application is not limited to this.
  • the method 500 may further include the following steps.
  • the session management network element sends a second service response message to the access and mobility management network element.
  • the second service response message is a response to the second service request message in step 520.
  • the service response message sent by the session management network element to the access and mobility management network element is recorded as the second service response message, which is uniformly represented by the second service response message below.
  • the second service response message may be a PDU session creation session management context service response.
  • step 540 can also be understood as that the session management network element returns a PDU session creation session management context service response to the access and mobility management network element.
  • the second service response message sent by the session management network element to the access and mobility management network element carries the fourth indication information in step 530.
  • the second service response message may include the fourth indication information.
  • the indication information is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, or the fourth indication information is used to indicate that integrity protection is preferred when the rate conflicts with integrity protection, and access The network equipment transmits at the maximum rate currently available.
  • the access and mobility management network element sends information indicating fourth indication information to the access network device.
  • the access and mobility management network element forwards the information received from the session management network element to the access network device. For example, the access and mobility management network element sends the fourth instruction information and the security policy to the access network device, and the security policy is the security policy generated in step 530.
  • the fourth indication information and security policy may be carried in the N2 interface message of the access and mobility management network element and the access network device, such as an N2 interface PDU session request (N2PDU session request) message.
  • N2PDU session request N2 interface PDU session request
  • the access network device prioritizes integrity protection according to the fourth instruction information.
  • the access network device receives the fourth indication information, in the case that the rate cannot meet the requirement or in the case that the rate conflicts with the integrity protection, the integrity protection is preferred; or the access network device receives After the fourth indication information, in the case that the rate cannot meet the requirement or the rate conflicts with the integrity protection, the integrity protection is selected first, and the service is performed at the maximum rate currently provided by the access network device.
  • the access network device may also determine whether to perform speed reduction processing according to its own capabilities.
  • the access network device may notify the session management network element that the speed reduction process has been performed and the final speed.
  • the access network device in the case of a conflict between the rate and the integrity protection, can implement integrity protection and transmit at the second rate, that is, the access network device can perform the transmission at the second rate.
  • the second rate may be the maximum rate currently provided by the access network device indicated in the fourth indication information, or the second rate may also be any rate lower than the maximum rate currently provided by the access network device, or,
  • the second rate may also be a rate indicated by the policy control network element.
  • the access network device may report the second rate to the session management network element. The following will be described in detail with reference to the embodiment shown in FIG. 6.
  • the instruction information when the access network equipment cannot meet the service capability requirements, that is, when the rate conflicts with integrity protection, or in other words, the access network equipment cannot perform at the first rate.
  • integrity protection is preferred, so that the integrity protection strategy can be dynamically adjusted according to the business to match different business scenarios as much as possible.
  • the instruction information may be made and generated by the terminal device.
  • the following describes the transmission rate when the access network device and the terminal device transmit data, that is, the second rate, with reference to FIG. 6.
  • FIG. 6 is a schematic interaction diagram of a method 600 provided by an embodiment of the present application.
  • the method 600 may include the following steps.
  • the terminal device sends a service request message to the access and mobility management network element.
  • the access and mobility management network element receives the service request message from the terminal device.
  • the service request message sent by the terminal device to the access and mobility management network element is recorded as the first service request message, which is uniformly represented by the first service request message below.
  • step 310 in method 300 For this step, reference may be made to step 310 in method 300, step 410 in method 400, or step 510 in method 500, which will not be repeated here.
  • the access and mobility management network element sends a second service request message to the session management network element.
  • the service request message sent by the access and mobility management network element to the session management network element is recorded as the second service request message, which is uniformly represented by the second service request message below.
  • step 320 in the method 300 reference may be made to step 320 in the method 300, step 420 in the method 400, or step 520 in the method 500, which will not be repeated here.
  • the session management network element sends a third service request message to the unified data management network element.
  • the service request message sent by the session management network element to the unified data management network element is recorded as the third service request message, which is uniformly represented by the third service request message below.
  • step 330 in the method 300 or step 430 in the method 400 which will not be repeated here.
  • the unified data management network element sends a third service response message to the session management network element.
  • step 340 in the method 300 or step 440 in the method 400 which will not be repeated here.
  • the session management network element determines whether the access network device should preferentially select integrity protection according to the subscription information and/or the local policy.
  • step 350 the session management network element determines to implement the fourth strategy according to the subscription information and/or the local strategy, which will not be repeated here.
  • this step may refer to step 450 in the above method 400, that is, the session management network element determines the second indication information according to the subscription information and/or the local policy, which will not be repeated here.
  • this step may refer to step 530 in the above method 500, that is, the session management network element determines the fourth indication information according to the second service request message, which will not be repeated here.
  • the policy control network element may determine the second rate, that is, the transmission rate when the access network device implements the integrity protection in the case that the rate conflicts with the integrity protection. For example, the following steps 601 to 603 can be used to determine the second rate.
  • the session management network element sends fifth indication information to the policy control network element.
  • the fifth indication information may be used to indicate that the access network device will perform integrity protection when the rate conflicts with integrity protection.
  • the fifth indication information may be carried in a communication message (Npcf_SMPolicyControl_Create_request) between the session management network element and the policy control network element.
  • the fifth indication information may include the maximum rate that the access network device can currently provide.
  • the policy control network element determines the second rate.
  • the policy control network element determines the final rate according to the fifth instruction information, and the final rate may be the rate of the service data flow.
  • the policy control network element sends sixth indication information to the session management network element.
  • the sixth indication information may be a response to the fifth indication information. It can also be understood that the policy control network element returns the sixth indication information to the session management network element.
  • the sixth indication information may indicate the final rate information in step 602.
  • the sixth indication information may be carried in a communication message (Npcf_SMPolicyControl_Create_response) between the session management network element and the policy control network element.
  • the session management network element may process the final rate indicated by the sixth indication information to obtain a quality of service (QoS) flow (QoS flow).
  • QoS quality of service
  • the session management network element can determine the final QoS flow corresponding to the data transmitted by the terminal device and the access network device.
  • the session management network element sends a second service response message to the access and mobility management network element.
  • step 360 in the method 300
  • step 460 in the method 400 or step 540 in the method 500, which will not be repeated here.
  • the second service response message may also include QoS flow information.
  • the access and mobility management network element sends to the access network device information instructing the access network device to preferentially select integrity protection.
  • step 370 the access and mobility management network element sends the information indicating the fourth strategy to the access network device, which will not be repeated here.
  • this step may refer to step 470 in the above method 400, that is, the access and mobility management network element sends the information indicating the second indication information to the access network device, which will not be repeated here.
  • this step may refer to step 550 in the above method 500, that is, the access and mobility management network element sends the information indicating the fourth indication information to the access network device, which will not be repeated here.
  • the information instructing the access network device to preferentially select integrity protection may also include QoS flow information.
  • the access network device preferentially selects integrity protection information according to the instruction to the access network device, and performs integrity protection first.
  • step 380 the access network device preferentially implements integrity protection according to the fourth policy, which will not be repeated here.
  • this step may refer to step 480 in the above method 400, that is, the access network device preferentially implements integrity protection according to the second instruction information, which will not be repeated here.
  • this step can refer to step 560 in the above method 500, that is, the access network device preferentially implements integrity protection according to the fourth instruction information, which will not be repeated here.
  • the information instructing the access network device to preferentially select integrity protection may also include QoS flow information, and the access network device may determine whether to reduce the speed and the second rate based on the QoS flow information.
  • the second rate is less than or equal to the maximum rate currently provided by the access network device.
  • the access network device may also determine whether it needs to perform speed reduction processing according to its own capabilities.
  • the access network device may notify the session management network element that the speed reduction process has been performed and the final speed.
  • the access network device can also determine the final transmission rate (that is, the second rate) according to the instruction of the policy control network element.
  • FIG. 7 is a schematic interaction diagram of a method 700 provided by an embodiment of the present application.
  • the method 700 may include the following steps.
  • the terminal device sends a service request message to the access and mobility management network element.
  • the access and mobility management network element receives the service request message from the terminal device.
  • the service request message sent by the terminal device to the access and mobility management network element is recorded as the first service request message, which is uniformly represented by the first service request message below.
  • step 310 in the above method 300 or step 410 in the method 400, which will not be repeated here.
  • the access and mobility management network element sends a second service request message to the session management network element.
  • the service request message sent by the access and mobility management network element to the session management network element is recorded as the second service request message, which is uniformly represented by the second service request message below.
  • step 320 in the method 300 or step 420 in the method 400 which will not be repeated here.
  • the session management network element Based on the second service request message, the session management network element performs processing.
  • the session management network element may determine a security algorithm based on the second service request message; another example, the session management network element generates an encryption key and an integrity protection key based on the second service request message; another example, the session management network Based on the second service request message, the element generates a security policy, and so on.
  • This step can be implemented according to existing standards, which are not limited in the embodiment of the present application.
  • the session management network element sends a second service response message to the access and mobility management network element.
  • the second service response message is a response to the second service request message in step 720.
  • the service response message sent by the session management network element to the access and mobility management network element is recorded as the second service response message, which is uniformly represented by the second service response message below.
  • the second service response message may be a PDU session creation session management context service response.
  • step 740 can also be understood as that the session management network element returns a PDU session creation session management context service response to the access and mobility management network element.
  • the second service response message sent by the session management network element to the access and mobility management network element may carry the information determined by the session management network element in step 730, such as a security policy and/or a security algorithm.
  • the access and mobility management network element sends a request message to the access network device.
  • the access and mobility management network element forwards the information received from the session management network element to the access network device.
  • the request message may be an N2 interface message between the access and mobility management network element and the access network device, such as an N2 interface PDU session request (N2PDU session request) message.
  • N2PDU session request N2PDU session request
  • the access network device in the case where the rate conflicts with the integrity protection, can decide by itself whether to preferentially select the integrity protection.
  • the method 700 may also include the following steps.
  • the access network device determines whether speed reduction processing can be performed.
  • the access network device finds that the rate cannot meet the requirement or that the rate conflicts with integrity protection, then the access network device can determine whether speed reduction can be performed to implement integrity protection.
  • the access network device can determine whether it can perform speed reduction processing based on its own capabilities.
  • a possible implementation method When the access network device determines that the rate conflicts with the integrity protection, the integrity protection is preferred, and the speed reduction process is performed by itself, and the access network device can notify the session management network element to reduce the speed process result.
  • the access network device when the access network device determines that the rate conflicts with the integrity protection, it preferentially selects the integrity protection, and requests the session management network element whether the speed can be reduced. In other words, the access network device will perform the speed reduction process after obtaining the approval of the session management network element.
  • the method 700 may further include step 770 and step 780.
  • the access network device sends a message requesting speed reduction to the session management network element.
  • the speed reduction request message is used to request the session management network element, whether the access network device can perform speed reduction processing.
  • the message requesting the speed reduction can be implemented by the forwarding of the access and mobility management network element. That is, the access network device sends the message requesting speed reduction to the access and mobility management network element, and the access and mobility management network element forwards the message requesting speed reduction to the session management network element.
  • the session management network element sends a message indicating speed reduction to the access network device.
  • the message indicating the speed reduction can be implemented by the forwarding of the access and mobility management network element. That is, the session management network element sends the message indicating the speed reduction to the access and mobility management network element, and the access and mobility management network element forwards the message indicating the speed reduction to the access network device.
  • the message indicating the speed reduction is used to indicate that the access network device can or cannot perform speed reduction processing.
  • the access network device can implement integrity protection and perform speed reduction processing.
  • the access network device when the message indicating speed reduction is used to indicate that the access network device cannot perform speed reduction processing, the access network device will not implement integrity protection, and will not perform speed reduction processing.
  • the access network device may transmit data with the terminal device at the second rate after the speed reduction processing.
  • the second rate may be the second rate obtained by the method 600, or may be determined by the access network device itself, or may be determined by the access network device itself and approved by the session management network element.
  • the second rate may be less than or equal to the maximum rate currently provided by the access network device.
  • the access network device may report the second rate to the session management network element.
  • integrity protection can be preferentially selected by self-determination, and the session management network element can be notified, so that the integrity protection strategy can be dynamically adjusted according to the business to match different business scenarios as much as possible.
  • the size of the sequence number of each process does not mean the order of execution.
  • the execution order of each process should be determined by its function and internal logic, and should not be implemented in the embodiments of this application.
  • the process constitutes any limitation.
  • the methods and operations implemented by the terminal side can also be implemented by components (such as chips or circuits) that can be used for terminal-side devices
  • the methods and operations implemented by the network side can also be implemented It is implemented by components (such as chips or circuits) that can be used in network side devices.
  • each network element such as a transmitting end device or a receiving end device, includes hardware structures and/or software modules corresponding to each function in order to realize the above functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function
  • FIG. 8 is a schematic block diagram of a secure conversation apparatus 800 provided by an embodiment of the present application.
  • the communication device 800 may include: a transceiver unit 810 and a processing unit 820.
  • the secure session device 800 may be the access network device in the above method embodiment, or may be a chip for implementing the function of the access network device in the above method embodiment.
  • the transceiver unit 810 is configured to: receive a session request message sent by a session management network element, the session request message carries the user plane security policy of the terminal device and the first rate information; the processing unit 820 is configured to: When the secure conversation device 800 cannot execute the user plane security policy at the first rate, the integrity protection is activated at the second rate, where the second rate is lower than the first rate.
  • the second rate is less than or equal to the maximum transmission rate currently supported by the secure session device 800.
  • the processing unit 820 is specifically configured to: based on the user plane security policy, activate the integrity protection at the second rate.
  • the user plane security policy is determined by the session management network element or the unified data management network element.
  • the session request message includes indication information; the processing unit 820 is specifically configured to: based on the indication information, activate integrity protection at the second rate.
  • the processing unit 820 is specifically configured to: in a case where it is determined that the session meets a preset condition, activate the integrity protection at the second rate.
  • the transceiver unit 810 is further configured to receive rate information from the policy control network element, where the rate information is used to indicate the second rate.
  • the transceiving unit 810 is further configured to send information of the second rate to the session management network element.
  • the secure conversation apparatus 800 may correspond to the access network equipment in the methods 200 to 700 according to the embodiments of the present application, and the secure conversation apparatus 800 may include methods for executing the methods 200 to 7 in FIG. 2 Unit of the method executed by the access network device in 700.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure session device 800 may be the session management network element in the above method embodiment, or a chip for implementing the function of the session management network element in the above method embodiment.
  • the processing unit 820 is configured to determine a user plane security policy of the terminal device, and the user plane security policy is used to indicate: when the access network device cannot execute the user plane security policy at the first rate, The access network device activates integrity protection at a second rate, where the second rate is lower than the first rate; the transceiver unit 810 is configured to send a user plane security policy to the access network device.
  • the transceiving unit 810 is further configured to: obtain subscription information of the terminal device; the processing unit 820 is specifically configured to determine the user plane security policy of the terminal device based on the subscription information of the terminal device.
  • the processing unit 820 is specifically configured to determine the user plane security policy of the terminal device according to the session request message of the terminal device.
  • the processing unit 820 is further configured to: receive rate information provided by the policy control network element; the transceiving unit 810 is further configured to: send information indicating the second rate to the access network device based on the rate information.
  • the transceiver unit 810 is further configured to: receive the second rate information sent by the access network device.
  • the transceiver unit 810 is configured to: receive a session creation session management context service request initiated by an access and mobility management network element; the transceiver unit 810 is also configured to: create a session management context service request based on the session, and send The access and mobility management network element returns a session creation session management context service response.
  • the session creation session management context service response includes indication information, which is used to indicate that the access network device cannot execute the user plane security policy at the first rate Next, the access network device activates integrity protection at a second rate, where the second rate is lower than the first rate.
  • the session creation session management context service request includes notification information, and the notification information is used to notify that the access network device activates integrity at the second rate when the access network device cannot execute the user plane security policy at the first rate. Protection;
  • the transceiver unit 810 is specifically configured to: determine the indication information based on the notification information.
  • the session creation session management context service request includes information of the service type of the terminal device; the processing unit 820 is configured to determine the indication information based on the information of the service type.
  • the transceiver unit 810 is further configured to: receive rate information provided by the policy control network element; the processing unit 820 is further configured to: based on the rate information, determine that the access network device cannot execute the user plane security policy at the first rate Next, the access network device activates integrity protection at the second rate.
  • the transceiver unit 810 is further configured to: receive the second rate information sent by the access network device.
  • the secure session device 800 may correspond to the session management network element in the methods 200 to 700 according to the embodiments of the present application, and the secure session device 800 may include methods for executing the methods 200 to 7 in FIG. 2 Unit of the method performed by the session management network element in 700.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure conversation device 800 may be the UE in the above method embodiment, or may be a chip for implementing the function of the UE in the above method embodiment.
  • the processing unit 820 is configured to: determine indication information, and the indication information is used to indicate: in the case that the access network device cannot execute the user plane security policy at the first rate, the access network device performs the second rate Integrity protection is activated, where the second rate is lower than the first rate; the transceiver unit 810 is configured to send indication information to the access and mobility management network element.
  • the secure session device 800 may correspond to the UE in the methods 200 to 700 according to the embodiments of the present application, and the secure session device 800 may include methods for executing the method 200 in FIG. 2 to the method 700 in FIG. Unit of the method performed by the UE.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG. The corresponding process of the method 600 in FIG. 6 or the method 700 in FIG. 7.
  • the secure conversation device 800 may be the access and mobility management network element in the above method embodiment, or it may be used to implement the access and mobility management network element in the above method embodiment.
  • the function of the chip may be the access and mobility management network element in the above method embodiment, or it may be used to implement the access and mobility management network element in the above method embodiment. The function of the chip.
  • the secure session device 800 may correspond to the access and mobility management network elements in the methods 200 to 700 according to the embodiments of the present application, and the secure session device 800 may include methods for executing the methods 200 to 7 in FIG. 2
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure conversation device 800 may be the unified data management network element in the above method embodiment, or a chip for implementing the function of the unified data management network element in the above method embodiment. .
  • the secure conversation device 800 may correspond to the unified data management network element in the methods 200 to 700 according to the embodiments of the present application, and the secure conversation device 800 may include methods for executing methods 200 to 7 in FIG. 2 The unit of the method executed by the unified data management network element in the method 700.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG. The corresponding process of the method 600 in FIG. 6 or the method 700 in FIG. 7.
  • the secure conversation device 800 may be the policy control network element in the above method embodiment, or a chip for implementing the function of the policy control network element in the above method embodiment.
  • the secure conversation device 800 may correspond to the policy control network element in the method 600 according to the embodiment of the present application, and the secure conversation device 800 may include a network element for executing the policy control network element in the method 600 in FIG. Method unit.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the corresponding process of the method 600 in FIG. 6.
  • transceiving unit in the secure conversation device 800 may correspond to the transceiver 910 in the secure conversation device 900 shown in FIG. 9, and the processing unit 820 in the secure conversation device 800 may correspond to that shown in FIG. 9 The transceiver 920 in the secure conversation device 900.
  • the secure conversation device 800 when the secure conversation device 800 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor, microprocessor, or integrated circuit integrated on the chip.
  • FIG. 9 is a schematic block diagram of a secure conversation device 900 according to an embodiment of the present application.
  • the secure conversation device 900 includes a processor 910 and a transceiver 920.
  • the processor 910 is coupled with the memory, and is configured to execute instructions stored in the memory to control the transceiver 920 to send signals and/or receive signals.
  • the secure conversation device 900 further includes a memory 930 for storing instructions.
  • processor 910 and the memory 930 may be combined into one processing device, and the processor 910 is configured to execute the program code stored in the memory 930 to implement the foregoing functions.
  • the memory 930 may also be integrated in the processor 910 or independent of the processor 910.
  • the transceiver 920 may include a receiver (or called a receiver) and a transmitter (or called a transmitter).
  • the transceiver may further include an antenna, and the number of antennas may be one or more.
  • the secure conversation device 900 may be the access network device in the above method embodiment, or may be a chip for implementing the function of the access network device in the above method embodiment.
  • the secure conversation device 900 may correspond to the access network equipment in the methods 200 to 700 according to the embodiments of the present application, and the secure conversation device 900 may include methods for executing the methods 200 to 7 in FIG. 2 Unit of the method executed by the access network device in 700.
  • each unit in the secure conversation device 900 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure session device 900 may be the session management network element in the above method embodiment, or may be a chip for realizing the function of the session management network element in the above method embodiment. It should be understood that the specific process for each unit to execute the foregoing corresponding steps has been described in detail in the foregoing method embodiment, and is not repeated here for brevity.
  • the secure session device 900 may be the session management network element in the above method embodiment, or may be a chip for realizing the function of the session management network element in the above method embodiment.
  • the secure session device 900 may correspond to the session management network element in the methods 200 to 700 according to the embodiments of the present application, and the secure session device 900 may include methods for executing the methods 200 to 7 in FIG. 2 Unit of the method performed by the session management network element in 700.
  • each unit in the secure conversation device 800 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure conversation device 900 may be the access and mobility management network element in the above method embodiment, or it may be used to implement the access and mobility management network element in the above method embodiment.
  • the function of the chip may be the access and mobility management network element in the above method embodiment, or it may be used to implement the access and mobility management network element in the above method embodiment. The function of the chip.
  • the secure conversation device 900 may correspond to the access and mobility management network elements in the methods 200 to 700 according to the embodiments of the present application, and the secure conversation device 900 may include methods for executing the methods 200 to 7 in FIG. 2
  • each unit in the secure conversation device 900 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure conversation device 900 may be the UE in the above method embodiment, or may be a chip for implementing the function of the UE in the above method embodiment.
  • the secure conversation device 900 may correspond to the UE in the methods 200 to 700 according to the embodiments of the present application, and the secure conversation device 900 may include methods for executing the method 200 in FIG. 2 to the method 700 in FIG. Unit of the method performed by the UE.
  • each unit in the secure conversation device 900 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG.
  • the secure conversation device 900 may be the unified data management network element in the above method embodiment, or a chip for implementing the function of the unified data management network element in the above method embodiment. .
  • the secure session device 900 may correspond to the unified data management network element in the methods 200 to 700 according to the embodiments of the present application, and the secure session device 900 may include methods for executing methods 200 to 7 in FIG. 2 The unit of the method executed by the unified data management network element in the method 700.
  • each unit in the secure conversation device 900 and other operations and/or functions described above are used to implement the method 200 in FIG. 2, the method 300 in FIG. 3, the method 400 in FIG. 4, the method 500 in FIG. The corresponding process of the method 600 in FIG. 6 or the method 700 in FIG. 7.
  • the secure conversation device 900 may be the policy control network element in the above method embodiment, or a chip for implementing the function of the policy control network element in the above method embodiment.
  • the secure conversation device 900 may correspond to the policy control network element in the method 600 according to the embodiment of the present application, and the secure conversation device 900 may include a network element for executing the policy control network element in the method 600 in FIG. Method unit.
  • each unit in the secure conversation device 900 and other operations and/or functions described above are used to implement the corresponding process of the method 600 in FIG. 6.
  • the chip When the secure conversation device 900 is a chip, the chip includes a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit or a communication interface;
  • the processing unit may be a processor or microprocessor or integrated circuit integrated on the chip.
  • the embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the method in the foregoing method embodiment.
  • the processing device may be a chip.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a system on chip (SoC), or It is a central processor unit (CPU), it can also be a network processor (NP), it can also be a digital signal processing circuit (digital signal processor, DSP), or it can be a microcontroller (microcontroller unit). , MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processing circuit
  • microcontroller unit microcontroller unit
  • MCU programmable logic device
  • PLD programmable logic device
  • the steps of the above method can be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor in the embodiment of the present application may be an integrated circuit chip with signal processing capability.
  • the steps of the foregoing method embodiments can be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electronic Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computer program product.
  • the computer program product includes: computer program code, which when the computer program code runs on a computer, causes the computer to execute the steps shown in FIGS. 2 to 7 The method of any one of the embodiments is shown.
  • the present application also provides a computer-readable medium that stores program code, and when the program code runs on a computer, the computer executes the steps shown in FIGS. 2 to 7 The method of any one of the embodiments is shown.
  • the present application also provides a system, which includes the aforementioned session management network element, access network equipment, and UE.
  • the present application also provides a system, which includes the aforementioned session management network element, access and mobility management network element, access network equipment, unified data management network element, and UE.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • the network-side equipment in the above-mentioned device embodiments corresponds to the terminal equipment and the network-side equipment or terminal equipment in the method embodiments, and the corresponding modules or units execute the corresponding steps.
  • the communication unit transmits the reception in the method embodiments.
  • the sending step other steps except sending and receiving can be executed by the processing unit (processor).
  • the processing unit processor
  • component used in this specification are used to denote computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution.
  • the component may be, but is not limited to, a process, a processor, an object, an executable file, an execution thread, a program, and/or a computer running on a processor.
  • the application running on the computing device and the computing device can be components.
  • One or more components may reside in processes and/or threads of execution, and components may be located on one computer and/or distributed between two or more computers.
  • these components can be executed from various computer readable media having various data structures stored thereon.
  • the component may be based on, for example, a signal having one or more data packets (such as data from two components interacting with another component in a local system, a distributed system, and/or a network, such as the Internet that interacts with other systems through signals) Communicate through local and/or remote processes.
  • a signal having one or more data packets (such as data from two components interacting with another component in a local system, a distributed system, and/or a network, such as the Internet that interacts with other systems through signals) Communicate through local and/or remote processes.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种安全会话方法和装置，以期能够考虑更多的应用场景，满足不同的业务需求，提高用户体验。该方法可以包括：接入网设备接收会话管理网元发送的会话请求消息，该会话请求消息携带终端设备的用户面安全策略以及第一速率的信息；在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备可以基于会话请求消息中的用户面安全策略或者指示信息，按照第二速率激活完整性保护，其中，第二速率低于第一速率。

Description

安全会话方法和装置
本申请要求于2019年05月23日提交中国专利局、申请号为201910432802.2、申请名称为“安全会话方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及无线通信领域，并且更具体地，涉及安全会话方法和装置。
背景技术
移动通信的安全问题正越来越多地受到关注。在第五代(5th Generation，5G)通信系统中，增加了终端设备和接入网设备(如基站)之间的用户面完整性保护，以此来防止终端设备的数据在传输至接入网设备之前被篡改或丢失等。
考虑到完整性保护对网络性能消耗较大，可以根据业务特性决策确定是否进行完整性保护。通常，对精确性要求较高的业务的数据，终端设备和接入网设备之间需要进行完整性保护；对精确性要求较低的业务的数据，终端设备和接入网设备之间可以不进行完整性保护。
这种方式太过局限，不能很好地满足不同的业务需求。
发明内容
本申请提供一种安全会话方法和装置，以期能够考虑更多的应用场景，满足不同的业务需求，提高用户体验。
第一方面，提供了一种安全会话方法。该方法可以由接入网设备执行，或者，也可以由配置于接入网设备中的芯片或电路执行，本申请对此不作限定。
该方法可以包括：接入网设备接收会话管理网元发送的会话请求消息，所述会话请求消息携带终端设备的用户面安全策略以及第一速率的信息；在所述接入网设备无法按照所述第一速率执行所述用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
基于上述技术方案，在接入网设备无法按照第一速率执行用户面安全策略的情况下，换句话说，在接入网设备的能力无法对会话进行完整性保护且按照会话要求的速率(例如记作第一速率)进行服务的情况下，换句话说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备可以按照低于第一速率的速率(例如记作第二速率)激活完整性保护，进而通过考虑到各种业务的应用场景，提出又一种方案，进而可以提供又一种选择，便于尽可能地满足不同业务的需求，匹配更多的应用场景，提高用户体验。
另外，需要指出的是，所述接入网设备无法按照第一速率执行用户面安全策略包括：所述接入网设备无法同时既开启完整性保护又按照第一速率进行数据传输。那么在这种情 况下，就可以优先开启完整性保护；然后在能力范围内，按照第二速率进行数据传输，其中所述第二速率低于所述第一速率。
相反地，如果仅是规定：对某些业务必须进行完整性保护，或者，对某些业务不进行完整性保护，或者，当完整性保护与业务速率冲突的情况下舍弃完整性保护，这种方式太过绝对，对于某些业务来说，能够实行完整性保护当然更好，但是如果实在无法完整性保护，偶尔的丢包篡改也不影响业务的传输，那么针对于该业务，现有的规定会影响用户体验，降低传输性能。
可选地，所述接入网设备按照第二速率激活完整性保护，可以表示，所述接入网设备按照低于第一速率的任一速率激活完整性保护；或者，也可以表示为，所述接入网设备激活完整性保护并降低速率；或者，也可以表示，所述接入网设备按照某一确定的速率激活完整性保护。
结合第一方面，在第一方面的某些实现方式中，所述第二速率小于或等于所述接入网设备当前能够支持的最大传输速率。
基于上述技术方案，在接入网设备无法按照第一速率执行用户面安全策略的情况下，可以坚持完整性保护，并降低传输速率，例如以第二速率来与终端设备传输业务数据，该第二速率小于会话要求的速率(例如记作第一速率)，或者，该第二速率可以是接入网设备当前能够支持的最大传输速率，或者，该第二速率也可以小于接入网设备当前能够支持的最大传输速率。
结合第一方面，在第一方面的某些实现方式中，所述接入网设按照第二速率激活完整性保护，包括：基于所述用户面安全策略，所述接入网设备按照所述第二速率激活完整性保护。
基于上述技术方案，接入网设备可以根据终端设备的用户面安全策略，在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护。
可选地，所述终端设备的用户面安全策略用于指示：在所述接入网设备无法按照所述第一速率执行所述用户面安全策略的情况下，所述接入网设备按照所述第二速率激活完整性保护。
可选地，可以对现有的安全策略进行完善，增加完整性保护与业务速率冲突的时候开启完整性保护的方式。下文实施例具体描述。
结合第一方面，在第一方面的某些实现方式中，所述终端设备的用户面安全策略是所述会话管理网元或统一数据管理网元确定的。
基于上述技术方案，终端设备的用户面策略可以是会话管理网元确定的，也可以是统一数据管理网元确定的，对此不做限定。
结合第一方面，在第一方面的某些实现方式中，所述会话请求消息还包括指示信息；所述接入网设备按照第二速率激活完整性保护，包括：基于所述指示信息，所述接入网设备按照所述第二速率激活完整性保护。
基于上述技术方案，接入网设备可以根据指示信息，在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护。
可选地，所述接入网设备接收来自以下任意一项设备的指示信息：所述会话管理网元、统一数据管理网元、或所述终端设备，其中，所述指示信息用于指示：在接入网设备无法 按照所述第一速率执行用户面安全策略的情况下，所述接入网设备按照所述第二速率激活完整性保护。
基于上述技术方案，该指示信息可以是由会话管理网元、统一数据管理网元、或所述终端设备中的任意一个设备指示的。
结合第一方面，在第一方面的某些实现方式中，所述接入网设备按照第二速率激活完整性保护，包括：在确定所述会话满足预设条件的情况下，所述接入网设备按照所述第二速率激活完整性保护。
基于上述技术方案，接入网设备可以自行判断是否要在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护。例如，可以根据会话类型或业务类型等，判断是否要在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护。
结合第一方面，在第一方面的某些实现方式中，所述安全会话方法还包括：所述接入网设备接收来自策略控制网元的速率信息，所述速率信息用于指示所述第二速率。
基于上述技术方案，接入网设备可以基于策略控制网元的速率信息，确定与终端设备传输业务数据时的传输速率。
结合第一方面，在第一方面的某些实现方式中，所述安全会话方法还包括：所述接入网设备向会话管理网元发送所述第二速率的信息。
第二方面，提供了一种安全会话方法。该方法可以由会话管理网元执行，或者，也可以由配置于会话管理网元中的芯片或电路执行，本申请对此不作限定。
该方法可以包括：会话管理网元确定终端设备的用户面安全策略，所述用户面安全策略用于指示：在接入网设备无法按照第一速率执行所述用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率；所述会话管理网元向所述接入网设备发送所述用户面安全策略。
基于上述技术方案，会话管理网络可以确定终端设备的用户面安全策略，该用户面安全策略可以用于指示，在接入网设备无法按照第一速率执行用户面安全策略的情况下，换句话说，在接入网设备的能力无法对会话进行完整性保护且按照会话要求的速率进行服务的情况下，换句话说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备可以按照低于第一速率的速率(例如记作第二速率)激活完整性保护，进而通过考虑到各种业务的应用场景，提出又一种方案，进而可以提供又一种选择，便于尽可能地满足不同业务的需求，匹配更多的应用场景，提高用户体验。
相反地，如果安全策略仅是：对某些业务必须进行完整性保护，或者，对某些业务不进行完整性保护，或者，当完整性保护与业务速率冲突的情况下舍弃完整性保护，这种方式太过绝对，对于某些业务来说，能够实行完整性保护当然更好，但是如果实在无法完整性保护，偶尔的丢包篡改也不影响业务的传输，那么针对于该业务，现有的规定会影响用户体验，降低传输性能。
结合第二方面，在第二方面的某些实现方式中，所述会话管理网元获取所述终端设备的签约信息；所述会话管理网元确定终端设备的用户面安全策略，包括：所述会话管理网元基于所述终端设备的签约信息，确定所述终端设备的用户面安全策略。
基于上述技术方案，会话管理网元可以基于终端设备的签约信息，确定终端设备的用 户面安全策略，或者，基于终端设备的签约信息，确定接入网设备是否要在无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护，从而可以动态地调整完整性保护策略，进而匹配更多的应用场景。
结合第二方面，在第二方面的某些实现方式中，所述会话管理网元确定所述终端设备的用户面安全策略，包括：所述会话管理网元根据所述终端设备的会话请求消息，确定所述终端设备的用户面安全策略。
基于上述技术方案，会话管理网元可以基于终端设备的会话请求消息，确定终端设备的用户面安全策略，或者，基于终端设备的会话请求消息，确定接入网设备是否要在无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护，从而可以根据会话请求消息动态地调整完整性保护策略，进而尽可能地提高数据传输性能，提高用户体验。
结合第二方面，在第二方面的某些实现方式中，所述安全会话方法还包括：所述会话管理网元接收所述策略控制网元提供的速率信息；基于所述速率信息，所述会话管理网元向所述接入网设备发送用于指示所述第二速率的信息。
结合第二方面，在第二方面的某些实现方式中，所述安全会话方法还包括：所述会话管理网元接收所述接入网设备发送的所述第二速率的信息。
第三方面，提供了一种安全会话方法。该方法可以由会话管理网元执行，或者，也可以由配置于会话管理网元中的芯片或电路执行，本申请对此不作限定。
该方法可以包括：会话管理网元接收接入和移动管理网元发起的会话创建会话管理上下文服务请求；基于所述会话创建会话管理上下文服务请求，所述会话管理网元向所述AMF返回会话创建会话管理上下文服务响应，所述会话创建会话管理上下文服务响应包括指示信息，所述指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
基于上述技术方案，会话管理网元可以根据调用接入和移动管理网元提供的会话创建会话管理上下文服务请求，确定是否要指示接入网设备，在接入网设备无法按照第一速率执行用户面安全策略的情况下，换句话说，在接入网设备的能力无法对会话进行完整性保护且按照会话要求的速率进行服务的情况下，换句话说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备可以按照低于第一速率的速率(例如记作第二速率)激活完整性保护，进而通过考虑到各种业务的应用场景，提出又一种方案，进而可以提供又一种选择，便于尽可能地满足不同业务的需求，匹配更多的应用场景，提高用户体验。
可选地，会话管理网元接收所述接入和移动管理网元发起的会话创建会话管理上下文服务请求，包括：会话管理网元接收所述接入和移动管理网元发起的分组数据单元(packet data unit，PDU)会话创建会话管理上下文服务请求。
可选地，所述会话管理网元向所述接入和移动管理网元返回会话创建会话管理上下文服务响应，包括：所述会话管理网元向所述接入和移动管理网元返回PDU会话创建会话管理上下文服务响应。
结合第三方面，在第三方面的某些实现方式中，所述会话创建会话管理上下文服务请求包括通知信息，所述通知信息用于通知在所述接入网设备无法按照所述第一速率执行用 户面安全策略的情况下，所述接入网设备按照所述第二速率激活完整性保护；所述方法还包括：基于所述通知信息，所述会话管理网元确定所述指示信息。
基于上述技术方案，终端设备可以自行确定接入网设备是否要在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护，从而可以更好地满足用户体验。当终端设备确定接入网设备要在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护的情况下，可以通知给会话管理网元，进而会话管理网元通知接入网设备。
结合第三方面，在第三方面的某些实现方式中，所述会话创建会话管理上下文服务请求包括所述终端设备的业务类型的信息；所述安全会话方法还包括：基于所述业务类型的信息，所述会话管理网元确定所述指示信息。
基于上述技术方案，会话管理网元可以根据业务类型确定接入网设备是否要在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护，从而可以满足不同业务的需求。
结合第三方面，在第三方面的某些实现方式中，所述安全会话方法还包括：所述会话管理网元接收策略控制网元提供的速率信息；基于所述速率信息，所述会话管理网元确定所述第二速率。
结合第三方面，在第三方面的某些实现方式中，所述安全会话方法还包括：所述会话管理网元接收所述接入网设备发送的所述第二速率的信息。
第四方面，提供了一种安全会话方法。该方法可以由终端设备执行，或者，也可以由配置于终端设备中的芯片或电路执行，本申请对此不作限定。
该方法可以包括：终端设备确定指示信息，所述指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率；所述终端设备向接入和移动管理网元发送所述指示信息。
基于上述技术方案，终端设备可以自行确定接入网设备是否要在接入网设备无法按照第一速率执行用户面安全策略的情况下，换句话说，确定接入网设备是否要在接入网设备的能力无法对会话进行完整性保护且按照会话要求的速率进行服务的情况下，换句话说，确定接入网设备是否要在接入网设备无法按照第一速率激活完整性保护的情况下，按照低于第一速率的速率(例如记作第二速率)激活完整性保护，从而可以更好地满足用户体验。当终端设备确定接入网设备要在接入网设备无法按照第一速率激活完整性保护的情况下，按照第二速率激活完整性保护，可以通知给会话管理网元，进而便于会话管理网元通知接入网设备。
第五方面，提供了一种安全会话装置，包括用于执行上述第一至第四方面中任一种可能实现方式中的方法的各个模块或单元。
第六方面，提供了一种安全会话设备，包括处理器。该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一至第四方面中任一种可能实现方式中的方法。可选地，该安全会话设备还包括存储器。可选地，该安全会话设备还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该安全会话设备为通信设备，如本申请实施例中的终端设备、会 话管理网元或接入网设备。当该安全会话设备为通信设备时，所述通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该安全会话设备为配置于通信设备中的芯片，如配置于如本申请实施例中的终端设备、会话管理网元或接入网设备中的芯片。当该安全会话设备为配置于通信设备中的芯片时，所述通信接口可以是输入/输出接口。
可选地，所述收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
第七方面，提供了一种处理器，包括：输入电路、输出电路和处理电路。所述处理电路用于通过所述输入电路接收信号，并通过所述输出电路发射信号，使得所述处理器执行上述第一至第四方面任一种可能实现方式中的方法。
在具体实现过程中，上述处理器可以为芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是由例如但不限于接收器接收并输入的，输出电路所输出的信号可以是例如但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第八方面，提供了一种处理装置，包括处理器和存储器。该处理器用于读取存储器中存储的指令，并可通过接收器接收信号，通过发射器发射信号，以执行上述第一至第四方面任一种可能实现方式中的方法。
可选地，所述处理器为一个或多个，所述存储器为一个或多个。
可选地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
在具体实现过程中，存储器可以为非瞬时性(non-transitory)存储器，例如只读存储器(read only memory，ROM)，其可以与处理器集成在同一块芯片上，也可以分别设置在不同的芯片上，本申请实施例对存储器的类型以及存储器与处理器的设置方式不做限定。
应理解，相关的数据交互过程例如发送指示信息可以为从处理器输出指示信息的过程，接收能力信息可以为处理器接收输入能力信息的过程。具体地，处理输出的数据可以输出给发射器，处理器接收的输入数据可以来自接收器。其中，发射器和接收器可以统称为收发器。
上述第八方面中的处理装置可以是一个芯片，该处理器可以通过硬件来实现也可以通过软件来实现，当通过硬件实现时，该处理器可以是逻辑电路、集成电路等；当通过软件来实现时，该处理器可以是一个通用处理器，通过读取存储器中存储的软件代码来实现，该存储器可以集成在处理器中，可以位于该处理器之外，独立存在。
第九方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得安全会话装置执行上述第一至第四方面中任一种可能实现方式中的方法。
第十方面，提供了一种计算机可读介质，所述计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在安全会话装置上运行时，使得安全会话装置执行上述第一 至第四方面中任一种可能实现方式中的方法。
第十一方面，提供了一种系统，包括前述的终端设备、会话管理网元、以及接入网设备。
附图说明
图1是适用于本申请实施例提供的方法的网络架构的示意图；
图2是根据本申请实施例提供的安全会话方法的示意图；
图3是本申请另一实施例提供的安全会话方法的示意性流程图；
图4是本申请又一实施例提供的安全会话方法的示意性流程图；
图5是本申请再一实施例提供的安全会话方法的示意性流程图；
图6是本申请又一实施例提供的安全会话方法的示意性流程图；
图7是本申请再一实施例提供的安全会话方法的示意性流程图；
图8是本申请实施例提供的安全会话装置的示意性框图；
图9是本申请实施例提供的安全会话设备的示意性框图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通讯(Global System of Mobile communication，GSM)系统、码分多址(Code Division Multiple Access，CDMA)系统、宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统、通用分组无线业务(General Packet Radio Service，GPRS)、长期演进(Long Term Evolution，LTE)系统、LTE频分双工(Frequency Division Duplex，FDD)系统、LTE时分双工(Time Division Duplex，TDD)、通用移动通信系统(Universal Mobile Telecommunication System，UMTS)、全球互联微波接入(Worldwide Interoperability for Microwave Access，WiMAX)通信系统、第五代(5th Generation，5G)系统或新无线(New Radio，NR)、或未来的通信系统等。
应理解，本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是终端或网络侧设备，或者，是UE或网络侧设备中能够调用程序并执行程序的功能模块。
为便于理解本申请实施例，首先结合图1详细说明本申请实施例的一个应用场景。
图1是适用于本申请实施例提供的方法的网络架构的示意图。如图所示，该网络架构例如可以是非漫游(non-roaming)架构。该网络架构具体可以包括下列网元：
1、用户设备(user equipment，UE)：可以称终端设备、终端、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、无线通信设备、用户代理或用户装置。终端设备还可以是蜂窝电话、无绳电话、会话启动协议(Session Initiation Protocol，SIP)电话、无线本地环路(Wireless Local Loop，WLL)站、个人数字处理(Personal Digital Assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，未来5G网络中的终端 设备或者未来演进的公用陆地移动通信网络(Public Land Mobile Network，PLMN)中的终端设备等，本申请实施例对此并不限定。
2、接入网(access network，AN)：为预设区域的授权用户提供入网功能，并能够根据用户的级别，业务的需求等使用不同质量的传输隧道。接入网络可以为采用不同接入技术的接入网络。目前的无线接入技术有两种类型：第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)接入技术(例如3G、4G、5G或6G系统中采用的无线接入技术)和非第三代合作伙伴计划(non-3GPP)接入技术。3GPP接入技术是指符合3GPP标准规范的接入技术，采用3GPP接入技术的接入网络称为无线接入网络(Radio Access Network，RAN)，其中，5G系统中的接入网设备称为下一代基站节点(next generation Node Base station，gNB)。非3GPP接入技术是指不符合3GPP标准规范的接入技术，例如，以wifi中的接入点(access point，AP)为代表的空口技术。
基于无线通信技术实现接入网络功能的接入网可以称为无线接入网(radio access network，RAN)。无线接入网能够管理无线资源，为终端提供接入服务，进而完成控制信号和用户数据在终端和核心网之间的转发。
无线接入网例如可以是全球移动通讯(Global System of Mobile communication，GSM)系统或码分多址(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)系统中的基站(NodeB，NB)，还可以是LTE系统中的演进型基站(Evolutional NodeB，eNB或eNodeB)，还可以是云无线接入网络(Cloud Radio Access Network，CRAN)场景下的无线控制器，或者该网络设备可以为中继站、接入点、车载设备、可穿戴设备以及未来5G网络中的网络设备或者未来演进的PLMN网络中的网络设备等，本申请实施例并不限定。
3、接入和移动管理功能(access and mobility management function，AMF)实体：主要用于移动性管理和接入管理等，可以用于实现移动性管理实体(mobility management entity，MME)功能中除会话管理之外的其它功能，例如，合法监听、或接入授权(或鉴权)等功能。在本申请实施例中，可用于实现接入和移动管理网元的功能。
4、会话管理功能(session management function，SMF)实体：主要用于会话管理、UE的网际协议(Internet Protocol，IP)地址分配和管理、选择可管理用户平面功能、策略控制、或收费功能接口的终结点以及下行数据通知等。在本申请实施例中，可用于实现会话管理网元的功能。
5、用户平面功能(User Plane Function，UPF)实体：即，数据面网关。可用于分组路由和转发、或用户面数据的服务质量(quality of service，QoS)处理等。用户数据可通过该网元接入到数据网络(data network，DN)。在本申请实施例中，可用于实现用户面网关的功能。
6、数据网络(DN)：用于提供传输数据的网络。例如，运营商业务的网络、因特(Internet)网、第三方的业务网络等。
7、认证服务功能(authentication server function，AUSF)实体：主要用于用户鉴权等。
8、网络开放功能(network exposure function，NEF)实体：用于安全地向外部开放由3GPP网络功能提供的业务和能力等。
9、网络存储功能((network function(NF)repository function，NRF)实体：用于保存网络功能实体以及其提供服务的描述信息，以及支持服务发现，网元实体发现等。
10、策略控制功能(policy control function，PCF)实体：用于指导网络行为的统一策略框架，为控制平面功能网元(例如AMF，SMF网元等)提供策略规则信息等。
11、统一数据管理(unified data management，UDM)实体：用于统一数据管理、5G用户数据管理、处理用户标识、接入鉴权、注册、或移动性管理等。
12、应用功能(application function，AF)实体：用于进行应用影响的数据路由，接入网络开放功能网元，或，与策略框架交互进行策略控制等。
在该网络架构中，N1接口为终端与AMF实体之间的参考点；N2接口为AN和AMF实体的参考点，用于非接入层(non-access stratum，NAS)消息的发送等；N3接口为(R)AN和UPF实体之间的参考点，用于传输用户面的数据等；N4接口为SMF实体和UPF实体之间的参考点，用于传输例如N3连接的隧道标识信息，数据缓存指示信息，以及下行数据通知消息等信息；N6接口为UPF实体和DN之间的参考点，用于传输用户面的数据等。
应理解，上述应用于本申请实施例的网络架构仅是举例说明的从传统点到点的架构和服务化架构的角度描述的网络架构，适用本申请实施例的网络架构并不局限于此，任何能够实现上述各个网元的功能的网络架构都适用于本申请实施例。
还应理解，图1中所示的AMF实体、SMF实体、UPF实体、NSSF实体、NEF实体、AUSF实体、NRF实体、PCF实体、UDM实体可以理解为核心网中用于实现不同功能的网元，例如可以按需组合成网络切片。这些核心网网元可以各自独立的设备，也可以集成于同一设备中实现不同的功能，本申请对此不做限定。
下文中，为便于说明，将用于实现AMF的实体记作接入和移动管理网元，将用于实现SMF的实体记作会话管理网元，将用于实现UPF的实体记作用户面网关，将用于实现UDM功能的实体记作统一数据管理网元，将用于实现PCF的实体记作策略控制网元。应理解，上述命名仅为用于区分不同的功能，并不代表这些网元分别为独立的物理设备，本申请对于上述网元的具体形态不作限定，例如，可以集成在同一个物理设备中，也可以分别是不同的物理设备。此外，上述命名仅为便于区分不同的功能，而不应对本申请构成任何限定，本申请并不排除在5G网络以及未来其它的网络中采用其他命名的可能。例如，在6G网络中，上述各个网元中的部分或全部可以沿用5G中的术语，也可能采用其他名称等。在此进行统一说明，以下不再赘述。
还应理解，图1中的各个网元之间的接口名称只是一个示例，具体实现中接口的名称可能为其他的名称，本申请对此不作具体限定。此外，上述各个网元之间的所传输的消息(或信令)的名称也仅仅是一个示例，对消息本身的功能不构成任何限定。
为便于理解，在描述本申请实施例之前，首先对本申请涉及的几个术语做简单介绍。
1、完整性保护：发送端根据完整性保护算法以及完整性保护密钥对明文或密文进行完整性保护。接收端可以根据相同的完整性保护算法和完整性保护密钥对进行了完整性保护的数据进行完整性验证。其中，完整性保护密钥可以是在接收端接收到接入层安全模式命令AS SMC之后生成的(根据AS SMC中携带的用户面完整性保护算法生成)，也可以是需要开启完整性保护时生成的(根据AS SMC中携带的用户面完整性保护算法生成)。
2、安全能力：包括但不限于：安全算法、安全参数、密钥等。在本申请实施例中， 安全能力例如可以包括UE的安全能力和用户面网关的安全能力等。
3、安全算法：用于在对数据安全保护时使用的算法。例如可包括：加/解密算法、完整性保护算法等。
4、激活用户面安全保护：可以理解为开启了安全保护功能。在本实施例中，激活用户面安全保护包括激活完整性保护。例如激活完整性保护，即开启了完整性保护功能。相反，不激活完整性保护，即不开启完整性保护功能。在确定激活某种安全保护的情况下可直接开启相应的安全保护。
应理解，本申请实施例并未限定于此，激活用户面安全保护还可以包括激活加/解密保护、完整性验证等。
可以理解的是，在本申请实施例中，对于下行传输来说，用户面网关可以是完整性保护端，激活用户面安全保护可以包括激活完整性保护；终端设备可以是完整性验证端，激活用户面安全保护可以包括激活完整性验证。对于上行传输来说，终端设备可以是完整性保护端，激活用户面安全保护可以包括激活完整性保护；用户面网关可以是完整性验证端，激活用户面安全保护可以包括激活完整性验证。
因此，在数据传输过程中，终端设备可以同时作为完整性保护端和完整性验证端；用户面网关可以同时作为完整性保护端和完整性验证端。若激活完整性保护/验证，则终端设备和用户面网关可以均激活完整性保护和完整性验证。
应理解，下文中在未作出特别说明的情况下，“激活完整性保护”和“激活完整性保护/验证”所表达的含义是一致的，或者说，可替换的。
5、安全策略：至少可用于指示是否激活加密保护和/或完整性保护。可选地，安全策略还可用于指示其他更多的信息，比如安全算法的强度建议等，其具体内容本申请实施例不做限定。
安全策略，或者也可以称为用户面安全策略，下文统一用安全策略表述。
在一种实现方式中，安全策略可以指示安全保护的偏好，例如，可以指示需要的(required)、推荐的(preferred)和不需要的(not needed)安全保护。基于该安全保护的偏好可以确定是否激活加密保护和/或完整性保护。
其中，required：终端设备和接入网设备(如基站)之间必须进行完整性保护。如果接入网设备因自身能力不支持则直接拒绝相应业务会话的建立。例如，对于上报测量数据的这种业务，数据精确性十分重要，被篡改了影响很大，所以必须开启完保。
其中，not needed：终端设备和接入网设备之间不需要进行完整性保护。例如，对于大型游戏等高流量业务，稍微的丢包或者包篡改不影响游戏的整体体验，只需要高速率即可，所以不需要进行完整性保护。
其中，preferred：终端设备和接入网设备之间优先进行完整性保护，换句话说，当接入网设备的能力可以支持完整性保护时就会采用完整性保护，当接入网设备的能力不支持完整性保护的时候就不进行。例如，当终端设备的业务要求能力是1兆比特每秒(million bits per second，Mbps)，且安全策略为preferred，接入网设备能够支持完整性保护，但是因为负载等原因，无法在支持开启完整性保护的情况下还支持1Mbps的速率。那么，该情况下，接入网设备会选择关闭完整性保护以满足1Mbps的速率要求。也就是说，preferred指的是，接入网设备能够满足业务速率要求并且也能够支持开启完整性保护的情况下，才 会开启完整性保护，或者，也可以理解为，当速率与完整性保护二者只能选其一的时候会优先满足速率而关闭完整性保护。
在本申请实施例中，为区分，可以将required对应的安全策略记为第一策略、将not need对应的安全策略记为第二策略、将preferred对应的安全策略记为第三策略。应理解，第一策略、第二策略、第三策略仅是为区分做的命名，并不对本申请实施例的保护范围造成限定。
由上可知，现有的安全策略基本考虑了三种情况：必须完整性保护(例如记作第一策略)、不完整性保护(例如记作第二策略)、以及完整性保护与业务速率冲突时舍弃完整性保护以保持速率(例如记作第三策略)。
本申请实施例提出一种安全会话方法，以便能够匹配更多的业务场景。
下面结合附图详细说明本申请实施例提供安全会话方法。
需要说明的是，在下文中结合附图描述实施例的过程中，图中仅为便于理解而示意，不应对本申请构成任何限定。此外，图中示出的gNB可对应于接入网设备，AMF可对应于接入和移动管理网元，SMF可对应于会话管理网元，UDM可对应于统一数据管理网元，PCF可对应于策略管理网元。各网元名称仅为区分不同的功能而定义，不应对本申请构成任何限定。本申请并不排除定义其他网元来实现相同或相似功能的可能。
图2是本申请实施例提供的一种方法200的示意性交互图。方法200可以包括以下步骤。
210，接入网设备接收会话管理网元发送的会话请求消息，该会话请求消息携带终端设备的用户面安全策略以及第一速率的信息。
其中，第一速率，可以用于表示会话要求的速率，或者，换句话说，可以用于表示当接入网设备执行用户面安全策略时会话要求的速率，或者，换句话说，可以用于表示当接入网设备激活完整性保护时会话要求的速率，或者，换句话说，可以用于表示接入网设备对会话进行完整性保护时需要满足的传输速率，或者，换句话说，可以用于表示接入网设备对会话进行完整性保护时终端设备要求的传输速率。下文统一用第一速率表示。
其中，用户面安全策略可以包括已有技术中签约信息中包含的用户面安全策略，如上文所述的required、not need、preferred，此外，用户面安全策略还可以包括又一策略，为区分，将该策略记为第四种策略。
该第四策略至少可以为以下两种形式中的任意一种。
形式1，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护。
换句话说，该第四策略可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或者说，在接入网设备的能力无法对会话进行完整性保护且按会话的速率进行服务时，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，或者说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备选择开启完整性保护。
形式2，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
换句话说，该第四策略可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或者说，在接入网设备的能力无法对会话进行完整性保护且按会话的速率进行服 务时，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，或者说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备选择开启完整性保护，且接入网设备以当前能够提供的最大速率与终端设备传输数据。
接入网设备接收会话请求消息，或者，也可以是，接入网设备接收业务请求消息。接入网基于该会话请求消息或业务请求消息，可以与终端设备进行相应的数据传输。
220，在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护，其中，第二速率低于第一速率。
换句话说，接入网设备收到会话请求消息后，在接入网设备的能力无法对会话进行完整性保护同时且按会话的速率(例如记作第一速率)进行服务的情况下，会选择激活完整性保护但是会按照小于第一速率进行服务。
在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护，也可以理解为，在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备降低速率，并激活完整性保护；或者，也可以理解为，在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备激活完整性保护；或者，也可以理解为，在速率与完整性保护冲突的情况下，接入网设备选择实行完整性保护。
应理解，第二速率用于表示低于第一速率的速率。也就是说，接入网设备在激活完整性保护的情况下，其传输速率小于第一速率。可选地，该第二速率可以是接入网设备自行确定的速率，也可以是其它网元指示的速率，对此不做限定。
在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备激活完整性保护，至少可以通过以下三种方式中的任意一种方式实现；或者说，接入网设备可以基于以下任意一种方式，确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，是否要按照第二速率激活完整性保护。
方式A：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备基于第四策略激活完整性保护。
例如，步骤210中，会话请求消息携带的终端设备的用户面安全策略为第四策略，该第四策略可以为上述任一形式。接入网设备接收到该第四策略后，基于该第四策略确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，激活完整性保护。
示例性地，该第四策略可以是会话管理网元确定的。例如，会话管理网元确定第四策略，并向接入网设备发送该第四策略的信息。
示例性地，该第四策略可以是统一数据管理网元确定的。例如，统一数据管理网元确定第四策略，并向会话管理网元发送该第四策略的信息，换句话说，会话管理网元接收统一数据管理网元提供的第四策略。
一种可能的实现方式，会话管理网元可以直接向接入网设备发送该第四策略的信息。
又一种可能的实现方式，会话管理网元也可以先确定是否实现第四策略，当确定可以实现第四策略时，向接入网设备发送该第四策略的信息。
例如，会话管理网元可以基于业务类型和/或接入网设备的能力等来确定是否可以实行第四策略。
如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以实行第四 策略。
方式B：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备基于指示信息激活完整性保护。
该指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备激活完整性保护，或者，在接入网设备无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活完整性保护。
示例性地，该指示信息可以是终端设备确定的。换句话说，终端设备确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备是否要激活完整性保护，并且向接入网设备指示。该指示信息可以通过单独的信令发送给接入网设备，如通过会话管理网元转发给接入网设备；该指示信息也可以携带于会话请求消息中，对此不做限定。
示例性地，该指示信息可以是会话管理网元确定的。换句话说，会话管理网元确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备激活完整性保护，接入网设备是否要激活完整性保护，并且向接入网设备指示。该指示信息可以通过单独的信令发送给接入网设备；该指示信息也可以携带于会话请求消息中，如携带于会话管理网元向接入和移动管理网元返回的会话创建会话管理上下文服务响应中，对此不做限定。
示例性地，该指示信息可以是统一数据管理网元确定的。换句话说，统一数据管理网元确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备激活完整性保护，接入网设备是否要激活完整性保护，并且向接入网设备指示。该指示信息可以通过单独的信令发送给接入网设备，如通过会话管理网元转发给接入网设备；该指示信息也可以携带于会话请求消息中，对此不做限定。
方式C：接入网设备确定在无法按照第一速率执行用户面安全策略的情况下，激活完整性保护。
例如，在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备确定会话是否满足预设条件，当会话满足预设条件时，接入网设备激活完整性保护。
会话满足预设条件，或者也可以理解为，业务满足预设条件，例如业务为小容量语音等业务，或者，业务为这一类型的业务，即偶尔的丢包篡改影响不大的业务，或者丢包带来的影响小于预设阈值等等。
其中，该预设条件或者预设阈值可以是预先规定好的，如协议预先规定，或者，也可以是网络设备预先规定的，或者也可以是终端设备通知给网络设备的，或者也可以是从核心网获取的，对此不做限定。
可选地，接入网设备接收来自策略控制网元的速率信息，该速率信息用于指示第二速率。
可选地，接入网设备向会话管理网元上报第二速率。
关于第二速率的确定，下文结合图6实施例具体描述。
基于上述方案，接入网设备在能力达不到业务能力要求的情况下，即在速率与完整性保护冲突的情况下，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，可以自行决策优先选择完整性保护，且可以通知会话管理网元，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。
下面结合图3至图7对上述方法作出更详细的说明。
图3是本申请实施例提供的一种方法300的示意性交互图。方法300可以包括以下步骤。
310，终端设备向接入和移动管理网元发送业务请求消息。相应地，接入和移动管理网元接收来自终端设备的业务请求消息。
换句话说，终端设备向接入和移动管理网元发起业务请求消息。业务请求消息可以用于请求建立终端设备与数据网络的业务服务器的连接，该业务请求消息所请求建立的与数据网络的业务服务器的连接可用于传输数据。该数据例如可以是普通数据、小数据、具体的业务对应的数据等，本申请对此不作限定。
为区分，在本申请实施例中，将终端设备向接入和移动管理网元发送的业务请求消息记为第一业务请求消息，下文统一用第一业务请求消息表示。
可选地，终端设备可以经由接入网设备向接入和移动管理网元发送第一业务请求消息。
可选地，该第一业务请求消息为服务请求(service request)消息或分组数据单元(packet data unit，PDU)会话建立请求(PDU session establishment request)消息。
可选地，该第一业务请求消息可以携带切片或者具体业务相关信息，如业务类型、单一切片选择辅助信息(single network slice selection assistance information，S-NSSAI)等，例如可以通过S-NSSAI指示终端设备请求的切片信息。可选地，该第一业务请求消息可以携带数据网络名称(date network name，DNN)，以指示终端设备请求访问的数据网络名称。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第一业务请求消息也可以是终端设备和接入和移动管理网元之间传输的其他消息。
320，接入和移动管理网元向会话管理网元发送第二业务请求消息。
为区分，在本申请实施例中，将接入和移动管理网元向会话管理网元发送的业务请求消息记为第二业务请求消息，下文统一用第二业务请求消息表示。
可选地，该第二业务请求消息可以为PDU会话创建会话管理上下文服务请求。换句话说，步骤320，也可以理解为，会话管理网元接收接入和移动管理网元发起的PDU会话创建会话管理上下文服务请求。
应理解，在本申请实施例中，各个网元之间可以通过调用的方式传输消息，例如，接入和移动管理网元向会话管理网元发送第二业务请求消息，可以理解为，接入和移动管理网元调用会话管理网元提供的会话创建会话管理上下文服务。下文不再赘述。
可选地，该第二业务请求消息可以携带该终端设备的标识。该终端设备的标识例如可以包括但不限于：国际移动设备识别码(international mobile equipment identity，IMEI)、国际移动用户识别码(international mobile subscriber identification number，IMSI)、IP多媒体子系统私有用户标识(IMS(IP multimedia subsystem)private user identity，IMPI)、临时移动用户标识(temporary mobile subscriber identity，TMSI)、IP多媒体公共标识(IP multimedia public identity，IMPU)、媒体接入控制(media access control，MAC)地址、IP地址、手机号码、全球唯一UE标识(globally unique temporary UE identity，GUTI)(例如对于5G来说，具体可以是5G GUTI)、永久身份标识(subscription permanent identifier， SUPI)、隐藏的身份标识(subscriber concealed identifier，SUCI)或永久设备标识(permanent equipment identifier，PEI)。
应理解，该第二业务请求消息中也可以不携带该终端设备的标识。例如，在此前的注册请求消息中已经携带了终端设备的标识，如，SUPI、5G GUTI或PEI等。
可选地，该第二业务请求消息还可以包括DNN、S-NSSAI等信息。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第二业务请求消息也可以是接入和移动管理网元和会话管理网元之间传输的其他消息。
330，会话管理网元向统一数据管理网元发送第三业务请求消息。
为区分，在本申请实施例中，将会话管理网元向统一数据管理网元发送的业务请求消息记为第三业务请求消息，下文统一用第三业务请求消息表示。
也可以理解为，会话管理网元调用统一数据管理网元提供的用户数据管理获取请求服务，从统一数据管理网元处获取终端设备的签约信息。
可选地，该第三业务请求消息可以为签约请求消息或会话管理网元和统一数据管理网元之间的通信消息(Nudm_SDM_Get_request)。
可选地，该第三业务请求消息可以包括终端设备的标识。关于终端设备的标识可参考步骤320中的描述，此处不再赘述。
可选地，该第三业务请求消息还可以包括DNN、S-NSSAI等信息。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第三业务请求消息也可以是会话管理网元和统一数据管理网元之间传输的其他消息。
340，统一数据管理网元向会话管理网元发送第三业务响应消息。
该第三业务响应消息为针对步骤330中第三业务请求消息的响应。为区分，在本申请实施例中，将统一数据管理网元向会话管理网元发送的业务响应消息记为第三业务响应消息，下文统一用第三业务响应消息表示。
也可以理解为，统一数据管理网元根据终端设备的标识，如SUPI，找到终端设备的签约信息，并将该签约信息通过第三业务响应消息通知给会话管理网元。或者，也可以理解为，统一数据管理网元向会话管理网元返回第三业务响应消息。
可选地，该第三业务响应消息可以为签约响应消息或会话管理网元和统一数据管理网元之间的通信消息(Nudm_SDM_Get_response)。
可选地，该终端设备的签约信息可以预先保存在统一数据管理网元中。该签约信息中可以包含用户面(user plane，UP)安全策略(UP security policy)，该用户面安全策略可以用于指示是否需要激活完整性保护。
在本申请实施例中，用户面安全策略可以包括已有技术中签约信息中包含的用户面安全策略，如上文所述的required、not need、preferred，此外，用户面安全策略还可以包括又一策略，为区分，将该策略记为第四种策略。
该第四策略至少可以为以下两种形式中的任意一种。
形式1，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护。
换句话说，该第四策略可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或者说，在接入网设备的能力无法对会话进行完整性保护且按会话的速率进行服务时，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，或者说， 在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备选择开启完整性保护。
对于该形式，该终端设备的签约信息中可以包括第四策略，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护。
形式2，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
其中，速率与完整性保护冲突包括：当按照第一速率进行数据传输时无法开启完整性保护，或者，当开启完整性保护时无法按照第一速率进行数据传输。
换句话说，该第四策略可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或者说，在接入网设备的能力无法对会话进行完整性保护且按会话的速率进行服务时，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，或者说，在接入网设备无法按照第一速率激活完整性保护的情况下，接入网设备选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
对于该形式，该终端设备的签约信息中可以包括第四策略，该第四策略可以用于指示当速率与完整性保护冲突时优先选择完整性保护，且指示接入网设备以当前能够提供的最大速率传输。
应理解，在本申请中，多次提及接入网设备无法按照第一速率执行用户面安全策略，其可以用于表示，接入网设备如果实行完整性保护将不能满足业务的需求；或者，接入网设备如果实行完整性保护，其传输速率将不能满足业务要求的传输速率；或者，速率与完整性保护有冲突；或者，接入网设备的能力不支持终端设备的业务要求等等。下文统一用速率与完整性保护冲突的方式来表述。
还应理解，在本申请中，多次提及优先选择完整性保护，其可以用于表示，在速率与完整性保护冲突的情况下，接入网设备选择实行完整性保护，此外，接入网设备还可以采取一些措施以能够实行完整性保护，例如降低传输速率等。
可选地，统一数据管理网元可以根据业务的类型，确定是否要指示第四策略。如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以实行第四策略。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第三业务请求响应也可以是会话管理网元和统一数据管理网元之间传输的其他消息。
350，会话管理网元根据签约信息和/或本地策略(local policy)，确定实行第四策略。
也就是说，会话管理网元可以根据签约信息和/或本地策略，确定接入网设备是否要实行第四策略或者确定是否要指示第四策略；或者，换句话说，会话管理网元根据签约信息和/或本地策略，确定是否要指示接入网设备，在速率与完整性保护冲突的情况下，对当前终端设备请求的会话实实行优先选择完整性保护的策略。
该第四策略可以为上述形式1或形式2中的任意一种。
例如，该第四策略为上述形式1，那么会话管理网元确定实行第四策略，即表示会话管理网元向接入网设备指示第四策略，相应地，接入网设备接收到该第四策略后，在速率与完整性保护冲突的情况下会优先选择完整性保护。
又如，该第四策略为上述形式2，那么会话管理网元确定实行第四策略，即表示会话 管理网元向接入网设备指示第四策略，相应地，接入网设备接收到该第四策略后，在速率与完整性保护冲突的情况下会优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
该第四策略可以是统一数据管理网元指示的，也可以是会话管理网元指示的，对此不做限定。下面分别说明。
一种可能的实现方式，会话管理网元从统一数据管理网元处获取的终端设备的签约信息中得到第四策略。
或者，也可以理解为，会话管理网元根据终端设备的签约信息中包含的用户面安全策略确定是否实行第四策略；或者，换句话说，第四策略为统一数据管理网元指示的，会话管理网元判断是否可以实行第四策略。
会话管理网元可以基于终端设备的签约信息中包含的用户面安全策略(即第四策略)，生成第一安全策略。该第一安全策略可以包括该用户面安全策略(即第四策略)，或者说，该第一安全策略可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，或者，该第一安全策略可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
会话管理网元可以基于业务类型和/或接入网设备的能力等来确定是否可以实行第四策略。
例如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以实行第四策略。
又一种可能的实现方式，会话管理网元根据其他信息得到第四策略。
或者，也可以理解为，会话管理网元根据终端设备的其他信息确定第四策略；或者，换句话说，第四策略为会话管理网元指示的，即会话管理网元判断是否可以实行第四策略，如果可以实行，则会话管理网元指示第四策略。
会话管理网元还可以基于其他信息，比如本地策略(local policy)、获得的切片相关信息、支持的服务类型等信息中的一项或多项综合判断来生成第二安全策略，或者说，确定在速率与完整性保护冲突的情况下，接入网设备是否要优先选择开启完整性保护。其中，该业务类型的安全需求可以从签约信息获取；还可以通过与其他网元交互，比如策略控制网元、应用服务网元等。
例如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以实行第四策略。
因此，可以理解，该会话管理网元确定的第一安全策略与从终端设备的签约信息中获取的用户面安全策略有可能是相同的，也有可能是不同的，本申请对此不作限定。
应理解，在本实施例中，为方便说明，假设第一安全策略或第二安全策略仅用于指示第四策略。即，与已有的用户面安全策略中所指示的信息的项目相同，但所指示的具体信息可能相同，也可能不同。但应理解，本申请并不排除第一安全策略或第二安全策略包括其他信息的可能，如安全能力信息、用户面安全的终结点信息等。
应理解，图3中为便于理解，仅示出了确定实行第四策略的情况，本申请实施例并未 限定于此。例如，会话管理网元还可以确定实行以下任一策略：第一策略、第二策略、或第三策略。
假设在步骤350中，会话管理网元确定接入网设备可以实行第四策略，方法300还可以包括如下步骤。
360，会话管理网元向接入和移动管理网元发送第二业务响应消息。
该第二业务响应消息为针对步骤320中第二业务请求消息的响应。为区分，在本申请实施例中，将会话管理网元向接入和移动管理网元发送的业务响应消息记为第二业务响应消息，下文统一用第二业务响应消息表示。
可选地，该第二业务响应消息可以为PDU会话创建会话管理上下文服务响应。换句话说，步骤360，也可以理解为，会话管理网元向接入和移动管理网元返回PDU会话创建会话管理上下文服务响应。
会话管理网元向接入和移动管理网元发送的第二业务响应消息中携带生成的第一安全策略或第二安全策略，换句话说，该第二业务响应消息可以包括第四策略，该第四策略用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，或者，该第四策略用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
370，接入和移动管理网元向接入网设备发送指示第四策略的信息。
接入和移动管理网元将从会话管理网元接收到的信息转发给接入网设备。例如，接入和移动管理网元向接入网设备发送第四策略的信息。
其中，第四策略，可以携带于接入和移动管理网元与接入网设备的N2接口消息，比如N2接口PDU会话请求(N2PDU session request)消息。
380，接入网设备根据第四策略，优先实行完整性保护。
也就是说，接入网设备接收到第四策略后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护；或者，接入网设备接收到第四策略后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护，并以接入网设备当前能够提供的最大速率进行服务。
可选地，接入网设备可以通知会话管理网元已做降速处理以及最终的速率。
应理解，上述实施例主要介绍了接入网设备实行第四策略的情况，应理解，本申请实施例并未限定于此。例如，上述实施例可以应用于其他策略，如第一策略、第二策略、或第三策略的场景。
还应理解，上述实施例涉及信令仅是示例性说明，并不对本申请实施例的保护范围造成限定。
还应理解，上述实施例中，在速率与完整性保护冲突的情况下，接入网设备可以实行完整性保护，并且以第二速率进行传输。也就是说，接入网设备可以以第二速率来与终端设备传输数据。该第二速率可以是第四策略中指示的接入网设备当前能够提供的最大速率，或者，该第二速率也可以小于接入网设备当前能够提供的最大速率的任一速率，或者，该第二速率也可以是策略控制网元指示的一速率。可选地，接入网设备可以将该第二速率上报给会话管理网元。下文将结合图6所示的实施例详细描述。
基于上述方案，通过第四策略，接入网设备在能力达不到业务能力要求的情况下，即 在速率与完整性保护冲突的情况下，优先选择完整性保护，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。其中，该第四策略可以是会话管理网元进行决策并选择的，也可以是统一数据管理网元进行决策并选择的。
图4是本申请实施例提供的一种方法400的示意性交互图。方法400可以包括以下步骤。
410，终端设备向接入和移动管理网元发送业务请求消息。相应地，接入和移动管理网元接收来自终端设备的业务请求消息。
为区分，在本申请实施例中，将终端设备向接入和移动管理网元发送的业务请求消息记为第一业务请求消息，下文统一用第一业务请求消息表示。
该步骤同方法300中的步骤310相同，具体可参考上述步骤310，此处不再赘述。
420，接入和移动管理网元向会话管理网元发送第二业务请求消息。
为区分，在本申请实施例中，将接入和移动管理网元向会话管理网元发送的业务请求消息记为第二业务请求消息，下文统一用第二业务请求消息表示。
该步骤同方法300中的步骤320相同，具体可参考上述步骤320，此处不再赘述。
430，会话管理网元向统一数据管理网元发送第三业务请求消息。
为区分，在本申请实施例中，将会话管理网元向统一数据管理网元发送的业务请求消息记为第三业务请求消息，下文统一用第三业务请求消息表示。
该步骤同方法300中的步骤330相同，具体可参考上述步骤330，此处不再赘述。
440，统一数据管理网元向会话管理网元发送第三业务响应消息。
该第三业务响应消息为针对步骤430中第三业务请求消息的响应。为区分，在本申请实施例中，将统一数据管理网元向会话管理网元发送的业务响应消息记为第三业务响应消息，下文统一用第三业务响应消息表示。
也可以理解为，统一数据管理网元根据终端设备的标识，如SUPI，找到终端设备的签约信息，并将该签约信息通过第三业务响应消息通知给会话管理网元。或者，也可以理解为，统一数据管理网元向会话管理网元返回第三业务响应消息。
可选地，该第三业务响应消息可以为签约响应消息或会话管理网元和统一数据管理网元之间的通信消息(Nudm_SDM_Get_response)。
可选地，该终端设备的签约信息可以预先保存在统一数据管理网元中。该签约信息中可以包含用户面安全策略(UP security policy)，该用户面安全策略可以用于指示是否需要激活完整性保护。在本申请实施例中，用户面安全策略可以包括已有技术中签约信息中包含的用户面安全策略，如上文所述的required、not need、preferred。
可选地，该第三业务响应消息可以包括第一指示信息。
一种可能的实现方式，该第一指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护。换句话说，该第一指示信息可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或者，该第一指示信息可以用于指示在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备优先选择开启完整性保护。
又一种可能的实现方式，该第一指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。换句话说，该第一指示信息可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，或 者，该第一指示信息可以用于指示在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
在步骤430中，统一数据管理网元可以根据业务的类型等信息，确定是否要发送第一指示信息。如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以发送第一指示信息。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第一指示信息也可以携带于会话管理网元和统一数据管理网元之间传输的其他消息中，或者，也可以通过单独的一个信令发送。
450，会话管理网元根据签约信息和/或本地策略，确定第二指示信息。
一种可能的实现方式，该第二指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护。
换句话说，该第二指示信息可以用于指示在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备优先选择开启完整性保护。
在该实现方式下，会话管理网元确定第二指示信息，即表示会话管理网元向接入网设备指示：在速率与完整性保护冲突的情况下优先选择完整性保护。
又一种可能的实现方式，该第二指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。换句话说，该第二指示信息可以用于指示在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
在该实现方式下，会话管理网元确定第二指示信息，即表示会话管理网元向接入网设备指示：在速率与完整性保护冲突的情况下优先选择完整性保护，且指示接入网设备以当前能够提供的最大速率传输。
该第二指示信息和步骤440中的第一指示信息可以相同，也可以不同，对此不做限定。下面分别说明。
一种可能的实现方式，会话管理网元基于从统一数据管理网元处获取到的第一指示信息，得到第二指示信息。
或者，也可以理解为，会话管理网元根据从统一数据管理网元处获取到的第一指示信息，确定是否要向接入网设备指示在速率与完整性保护冲突的情况下优先选择完整性保护，或确定是否要向接入网设备指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输；或者，换句话说，第二指示信息为统一数据管理网元指示的，会话管理网元判断是否可以向接入网设备指示该第二指示信息。
会话管理网元可以基于第一指示信息，生成第二指示信息。该第二指示信息可以包括该第一指示信息或者也可以为第一指示信息，或者说，该第二指示信息可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，或者，该第二指示信息可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
会话管理网元可以基于业务类型和/或接入网设备的能力等来确定是否要指示第二指 示信息。或者，会话管理网元也可以直接根据第一指示信息确定向接入网设备指示第二指示信息。
可选地，会话管理网元可以根据从统一数据管理网元处获取的终端设备的签约信息生成第三安全策略，该第三安全策略可以包括步骤440中的用户面安全策略，如，required、not need、或preferred。
又一种可能的实现方式，会话管理网元根据其他信息得到第二指示信息。
或者，也可以理解为，会话管理网元根据终端设备的其他信息确定是否可以向接入网设备指示第二指示信息；或者，换句话说，第二指示信息为会话管理网元指示的，即会话管理网元判断在速率与完整性保护冲突的情况下，接入网设备是否要优先选择开启完整性保护，如果是，则会话管理网元指示第二指示信息。
会话管理网元还可以基于其他信息，比如本地策略、获得的切片相关信息、支持的服务类型等信息中的一项或多项综合判断来生成第二指示信息，或者说，确定在速率与完整性保护冲突的情况下，接入网设备是否要优先选择开启完整性保护。其中，该业务类型的安全需求可以从签约信息获取；还可以通过与其他网元交互，比如策略控制网元、应用服务网元等。
例如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以指示第二指示信息。
可选地，会话管理网元也可以根据其他信息生成第四安全策略，比如本地策略(local policy)、获得的切片相关信息、支持的服务类型等信息中的一项或多项综合判断来生成第四安全策略，该第四安全策略例如可以包括为：required、not need、或preferred。其中，该业务类型的安全需求可以从签约信息获取；还可以通过与其他网元交互，比如策略控制网元、应用服务网元等。
应理解，第二指示信息与第一指示信息有可能是相同的，也有可能是不同的，本申请对此不作限定。
还应理解，图4中为便于理解，仅示出了确定第二指示信息的情况，即接入网设备优先选择完整性保护的情况，本申请实施例并未限定于此。
假设在步骤450中，会话管理网元确定第二指示信息，方法400还可以包括如下步骤。
460，会话管理网元向接入和移动管理网元发送第二业务响应消息。
该第二业务响应消息为针对步骤420中第二业务请求消息的响应。为区分，在本申请实施例中，将会话管理网元向接入和移动管理网元发送的业务响应消息记为第二业务响应消息，下文统一用第二业务响应消息表示。
可选地，该第二业务响应消息可以为PDU会话创建会话管理上下文服务响应。换句话说，步骤460，也可以理解为，会话管理网元向接入和移动管理网元返回PDU会话创建会话管理上下文服务响应。
会话管理网元向接入和移动管理网元发送的第二业务响应消息中携带步骤450中的第二指示信息，换句话说，该第二业务响应消息可以包括第二指示信息，该第二指示信息用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，或者，该第二指示信息用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能 够提供的最大速率传输。
470，接入和移动管理网元向接入网设备发送指示第二指示信息的信息。
接入和移动管理网元将从会话管理网元接收到的信息转发给接入网设备。例如，接入和移动管理网元向接入网设备发送第二指示信息和安全策略，安全策略即为第三安全策略或第四安全策略。
其中，第二指示信息和安全策略，可以携带于接入和移动管理网元与接入网设备的N2接口消息，比如N2接口PDU会话请求(N2PDU session request)消息。
480，接入网设备根据第二指示信息，优先实行完整性保护。
也就是说，接入网设备接收到第二指示信息后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护；或者，接入网设备接收到第二指示信息后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护，并以接入网设备当前能够提供的最大速率进行服务。
可选地，接入网设备可以通知会话管理网元已做降速处理以及最终的速率。
应理解，上述实施例涉及信令仅是示例性说明，并不对本申请实施例的保护范围造成限定。
还应理解，上述实施例中，在速率与完整性保护冲突的情况下，接入网设备可以实行完整性保护，并且以第二速率进行传输，也就是说，接入网设备可以以第二速率来与终端设备传输数据。该第二速率可以是第二指示信息中指示的接入网设备当前能够提供的最大速率，或者，该第二速率也可以小于接入网设备当前能够提供的最大速率的任一速率，或者，该第二速率也可以是策略控制网元指示的一速率。可选地，接入网设备可以将该第二速率上报给会话管理网元。下文将结合图6所示的实施例详细描述。
基于上述方案，通过指示信息，接入网设备在能力达不到业务能力要求的情况下，即在速率与完整性保护冲突的情况下，优先选择完整性保护，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。其中，该指示信息可以是会话管理网元进行决策并生成的，即第二指示信息；或者，该指示信息也可以是统一数据管理网元进行决策并生成的，即第一指示信息。
图5是本申请实施例提供的一种方法500的示意性交互图。方法500可以包括以下步骤。
510，终端设备向接入和移动管理网元发送业务请求消息。相应地，接入和移动管理网元接收来自终端设备的业务请求消息。
换句话说，终端设备向接入和移动管理网元发起业务请求消息。业务请求消息可以用于请求建立终端设备与数据网络的业务服务器的连接，该业务请求消息所请求建立的与数据网络的业务服务器的连接可用于传输数据。该数据例如可以是普通数据、小数据、具体的业务对应的数据等，本申请对此不作限定。
为区分，在本申请实施例中，将终端设备向接入和移动管理网元发送的业务请求消息记为第一业务请求消息，下文统一用第一业务请求消息表示。
可选地，终端设备可以经由接入网设备向接入和移动管理网元发送第一业务请求消息。
可选地，该第一业务请求消息为服务请求消息或PDU会话建立请求消息。
可选地，该第一业务请求消息可以携带切片或者具体业务相关信息，如业务类型、S-NSSAI等，例如可以通过S-NSSAI指示终端设备请求的切片信息。可选地，该第一业务请求消息可以携带DNN，以指示终端设备请求访问的数据网络名称。
在本申请实施例中，该第一业务请求消息可以包括第三指示信息。
一种可能的实现方式，该第三指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护。换句话说，该第三指示信息可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，接入网设备优先选择开启完整性保护。
又一种可能的实现方式，该第三指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。换句话说，该第三指示信息可以用于指示在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
在步骤510中，终端设备可以根据待传输业务的类型等信息，确定是否要发送第三指示信息。如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以发送第三指示信息。
可选地，终端设备发送的第三指示信息可以为会话粒度，即针对不同数据网络(data network，DN)或者应用的指示信息。针对不同DN或应用的指示信息，可以预先配置，如协议预先规定；或者也可以是终端设备自身配置；或者也可以是在注册流程中从核心网获取等，对此不做限定。
可选地，可以在用户路由选择策略(UE routing selection policy，URSP)中引入该指示(即第三指示信息)。例如，通过URSP定义应用与PDU会话属性的关系，对于某些类型的应用，可以在速率不满足要求的情况下，不拒绝会话，以当前能够提供的最大速率传输即可。
应理解，以上列举的信令仅为示例，不应对本申请构成任何限定。该第三指示信息也可以携带于终端设备和接入和移动管理网元之间传输的其他消息中，或者，也可以通过单独的一个信令发送。
520，接入和移动管理网元向会话管理网元发送第二业务请求消息。
为区分，在本申请实施例中，将接入和移动管理网元向会话管理网元发送的业务请求消息记为第二业务请求消息，下文统一用第二业务请求消息表示。也可以理解为，接入和移动管理网元调用会话管理网元提供的会话创建会话管理上下文服务。
该步骤同方法300中的步骤320相似，具体可参考上述步骤320，此处不再赘述。
可选地，第二业务请求消息中包括第三指示信息，即步骤510中的第三指示信息。
530，会话管理网元根据第二业务请求消息确定第四指示信息。
换句话说，会话管理网元根据接收到的第二业务请求消息，确定在速率与完整性保护冲突的情况下是否要优先选择完整性保护。
一种可能的实现方式，该第四指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护。
换句话说，该第四指示信息可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，接入网设备优先选择开启完整性保护。
在该实现方式下，会话管理网元确定第四指示信息，即表示会话管理网元向接入网设备指示：在速率与完整性保护冲突的情况下优先选择完整性保护。
又一种可能的实现方式，该第四指示信息可以用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
换句话说，该第四指示信息可以用于指示当接入网设备的能力不支持终端设备的业务要求能力时，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
在该实现方式下，会话管理网元确定第四指示信息，即表示会话管理网元向接入网设备指示：在速率与完整性保护冲突的情况下优先选择完整性保护，且指示接入网设备以当前能够提供的最大速率传输。
该第四指示信息和步骤510中的第三指示信息可以相同，也可以不同，对此不做限定。下面分别说明。
一种可能的实现方式，会话管理网元基于获取到的第三指示信息，得到第四指示信息。
或者，也可以理解为，会话管理网元根据从终端设备处获取到的第三指示信息，确定是否要向接入网设备指示在速率与完整性保护冲突的情况下优先选择完整性保护，或确定是否要向接入网设备指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输；或者，换句话说，第四指示信息为终端设备指示的，会话管理网元判断是否可以向接入网设备指示该第四指示信息。
会话管理网元可以基于第三指示信息，生成第四指示信息。该第四指示信息可以包括该第三指示信息或者也可以为第三指示信息，或者说，该第四指示信息可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，或者，该第四指示信息可用于指示在速率与完整性保护冲突的情况下，接入网设备优先选择开启完整性保护，且接入网设备以当前能够提供的最大速率传输。
会话管理网元可以基于业务类型和/或接入网设备的能力等来确定是否要指示第四指示信息。或者，会话管理网元也可以直接根据第三指示信息确定向接入网设备指示第四指示信息。
又一种可能的实现方式，会话管理网元根据其他信息得到第四指示信息。
或者，也可以理解为，会话管理网元根据终端设备的其他信息确定是否可以向接入网设备指示第四指示信息；或者，换句话说，第四指示信息为会话管理网元指示的，即会话管理网元判断在速率与完整性保护冲突的情况下，接入网设备是否要优先选择开启完整性保护，如果是，则会话管理网元指示第四指示信息。
会话管理网元还可以基于其他信息，比如本地策略、获得的切片相关信息、支持的服务类型等信息中的一项或多项综合判断来生成第四指示信息，或者说，确定在速率与完整性保护冲突的情况下，接入网设备是否要优先选择开启完整性保护。其中，该业务类型的安全需求可以从签约信息获取；还可以通过与其他网元交互，比如策略控制网元、应用服务网元等。
例如，对于某些业务，如小容量语音等业务，能够完整性保护当然更好，如果实在无法完整性保护，偶尔的丢包篡改也不影响理解语音的内容，故针对该类业务，可以指示第四指示信息。
因此，可以理解，第四指示信息与第三指示信息有可能是相同的，也有可能是不同的，本申请对此不作限定。
可选地，会话管理网元可以生成安全策略，该安全策略可以为，required、not need、或preferred。
关于会话管理网元生成安全策略的方式，可以参考方法400中的描述，此处不再赘述。
应理解，图5中为便于理解，仅示出了确定第四指示信息的情况，即接入网设备优先选择完整性保护的情况，本申请实施例并未限定于此。
假设在步骤530中，会话管理网元确定第四指示信息，方法500还可以包括如下步骤。
540，会话管理网元向接入和移动管理网元发送第二业务响应消息。
该第二业务响应消息为针对步骤520中第二业务请求消息的响应。为区分，在本申请实施例中，将会话管理网元向接入和移动管理网元发送的业务响应消息记为第二业务响应消息，下文统一用第二业务响应消息表示。
可选地，该第二业务响应消息可以为PDU会话创建会话管理上下文服务响应。换句话说，步骤540，也可以理解为，会话管理网元向接入和移动管理网元返回PDU会话创建会话管理上下文服务响应。
会话管理网元向接入和移动管理网元发送的第二业务响应消息中携带步骤530中的第四指示信息，换句话说，该第二业务响应消息可以包括第四指示信息，该第四指示信息用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，或者，该第四指示信息用于指示在速率与完整性保护冲突的情况下优先选择完整性保护，且接入网设备以当前能够提供的最大速率传输。
550，接入和移动管理网元向接入网设备发送指示第四指示信息的信息。
接入和移动管理网元将从会话管理网元接收到的信息转发给接入网设备。例如，接入和移动管理网元向接入网设备发送第四指示信息和安全策略，安全策略即为步骤530中生成的安全策略。
其中，第四指示信息和安全策略，可以携带于接入和移动管理网元与接入网设备的N2接口消息，比如N2接口PDU会话请求(N2PDU session request)消息。
560，接入网设备根据第四指示信息，优先实行完整性保护。
也就是说，接入网设备接收到第四指示信息后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护；或者，接入网设备接收到第四指示信息后，在速率无法达到要求的情况下或者说在速率与完整性保护冲突的情况下，优先选择完整性保护，并以接入网设备当前能够提供的最大速率进行服务。
可选地，接入网设备还可以根据自身的能力确定是否需要进行降速处理。
可选地，接入网设备可以通知会话管理网元已做降速处理以及最终的速率。
应理解，上述实施例涉及信令仅是示例性说明，并不对本申请实施例的保护范围造成限定。
还应理解，上述实施例中，在速率与完整性保护冲突的情况下，接入网设备可以实行完整性保护，并且以第二速率进行传输，也就是说，接入网设备可以以第二速率来与终端设备传输数据。该第二速率可以是第四指示信息中指示的接入网设备当前能够提供的最大速率，或者，该第二速率也可以小于接入网设备当前能够提供的最大速率的任一速率，或 者，该第二速率也可以是策略控制网元指示的一速率。可选地，接入网设备可以将该第二速率上报给会话管理网元。下文将结合图6所示的实施例详细描述。
基于上述方案，通过指示信息，接入网设备在能力达不到业务能力要求的情况下，即在速率与完整性保护冲突的情况下，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，优先选择完整性保护，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。其中，该指示信息可以是终端设备进行决策并生成的。
下面结合图6介绍接入网设备与终端设备传输数据时的传输速率，即第二速率。
图6是本申请实施例提供的一种方法600的示意性交互图。方法600可以包括以下步骤。
610，终端设备向接入和移动管理网元发送业务请求消息。相应地，接入和移动管理网元接收来自终端设备的业务请求消息。
为区分，在本申请实施例中，将终端设备向接入和移动管理网元发送的业务请求消息记为第一业务请求消息，下文统一用第一业务请求消息表示。
该步骤可以参考上述方法300中的步骤310、方法400中的步骤410、或方法500中的步骤510，此处不再赘述。
620，接入和移动管理网元向会话管理网元发送第二业务请求消息。
为区分，在本申请实施例中，将接入和移动管理网元向会话管理网元发送的业务请求消息记为第二业务请求消息，下文统一用第二业务请求消息表示。
该步骤可以参考上述方法300中的步骤320、方法400中的步骤420、或方法500中的步骤520，此处不再赘述。
630，会话管理网元向统一数据管理网元发送第三业务请求消息。
为区分，在本申请实施例中，将会话管理网元向统一数据管理网元发送的业务请求消息记为第三业务请求消息，下文统一用第三业务请求消息表示。
该步骤可以参考上述方法300中的步骤330、或方法400中的步骤430，此处不再赘述。
640，统一数据管理网元向会话管理网元发送第三业务响应消息。
该步骤可以参考上述方法300中的步骤340、或方法400中的步骤440，此处不再赘述。
650，会话管理网元根据签约信息和/或本地策略，确定接入网设备是否要优先选择完整性保护。
该步骤可以参考上述方法300中的步骤350，即会话管理网元根据签约信息和/或本地策略确定实行第四策略，此处不再赘述。
或者，该步骤可以参考上述方法400中的步骤450，即会话管理网元根据签约信息和/或本地策略确定第二指示信息，此处不再赘述。
或者，该步骤可以参考上述方法500中的步骤530，即会话管理网元根据第二业务请求消息确定第四指示信息，此处不再赘述。
在本申请实施例中，策略控制网元可以确定第二速率，即在速率与完整性保护冲突的情况下，接入网设备实行完整性保护时的传输速率。如可以通过如下步骤601至603，确 定第二速率。
601，会话管理网元向策略控制网元发送第五指示信息。
该第五指示信息可以用于指示在速率与完整性保护冲突的情况下接入网设备将实行完整性保护。
该第五指示信息可以携带于会话管理网元与策略控制网元之间的通信消息(Npcf_SMPolicyControl_Create_request)。
可选地，该第五指示信息可以包括接入网设备当前能够提供的最大速率。
602，策略控制网元确定第二速率。
策略控制网元根据第五指示信息，确定最终速率，该最终速率可以为服务数据流(service data flow)的速率。
603，策略控制网元向会话管理网元发送第六指示信息。
该第六指示信息可以为针对第五指示信息的响应。也可以理解为，策略控制网元向会话管理网元返回第六指示信息。
该第六指示信息可以指示上述步骤602中的最终速率的信息。
该第六指示信息可以携带于会话管理网元与策略控制网元之间的通信消息(Npcf_SMPolicyControl_Create_response)。
会话管理网元接收到该第六指示信息后，可以将该第六指示信息指示的最终速率进行处理以得到服务质量(quality of service，QoS)流(QoS flow)。
基于上述步骤601至步骤603，会话管理网元可以确定最终的接入网设备与终端设备传输的数据对应的QoS流。
660，会话管理网元向接入和移动管理网元发送第二业务响应消息。
该步骤可以参考上述方法300中的步骤360、方法400中的步骤460、或方法500中的步骤540，此处不再赘述。
可选地，该第二业务响应消息中还可以包括QoS流的信息。
670，接入和移动管理网元向接入网设备发送指示接入网设备优先选择完整性保护的信息。
该步骤可以参考上述方法300中的步骤370，即接入和移动管理网元向接入网设备发送指示第四策略的信息，此处不再赘述。
或者，该步骤可以参考上述方法400中的步骤470，即接入和移动管理网元向接入网设备发送指示第二指示信息的信息，此处不再赘述。
或者，该步骤可以参考上述方法500中的步骤550，即接入和移动管理网元向接入网设备发送指示第四指示信息的信息，此处不再赘述。
可选地，该指示接入网设备优先选择完整性保护的信息中还可以包括QoS流的信息。
680，接入网设备根据指示接入网设备优先选择完整性保护的信息，优先实行完整性保护。
该步骤可以参考上述方法300中的步骤380，即接入网设备根据第四策略优先实行完整性保护，此处不再赘述。
或者，该步骤可以参考上述方法400中的步骤480，即接入网设备根据第二指示信息优先实行完整性保护，此处不再赘述。
或者，该步骤可以参考上述方法500中的步骤560，即接入网设备根据第四指示信息优先实行完整性保护，此处不再赘述。
可选地，该指示接入网设备优先选择完整性保护的信息中还可以包括QoS流的信息，接入网设备可以基于该QoS流的信息确定是否降速以及第二速率。该第二速率小于或等于接入网设备当前能够提供的最大速率。
或者，接入网设备也可以结合自身的能力确定是否需要做降速处理。
可选地，接入网设备可以通知会话管理网元已做降速处理以及最终的速率。
应理解，上述实施例涉及信令仅是示例性说明，并不对本申请实施例的保护范围造成限定。
还应理解，上述方法600可以与方法300、方法400、或方法500结合使用。
基于上述方案，接入网设备在能力达不到业务能力要求的情况下，即在速率与完整性保护冲突的情况下，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，优先选择完整性保护，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。此外，接入网设备还可以根据策略控制网元的指示，确定最终的传输速率(即第二速率)。
图7是本申请实施例提供的一种方法700的示意性交互图。方法700可以包括以下步骤。
710，终端设备向接入和移动管理网元发送业务请求消息。相应地，接入和移动管理网元接收来自终端设备的业务请求消息。
为区分，在本申请实施例中，将终端设备向接入和移动管理网元发送的业务请求消息记为第一业务请求消息，下文统一用第一业务请求消息表示。
该步骤可以参考上述方法300中的步骤310、或方法400中的步骤410，此处不再赘述。
720，接入和移动管理网元向会话管理网元发送第二业务请求消息。
为区分，在本申请实施例中，将接入和移动管理网元向会话管理网元发送的业务请求消息记为第二业务请求消息，下文统一用第二业务请求消息表示。
该步骤可以参考上述方法300中的步骤320、或方法400中的步骤420，此处不再赘述。
730，基于第二业务请求消息，会话管理网元进行处理。
例如，会话管理网元可以基于该第二业务请求消息确定安全算法；又如，会话管理网元基于该第二业务请求消息，生成加密密钥和完整性保护密钥；又如，会话管理网元基于该第二业务请求消息，生成安全策略，等等。该步骤可以按照现有标准实现，本申请实施例对此不做限定。
740，会话管理网元向接入和移动管理网元发送第二业务响应消息。
该第二业务响应消息为针对步骤720中第二业务请求消息的响应。为区分，在本申请实施例中，将会话管理网元向接入和移动管理网元发送的业务响应消息记为第二业务响应消息，下文统一用第二业务响应消息表示。
可选地，该第二业务响应消息可以为PDU会话创建会话管理上下文服务响应。换句话说，步骤740，也可以理解为，会话管理网元向接入和移动管理网元返回PDU会话创 建会话管理上下文服务响应。
会话管理网元向接入和移动管理网元发送的第二业务响应消息中可以携带步骤730中会话管理网元确定的信息，如安全策略和/或安全算法等等。
750，接入和移动管理网元向接入网设备发送请求消息。
接入和移动管理网元将从会话管理网元接收到的信息转发给接入网设备。
其中，请求消息可以为接入和移动管理网元与接入网设备的N2接口消息，比如N2接口PDU会话请求(N2PDU session request)消息。
上述步骤710至步骤750可参考现有标准实现，本申请实施例对此不做限定。
在本申请实施例中，在速率与完整性保护冲突的情况下，接入网设备可以自行决策是否要优先选择完整性保护。方法700还可以包括如下步骤。
760，基于请求消息，接入网设备确定是否可以做降速处理。
也就是说，接入网设备接收到请求消息后，发现速率无法达到要求或者说速率与完整性保护冲突，那么接入网设备可以确定是否可以做降速处理，以实行完整性保护。
例如，接入网设备可以结合自身能力确定是否能够做降速处理。
一种可能的实现方式，当接入网设备确定在速率与完整性保护冲突的情况下，优先选择完整性保护，并自行进行降速处理，且接入网设备可以通知会话管理网元降速处理结果。
又一种可能的实现方式，当接入网设备确定在速率与完整性保护冲突的情况下，优先选择完整性保护，并向会话管理网元请求是否可以降速处理。也就是说，接入网设备获得会话管理网元的批准后再进行降速处理。
假设接入网设备获得会话管理网元的批准后再进行降速处理，则方法700还可以包括步骤770和步骤780。
770，接入网设备向会话管理网元发送请求降速的消息。
该请求降速的消息用于请求会话管理网元，接入网设备是否可以做降速处理。
该请求降速的消息可以通过接入和移动管理网元的转发进行实现。即接入网设备向接入和移动管理网元发送该请求降速的消息，接入和移动管理网元向会话管理网元转发该请求降速的消息。
780，会话管理网元向接入网设备发送指示降速的消息。
该指示降速的消息可以通过接入和移动管理网元的转发进行实现。即会话管理网元向接入和移动管理网元发送该指示降速的消息，接入和移动管理网元向接入网设备转发该指示降速的消息。
该指示降速的消息用于指示接入网设备可以进行降速处理或者不可以进行降速处理。
例如，当该指示降速的消息用于指示接入网设备可以进行降速处理时，接入网设备可以实现完整性保护，并进行降速处理。
又如，当该指示降速的消息用于指示接入网设备不可以进行降速处理时，接入网设备不会实现完整性保护，也不会进行降速处理。
应理解，上述实施例中，在速率与完整性保护冲突的情况下，接入网设备降速处理后，可以以第二速率来与终端设备传输数据。该第二速率可以是通过方法600的方式获得的第二速率，或者，也可以是接入网设备自身确定的，或者，也可以是接入网设备自身确定且会话管理网元批准的。该第二速率可以小于或等于接入网设备当前能够提供的最大速率。 可选地，接入网设备可以向会话管理网元上报该第二速率。
还应理解，上述实施例涉及信令仅是示例性说明，并不对本申请实施例的保护范围造成限定。
基于上述方案，接入网设备在能力达不到业务能力要求的情况下，即在速率与完整性保护冲突的情况下，或者说，在接入网设备无法按照第一速率执行用户面安全策略的情况下，可以自行决策优先选择完整性保护，且可以通知会话管理网元，从而可以实现根据业务动态调整完整性保护策略，以尽可能地匹配不同的业务场景。
应理解，在本文描述的各个实施例中，各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
本文中描述的各个实施例可以为独立的方案，也可以根据内在逻辑进行组合，这些方案都落入本申请的保护范围中。
可以理解的是，上述各个方法实施例中，由终端侧实现的方法和操作，也可以由可用于终端侧设备的部件(例如芯片或者电路)实现，由网络侧实现的方法和操作，也可以由可用于网络侧设备的部件(例如芯片或者电路)实现。
以上，结合图2至图7详细说明了本申请实施例提供的方法。以下，结合图8至图9详细说明本申请实施例提供的安全会话装置。应理解，装置实施例的描述与方法实施例的描述相互对应，因此，未详细描述的内容可以参见上文方法实施例，为了简洁，这里不再赘述。
上述主要从各个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，各个网元，例如发射端设备或者接收端设备，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对发射端设备或者接收端设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分各个功能模块为例进行说明
图8是本申请实施例提供的安全会话装置800的示意性框图。如图所示，该通信装置800可以包括：收发单元810和处理单元820。
在一种可能的设计中，该安全会话装置800可以是上文方法实施例中的接入网设备，也可以是用于实现上文方法实施例中接入网设备的功能的芯片。
在一种可能的实现方式，收发单元810用于：接收会话管理网元发送的会话请求消息，会话请求消息携带终端设备的用户面安全策略以及第一速率的信息；处理单元820用于：在安全会话装置800无法按照第一速率执行用户面安全策略的情况下，按照第二速率激活 完整性保护，其中，第二速率低于第一速率。
可选地，第二速率小于或等于安全会话装置800当前能够支持的最大传输速率。
可选地，处理单元820具体用于：基于用户面安全策略，按照第二速率激活完整性保护。
可选地，用户面安全策略是会话管理网元或统一数据管理网元确定的。
可选地，会话请求消息包括指示信息；处理单元820具体用于：基于指示信息，按照第二速率激活完整性保护。
可选地，处理单元820具体用于：在确定会话满足预设条件的情况下，按照第二速率激活完整性保护。
可选地，收发单元810还用于：接收来自策略控制网元的速率信息，速率信息用于指示第二速率。
可选地，收发单元810还用于：向会话管理网元发送第二速率的信息。
具体地，该安全会话装置800可对应于根据本申请实施例的方法200至700中的接入网设备，该安全会话装置800可以包括用于执行图2中的方法200至图7中的方法700中的接入网设备执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话装置800可以是上文方法实施例中的会话管理网元，也可以是用于实现上文方法实施例中会话管理网元的功能的芯片。
一种可能的实现方式中，处理单元820用于：确定终端设备的用户面安全策略，用户面安全策略用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护，其中，第二速率低于第一速率；收发单元810用于：向接入网设备发送用户面安全策略。
可选地，收发单元810还用于：获取终端设备的签约信息；处理单元820具体用于：基于终端设备的签约信息，确定终端设备的用户面安全策略。
可选地，处理单元820具体用于：根据终端设备的会话请求消息，确定终端设备的用户面安全策略。
可选地，处理单元820还用于：接收来自策略控制网元提供的速率信息；收发单元810还用于：基于速率信息，向接入网设备发送用于指示第二速率的信息。
可选地，收发单元810还用于：接收接入网设备发送的第二速率的信息。
又一种可能的实现方式中，收发单元810用于：接收接入和移动管理网元发起的会话创建会话管理上下文服务请求；收发单元810还用于：基于会话创建会话管理上下文服务请求，向接入和移动管理网元返回会话创建会话管理上下文服务响应，会话创建会话管理上下文服务响应包括指示信息，指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护，其中，第二速率低于第一速率。
可选地，会话创建会话管理上下文服务请求包括通知信息，通知信息用于通知在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完 整性保护；收发单元810具体用于：基于通知信息，确定所述指示信息。
可选地，会话创建会话管理上下文服务请求包括终端设备的业务类型的信息；处理单元820用于：基于业务类型的信息，确定所述指示信息。
可选地，收发单元810还用于：接收策略控制网元提供的速率信息；处理单元820还用于：基于速率信息，确定在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护。
可选地，收发单元810还用于：接收接入网设备发送的第二速率的信息。
具体地，该安全会话装置800可对应于根据本申请实施例的方法200至700中的会话管理网元，该安全会话装置800可以包括用于执行图2中的方法200至图7中的方法700中的会话管理网元执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话装置800可以是上文方法实施例中的UE，也可以是用于实现上文方法实施例中UE的功能的芯片。
一种可能的实现方式，处理单元820用于：确定指示信息，指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，接入网设备按照第二速率激活完整性保护，其中，第二速率低于第一速率；收发单元810用于：向接入和移动管理网元发送指示信息。
具体地，该安全会话装置800可对应于根据本申请实施例的方法200至700中的UE，该安全会话装置800可以包括用于执行图2中的方法200至图7中的方法700中的UE执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。
在另一种可能的设计中，该安全会话装置800可以是上文方法实施例中的接入和移动管理网元，也可以是用于实现上文方法实施例中接入和移动管理网元的功能的芯片。
具体地，该安全会话装置800可对应于根据本申请实施例的方法200至700中的接入和移动管理网元，该安全会话装置800可以包括用于执行图2中的方法200至图7中的方法700中的接入和移动管理网元执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话装置800可以是上文方法实施例中的统一数据管理网元，也可以是用于实现上文方法实施例中统一数据管理网元的功能的芯片。
具体地，该安全会话装置800可对应于根据本申请实施例的方法200至700中的统一数据管理网元，该安全会话装置800可以包括用于执行图2中的方法200至图7中的方法700中的统一数据管理网元执行的方法的单元。并且，该安全会话装置800中的各单元和 上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。
在另一种可能的设计中，该安全会话装置800可以是上文方法实施例中的策略控制网元，也可以是用于实现上文方法实施例中策略控制网元的功能的芯片。
具体地，该安全会话装置800可对应于根据本申请实施例的方法600中的策略控制网元，该安全会话装置800可以包括用于执行图6中的方法600中的策略控制网元执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图6中的方法600的相应流程。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
还应理解，该安全会话装置800中的收发单元可对应于图9中示出的安全会话设备900中的收发器910，该安全会话装置800中的处理单元820可对应于图9中示出的安全会话设备900中的收发器920。
还应理解，当该安全会话装置800为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或者集成电路。
图9是本申请实施例提供的安全会话设备900的示意性框图。如图所示，该安全会话设备900包括：处理器910和收发器920。该处理器910与存储器耦合，用于执行存储器中存储的指令，以控制收发器920发送信号和/或接收信号。可选地，该安全会话设备900还包括存储器930，用于存储指令。
应理解，上述处理器910和存储器930可以合成一个处理装置，处理器910用于执行存储器930中存储的程序代码来实现上述功能。具体实现时，该存储器930也可以集成在处理器910中，或者独立于处理器910。
还应理解，收发器920可以包括接收器(或者称，接收机)和发射器(或者称，发射机)。收发器还可以进一步包括天线，天线的数量可以为一个或多个。
在一种可能的设计中，该安全会话设备900可以是上文方法实施例中的接入网设备，也可以是用于实现上文方法实施例中接入网设备的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法200至700中的接入网设备，该安全会话设备900可以包括用于执行图2中的方法200至图7中的方法700中的接入网设备执行的方法的单元。并且，该安全会话设备900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的会话管理网元，也可以是用于实现上文方法实施例中会话管理网元的功能的芯片。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的会话管理网元，也可以是用于实现上文方法实施例中会话管理网元的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法200至700中的会话 管理网元，该安全会话设备900可以包括用于执行图2中的方法200至图7中的方法700中的会话管理网元执行的方法的单元。并且，该安全会话装置800中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的接入和移动管理网元，也可以是用于实现上文方法实施例中接入和移动管理网元的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法200至700中的接入和移动管理网元，该安全会话设备900可以包括用于执行图2中的方法200至图7中的方法700中的接入和移动管理网元执行的方法的单元。并且，该安全会话设备900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的UE，也可以是用于实现上文方法实施例中UE的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法200至700中的UE，该安全会话设备900可以包括用于执行图2中的方法200至图7中的方法700中的UE执行的方法的单元。并且，该安全会话设备900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的统一数据管理网元，也可以是用于实现上文方法实施例中统一数据管理网元的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法200至700中的统一数据管理网元，该安全会话设备900可以包括用于执行图2中的方法200至图7中的方法700中的统一数据管理网元执行的方法的单元。并且，该安全会话设备900中的各单元和上述其他操作和/或功能分别为了实现图2中的方法200、图3中的方法300、图4中的方法400、图5中的方法500、图6中的方法600或图7中的方法700的相应流程。
在另一种可能的设计中，该安全会话设备900可以是上文方法实施例中的策略控制网元，也可以是用于实现上文方法实施例中策略控制网元的功能的芯片。
具体地，该安全会话设备900可对应于根据本申请实施例的方法600中的策略控制网元，该安全会话设备900可以包括用于执行图6中的方法600中的策略控制网元执行的方法的单元。并且，该安全会话设备900中的各单元和上述其他操作和/或功能分别为了实现图6中的方法600的相应流程。
应理解，各单元执行上述相应步骤的具体过程在上述方法实施例中已经详细说明，为了简洁，在此不再赘述。
当该安全会话设备900为芯片时，该芯片包括收发单元和处理单元。其中，收发单元可以是输入输出电路或通信接口；处理单元可以为该芯片上集成的处理器或者微处理器或 者集成电路。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产 品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行图2至图7所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图2至图7所示实施例中任意一个实施例的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的会话管理网元、接入网设备以及UE。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的会话管理网元、接入和移动管理网元、接入网设备、统一数据管理网元以及UE。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络侧设备与终端设备和方法实施例中的网络侧设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本 申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (26)

  1. 一种安全会话方法，其特征在于，包括：
    接入网设备接收会话管理网元发送的会话请求消息，所述会话请求消息携带终端设备的用户面安全策略以及第一速率的信息；
    在所述接入网设备无法按照所述第一速率执行所述用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
  2. 根据权利要求1所述的安全会话方法，其特征在于，
    所述接入网设备按照第二速率激活完整性保护，包括：
    基于所述用户面安全策略，所述接入网设备按照所述第二速率激活完整性保护。
  3. 根据权利要求1所述的安全会话方法，其特征在于，
    所述会话请求消息还包括指示信息；
    所述接入网设备按照第二速率激活完整性保护，包括：
    基于所述指示信息，所述接入网设备按照所述第二速率激活完整性保护。
  4. 根据权利要求1所述的安全会话方法，其特征在于，
    所述接入网设备按照第二速率激活完整性保护，包括：
    在确定所述会话满足预设条件的情况下，所述接入网设备按照所述第二速率激活完整性保护。
  5. 根据权利要求1至4中任一项所述的安全会话方法，其特征在于，所述安全会话方法还包括：
    所述接入网设备接收来自策略控制网元的速率信息，所述速率信息用于指示所述第二速率。
  6. 根据权利要求1至5中任一项所述的安全会话方法，其特征在于，所述方法还包括：
    所述接入网设备向会话管理网元发送所述第二速率的信息。
  7. 一种安全会话方法，其特征在于，包括：
    会话管理网元接收接入和移动管理网元发起的会话创建会话管理上下文服务请求；
    基于所述会话创建会话管理上下文服务请求，所述会话管理网元向所述接入和移动管理网元返回会话创建会话管理上下文服务响应，所述会话创建会话管理上下文服务响应包括指示信息，所述指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
  8. 根据权利要求7所述的安全会话方法，其特征在于，
    所述会话创建会话管理上下文服务请求包括通知信息，所述通知信息用于通知在所述接入网设备无法按照所述第一速率执行用户面安全策略的情况下，所述接入网设备按照所述第二速率激活完整性保护；
    所述安全会话方法还包括：
    基于所述通知信息，所述会话管理网元确定所述指示信息。
  9. 根据权利要求7所述的安全会话方法，其特征在于，
    所述会话创建会话管理上下文服务请求包括所述终端设备的业务类型的信息；
    所述安全会话方法还包括：
    基于所述业务类型的信息，所述会话管理网元确定所述指示信息。
  10. 根据权利要求7至9中任一项所述的安全会话方法，其特征在于，所述安全会话方法还包括：
    所述会话管理网元接收所述策略控制网元提供的速率信息；
    基于所述速率信息，所述会话管理网元确定所述第二速率。
  11. 一种安全会话装置，其特征在于，包括：处理单元和收发单元，
    所述收发单元用于：接收会话管理网元发送的会话请求消息，所述会话请求消息携带终端设备的用户面安全策略以及第一速率的信息；
    所述处理单元用于：在所述安全会话装置无法按照所述第一速率执行所述用户面安全策略的情况下，按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
  12. 根据权利要求11所述的安全会话装置，其特征在于，
    所述处理单元具体用于：
    基于所述用户面安全策略，按照所述第二速率激活完整性保护。
  13. 根据权利要求11所述的安全会话装置，其特征在于，
    所述会话请求消息还包括指示信息；
    所述处理单元具体用于：
    基于所述指示信息，按照所述第二速率激活完整性保护。
  14. 根据权利要求11所述的安全会话装置，其特征在于，所述处理单元具体用于：
    在确定所述会话满足预设条件的情况下，按照所述第二速率激活完整性保护。
  15. 根据权利要求11至14中任一项所述的安全会话装置，其特征在于，所述收发单元还用于：
    接收来自策略控制网元的速率信息，所述速率信息用于指示所述第二速率。
  16. 根据权利要求11至15中任一项所述的安全会话装置，其特征在于，所述收发单元还用于：
    向会话管理网元发送所述第二速率的信息。
  17. 一种安全会话装置，其特征在于，包括：收发单元，
    所述收发单元用于：接收接入和移动管理网元发起的会话创建会话管理上下文服务请求；
    所述收发单元还用于：基于所述会话创建会话管理上下文服务请求，向所述接入和移动管理网元返回会话创建会话管理上下文服务响应，所述会话创建会话管理上下文服务响应包括指示信息，所述指示信息用于指示：在接入网设备无法按照第一速率执行用户面安全策略的情况下，所述接入网设备按照第二速率激活完整性保护，其中，所述第二速率低于所述第一速率。
  18. 根据权利要求17所述的安全会话装置，其特征在于，
    所述会话创建会话管理上下文服务请求包括通知信息，所述通知信息用于通知在所述接入网设备无法按照所述第一速率执行用户面安全策略的情况下，所述接入网设备按照所 述第二速率激活完整性保护；
    所述安全会话装置还包括处理单元，所述处理单元用于：
    基于所述通知信息，确定所述指示信息。
  19. 根据权利要求17所述的安全会话装置，其特征在于，
    所述会话创建会话管理上下文服务请求包括所述终端设备的业务类型的信息；
    所述安全会话装置还包括处理单元，所述处理单元用于：
    基于所述业务类型的信息，确定所示指示信息。
  20. 根据权利要求17至19中任一项所述的安全会话装置，其特征在于，
    所述收发单元还用于：
    接收策略控制网元提供的速率信息；
    所述安全会话装置还包括处理单元，所述处理单元用于：
    基于所述速率信息，确定所述第二速率。
  21. 一种安全会话装置，包括处理器和存储器，所述存储器用于存储指令，所述处理器用于读取所述存储器中存储的指令，使得所述安全会话装置实现上述权利要求1至10中任一项所述的方法。
  22. 一种处理装置，其特征在于，包括至少一个处理器，所述至少一个处理器用于执行存储器中存储的计算机程序，以使得所述装置实现如权利要求1至10中任一项所述的方法。
  23. 一种处理装置，其特征在于，包括：
    通信接口，用于输入和/或输出信息；
    处理器，用于执行计算机程序，以使得所述装置实现如权利要求1至10中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，包括计算机程序，当所述计算机程序在安全会话装置运行时，使得所述安全会话装置执行如权利要求1至10中任一项所述的方法。
  25. 一种计算机程序产品，其特征在于，所述计算机程序产品中包括计算机程序代码，其特征在于，当所述计算机程序代码在安全会话装置上运行时，使得安全会话装置实现上述权利要求1至10中任一项所述的方法。
  26. 一种芯片，其特征在于，所述芯片包括处理模块与通信接口，所述处理模块用于控制所述通信接口与外部进行通信，所述处理模块用于执行如权利要求1至10中任一项所述的方法。
PCT/CN2020/090240 2019-05-23 2020-05-14 安全会话方法和装置 WO2020233496A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910432802.2 2019-05-23
CN201910432802.2A CN111988782B (zh) 2019-05-23 2019-05-23 安全会话方法和装置

Publications (1)

Publication Number Publication Date
WO2020233496A1 true WO2020233496A1 (zh) 2020-11-26

Family

ID=73437367

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/090240 WO2020233496A1 (zh) 2019-05-23 2020-05-14 安全会话方法和装置

Country Status (2)

Country Link
CN (1) CN111988782B (zh)
WO (1) WO2020233496A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117336711A (zh) * 2022-06-25 2024-01-02 华为技术有限公司 安全决策协商方法及网元

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140269613A1 (en) * 2013-03-18 2014-09-18 Nokia Siemens Networks Oy Integrity protection towards one CN after handovers involving multiple services to be handled by different CNs
CN109618335A (zh) * 2017-05-05 2019-04-12 华为技术有限公司 一种通信方法及相关装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109218325B (zh) * 2017-08-11 2020-03-10 华为技术有限公司 数据完整性保护方法和装置
JP6977153B2 (ja) * 2017-10-02 2021-12-08 テレフオンアクチーボラゲット エルエム エリクソン（パブル） 無線通信システムにおけるアクセスストラタムセキュリティ
MX2020005121A (es) * 2017-11-16 2020-11-06 Zte Corp Método y dispositivo de computo para llevar a cabo protección de integridad de datos.

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140269613A1 (en) * 2013-03-18 2014-09-18 Nokia Siemens Networks Oy Integrity protection towards one CN after handovers involving multiple services to be handled by different CNs
CN109618335A (zh) * 2017-05-05 2019-04-12 华为技术有限公司 一种通信方法及相关装置

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
ERICSSON: "Handling of maximum supported data rate per UE for integrity protection of DRBs", 3GPP TSG-SA WG3 MEETING #92 S3-182351, 24 August 2018 (2018-08-24), XP051541445, DOI: 20200731100409A *
ERICSSON: "UP security policy", 3GPP TSG-SA WG3 MEETING #91 S3-181309, 20 April 2018 (2018-04-20), XP051438412, DOI: 20200731100202A *
HUAWEI ET AL.: "Deletion of the 5GSM cause #8", 3GPP TSG-CT WG1 MEETING #116 C1-192228, 12 April 2019 (2019-04-12), XP051705420, DOI: 20200731100921A *

Also Published As

Publication number Publication date
CN111988782A (zh) 2020-11-24
CN111988782B (zh) 2022-04-12

Similar Documents

Publication Publication Date Title
WO2020029938A1 (zh) 安全会话方法和装置
US11477689B2 (en) Method and apparatus for establishing guaranteed bit rate (GBR) quality of service (QoS) flow in session
WO2021135295A1 (zh) 建立连接和获取中继服务代码的方法和通信装置
WO2020200066A1 (zh) 获取数据包延迟参数的方法、系统和装置
WO2020052531A1 (zh) 获取安全上下文的方法和装置
WO2019196643A1 (zh) 通信的方法和通信装置
US11489760B2 (en) Multicast group creation method, multicast group joining method, and apparatus
WO2017054183A1 (zh) 业务承载拥塞控制的方法及设备
WO2020052613A1 (zh) 切换方法和终端设备
US20220124500A1 (en) Communication method, terminal device and network device
US20220141664A1 (en) Data transmission method and apparatus in network slice architecture
WO2020151614A1 (zh) 用户面安全保护的方法和装置
US20220272577A1 (en) Communication method and communication apparatus
WO2021062727A1 (zh) 一种重定向方法及装置、终端设备、网络设备
WO2020233496A1 (zh) 安全会话方法和装置
WO2019028794A1 (zh) 确定业务路径的方法和设备
WO2020142884A1 (zh) 切换传输路径的方法及装置
WO2022174802A1 (zh) 密钥更新的方法和装置
WO2021147672A1 (zh) 会话处理方法及通信装置
WO2020200297A1 (zh) 选择会话管理网元的方法和装置
WO2017193368A1 (zh) 用于调整编码速率的方法和装置
WO2019196668A1 (zh) 一种信息发送方法、密钥生成方法以及装置
WO2021208817A1 (zh) 网络资源控制的方法及设备
WO2020207304A1 (zh) 通信方法与设备
US20220124158A1 (en) Method and apparatus for changing data transmission scheme, device, and storage medium

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20810252

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20810252

Country of ref document: EP

Kind code of ref document: A1