WO2020238596A1

WO2020238596A1 - Handover method, apparatus and communications system

Info

Publication number: WO2020238596A1
Application number: PCT/CN2020/089622
Authority: WO
Inventors: 李飞; 张博
Original assignee: 华为技术有限公司
Priority date: 2019-05-29
Filing date: 2020-05-11
Publication date: 2020-12-03
Also published as: CN112020056B; CN112020056A

Abstract

Provided in embodiments of the present application are a handover method, an apparatus and a communications system, used in a scenario in which a main base station (MN) to which user equipment in a dual connectivity state is connected performs handover while a secondary base station (SN) does not change. The method comprises: a first MN sends a handover request message to a second MN, the handover request message carrying first indicator information, the first indicator information being used to indicate security capabilities of an SN, and the second MN determines a security policy according to the security capabilities of the SN. The handover method provided in the present application enables a second MN in an MN handover process to learn security capabilities of an SN, and to determine a security policy on the basis of the security capabilities of the SN, lowering signaling overhead between the second MN and a UE.

Description

Method, device and communication system for switching

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on May 29, 2019, the application number is 201910457885.0, and the application name is "Method, Device and Communication System for Handover", the entire content of which is incorporated into this application by reference in.

Technical field

This application relates to the field of communications, and more specifically, to a method, device and communication system for handover.

Background technique

The user equipment in the communication system can perform data transmission with two network equipment at the same time, which is called dual-connectivity (DC). Among them, one of the two network devices is responsible for sending radio resource control (Radio Resource Control, RRC) messages to the user equipment and for interacting with the core network. This network device is called the main node (MN), Another network device is called a secondary network device (secondary node, SN).

When the user equipment switches from the source MN to the target MN to connect to the target MN and the SN, respectively, the problem of how the target MN negotiates security policies with the SN needs to be solved urgently.

Summary of the invention

This application provides a handover method, device, and communication system. In the MN handover procedure, the first primary base station MN carries the security capability information of the secondary base station SN in a handover request message to notify the second primary base station MN, so that the second primary base station MN The primary base station MN can learn the security capability of the SN during the MN handover process, and determine the security policy according to the security capability of the SN to reduce the signaling overhead between the second MN and the UE.

In the first aspect, a handover method is provided. User equipment is connected to a first primary base station MN and a secondary base station SN respectively. When the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN. When the second MN is connected to the SN, the method includes: the first MN sends a handover request message to the second MN, the handover request message carries first indication information, and the first indication information is used for Indicate the security capability of the SN; the second MN determines a security policy according to the security capability of the SN.

In the handover method provided by the embodiment of the present application, the first MN carries the first indication information indicating the security capability of the assisting base station SN in the handover request message in the MN handover process, and notifies the second MN so that the second MN can In the MN handover procedure, the security capability of the SN is learned based on the first indication information, and the security policy is determined based on the security capability of the SN.

With reference to the first aspect, in some implementations of the first aspect, the second MN determines a security policy according to the security capability of the SN, including: when the SN does not support security protection, the second MN determines The security policy is not to activate security protection between the second MN and the user equipment.

In the handover method provided by the embodiment of the present application, the second MN determines that the security policy according to the security capability of the SN may be that the second MN determines that the security policy is not to activate the second MN when it learns that the SN does not support security protection based on the security capability of the SN Security with user equipment.

With reference to the first aspect, in some implementations of the first aspect, the method further includes: the second MN sends second indication information to the SN, where the second indication information is used to indicate that the SN does not Activate the security protection between the SN and the user equipment.

In the handover method provided by the embodiment of the present application, after the second MN determines the security policy based on the security capability of the SN, the security policy may be notified to the SN through the second indication information.

With reference to the first aspect, in some implementations of the first aspect, the second MN determines a security policy according to the security capability of the SN, including: the second MN determines the security policy according to the second MN and the SN The security capability determines the security strategy.

In the handover method provided in the embodiment of the present application, the second MN determines the security policy according to the security capability of the SN, which may be that the second MN determines the security policy based on the security capability of the SN and the security capability of the second MN.

With reference to the first aspect, in some implementations of the first aspect, the second MN determines a security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection but When the second MN does not support security protection, the second MN determines that the security policy is not to activate security protection between the second MN and the user equipment.

In the handover method provided by the embodiment of the present application, the second MN determines the security policy according to the security capabilities of the second MN and the SN, specifically when the SN supports security protection but the second MN does not support security protection , The security protection between the second MN and the user equipment is not activated.

With reference to the first aspect, in some implementations of the first aspect, the method further includes: the second MN sends third indication information to the SN, and the third indication information is used to indicate that the SN does not Activate the security protection between the SN and the user equipment.

In the handover method provided by the embodiment of the present application, after the second MN determines the security policy based on the security capability of the SN and the security capability of the second MN, the third indication information may indicate the security policy between the SN and the UE.

With reference to the first aspect, in some implementations of the first aspect, the second MN determines a security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection and the When the second MN supports security protection, the second MN determines that the security policy is to activate security protection between the second MN and the user equipment.

In the handover method provided by the embodiment of the present application, the second MN determines the security policy according to the security capabilities of the second MN and the SN. Specifically, when the SN supports security protection and the second MN supports security protection, activate the Security protection between the second MN and the user equipment.

With reference to the first aspect, in some implementations of the first aspect, the method further includes: the second MN sends fourth indication information to the SN, where the fourth indication information is used to indicate that the SN is activated Security protection between the SN and the user equipment.

In the handover method provided in the embodiment of the present application, after the second MN determines the security policy based on the security capability of the SN and the security capability of the second MN, the security policy between the SN and the UE may be indicated through the fourth indication information.

With reference to the first aspect, in some implementations of the first aspect, the security protection is encryption protection and/or integrity protection.

In the switching method provided in the embodiment of the present application, the security protection is encryption protection and/or integrity protection.

It should be understood that the aforementioned security protection is encryption protection and/or integrity protection; the aforementioned security capability is whether to support encryption protection and/or integrity protection.

In a second aspect, a handover method is provided. User equipment is connected to a first primary base station MN and a secondary base station SN. When the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN. When the second MN is connected to the SN, the method includes: the first primary base station MN determines to perform MN handover; the first MN sends a handover request message to the second MN, and the handover request message carries a first indication Information, the first indication information is used to indicate the security capability of the SN, where the security capability of the SN includes whether the SN supports security protection, and/or the SN is for the packet data unit of the UE Whether to enable security protection for the PDU session, the security protection includes encryption protection and/or integrity protection.

In the handover method provided in the embodiment of the present application, the first primary base station MN carries the first indication information indicating the security capability of the secondary base station SN in the handover request message in the MN handover process, and notifies the second primary base station MN, so that The second primary base station MN can learn the security capability of the SN based on the first indication information during the MN handover procedure.

With reference to the second aspect, in some implementations of the second aspect, the first indication information is carried in the UE context parameter at the auxiliary access network node carried in the handover request message.

In the handover method provided by the embodiment of the present application, the above-mentioned first indication information may be a new information element of the UE context parameter at the auxiliary access network node carried in the handover request message.

It should be understood that the foregoing first indication information may also be a new information element carried in other parameters in the handover request message, or the first indication information may be a newly added parameter in the handover request message, which is described in this embodiment of the application. Not limited.

In a third aspect, a handover method is provided. User equipment is connected to a first primary base station MN and a secondary base station SN respectively. When the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN. When the second MN is connected to the SN, the method includes: the second primary base station MN receives a handover request message from the first MN, the handover request message carries first indication information, and the first indication information is used to indicate The security capability of the assisting base station SN; the second MN determines a security policy according to the security capability of the SN.

In the handover method provided by the embodiment of the present application, the second primary base station MN can learn the security capability of the SN based on the first indication information received from the first MN during the MN handover process, and determine the security policy according to the security capability of the SN .

With reference to the third aspect, in some implementations of the third aspect, the second MN determines a security policy according to the security capability of the SN, including: when the SN does not support security protection, the second MN determines The security policy is not to activate security protection between the second MN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the method further includes: the second MN sends second indication information to the SN, where the second indication information is used to indicate that the SN does not Activate the security protection between the SN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the second MN determines a security policy according to the security capability of the SN, including: the second MN determines the security policy according to the second MN and the SN The security capability determines the security strategy.

With reference to the third aspect, in some implementations of the third aspect, the second MN determines a security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection but the When the second MN does not support security protection, the second MN determines that the security policy is not to activate security protection between the second MN and the user equipment.

In the handover method provided by the embodiment of the present application, the second MN determines the security policy according to the security capabilities of the second MN and the SN. Specifically, when the SN supports security protection but the second MN does not support security protection, it is not activated. Security protection between the second MN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the method further includes: the second MN sends third indication information to the SN, and the third indication information is used to indicate that the SN does not Activate the security protection between the SN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the second MN determines a security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection and the When the second MN supports security protection, the second MN determines that the security policy is to activate security protection between the second MN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the method further includes: the second MN sends fourth indication information to the SN, where the fourth indication information is used to indicate that the SN is activated Security protection between the SN and the user equipment.

With reference to the third aspect, in some implementations of the third aspect, the security protection is encryption protection and/or integrity protection.

In a fourth aspect, a communication system is provided, which can be used to perform the operations of the first MN and the second MN in the first aspect and any possible implementation of the first aspect. Specifically, the communication system includes means for performing the steps or functions described in the first aspect and any possible implementation of the first aspect. The means may be the first MN and the second MN in the first aspect. MN or chip or functional module inside the first MN and the second MN. The steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.

Specifically, the first MN and the second MN included in the communication system may perform the following operations: the first MN is configured to send a handover request message to the second MN, and the handover request message carries the first indication information, so The first indication information is used to indicate the security capability of the SN; the second MN is used to determine a security policy according to the security capability of the SN.

Exemplarily, the second MN determines the security policy according to the security capability of the SN, including: when the SN does not support security protection, the second MN determines that the security policy is to not activate the second MN and the user Security protection between devices.

Exemplarily, the second MN is further configured to send second indication information to the SN, where the second indication information is used to indicate that the SN does not activate the security protection between the SN and the user equipment.

Exemplarily, the second MN determining the security policy according to the security capabilities of the SN includes: the second MN determining the security policy according to the security capabilities of the second MN and the SN.

Exemplarily, the second MN determines the security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection but the MN does not support integrity protection, the second MN determines The security policy is not to activate security protection between the second MN and the user equipment.

Exemplarily, the second MN is further configured to send third indication information to the SN, where the third indication information is used to indicate that the SN does not activate the security protection between the SN and the user equipment.

Exemplarily, the second MN determines the security policy according to the security capabilities of the second MN and the SN, including: when the SN supports security protection and the MN supports integrity protection, the second MN determines The security policy is to activate security protection between the second MN and the user equipment.

Exemplarily, the second MN sends fourth indication information to the SN, where the fourth indication information is used to instruct the SN to activate security protection between the SN and the user equipment.

Exemplarily, the security protection is encryption protection and/or integrity protection.

In a fifth aspect, a handover device is provided, which can be used to perform the operation of the first primary base station MN in the second aspect and any possible implementation manner of the second aspect. Specifically, the device for handover includes the steps or functions corresponding to the steps or functions described in the second aspect and any possible implementation of the second aspect. The means may be the first primary base station MN in the second aspect. Or a chip or functional module inside the first main base station MN. The steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.

In the sixth aspect, a handover device is provided, which can be used to perform the operation of the second primary base station MN in the third aspect and any possible implementation manner of the third aspect. Specifically, the handover device may include the steps or functions described in any possible implementation of the second aspect and the third aspect. The corresponding means may be the second primary base station of the third aspect. The chip or functional module inside the MN or the second main base station MN. The steps or functions can be realized by software, or by hardware, or by a combination of hardware and software.

In a seventh aspect, a communication device is provided, including a processor, a transceiver, and a memory, where the memory is used to store a computer program, and the transceiver is used to execute any one of the possible implementation manners of the second and third aspects In the transceiving step in the switching method, the processor is used to call and run the computer program from the memory, so that the communication device executes the switching method in any one of the possible implementation manners of the second and third aspects.

Optionally, there are one or more processors and one or more memories.

Optionally, the memory may be integrated with the processor, or the memory and the processor may be provided separately.

Optionally, the transceiver includes a transmitter (transmitter) and a receiver (receiver).

In one possible design, a communication device is provided, including a transceiver, a processor, and a memory. The processor is used to control the transceiver to send and receive signals, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the communication device executes the second aspect and any possible implementation of the second aspect Method in.

In another possible design, a communication device is provided, including a transceiver, a processor, and a memory. The processor is used to control the transceiver to send and receive signals, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the communication device executes the third aspect and any possible implementation manners of the third aspect Method in.

In an eighth aspect, a system is provided, and the system includes the switching devices provided in the fifth aspect and the sixth aspect.

In a ninth aspect, a computer program product is provided. The computer program product includes: a computer program (also called code, or instruction), which when the computer program is executed, causes the computer to execute any one of the second and third aspects. One of the possible implementation methods.

In a tenth aspect, a computer-readable medium is provided, and the computer-readable medium stores a computer program (also called code, or instruction) when it runs on a computer, so that the computer executes the above-mentioned second and third aspects. Any one of the possible implementation methods.

In an eleventh aspect, a chip system is provided, including a memory and a processor, the memory is used to store a computer program, the processor is used to call and run the computer program from the memory, so that the communication device installed with the chip system executes The method in any one of the above-mentioned second and third aspects.

Description of the drawings

FIG. 1 is a schematic diagram of a communication system 100 to which the handover method provided in an embodiment of the present application is applicable.

Figure 2 is a schematic flow chart for establishing a dual connection.

Figure 3 is a schematic diagram of MN handover.

Fig. 4 is a schematic diagram of a handover method provided by an embodiment of the present application.

Fig. 5 is a schematic diagram of another handover method provided by an embodiment of the present application.

FIG. 6 is a schematic diagram of the switching device 10 proposed by the present application.

FIG. 7 is a schematic structural diagram of a user equipment 20 applicable to an embodiment of the present application.

FIG. 8 is a schematic diagram of the switching device 30 proposed in the present application.

FIG. 9 is a schematic structural diagram of a first MN 40 applicable to an embodiment of the present application.

FIG. 10 is a schematic diagram of the switching device 50 proposed in this application.

FIG. 11 is a schematic structural diagram of a second MN 60 applicable to an embodiment of the present application.

Detailed ways

The technical solution in this application will be described below in conjunction with the drawings.

The technical solutions of the embodiments of this application can be applied to various communication systems, such as: long term evolution (LTE) system, LTE frequency division duplex (FDD) system, LTE time division duplex (time division duplex) , TDD), Universal Mobile Telecommunication System (UMTS), Worldwide Interoperability for Microwave Access (WiMAX) Communication System, Future 5th Generation (5G) System or New Wireless ( new radio, NR) etc.

The user equipment (user equipment) in the embodiments of the present application may refer to an access terminal, a user unit, a user station, a mobile station, a mobile station, a relay station, a remote station, a remote terminal, a mobile device, a user terminal, and a terminal device. (terminal equipment), terminal (terminal), wireless communication equipment, user agent or user device. The user equipment can also be a cellular phone, a cordless phone, a session initiation protocol (SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), with wireless communication Functional handheld devices, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, user equipment in the future 5G network or future evolution of the public land mobile network (PLMN) User equipment, etc., which are not limited in this embodiment of the present application.

The network device in the embodiment of the present application may be any device with wireless transceiving function used to communicate with user equipment. This equipment includes but is not limited to: evolved Node B (eNB), radio network controller (RNC), Node B (NB), base station controller (BSC) , Base transceiver station (base transceiver station, BTS), home base station (home evolved NodeB, HeNB, or home Node B, HNB), baseband unit (BBU), wireless fidelity (wireless fidelity, WIFI) system Access point (AP), wireless relay node, wireless backhaul node, transmission point (TP) or transmission and reception point (TRP), etc., can also be 5G, such as NR , The gNB in the system, or the transmission point (TRP or TP), one or a group of antenna panels (including multiple antenna panels) of the base station in the 5G system, or the network node that constitutes the gNB or transmission point, Such as baseband unit (BBU), or distributed unit (DU), etc.

In some deployments, the gNB may include a centralized unit (CU) and a DU. The gNB may also include an active antenna unit (AAU). CU implements part of the functions of gNB, and DU implements part of the functions of gNB. For example, the CU is responsible for processing non-real-time protocols and services, and implements radio resource control (radio resource control, RRC), packet data convergence protocol (packet data convergence protocol, PDCP) layer functions. The DU is responsible for processing physical layer protocols and real-time services, and realizes the functions of the radio link control (RLC) layer, media access control (MAC) layer, and physical (PHY) layer. AAU realizes some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by DU , Or, sent by DU+AAU. It can be understood that the network device may be a device that includes one or more of a CU node, a DU node, and an AAU node. In addition, the CU can be divided into network equipment in an access network (radio access network, RAN), or the CU can be divided into network equipment in a core network (core network, CN), which is not limited in this application.

In the embodiments of the present application, the user equipment or network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also referred to as main memory). The operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system. The application layer includes applications such as browsers, address books, word processing software, and instant messaging software. In addition, the embodiments of the application do not specifically limit the specific structure of the execution subject of the methods provided in the embodiments of the application, as long as the program that records the codes of the methods provided in the embodiments of the application can be provided according to the embodiments of the application. For example, the execution subject of the method provided in the embodiments of the present application may be user equipment or network equipment, or a functional module in the user equipment or network equipment that can call and execute programs.

In addition, various aspects or features of the present application can be implemented as methods, devices, or products using standard programming and/or engineering techniques. The term "article of manufacture" as used in this application encompasses a computer program accessible from any computer-readable device, carrier, or medium. For example, computer-readable media may include, but are not limited to: magnetic storage devices (for example, hard disks, floppy disks, or tapes, etc.), optical disks (for example, compact discs (CD), digital versatile discs (DVD)) Etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). In addition, various storage media described herein may represent one or more devices and/or other machine-readable media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.

FIG. 1 is a schematic diagram of a communication system 100 to which the handover method provided in an embodiment of the present application is applicable. The schematic diagram includes a main base station #1 (base station 10 shown in FIG. 1), a main base station #2 (shown in FIG. Base station 11), auxiliary base station (base station 20 shown in FIG. 1), and user equipment 30.

The handover method provided in the present application mainly relates to the case where the user equipment supports dual connectivity. As shown in FIG. 1, a schematic diagram of a network architecture in which a primary base station and an auxiliary base station simultaneously provide communication services for the user equipment. For user equipment configured with dual connectivity, the primary base station can configure at least one serving cell including primary cell (primarily cell, PCell). These cells can be called master cell group (MCG), and the primary cell can be used Provide non-access layer information and security parameters at the main base station. For example, the primary cell group may include one primary cell or at least one secondary cell; the secondary base station may be configured with at least one serving cell including a primary secondary cell (PSCell), and the secondary primary cell can be used as a secondary cell. The base station provides physical layer uplink control channels, or random access, etc. These cells can be called secondary cell groups (SCG). For example, the secondary cell group may include one primary and secondary cell, or may further include at least one secondary cell. .

In this embodiment of the application, the scenario involved is the occurrence of handover of a primary base station that provides services to user equipment. Before handover, the primary base station that provides services to the user equipment is hereinafter referred to as the source primary base station (base station 10 shown in Figure 1); after the handover, the primary base station that provides services to the user equipment is hereinafter referred to as the target primary base station (as shown in Figure 1). The base station shown 11). In the same way, before handover, the auxiliary base station that provides services to the user equipment is hereinafter referred to as the source auxiliary base station; after the handover, the auxiliary base station that provides services to the user equipment is hereinafter referred to as the target auxiliary base station. Because, the embodiment of the present application only involves the handover of the primary base station, that is, the secondary base stations before and after the primary base station is switched are the same base station.

In order to facilitate the understanding of the handover method provided in the embodiments of the present application, the following briefly introduces several basic concepts involved in the embodiments of the present application:

1. Dual connection.

Dual connectivity is an important technology introduced in 3GPP Release 12. Through dual connectivity technology, macro base stations and micro base stations in LTE can use the existing non-ideal backhaul X2 interface to implement carrier aggregation, thereby providing higher rates for user equipment, and using macro networking Or micro-networking improves spectrum efficiency and load balance. User equipment that supports dual connections can connect two network devices at the same time, increasing the throughput of a single user device.

2. Establish a dual connection.

As shown in Figure 2, Figure 2 is a schematic flow chart of establishing a dual connection. The flowchart includes MN, SN, and UE.

Establishing a dual connection includes the following steps:

S210, the RRC connection is established.

Refers to the establishment of an air interface connection between the UE and the MN.

S220: The MN sends an SN addition request message to the SN.

The SN addition request message may be called (SN addition/modification request). The SN addition request message carries the security capability information of the UE, for example, the encryption protection algorithm supported by the UE and the integrity protection algorithm supported by the UE. Further, the SN addition request message will also carry the user plane security policy of the UE.

The security policies involved in this application include security policies for encryption protection and integrity protection. Among them, the security policies for encryption protection include the following types:

1). Required: Encryption protection must be turned on. If the base station does not support it, session establishment will be rejected;

2) Not needed: No need to open encryption protection;

3) Preferred: Encryption protection is turned on first. If it cannot be turned on, the base station returns a notification that the encryption protection is not turned on to the session management function (SMF) network element, without the need to refuse session establishment.

Similarly, security policies for integrity protection include the following types:

1), required (required): integrity protection must be turned on, if the base station does not support it, session establishment will be rejected;

2) Not needed: No need to turn on integrity protection;

3). Preferred: the integrity protection is turned on first. If it cannot be turned on, the base station only needs to return a notification that the integrity protection is not turned on to the SMF network element, without the need to refuse session establishment.

It should be understood that the integrity protection algorithm and the encryption protection algorithm are not limited in this application, and they may be existing algorithms or algorithms proposed after the development of communication technology.

Optionally, after the UE accesses the MN, the MN reports the UE’s connectivity capabilities, such as whether the UE supports dual connectivity, whether there are cells that support dual connectivity in the neighbor cell list, and the link between the MN and these dual connectivity-enabled cells. Road status determines whether to add SN for the UE. If the UE supports dual connectivity, and the neighbor cell list that supports dual connectivity is configured in the neighbor cell list, and the link status of the MN and these dual connectivity-supporting cells is connected, the dual connectivity establishment process is triggered to add an SN for the UE.

It should be understood that there is no restriction on how to establish a dual connection in this application, and it can be any existing way of establishing a dual connection, and this application only provides a brief description.

S230: The SN judges whether integrity protection and/or encryption protection is enabled.

SN selects an encryption protection algorithm and an integrity protection algorithm according to the security algorithm supported by itself and the security algorithm supported by the UE. At the same time, SN decides whether to enable integrity protection and/ Or whether to enable encryption protection.

S240: The SN sends an SN addition request response message to the MN.

The SN addition request message may be called (SN addition/modification request acknowledge). The SN addition request message carries the encryption protection algorithm, the integrity protection algorithm, the user plane security integrity protection result and the encryption protection result selected by the SN and is sent to the MN.

S250: The MN sends an RRC reconfiguration message to the UE.

The RRC connection reconfiguration message carries information such as the encryption protection algorithm, integrity protection algorithm, counter selected by the SN, whether encryption protection and/or integrity protection is enabled by the SN, and the result of encryption protection and/or integrity protection performed by the SN. .

The SN transmits its own key information to the UE through S240 and S250. It should be understood that when the MN establishes a connection with the UE, it also needs to transmit its own key information to the UE.

In fact, the MN passes its own key information to the UE, and the SN passes its own key information to the UE through S240 and S250, which is to configure some parameters of the transmission link between the UE and the MN and between the UE and the SN. Before the dual connection is established, there is no direct connection between the SN and the UE, so it is passed through the MN.

S260: The UE sends an RRC reconfiguration complete message to the MN.

After the UE configures the parameters according to the key information issued by the MN, it feeds back to the MN through the RRC reconfiguration complete message.

S270: The MN sends an SN reconfiguration complete message to the SN.

The MN will receive the message that the UE has configured the parameters from the UE and inform the SN through the SN reconfiguration complete message.

S280, SN and UE activation parameters.

The UE and SN can perform encryption protection or integrity protection according to the previously configured parameters. If the incomplete protection is decided before, the integrity protection will not be activated.

S290, a random access procedure is performed between the SN and the UE.

The random access procedure between the SN and the UE means that the UE and the SN start to communicate.

It should be understood that in this application, the primary base station in the dual connectivity scenario is referred to as MN, which is just an example, and does not constitute any limitation to the protection scope of this application. For example, the primary base station can also be referred to as (main evolutional NodeB, MeNB) or (main gNode B, MgNB), etc.; for the same reason, in this application, the secondary base station in the dual connectivity scenario is called SN, which is just an example, and does not constitute any limitation to the protection scope of this application. For example, secondary base station can also be called (secondary evolutional NodeB, SeNB) or (secondary gNodeB, SgNB), etc.

It should also be understood that FIG. 2 is a description of the dual connection establishment process, and does not constitute any limitation to the protection scope of the present application. The specific establishment process can refer to the provisions of the existing agreement, which will not be repeated.

3. MN handover.

As shown in Figure 3, Figure 3 is a schematic diagram of MN handover. Including source MN, target MN, and UE.

MN handover includes the following steps:

S310: The source MN initiates measurement control to the UE.

S320: The UE sends a measurement report to the source MN.

S330: The source MN decides to perform handover.

The source MN performs MN handover according to the measurement report returned by the UE.

It should be understood that the reason why the source MN decides to perform the MN handover in the embodiment of the present application is not limited, and may be any corresponding possible reason when the MN handover occurs in the existing protocol. For example, based on the measurement report sent by the UE, the source MN determines that the current quality of the service provided to the UE is poor, and selects a suitable target MN from the neighbor cell list to provide the UE with the service.

S340: The source MN sends a handover request message to the target MN.

After the source MN decides that it needs to perform MN handover, it selects a suitable target MN that provides services for the UE, and sends a handover request message to the target MN.

Specifically, since the embodiment of the present application mainly involves the handover of the MN, and the SN connected to the MN before and after the handover is the same, the handover request message carries the indication information indicating the SN and the indication information indicating the UE.

It should be understood that, in the embodiments of the present application, when a MN handover occurs, how the source MN sends a handover request to the target MN and the information carried in the handover request message are not limited, and it is sufficient to refer to the existing protocol. For example, when the source MN sends a handover request (handover request) message in S340, it will carry a parameter in the handover request: UE Context Reference at the S-NG-RAN node, this parameter contains two IDs, one is Global NG-RAN Node ID indicates S-RAN node ID; one is S-NG-RAN node UE XnAP ID indicates UE.

S350, target MN admission control.

After the target MN receives the handover request message sent by the source MN, it judges whether handover is possible and prepares air interface resources.

S360: The target MN sends a handover request response message to the source MN.

After the target MN is determined to provide services for the UE, the source MN sends a handover request acknowledgement message. The handover request acknowledgement carries a parameter: UE context keep indicator (UE context keep indicator), which is used to indicate the handover but When the SN does not change, the SN needs to maintain the context of the UE. In other words, when the MN is handed over, the SN can remain unchanged and continue to be the SN of the MN after the handover.

S370: The source MN sends the downlink connection configuration to the UE.

The source MN receives the configuration parameters from the target MN, and forwards the configuration parameters to the UE so that the UE can perform corresponding configuration.

S380: Establish an RRC connection between the UE and the target MN.

After the UE completes the configuration, it can establish an RRC connection with the target MN.

It should be understood that FIG. 3 is only to facilitate the understanding of the MN handover involved in the embodiments of the present application, and a simple description is provided. The detailed MN handover process will not be repeated, and the MN handover specified in the existing protocol can be referred to.

In the existing protocol, when the MN is switched and the SN remains unchanged, after the MN is switched, the process of establishing a dual connection between the target MN and the SN is shown in Figure 2.

Optionally, in the dual-connection scenario of ultra-reliable and low latency communications (URLLC), the data protection methods between the UE and the MN, and between the UE and the SN are required to be consistent. Data protection Methods include integrity protection methods and/or encryption protection methods. According to the handover process shown in Figure 3, after the handover is completed, the MN needs to perform the process of establishing a dual link with the SN as shown in Figure 2. The SN directly or indirectly informs the target MN of its security capabilities. In order to identify whether the SN supports the relevant security protection mode, it may cause the target MN to re-establish the RRC connection with the target MN and the UE after learning the security protection mode of the SN, resulting in additional signaling interaction.

For example, after performing the RRC connection between the target MN and the UE in S210 shown in Figure 2, the data protection method between the UE and the target MN is encryption protection; after performing S220-S240 shown in Figure 2, the target MN learns the information of the SN If the security capability does not support encryption protection, the RRC connection needs to be re-established between the target MN and the UE, and the data protection mode between the UE and the target MN is negotiated to be non-encrypted protection to ensure that the data protection mode on the dual connection is consistent;

For another example, after the RRC connection is established between the target MN and the UE in S210 shown in FIG. 2, the data protection mode between the UE and the target MN is integrity protection; after S220-S240 shown in FIG. 2, the target MN learns If the security capability of the SN does not support integrity protection, the aforementioned S220-S240 are invalid signaling. If the target MN knows the security capability of the SN in advance, the aforementioned S220-S240 will not be initiated, saving signaling overhead.

Optionally, in a non-URLLC dual-connection scenario, after the handover of the MN is completed, the target MN may need to offload a part of packet data unit (PDU) sessions to the SN. If the SN cannot accept The offload request of the target MN results in offload failure, making the offload related signaling invalid signaling. If the target MN knows the security capability of the SN in advance, the above offload will not be initiated, saving signaling overhead.

For example, the source MN supports integrity protection, but the SN does not support integrity protection. The source MN receives 6 PDU session requests, of which 3 PDU sessions (PDU1, PDU2, and PDU3) require integrity protection, and the other 3 PDU sessions (PDU4, PDU5, and PDU6) do not require integrity protection. At this time, the source MN carries PDU1, PDU2, and PDU3 to itself, and offloads PDU4, PDU5, and PDU6 to SN. When MN handover occurs, the target MN may try to offload PDU1, PDU2, and PDU3 to the SN because it does not support integrity protection. However, if the SN does not support integrity protection, it will reject the offloading request, resulting in additional signaling overhead. If the target MN knows in advance that the SN does not support integrity protection, it can directly reject the session that requires integrity protection as early as the session is established, and there will be no subsequent signaling overhead.

That is to say, if the process of performing MN handover is the process shown in FIG. 3, after the handover, the process of establishing a dual connection between the target MN and the SN may cause the above-mentioned defect of additional signaling overhead. The embodiment of the application provides a handover method. The source MN forwards the security capabilities of the SN to the target MN during the MN handover process, so that the target MN can learn the security capabilities of the SN in advance, and further the target MN can be based on the security of the SN Ability to perform session processing and security policy decisions, to achieve the goal of saving signaling overhead in the process of establishing dual connections between the target MN and SN. The handover method provided by the embodiment of the present application will be described in detail below with reference to FIG. 4 and FIG. 5. Among them, the method flow shown in Figure 4 is mainly to learn the security capabilities of the SN from the target MN, and how to reduce the signaling overhead between the target MN and the UE from the perspective of determining the security policy based on the security capabilities of the SN; The method flow shown is mainly to learn the security capability of the SN from the target MN, and how to reduce the signaling overhead between the target MN and the SN from the perspective of determining the rejection of session establishment based on the security capability of the SN.

Fig. 4 is a schematic diagram of a handover method provided by an embodiment of the present application. It includes a first MN, a second MN, an SN, and a UE. Before the handover occurs, the UE is connected to the first MN and the SN respectively; the first MN may also be referred to as the source MN; The UE is connected to the second MN and the SN respectively, and the second MN may also be referred to as a target MN. In addition, optionally, in the process of UE handover from the first MN to the second MN, the UE always maintains a connection with the SN.

Specifically, the UE is connected to the first primary base station MN and the secondary base station SN respectively, and when the UE is handed over from the first MN to the second MN to connect to the second MN and the SN, The switching method includes the following steps:

S410: The first MN sends a handover request message to the second MN.

Wherein, the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN. Specifically, the security capabilities of the SN include whether the SN supports security protection. The security protection involved in this application includes at least one of encryption protection and integrity protection, that is, the security capability of SN can be that SN supports integrity protection, SN supports encryption protection, and SN supports encryption protection and integrity protection; Further, it can also specifically indicate whether the SN supports encryption protection for these PDU sessions for the PDU sessions performed by the UE, or whether the SN supports integrity protection for these PDU sessions, or whether the SN supports for these PDU sessions Turn on encryption protection and integrity protection.

As a possible implementation, the first indication information needs to indicate whether the security capability of the SN is whether the SN supports security protection, the first indication information may be a two-bit bitmap, and the first bit is used for Indicates whether the SN supports encryption protection (bit value 0 means not supported, bit value 1 means support), the first bit is used to indicate whether SN supports integrity protection (bit value 0 means not supported, bit value 1 Indicates support), the first indication information of 10 indicates that the SN supports encryption protection, the first indication information of 01 indicates that the SN supports integrity protection, and the first indication information of 11 indicates that the SN supports encryption protection and integrity protection.

As another possible implementation manner, the first indication information needs to indicate whether the security capability of the SN is whether the SN supports security protection, the first indication information may indicate whether the SN supports encryption protection, or whether the SN supports integrity Protection, or whether SN supports encryption protection and integrity protection.

It should be understood that the specific form in which the first indication information indicates the security capability of the SN is not limited in this application, and it may be one of the above-mentioned examples, or other forms, which will not be described one by one here.

Optionally, from the perspective of the function of the first indication information, the first indication information may be called a security capability (security capability) parameter.

As a possible implementation, the first indication information can be used as the new UE context (UE context reference at the S-NG-RAN node) parameter at the secondary access network node carried in the handover request message in the existing protocol. The increased cell is carried in the handover request message.

As another possible implementation manner, the first indication information may be used as a newly added parameter in the handover request message.

It should be understood that the embodiment of the present application does not limit how the first indication information sent by the first MN to the second MN is carried in the handover request message. It can be used as a new information element in the handover request message, or as the handover request message. The new information element in an original parameter in the handover request message; or, the above-mentioned first indication information can be carried in other signaling sent by the first MN to the second MN in the handover process; or, when allowed Under certain signaling overhead, the above-mentioned first indication information can be carried in the newly added signaling between the first MN and the second MN in the handover procedure. For example, before the first MN sends a handover request message to the second MN, The newly added signaling is used to transmit the above-mentioned first indication information.

It should also be understood that, similar to the handover process shown in Figure 3, before the first MN in Figure 4 sends a handover request message to the second MN, it also needs to decide to perform handover according to the measurement report returned by the UE, that is, the method shown in Figure 4 The process also includes S411, the first MN initiates measurement control to the UE, S412, the UE sends a measurement report to the first MN, S413, and the first MN decides to switch. These three steps are the same as those shown in S310, S320, and S330 in Figure 3. Similar to here will not repeat them.

Further, the handover method shown in FIG. 4 can ensure that the data security protection forms between the UE and the second MN, and between the UE and the SN are consistent, where the security protection can be integrity protection, encryption protection, or integrity protection and Encryption protection. That is to say, the handover method shown in Figure 4 can be applied in the URLLC scenario. It should be understood that this application is only restricted to the first MN when the MN handover occurs and the SN remains unchanged. The indication information is notified to the second MN without limiting the application scenarios of the method. The applicable scenarios of the method shown in FIG. 4 are not limited to the URLLC scenario, and may be other communication scenarios, which are not listed here.

In order to ensure that the data security protection forms between the UE and the second MN and between the UE and the SN are consistent, the handover method further includes the following steps:

S420: The second MN determines a security policy.

As a possible implementation manner, the second MN determines the security policy between the second MN and the UE according to the security capabilities of the SN. When the SN does not support security protection, the second MN determines the The security policy is not to activate the security protection between the second MN and the UE.

It should be understood that, in the embodiment shown in Figure 4 of this application, the second MN may only refer to the security capabilities of the SN when deciding whether to activate security protection between the second MN and the UE. When the security capabilities of the SN indicate that the SN does not support During security protection, the second MN decides not to activate security protection between the second MN and the UE. The only reference to the security capabilities of the SN applies to the case where the SN does not support security protection. When the SN supports the security protection, the security capabilities of the second MN need to be referred to, for example:

As another possible implementation manner, the second MN determines a security policy according to the security capabilities of the second MN and the SN. When the SN supports security protection but the second MN does not support security protection, the The second MN determines that the security policy is not to activate security protection between the SN and the UE;

Or, as another possible implementation manner, the second MN determines a security policy according to the security capabilities of the second MN and the SN, and when the SN supports security protection and the second MN supports security protection, The second MN determines that the security policy is to activate security protection between the SN and the UE.

Specifically, the second MN determines the security policy between the second MN and the UE based on the received first indication information and the security capability of the second MN.

It should be understood that, unlike in the existing protocol, the second MN in the existing protocol determines the security policy with the UE based only on the second MN’s security capabilities. For example, if the second MN supports security protection, the second MN determines If security protection is enabled between the second MN and the UE, and the second MN does not support security protection, the second MN determines that the corresponding security protection is not enabled between the second MN and the UE, which may cause the second MN to support security protection, and When the SN does not support security protection, the security protection is enabled when the RRC connection is established between the second MN and the UE, but the SN does not support security protection, then the security protection cannot be enabled when the RRC connection is established between the SN and the UE, then the existing protocol In this case, the RRC connection needs to be re-established between the second MN and the UE without security protection, which increases the signaling overhead between the second MN and the UE.

In the embodiment of this application, when the second MN supports security protection, when the second MN determines whether the security protection between the second MN and the UE is turned on, it refers to the security capabilities of the SN, where, when the SN supports security protection , The corresponding security protection is enabled between the second MN and the UE. When the SN does not support the security protection, the corresponding security protection is not enabled between the second MN and the UE.

In the case that the second MN does not support security protection, the security capability of the SN may not be referred to as specified in the existing protocol, and the corresponding security protection is not enabled between the second MN and the UE.

Or, in order to reflect that the second MN in the embodiment shown in FIG. 4 determines the security policy based on the security capability of the SN, it can be understood that when the second MN learns that the SN does not support security protection, the security policy is decided to not activate the second MN. Security protection between UE and UE.

It should be understood that when the second MN knows the security capability of the second MN and the security capability of the SN, and the security capability of at least one of the security capability of the second MN and the security capability of the SN does not support security protection, the second MN and The corresponding security protection is not opened between UEs.

After executing S420, the second MN needs to send a handover request response message to the first MN, and execute S421, which is similar to S360 shown in Figure 3, and will not be repeated here; the first MN needs to send the downlink connection configuration to the UE, and execute S422, It is similar to S370 shown in FIG. 3, and will not be repeated here.

After the UE configures the parameters based on the downlink connection configuration, it can establish an RRC connection with the second MN, that is, perform S430, and establish an RRC connection between the UE and the second MN, where whether the established RRC connection is opened for security protection is the above S420 Determine the result of the second MN.

Further, after the handover of the MN is completed, the second MN needs to establish a dual connection with the SN. The difference from the procedure for establishing a dual connection shown in Figure 2 is that the second MN learns the security capabilities of the SN during the handover procedure. , The second MN can determine whether the SN opens the security protection based on the security capabilities of the SN and its own security capabilities, that is, the method flow described in FIG. 4 further includes S440, the second MN determines whether the SN opens the security protection. The second MN determines whether the SN activates the security protection between the SN and the UE based on the security policy between the second MN and the UE; the method flow described in FIG. 4 also includes S450. The second MN sends indication information to the SN to indicate the SN Whether to open the security protection.

For example, corresponding to the aforementioned when the SN does not support security protection, the second MN determines that the security policy is not to activate the security protection between the second MN and the UE, and the second MN informs through the second indication information SN, do not activate the security protection between the SN and the UE, because when the SN does not support security protection, the second MN determines that the security policy is not to activate the security protection between the second MN and the UE In the case of security protection, the data protection methods between the UE and the second MN, and between the UE and the SN need to be consistent. That is, S450 in the method flow shown in FIG. 4 is that the second MN sends the second indication information to the SN.

For another example, corresponding to the aforementioned when the SN supports security protection but the second MN does not support security protection, the second MN determines that the security policy is not to activate the security protection between the second MN and the UE , The second MN informs the SN through the third indication information that the security protection between the SN and the UE is not activated, because when the SN supports security protection but the second MN does not support security protection, the first When the second MN determines that the security policy is not to activate the security protection between the second MN and the UE, the data protection mode between the UE and the second MN and between the UE and the SN needs to be consistent. That is, S450 in the method flow shown in FIG. 4 is that the second MN sends the third indication information to the SN.

For another example, corresponding to the above-mentioned when the SN supports security protection and the second MN supports security protection, the second MN determines that the security policy is to activate the security protection between the second MN and the UE. The second MN informs the SN through the fourth indication information to activate the security protection between the SN and the UE, because when the SN supports security protection and the second MN supports security protection, the second MN determines In the case where the security policy is to activate the security protection between the second MN and the UE, the data protection modes between the UE and the second MN and between the UE and the SN need to be consistent. That is, S450 in the method flow shown in FIG. 4 is that the second MN sends fourth indication information to the SN.

In the handover method provided by the present application, the second MN can determine whether the SN opens the security protection based on the security capabilities of the SN and its own security capabilities, without the need to establish a dual connection between the second MN and the SN shown in FIG. 2 In the process, it is learned whether the SN has security protection enabled, so as to avoid the additional signaling interaction between the second MN and the SN when the second MN fails to obtain whether the SN security protection is enabled in time.

Specifically, when the security capabilities of the second MN are inconsistent with the security capabilities of the SN, the second MN determines that the SN does not enable security protection; when the security capabilities of the second MN are consistent with the security capabilities of the SN, when the security capabilities of the second MN Both the security capabilities and the SN security capabilities do not support security protection. The second MN determines that the SN does not enable the security protection. When the second MN’s security capabilities and the SN’s security capabilities both support the security protection, the second MN determines the SN to enable the security protection. .

Since the security capability of the second MN and the security capability of the SN are both in the case of not supporting security protection, it is similar to the existing second MN based on the second MN’s non-supporting security protection and determining that the SN does not open the security protection. Both the security capability and the security capability of the SN support security protection, similar to the existing second MN based on the security protection of the second MN to determine that the SN opens the security protection, so the handover method provided in this application mainly implements the second In the case that the security capability of the MN is inconsistent with the security capability of the SN, the second MN may determine that the SN does not open the security protection.

After the second MN determines whether the SN opens the security protection, it may notify the SN through the aforementioned second indication information, third indication information, or fourth indication information. First

Specifically, the second indication information and the third indication information are used to indicate that no security protection is enabled between the SN and the UE.

In a possible implementation manner, the second indication information and the third indication information are displayed indication information, indicating that the SN does not open the security protection;

In a possible implementation manner, the second indication information and the third indication information are policy indication information, and the SN used to indicate does not enable security protection, and the specific policy indication is not needed.

Specifically, the fourth indication information is used to indicate that security protection is enabled between the SN and the UE.

In a possible implementation manner, the fourth indication information is displayed indication information, instructing the SN to enable security protection;

In a possible implementation manner, the fourth indication information is policy indication information, which is used to instruct the SN to enable security protection, and the specific policy indication is required.

Further, after the second MN determines the security policy of the SN, it establishes a dual connection with the SN. The specific establishment process is similar to that shown in Fig. 2. That is, the method process shown in Fig. 4 also includes S441. The second MN sends the SN to the SN. Add request message, S442, SN judges whether integrity protection and encryption protection are turned on, S443, SN sends SN add request response message to MN, these three steps are similar to S220, S230, S240 shown in Figure 2 and will not be repeated here. .

The method flow shown in Figure 4 mainly introduces how to ensure that the data security protection forms between the UE and the second MN and between the UE and the SN are consistent. The handover method provided in this application can also prevent the second MN from establishing a second Neither the MN nor the SN supports a PDU session that is secured but needs to be secured. The solution will be described in detail below with reference to Figure 5.

Fig. 5 is a schematic diagram of another handover method provided by an embodiment of the present application. It includes a first MN, a second MN, an SN, and a UE. Before the handover occurs, the UE is connected to the first MN and the SN respectively; the first MN may also be referred to as the source MN; The UE is connected to the second MN and the SN respectively, and the second MN may also be referred to as a target MN. In addition, optionally, in the process of UE handover from the first MN to the second MN, the UE always maintains a connection with the SN.

S510: The first MN sends a handover request message to the second MN.

Wherein, the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN. Specifically, the security capability of the SN includes whether the SN opens security protection for the PDU session of the UE. The security protection involved in this application includes at least one of encryption protection and integrity protection, that is, the security capability of the SN can be whether the SN opens integrity protection for the UE's PDU session, and whether the SN opens the UE's PDU session Encryption protection and whether SN enables encryption protection and integrity protection for the PDU session of the UE.

It should be understood that the specific form of the first indication information in FIG. 5 is similar to that shown in FIG. 4, except that the first indication information shown in FIG. 4 is used to indicate whether the SN is to enable security protection. The first indication information is used to indicate whether the SN opens security protection for the PDU session of the UE.

As a possible implementation, the first indication information needs to indicate that the security capability of the SN is whether the SN opens the security protection for the PDU session of the UE. The first indication information may be used to indicate at least one PDU session and indicate that the SN is Whether the security protection is enabled for the at least one PDU. For example, if it is necessary to indicate that the SN does not enable integrity protection for the first PDU session of the UE, the first indication information may carry the identifier of the first PDU and an indication indicating that the SN does not enable integrity protection for the first PDU session of the UE.

As a possible implementation, the first indication information needs to indicate that the security capability of the SN is whether the SN opens the security protection for the PDU session of the UE. The first indication information may be a bitmap, and every two bits are used for Indicate a PDU performed by the above-mentioned UE. For a PDU, whether the SN opens the security protection can be indicated by two bits corresponding to the PDU session.

It should also be understood that, similar to the handover process shown in Figure 3, before the first MN in Figure 5 sends a handover request message to the second MN, it also needs to decide to perform handover according to the measurement report returned by the UE, that is, the method shown in Figure 4 The process also includes S511, the first MN initiates measurement control to the UE, S512, the UE sends a measurement report to the first MN, S513, and the first MN decides to switch. These three steps are the same as S310, 320, and S330 shown in Figure 3. Similar to here will not repeat them.

Further, the handover method shown in FIG. 5 can prevent the second MN from establishing a PDU session in which neither the second MN nor the SN supports security protection but requires security protection.

S520: The second MN determines whether to reject session establishment.

Specifically, the second MN determines whether to reject the establishment of the PDU session based on its own security capability and the first indication information.

For example, the first MN receives 6 PDU session requests, of which 3 PDU sessions (PDU1, PDU2, and PDU3) require integrity protection, and the other 3 PDU sessions (PDU4, PDU5, and PDU6) do not require integrity protection. At this time, the first MN carries PDU1, PDU2, and PDU3 to itself, and offloads PDU4, PDU5, and PDU6 to SN. When a MN handover occurs, the second MN determines that it does not support integrity protection, and determines that the SN does not enable integrity protection for PDU1, PDU2, and PDU3 according to the first indication information, then the second MN rejects the establishment of PDU1, PDU2, and PDU3, Therefore, the second MN will not attempt to offload the PDU1, PDU2, and PDU3 to the SN because it does not support integrity protection. However, the SN does not support integrity protection and will reject the offload request, resulting in additional signaling overhead.

After executing S520, the second MN needs to send a handover request response message to the first MN, and execute S521, which is similar to S360 shown in Figure 3, and will not be repeated here; the first MN needs to send the downlink connection configuration to the UE, and execute S522. It is similar to S370 shown in Figure 3 and will not be repeated here; after the UE configures the parameters based on the downlink connection configuration, an RRC connection is established between the UE and the second MN, and S523 is executed, which is similar to S380 shown in Figure 3. No longer.

Further, after the handover is completed, the second MN needs to establish a dual connection with the SN. The difference from the process of establishing a dual connection shown in Figure 2 is that the second MN learns the security capabilities of the SN during the handover process. Then the second MN may determine how to perform offloading based on the security capability of the SN, that is, execute S530, and the second MN determines the offloading strategy.

The second MN determines according to the first indication information that the SN does not enable security protection for the PDU session, and the PDU session requires security protection, the second MN will not offload these PDU sessions to the SN.

Further, after the second MN determines the offload strategy, it establishes a dual connection with the SN. The specific establishment process is similar to that shown in FIG. 2, that is, the method process shown in FIG. 5 also includes S531. The second MN sends an SN addition request to the SN Message, S532, SN judges whether to enable integrity protection and encryption protection, S533, SN sends SN add request response message to MN, these three steps are similar to S220, S230, S240 shown in Figure 2 and will not be repeated here.

It should be understood that in the foregoing method embodiments, the size of the sequence numbers of the foregoing processes does not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, and should not correspond to the implementation process of the embodiments of this application. Constitute any limitation.

It should also be understood that the handover methods shown in Figures 4 and 5 can be used in combination, that is, in the URLLC scenario, the signaling overhead between the second MN and the UE, or between the second MN and the SN, and the first The second MN can also refuse to establish certain PDU sessions.

It should also be understood that the "first" and "second" in this application are only used for distinguishing description, and should not constitute any limitation to this application.

The handover method provided by the embodiment of the present application is described in detail above with reference to Figs. 4 and 5, and the handover device provided by the embodiment of the present application is described in detail below with reference to Figs. 6-11. It should be understood that the switching device and the switching method correspond to each other, and similar descriptions may refer to the method embodiments. It is worth noting that the switching device can be used in conjunction with the above switching method, or it can be used alone.

Refer to FIG. 6, which is a schematic diagram of the switching device 10 proposed in the present application. As shown in FIG. 6, the device 10 includes a sending and receiving unit 110, a processing unit 120 and a receiving unit 130.

The sending unit 110 is configured to send a measurement report to the first MN;

The processing unit 120 is configured to establish an RRC connection with the second MN;

The receiving unit 130 is configured to receive the downlink connection configuration sent by the first MN.

The apparatus 10 completely corresponds to the user equipment in the method embodiment, and the apparatus 10 may be the user equipment in the method embodiment, or a chip or functional module inside the user equipment in the method embodiment. The corresponding units of the apparatus 10 are used to execute the corresponding steps executed by the user equipment in the method embodiments shown in FIGS. 4 and 5.

Wherein, the sending unit 110 in the apparatus 10 executes the steps sent by the user equipment in the method embodiment. For example, step S412 of sending a measurement report to the first MN in FIG. 4 and step S512 of sending a measurement report to the first MN in FIG. 5 are performed.

The processing unit 120 in the device 10 executes the steps implemented or processed inside the user equipment in the method embodiment. For example, step S423 of establishing an RRC connection with the second MN in FIG. 4 and step S523 of establishing an RRC connection with the second MN in FIG. 5 are executed.

The receiving unit 130 in the apparatus 10 executes the steps of receiving by the user equipment in the method embodiment. For example, step S422 of receiving the downlink connection configuration sent by the first MN in FIG. 4 and step S522 of receiving the downlink connection configuration sent by the first MN in FIG. 5 are executed.

The receiving unit 130 and the sending unit 110 may constitute a transceiving unit and have the functions of receiving and sending at the same time. Wherein, the processing unit 120 may be a processor. The transmitting unit 110 may be a transmitter. The receiving unit 130 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.

Referring to FIG. 7, FIG. 7 is a schematic structural diagram of a user equipment 20 applicable to an embodiment of the present application. The user equipment 20 can be applied to the system shown in FIG. 1. For ease of description, FIG. 7 only shows the main components of the user equipment. As shown in FIG. 7, the user equipment 20 includes a processor (corresponding to the processing unit 120 shown in FIG. 6), a memory, a control circuit, an antenna, and an input and output device (corresponding to the receiving unit 130 and transmitting unit 130 shown in FIG. 6). Unit 110). The processor is used to control the antenna and the input and output device to send and receive signals, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory to execute the corresponding procedures and procedures executed by the user equipment in the switching method proposed in this application. /Or operation. I won't repeat them here.

Those skilled in the art can understand that, for ease of description, FIG. 7 only shows a memory and a processor. In actual user equipment, there may be multiple processors and memories. The memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.

Input and output devices, used to exchange information with other equipment;

The processor is configured to execute internal implementation or processing of the user equipment in the method embodiment.

Referring to FIG. 8, FIG. 8 is a schematic diagram of the switching device 30 proposed in this application. As shown in FIG. 8, the device 30 includes a sending unit 310, a receiving unit 320, and a processing unit 330.

The sending unit 310 is configured to send a handover request message to the second MN, where the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN. The capability includes whether the SN supports security protection, and/or whether the SN enables the security protection for a packet data unit PDU session of the UE, and the security protection includes encryption protection and/or integrity protection.

The receiving unit 320 is configured to receive information sent by other devices.

The processing unit 330 is configured to determine to perform an MN handover, where the MN handover includes the user equipment UE establishing a dual connection with the first MN and the auxiliary base station SN, and switching is for the UE to establish a dual connection with the second MN and the SN.

The device 30 completely corresponds to the first MN in the method embodiment, and the device 30 may be the first MN in the method embodiment, or a chip or functional module inside the first MN in the method embodiment. The corresponding unit of the device 30 is used to execute the corresponding steps performed by the first MN in the method embodiments shown in FIGS. 4 and 5.

The sending unit 310 in the device 30 executes the steps of sending by the first MN in the method embodiment. For example, perform step S411 of sending measurement control to the UE in FIG. 4, perform step S410 of sending a handover request message to the second MN in FIG. 4, perform step S422 of sending a downlink connection configuration to the UE in FIG. The step S511 of the UE sending measurement control, the step S510 of sending a handover request message to the second MN in FIG. 5, and the step S522 of sending a downlink connection configuration to the UE in FIG. 5 are executed.

The receiving unit 320 in the device 30 executes the steps of the first MN receiving in the method embodiment. For example, perform step S412 of receiving a measurement report sent by the UE in FIG. 4, perform step S421 of receiving a handover request response message sent by the second MN in FIG. 4, perform step S512 of receiving a measurement report sent by the UE in FIG. 5, and perform receiving in FIG. Step S521 where the second MN sends a handover request response message.

The processing unit 330 in the device 30 executes the steps implemented or processed inside the first MN in the method embodiment. For example, step S413 of deciding to switch in FIG. 4 is executed, and step S513 of deciding to switch in FIG. 5 is executed.

The receiving unit 320 and the sending unit 310 may constitute a transceiving unit and have the functions of receiving and sending at the same time. Wherein, the processing unit 330 may be a processor. The transmitting unit 310 may be a transmitter. The receiving unit 320 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.

Referring to FIG. 9, FIG. 9 is a schematic structural diagram of a first MN 40 applicable to an embodiment of the present application, and may be used to implement the function of the first MN in the above handover method. It can be a schematic diagram of the structure of a network device.

In the 5G communication system, the first MN 40 may include CU, DU, and AAU. Compared with the network equipment in the LTE communication system, the network equipment consists of one or more radio frequency units, such as a remote radio unit (RRU) 401 and one Or for multiple baseband units (BBU):

The non-real-time part of the original BBU will be divided and redefined as CU, which is responsible for processing non-real-time protocols and services. Part of the physical layer processing functions of the BBU are merged with the original RRU and passive antenna into AAU, and the remaining functions of the BBU are redefined as DU. Responsible for handling physical layer protocols and real-time services. In short, CU and DU are distinguished by the real-time nature of processing content, and AAU is a combination of RRU and antenna.

CU, DU, and AAU can be separated or co-located. Therefore, there will be multiple network deployment forms. A possible deployment form is shown in Figure 9 and is consistent with traditional 4G network equipment. CU and DU share hardware deployment. It should be understood that FIG. 9 is only an example, and does not limit the scope of protection of this application. For example, the deployment form may also be DU deployment in a 4G BBU computer room, CU centralized deployment or DU centralized deployment, and CU higher-level centralized deployment.

The AAU 401 that can implement the transceiving function is called a transceiving unit 401, which corresponds to the transmitting unit 310 in FIG. 8. Optionally, the transceiver unit 401 may also be called a transceiver, a transceiver circuit, or a transceiver, etc., and it may include at least one antenna 4011 and a radio frequency unit 4012. Optionally, the transceiving unit 401 may include a receiving unit and a transmitting unit, the receiving unit may correspond to a receiver (or receiver, receiving circuit), and the transmitting unit may correspond to a transmitter (or transmitter, transmitting circuit). The CU and DU 402 that can implement internal processing functions are called the processing unit 402, which corresponds to the processing unit 330 in FIG. 8. Optionally, the processing unit 402 may control network devices, etc., and may be referred to as a controller. The AAU 401, the CU and the DU 402 may be physically set together, or may be physically separated.

In addition, the first MN is not limited to the form shown in FIG. 9, but may also be in other forms: for example, it includes a BBU and an adaptive radio unit (ARU), or includes a BBU and an active antenna unit (active antenna unit, AAU); it can also be customer premises equipment (CPE), or other forms, which are not limited in this application.

It should be understood that the first MN 40 shown in FIG. 9 can implement the first MN function involved in the method embodiments of FIG. 4 and FIG. 5. The operations and/or functions of each unit in the first MN 40 are to implement the corresponding processes executed by the first MN in the method embodiment of the present application. To avoid repetition, detailed description is omitted here. The structure of the first MN illustrated in FIG. 10 is only a possible form and should not constitute any limitation to the embodiment of the present application. This application does not exclude the possibility of other forms of the first MN structure that may appear in the future.

Refer to FIG. 10, which is a schematic diagram of the switching device 50 proposed in the present application. As shown in FIG. 10, the device 50 includes a sending unit 510, a receiving unit 520, and a processing unit 530.

The sending unit 510 is used to send information to other devices.

The receiving unit 520 is configured to receive a handover request message from a first MN, where the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the assisting base station SN, and the first MN is The MN that serves the user equipment UE before the MN handover occurs, the second MN is the MN that serves the user equipment UE after the MN handover occurs, wherein the security capability of the SN includes whether the SN supports security protection, and /Or, whether the SN enables the security protection for the PDU session of the UE, and the security protection includes encryption protection and/or integrity protection.

The processing unit 530 is configured to determine the security capability of the SN based on the first indication information.

The device 50 completely corresponds to the second MN in the method embodiment, and the device 50 may be the second MN in the method embodiment, or a chip or functional module inside the second MN in the method embodiment. The corresponding units of the device 50 are used to perform the corresponding steps performed by the second MN in the method embodiments shown in FIGS. 4 and 5.

Wherein, the sending unit 510 in the device 50 executes the steps of sending by the second MN in the method embodiment. For example, perform step S421 of sending a handover request response message to the first MN in FIG. 4, perform step S450 of sending second, third, or fourth indication information to the SN in FIG. 4, and perform step S450 in FIG. Step S441 of sending an SN adding request message, step S521 of sending a handover request response message to the first MN in FIG. 5, and step S531 of sending an SN adding request message to the SN in FIG. 5 are executed.

The receiving unit 520 in the device 50 performs the steps of receiving by the second MN in the method embodiment. For example, step S410 of receiving the handover request message sent by the first MN in FIG. 4, step S443 of receiving the SN adding request response message sent by the SN in FIG. 4, and step S510 of receiving the handover request message sent by the first MN in FIG. Step S533 in FIG. 5 of receiving the SN adding request response message sent by the SN is performed.

The processing unit 530 in the device 50 executes the steps implemented or processed inside the second MN in the method embodiment. For example, perform step S430 of establishing an RRC connection with the UE in FIG. 4, perform step S420 of determining a security policy in FIG. 4, perform step S440 of determining whether the SN is enabled for security protection in FIG. Step S523: Perform step S520 in FIG. 5 to determine whether to reject session establishment, and perform step S530 in FIG. 5 to determine the offload strategy.

The receiving unit 520 and the sending unit 510 may constitute a transceiver unit, and have both receiving and sending functions. Wherein, the processing unit 530 may be a processor. The sending unit 510 may be a transmitter. The receiving unit 520 may be a receiver. The receiver and transmitter can be integrated to form a transceiver.

Referring to FIG. 11, FIG. 11 is a schematic structural diagram of a second MN 60 applicable to an embodiment of the present application, and may be used to implement the function of the second MN in the above handover method. It can be a schematic diagram of the structure of a network device.

The structure of the second MN 60 is similar to the structure of the first MN 40 shown in FIG. 9, and the second MN 60 may include CU, DU, and AAU.

The AAU 601 that can implement the transceiver function is called a transceiver unit 601, which corresponds to the sending unit 510 in FIG. 10. Optionally, the transceiver unit 601 may also be called a transceiver, a transceiver circuit, or a transceiver, etc., and it may include at least one antenna 6011 and a radio frequency unit 6012. Optionally, the transceiving unit 601 may include a receiving unit and a transmitting unit, the receiving unit may correspond to a receiver (or receiver, receiving circuit), and the transmitting unit may correspond to a transmitter (or transmitter, transmitting circuit). The CU and DU 602 that can implement internal processing functions are called a processing unit 602, which corresponds to the processing unit 530 in FIG. 10. Optionally, the processing unit 602 may control network devices, etc., and may be referred to as a controller. The AAU 601, the CU and the DU 602 may be physically set together, or may be physically separated.

In addition, the second MN is not limited to the form shown in FIG. 11, and may also be in other forms: for example, including BBU and ARU, or including BBU and AAU; it may also be CPE or other forms, which is not limited by this application.

It should be understood that the second MN 60 shown in FIG. 11 can implement the second MN function involved in the method embodiments of FIG. 4 and FIG. 5. The operations and/or functions of each unit in the second MN 60 are respectively for implementing the corresponding processes executed by the second MN in the method embodiment of the present application. To avoid repetition, detailed description is omitted here. The structure of the second MN illustrated in FIG. 10 is only a possible form, and should not constitute any limitation to the embodiment of the present application. This application does not exclude the possibility of other forms of the second MN structure that may appear in the future.

An embodiment of the present application also provides a communication system, which includes the aforementioned user equipment, a second MN, a second MN, and an SN.

The present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium. When the instructions run on a computer, the computer executes the first method shown in FIG. 4 and FIG. 5. The steps performed by the MN.

The present application also provides a computer-readable storage medium. The computer-readable storage medium stores instructions. When the instructions run on a computer, the computer executes the second method shown in FIG. 4 and FIG. 5. The steps performed by the MN.

The present application also provides a computer-readable storage medium that stores instructions in the computer-readable storage medium. When the instructions run on a computer, the computer executes the method shown in FIG. 4 and FIG. The various steps performed.

This application also provides a computer program product containing instructions. When the computer program product runs on a computer, the computer executes the steps performed by the first MN in the method shown in FIG. 4 and FIG. 5.

This application also provides a computer program product containing instructions. When the computer program product runs on a computer, the computer executes the steps performed by the second MN in the method shown in FIG. 4 and FIG. 5.

This application also provides a computer program product containing instructions. When the computer program product runs on a computer, the computer executes the steps performed by the user equipment in the methods shown in FIGS. 4 and 5.

This application also provides a chip including a processor. The processor is used to read and run the computer program stored in the memory to execute the corresponding operation and/or process executed by the first MN in the handover method provided in this application. Optionally, the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory. Further optionally, the chip further includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information. The communication interface can be an input and output interface.

This application also provides a chip including a processor. The processor is used to read and run a computer program stored in the memory to execute the corresponding operation and/or process executed by the second MN in the handover method provided in this application. Optionally, the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory. Further optionally, the chip further includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information. The communication interface can be an input and output interface.

This application also provides a chip including a processor. The processor is used to read and run the computer program stored in the memory to execute the corresponding operation and/or process executed by the user equipment in the switching method provided in this application. Optionally, the chip further includes a memory, the memory and the processor are connected to the memory through a circuit or a wire, and the processor is used to read and execute the computer program in the memory. Further optionally, the chip further includes a communication interface, and the processor is connected to the communication interface. The communication interface is used to receive data and/or information that needs to be processed, and the processor obtains the data and/or information from the communication interface, and processes the data and/or information. The communication interface can be an input and output interface.

A person of ordinary skill in the art may be aware that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware or a combination of computer software and electronic hardware. Whether these functions are executed by hardware or software depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and conciseness of description, the specific working process of the above-described system, device, and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, device, and method may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.

In addition, the functional units in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.

If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

In addition, the term "and/or" in this application is only an association relationship describing the associated objects, indicating that there can be three types of relationships, for example, A and/or B, which can mean: A alone exists, and both A and B exist. , There are three cases of B alone. In addition, the character "/" in this text generally means that the associated objects before and after are in an "or" relationship; the term "at least one" in this application can mean "one" and "two or more", for example, A At least one of, B and C can mean: A alone exists, B alone exists, C exists alone, A and B exist alone, A and C exist simultaneously, C and B exist simultaneously, and A and B and C exist simultaneously, this Seven situations. For another example, A, B, or C refers to any of A, B, and C; A, B, and C refer to the three possibilities of A, B, and C.

The above are only specific implementations of this application, but the protection scope of this application is not limited to this. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application. Should be covered within the scope of protection of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

A handover method, characterized in that a user equipment is respectively connected to a first primary base station MN and a secondary base station SN, and when the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN respectively. When connecting with the SN, the method includes:

Sending, by the first MN, a handover request message to the second MN, where the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN;

The second MN determines a security policy according to the security capability of the SN.
The method according to claim 1, wherein the second MN determining a security policy according to the security capability of the SN comprises:

When the SN does not support security protection, the second MN determines that the security policy is not to activate security protection between the second MN and the user equipment.
The method of claim 2, wherein the method further comprises:

The second MN sends second indication information to the SN, where the second indication information is used to instruct the SN to not activate security protection between the SN and the user equipment.
The method according to claim 1, wherein the second MN determining a security policy according to the security capability of the SN comprises:

The second MN determines a security policy according to the security capabilities of the second MN and the SN.
The method according to claim 4, wherein the second MN determining a security policy according to the security capabilities of the second MN and the SN comprises:

When the SN supports security protection but the second MN does not support security protection, the second MN determines that the security policy is not to activate security protection between the SN and the user equipment.
The method of claim 5, wherein the method further comprises:

The second MN sends third indication information to the SN, where the third indication information is used to instruct the SN to not activate the security protection between the SN and the user equipment.
The method according to claim 4, wherein the second MN determining a security policy according to the security capabilities of the second MN and the SN comprises:

When the SN supports security protection and the second MN supports security protection, the second MN determines that the security policy is to activate security protection between the SN and the user equipment.
The method according to claim 7, wherein the method further comprises:

The second MN sends fourth indication information to the SN, where the fourth indication information is used to instruct the SN to activate security protection between the SN and the user equipment.
The method according to any one of claims 2 to 8, wherein the security protection is encryption protection and/or integrity protection.
A handover method, characterized in that a user equipment is respectively connected to a first primary base station MN and a secondary base station SN, and when the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN respectively. When connecting with the SN, the method includes:

Receiving, by the second MN, a handover request message sent by the first MN, where the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN;

The second MN determines a security policy according to the security capability of the SN.
The method according to claim 10, wherein the second MN determining a security policy according to the security capability of the SN comprises:

When the SN does not support security protection, the second MN determines that the security policy is not to activate security protection between the second MN and the user equipment.
The method of claim 11, wherein the method further comprises:

The second MN sends second indication information to the SN, where the second indication information is used to instruct the SN to not activate security protection between the SN and the user equipment.
The method according to claim 12, wherein the second MN determining a security policy according to the security capability of the SN comprises:

The second MN determines a security policy according to the security capabilities of the second MN and the SN.
The method according to claim 13, wherein the second MN determining a security policy according to the security capabilities of the second MN and the SN comprises:

When the SN supports security protection but the MN does not support integrity protection, the second MN determines that the security policy is not to activate security protection between the second MN and the user equipment.
The method of claim 14, wherein the method further comprises:

The second MN sends third indication information to the SN, where the third indication information is used to instruct the SN to not activate the security protection between the SN and the user equipment.
The method according to claim 13, wherein the second MN determining a security policy according to the security capabilities of the second MN and the SN comprises:

When the SN supports security protection and the second MN supports security protection, the second MN determines that the security policy is to activate security protection between the SN and the user equipment.
The method of claim 16, wherein the method further comprises:

The second MN sends fourth indication information to the SN, where the fourth indication information is used to instruct the SN to activate security protection between the SN and the user equipment.
The method according to any one of claims 10 to 17, wherein the security protection is encryption protection and/or integrity protection.
A communication system, characterized in that the communication system includes a first primary base station MN, a second MN, and a secondary base station SN, and user equipment is connected to the first MN and the SN, and when the user equipment When the first MN switches to the second MN to connect to the second MN and the SN, the first MN is used to send a handover request message to the second MN, and the handover request The message carries first indication information, where the first indication information is used to indicate the security capability of the SN;

The second MN is used to determine a security policy according to the security capability of the SN.
A handover device, characterized in that user equipment is connected to a first primary base station MN and a secondary base station SN respectively, and when the user equipment is handed over from the first MN to the second MN, the user equipment is connected to the second MN. When connected to the SN, the device is used to perform operations of the second MN, and the device includes:

A receiving unit, configured to receive a handover request message sent by the first MN, where the handover request message carries first indication information, and the first indication information is used to indicate the security capability of the SN;

The processing unit is used to determine a security policy according to the security capability of the SN.
The device according to claim 20, wherein the processing unit determines a security policy according to the security capability of the SN, comprising:

When the SN does not support security protection, the processing unit determines that the security policy is not to activate security protection between the second MN and the user equipment.
The device according to claim 21, wherein the device further comprises:

The sending unit is configured to send second indication information to the SN, where the second indication information is used to instruct the SN to not activate the security protection between the SN and the user equipment.
The device according to claim 22, wherein the processing unit determines a security policy according to the security capability of the SN, comprising:

The processing unit determines a security policy according to the security capabilities of the second MN and the SN.
The device according to claim 23, wherein the processing unit determines a security policy according to the security capabilities of the second MN and the SN, comprising:

When the SN supports security protection but the MN does not support integrity protection, the processing unit determines that the security policy is not to activate security protection between the second MN and the user equipment.
The device according to claim 24, wherein the device further comprises:

The sending unit is configured to send third indication information to the SN, where the third indication information is used to instruct the SN to not activate the security protection between the SN and the user equipment.
The device according to claim 23, wherein the processing unit determines a security policy according to the security capabilities of the second MN and the SN, comprising:

When the SN supports security protection and the MN supports integrity protection, the processing unit determines that the security policy is to activate security protection between the second MN and the user equipment.
The device according to claim 26, wherein the device further comprises:

The sending unit is configured to send fourth indication information to the SN, where the fourth indication information is used to instruct the SN to activate security protection between the SN and the user equipment.
The device according to any one of claims 20 to 27, wherein the security protection is encryption protection and/or integrity protection.
A computer-readable storage medium, comprising: the computer-readable medium stores a computer program; when the computer program is run on a computer, the computer executes any one of claims 1-18 method.