WO2020249083A1 - 安全激活状态确定方法及相关产品 - Google Patents

安全激活状态确定方法及相关产品 Download PDF

Info

Publication number
WO2020249083A1
WO2020249083A1 PCT/CN2020/095812 CN2020095812W WO2020249083A1 WO 2020249083 A1 WO2020249083 A1 WO 2020249083A1 CN 2020095812 W CN2020095812 W CN 2020095812W WO 2020249083 A1 WO2020249083 A1 WO 2020249083A1
Authority
WO
WIPO (PCT)
Prior art keywords
session
network device
access network
identifier
target message
Prior art date
Application number
PCT/CN2020/095812
Other languages
English (en)
French (fr)
Inventor
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2020249083A1 publication Critical patent/WO2020249083A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/0001—Systems modifying transmission characteristics according to link quality, e.g. power backoff
    • H04L1/0015—Systems modifying transmission characteristics according to link quality, e.g. power backoff characterised by the adaptation strategy
    • H04L1/0017—Systems modifying transmission characteristics according to link quality, e.g. power backoff characterised by the adaptation strategy where the mode-switching is based on Quality of Service requirement
    • H04L1/0018—Systems modifying transmission characteristics according to link quality, e.g. power backoff characterised by the adaptation strategy where the mode-switching is based on Quality of Service requirement based on latency requirement
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L1/00—Arrangements for detecting or preventing errors in the information received
    • H04L1/22—Arrangements for detecting or preventing errors in the information received using redundant apparatus to increase reliability
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers

Definitions

  • This application relates to the field of communication technology, and in particular to a method for determining a security activation state and related products.
  • Ultra-Reliable Low-Latency Communication (URLLC) is used, which can ensure the reliability and low-latency of communication.
  • URLLC Ultra-Reliable Low-Latency Communication
  • the existing URLLC service When ensuring reliability, it usually adopts a redundant transmission method, but the existing redundant transmission method has low transmission reliability during data transmission, and may even fail to meet the demand for high reliability.
  • the embodiments of the present application provide a method for determining a safe activation state and related products, which can ensure that the safe activation states of redundant transmission paths are the same, thereby improving the reliability of redundant transmission.
  • an embodiment of the present application provides a method for determining a security activation state, the method including:
  • the first access network device receives the redundancy indication
  • the first access network device sends a session offload message of a reference session to a second access network device, the session offload message carries session information of the reference session, and the session offload message is used to instruct the second access
  • the network access device establishes a second session with the user equipment according to the session information
  • the first access network device sends a target message to the second access network device.
  • the target message carries a first identifier
  • the target message is used to instruct the second access network device to set the second identifier Assigned as the first identifier
  • the first identifier is used to indicate the security activation state of the first session
  • the second identifier is used to indicate the security activation state of the second session.
  • the first access network device receives the redundancy instruction, the first access network device establishes the first session and the reference session with the user equipment according to the redundancy instruction, and the first access network device communicates to the second access network device.
  • the network access device sends a session offload message.
  • the session offload message carries session information of the reference session.
  • the session offload message is used to instruct the second access network device to establish a second session with the user equipment according to the session information.
  • the first access network device Send a target message to the second access network device.
  • the target message carries the first identifier
  • the target message is used to instruct the second access network device to assign the second identifier to the first identifier
  • the first identifier is used to indicate the status of the first session.
  • Security activation status the second identifier is used to indicate the security activation status of the second session. Therefore, when performing redundant transmission, the first session and the second session can have the same security activation status, which can improve redundant transmission time. Reliability.
  • the sending of the target message by the first access network device to the second access network device includes:
  • the first access network device sends the target message to the second access network device at any time in a first time interval, where the first time interval is the time interval for establishing the reference session .
  • sending a target message to the second access network device in the time interval for establishing the reference session can enable the second access network device to obtain the secure activation state while the reference session is established, so that the session can be offloaded and established.
  • the security activation status of the second session is directly determined, so that the efficiency in determining the security activation status can be improved.
  • the sending of the target message by the first access network device to the second access network device includes:
  • the first access network device sends the target message to the second access network device at any time in a second time interval, where the second time interval is a preset after the establishment of the reference session is completed Time interval.
  • the target message can be sent to the second access network device within the preset time interval after the establishment of the reference session, and the security activation status can be sent to the second access network device without changing the existing mechanism. Access to the network equipment, which can improve the flexibility of the security activation state transmission.
  • the method further includes:
  • the first access network device determines the second identifier according to the security activation state indication information.
  • the method further includes:
  • the first access network device obtains the first identifier from a storage space corresponding to a storage address storing the first identifier.
  • the first identifier can be obtained quickly, and the efficiency of obtaining the first identifier is improved.
  • the target message when the target message carries a third identifier, the target message is used to instruct the second access network device to use the third identifier as the second identifier of the second session, and the third The identifier is used to indicate a third security activation state, and the third security activation state is a security activation state received by the first access network device.
  • the received third identifier is carried in the target message, thereby directly sending the third identifier to the second access network device, and instructing the second access network device to use the third identifier as the second identifier of the second session Therefore, there is no need to assign a value, and the second identifier is directly determined, which can improve the efficiency of determining the second identifier.
  • the target message includes a secondary node addition or modification message.
  • an embodiment of the present application provides a method for determining a secure activation state, the method including:
  • the second access network device receives a session offload message sent by the first access network device, where the session offload message carries session information of a reference session, and the reference session is the communication between the first access network device and the user equipment Conversation
  • the second access network device receives the target message sent by the first access network device, and when the target message carries a first identifier, the second access network device assigns the second identifier to the first Identifier, the first identifier is used to indicate the security activation state of the first session, the second identifier is used to indicate the security activation state of the second session, and the first session is the first access network device
  • the first session and the reference session are mutually redundant sessions.
  • the target message is a target message sent by the first access network device to the second access network device at any time in a first time interval, and the first time interval is the The time interval for establishing the reference session.
  • the target message is a target message sent by the first access network device to the second access network device at any time in a second time interval, and the second time interval is the Refer to the preset time interval after the establishment of the session.
  • the second identifier is an identifier determined by the first access network device according to the security activation status indication information of the second session.
  • the first wave identifier is an identifier obtained by the first access network device from a storage space corresponding to a storage address storing the first identifier.
  • the second access network device uses the third identifier as the second identifier of the second session, and the third identifier is used to indicate Three security activation status, the third security activation status is the security activation status received by the first access network device.
  • the target message includes a secondary node addition or modification message.
  • an embodiment of the present application provides an access network device.
  • the access network device includes a receiving unit, a session establishing unit, a first sending unit, and a second sending unit, where:
  • the receiving unit is configured to receive a redundancy indication
  • the session establishment unit is configured to establish a first session and a reference session with the user equipment according to the redundancy indication, where the first session and the reference session are mutually redundant sessions;
  • the first sending unit is configured to send a session offload message of a reference session to a second access network device, where the session offload message carries session information of the reference session, and the session offload message is used to indicate the second
  • the access network device establishes a second session with the user equipment according to the session information
  • the second sending unit is configured to send a target message to the second access network device.
  • the target message carries a first identifier
  • the target message is used to instruct the second access network device to send a second
  • the identifier is assigned to the first identifier
  • the first identifier is used to indicate the security activation state of the first session
  • the second identifier is used to indicate the security activation state of the second session.
  • the second sending unit is specifically configured to:
  • the second sending unit is specifically configured to:
  • the access network device is also specifically used for:
  • the second identifier is determined according to the safety activation state indication information.
  • the access network device is also specifically used for:
  • the second sending unit is further specifically configured to:
  • the target message When the target message carries a third identifier, the target message is used to instruct the second access network device to use the third identifier as the second identifier of the second session, and the third identifier is used to indicate A third security activation state, where the third security activation state is a security activation state received by the first access network device.
  • the target message includes a secondary node addition or modification message.
  • an embodiment of the present application provides an access network device.
  • the access network device includes a first receiving unit, a session establishing unit, and a second receiving unit, where:
  • the first receiving unit is configured to receive a session offload message sent by a first access network device, where the session offload message carries session information of a reference session, and the reference session is the first access network device and the user equipment Conversation between
  • the session establishment unit is configured to establish a second session with the user equipment according to the session information
  • the second receiving unit is configured to receive a target message sent by the first access network device, and when the target message carries a first identifier, assign the second identifier to the first identifier, and the first identifier Used to indicate the security activation status of the first session, the second identifier is used to indicate the security activation status of the second session, and the first session is between the first access network device and the user equipment
  • the first session and the reference session are mutually redundant sessions.
  • the target message is a target message sent by the first access network device at any time in a first time interval, and the first time interval is a time interval for establishing the reference session.
  • the target message is a target message sent by the first access network device at any time in a second time interval, and the second time interval is a preset time after the establishment of the reference session is completed Interval.
  • the second identifier is an identifier determined by the first access network device according to the security activation status indication information of the second session.
  • the first wave identifier is an identifier obtained by the first access network device from a storage space corresponding to a storage address storing the first identifier.
  • the access network device when the target message carries the third security activation state, is also specifically configured to:
  • the third identifier is used as the second identifier of the second session, the third identifier is used to indicate a third security activation state, and the third security activation state is the security received by the first access network device Active state.
  • the target message includes a secondary node addition or modification message.
  • an embodiment of the present application provides a communication system including the first access network device of the third aspect, the second access network device of the fourth aspect, and user equipment.
  • an embodiment of the present application provides a computer-readable storage medium that stores a computer program, and the computer program includes program instructions that when executed by a processor cause the processing The device performs the method as described in the first and second aspects.
  • the embodiments of the present application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the method for determining the security activation state described in any of the foregoing aspects.
  • an embodiment of the present application provides a communication chip.
  • the communication chip includes a processor and one or more interfaces coupled to the processor.
  • the processor can be used to call the method for determining the security activation state provided by any one of the above aspects from the memory, and execute the instructions contained in the program.
  • the interface can be used to output the processing result of the processor.
  • FIG. 1 is a schematic diagram of a redundant transmission architecture in ultra-high-reliability and low-latency communication according to an embodiment of the application;
  • FIG. 2 is an interactive schematic diagram of a method for determining a security activation state according to an embodiment of this application
  • FIG. 3 is an interactive schematic diagram of another method for determining a security activation state according to an embodiment of this application.
  • FIG. 4 is an interactive schematic diagram of another method for determining a security activation state according to an embodiment of this application.
  • FIG. 5 is an interactive schematic diagram of another security activation state determination method provided by an embodiment of this application.
  • FIG. 6 is a schematic structural diagram of an access network device according to an embodiment of this application.
  • FIG. 7 provides a schematic structural diagram of another access network device according to an embodiment of this application.
  • FIG. 8 is a schematic structural diagram of a network device provided in an embodiment of this application.
  • FIG. 9 is a schematic structural diagram of a communication chip provided by the present application according to an embodiment of the present application.
  • This application is applied to ultra-high-reliability and low-latency scenarios.
  • data transmission is performed using a redundant transmission method based on a dual-connection architecture. Data transmission, but its reliability is low.
  • the safe activation state of the redundant transmission path can be ensured to be the same, which can improve the reliability of redundant transmission.
  • RRC Radio Resource Control
  • UPF User Plane Function
  • UDM Unified Data Management Equipment (Unified Data Management)
  • user plane entities can For the user plane gateway, etc.
  • FIG. 1 provides a schematic diagram of a redundant transmission architecture in ultra-high reliability and low-latency communication according to an embodiment of the present application.
  • the architecture includes a master base station 101, a slave base station 102, a first user plane gateway 103, a second user plane gateway 104, a data network 105, an access management entity 106, a first session management entity 107, and a second user plane gateway.
  • the session management entity 108 when the connection is established, the master base station 101 and the access management entity 106 communicate through the link N2, the master base station 101 and the first user plane gateway 103, the slave base station 102 and the second user plane gateway 104 through the link N3 communicates, the first user plane gateway 103 and the first session management entity 107, the second user plane gateway 104 and the second session management entity 108 communicate through the link N4, the first user plane gateway 103, the second user plane gateway 104 communicates with the data network 105 through the link N6.
  • the user equipment 109 sends a first session establishment request to the main base station 101.
  • the first session may be a PDU session.
  • the main base station 101 forwards the first session establishment request through the access management entity 106.
  • the first session management entity 107 sends a registration information acquisition request, a subscription information acquisition request, or a subscription information update request to UDM. Both the registration information and the subscription information For registration information and subscription information corresponding to the user equipment 109, UDM feeds back the subscription information to the first session management entity 107.
  • the subscription information includes a redundancy indicator.
  • the redundancy indicator may be an RSN (Redundancy Sequence Number) indicator.
  • the session management entity 107 can determine whether the user equipment 109 needs to use a redundant session according to the redundancy indication. If it determines that a redundant session is needed, it notifies the first session management entity 107 to confirm the user plane gateway, and the first session management entity 107 determines The first user plane gateway 103 that needs to be used in the first session is output, the first session management entity 107 replies to the access management entity 106 with a message with a redundancy indication; the first session management entity 107 sends the first session to the main base station 101 An established air interface resource request message, which carries a redundancy indicator, and the redundancy indicator is used to instruct the primary base station 101 to establish the first session and the reference session with the user equipment 109, after the first session and the reference session are established , The first user plane gateway 103 can exchange data with the data network 105, the first session and the reference session are mutually redundant sessions, and the network side device involved in the first session includes the first access network device (primary base station 101) , The first user plane gateway
  • the master base station 101 can adopt a dual connection establishment process to add the slave base station 102 to the redundant transmission architecture; the master base station 101 sends a session offload message to the slave base station 102, so that the slave base station 102 establishes a connection with the user equipment 109 according to the session offload message.
  • the second user plane gateway 104 can exchange data with the data network 105.
  • the second session and the first session are mutually redundant sessions, and the second session and the reference session are related
  • the equipment is the same (except for the different access network equipment), and the data transmitted by the second session, the reference session, and the first session are the same data; the master base station 101 sends the target message to the slave base station 102.
  • the target message When the target message carries the first identifier, the The target message is used to instruct the secondary base station 102 to assign the second identifier to the first identifier, the first identifier is used to indicate the security activation status of the first session, and the second identifier is used to indicate the security activation status of the second session; when the target message carries In the case of the third identifier, the target message is used to instruct the slave base station 102 to use the third identifier as the second identifier of the second session, the third identifier is used to indicate the third security activation state, and the third security activation state is received by the master base station 101 Security activation state, the third security activation state may be the security activation state received from the session management entity 106; the session offload message is received from the base station 102, the second session is established according to the session offload message, and the second session information is obtained according to the target message Security activation status.
  • the session offloading message and the target message can be added or modified messages for the auxiliary node, or can be other separately defined messages;
  • the security activation status can specifically be: whether to enable encryption or whether to enable full security, the security activation status can also have: security The duration of the activation state, the use conditions of the safe activation state (for example: how much data rate is supported), etc. Therefore, in the embodiment of the present application, in a scenario of ultra-high reliability and low latency, when dual connections are used for data transmission, the first session and the second session can have the same security activation state, thereby improving the redundancy transmission time. Reliability.
  • the master base station can be any base station in the master access network device, and the slave base station can be from any base station in the access network.
  • the master access network can be understood as the network where the user equipment initiates the session request, that is, the first The network when the session is established can be understood from the access network as the network when the second session is established.
  • the first access network device can be a master base station or a slave base station, and the second access network device can be a slave base station or a master base station.
  • the second access network device can be a slave base station.
  • the second access network device can be the master base station.
  • the user plane gateway may also be other session-related user plane devices, the session management entity may also be referred to as a session management gateway, and the access management entity may also be referred to as an access management network element.
  • the user equipment 109 may be a machine type communication (eMTC) terminal, a mobile phone (mobile phone), a tablet computer (Pad), a portable computer, a computer with wireless transceiver function, a virtual reality (VR) terminal device, Augmented reality (AR) terminal equipment, wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, smart grid (smart grid) Wireless terminals in ), wireless terminals in transportation safety, wireless terminals in smart cities, smart cars, wireless terminals in smart homes, and so on.
  • eMTC machine type communication
  • VR virtual reality
  • AR Augmented reality
  • wireless terminals in industrial control wireless terminals in self-driving
  • wireless terminals in remote medical smart grid (smart grid) Wireless terminals in )
  • wireless terminals in transportation safety wireless terminals in smart cities, smart cars, wireless terminals in smart homes, and so on.
  • the embodiment of this application does not limit the application scenario.
  • UE User equipment
  • terminal access terminal
  • UE unit UE station
  • mobile equipment mobile station
  • mobile station mobile terminal
  • mobile client mobile unit (mobile unit)
  • remote station remote terminal equipment
  • remote unit wireless unit
  • wireless communication equipment user agent or user device, etc.
  • the user equipment 109 may be an NB-IoT terminal, or an enhanced machine type communication (eMTC) terminal.
  • the working bandwidth of the eMTC terminal may generally be small, which is smaller than the working bandwidth of the LTE system.
  • the working bandwidth of an eMTC terminal may be a narrowband NB, one NB includes 6 consecutive physical resource blocks (PRB), and one physical resource block PRB includes 12 subcarriers (SC).
  • the terminal device 102 may also include a smart home device, and may also include a mobile terminal such as a mobile phone.
  • FIG. 2 is an interactive schematic diagram of a method for determining a secure activation state according to an embodiment of the application.
  • the method for determining the security activation state includes steps S201-S206, which are specifically as follows:
  • S201 The first access network device receives an RSN indication.
  • the first access network device may receive an RSN indication from the access management entity, the RSN indication is used to instruct the first access network device to establish a first session and a reference session with the user equipment, and the RSN indication is also used to indicate the first session
  • An access network device uses a dual connection establishment process to add a second access network device to the dual connection architecture.
  • the first access network device establishes a first session and a reference session with the user equipment according to the RSN indication.
  • the RSN indication carries information such as the session identifier for establishing the first session and the reference session.
  • the first access network device may establish the first session and the reference session according to the information such as the session identifier; the first session and the reference session may be PDU sessions,
  • the first session and the reference session are mutually redundant sessions, that is, the data transmitted by the first session and the reference session are the same data, and in the ultra-high reliability and low-latency application scenario, the data transmitted by the first session and the reference session are The latency is low.
  • the session identifier can be: Protocol Data Unit Session Identity (PDU Session ID), Quality of Service Flow Identifier (QFI(s)), Quality of Service Profiles, QoS Profile(s)), core network channel information (Core Network Tunnel Information, CN Tunnel Info), signal from the allowed network slice selection assistance information Network slice selection assistance information (Single Network Slice Selection Assistance Information from the Allowed Network Slice Selection) Assistance Information, S-NSSAI from the Allowed NSSAI, Session Aggregation Maximum Bit Rate (Session-AMBR), Protocol Data Unit Session Type (Protocol Data Unit Session Type, PDU Session Type), user-plane security implementation Information (User Plane Security Enforcement information), user equipment integrity protection maximum data rate (UE Integrity Protection Maximum Data Rate), etc.
  • PDU Session ID Protocol Data Unit Session Identity
  • QFI(s) Quality of Service Flow Identifier
  • QoS Profile(s) Quality of Service Profiles
  • core network channel information Core Network Tunnel Information, CN Tunnel Info
  • the second access network device may be added to the redundant transmission architecture by adopting a dual connection establishment procedure according to the RSN indication.
  • the auxiliary node may be used to add or modify the message to initiate a dual connection establishment process to the second access network device.
  • S203 The first access network device sends a session offload message to the second access network device.
  • the session offload message carries session information of the reference session, and the session information may be a session identifier, identification information of the first access network device, and so on.
  • the first access network device sends a target message to the second access network device.
  • the target message may carry a first identifier or a third identifier
  • the first identifier is used to indicate the security activation state of the first session
  • the third identifier is used to indicate the third security activation state
  • the third security activation state may be the first connection.
  • the security activation status received by the networked device from the access management entity or the session management entity.
  • the target message can add or modify a message for the secondary node.
  • the second access network device establishes a second session with the user equipment according to the session offload message.
  • the second session established by the second access network device according to the session offload message and the reference session are mutually redundant sessions.
  • the session offload message can add or modify messages for the secondary node.
  • the establishment of the second session with the user equipment by the second access network device according to the session offload message can be understood as: replacing the identification information of the first access network device in the session information with the second access network device
  • the identification information of the reference session is thus offloaded to the second access network device to obtain the second session between the second access network device and the user equipment.
  • the difference between the reference session and the second session is that the access network equipment passed is different.
  • the second access network device determines the security activation state of the second session according to the target message.
  • the second access network device when the target message carries the first identifier, the second access network device assigns the second identifier to the first identifier, and the second identifier is used to indicate the security activation status of the second session; when the target message carries the third When identifying, the second access network device uses the third identifier as the second identifier of the second session.
  • a possible method for the first access network device to send the target message to the second access network device is:
  • the first access network device sends a target message to the second access network device at any time in the first time interval, where the first time interval is a time interval for establishing a reference session.
  • sending a target message to the second access network device in the time interval for establishing the reference session can enable the second access network device to obtain the secure activation state while the reference session is established, so that the session can be offloaded and established.
  • the security activation status of the second session is directly determined, so that the efficiency in determining the security activation status can be improved.
  • a possible method for the first access network device to send the target message to the second access network device is:
  • the first access network device sends the target message to the second access network device at any time in the second time interval, where the second time interval is a preset time interval after the establishment of the reference session is completed.
  • the preset time interval can be set through empirical values or historical data.
  • the target message can be sent to the second access network device within the preset time interval after the establishment of the reference session, and the security activation status can be sent to the second access network device without changing the existing mechanism. Access to the network equipment, which can improve the flexibility of the security activation state transmission.
  • the first access network device may also receive the security activation status indication information of the second session sent from the access management entity, and determine the security activation status of the second session according to the indication information.
  • the method may include steps A1-A2, specifically as follows:
  • the first access network device receives the security activation status indication information of the second session
  • the first access network device determines the second identifier according to the security activation status indication information.
  • the security activation status indication information of the second session may be an UP policy IE (User Plane Security Enforcement information) message.
  • UP policy IE User Plane Security Enforcement information
  • the method for determining the second identifier according to the security activation status indication information may be: judging the UP policy IE message to obtain the judgment result; and determining the second identifier according to the judgment result.
  • the judgment results include: Not Needed, Required, Preferred, and each judgment result corresponds to a different security activation state. For example, if the judgment result is Not Needed, the security activation state is the non-secure activation state, that is, encryption is not enabled or not enabled. Complete guarantee, complete guarantee can be understood as integrity protection.
  • the first access network device sends the second identification to the second access network device, and the second access network device assigns the second identification to the first identification; or, The first access network device assigns the first identifier to the second identifier, and the first access network device sends the second identifier to the second access network device.
  • the first access network device may also assign the second identification to the first identification, and then send the second identification to the second access network device, and the second access network device After receiving the second identifier, the security activation state indicated by the second identifier is used as the security activation state of the second session.
  • the security activation status of the second session can be obtained directly according to the original session establishment process, and the second identifier is sent to the second access network device, and the second access network device directly assigns the second identifier It is the first identifier, so that the second session and the first session have the same security activation state without changing the process of establishing the existing session, which improves the reliability of redundant transmission.
  • the embodiment of the present application also provides another method for determining the security activation status of the second session: the first access network device obtains from the storage space corresponding to the storage address storing the first identifier The first identifier, the second identifier of the second session is assigned to the first identifier, and the security activation state of the second session is obtained. After the first access network device determines the security activation status of the second session, the security activation status can be replaced by the first identifier (especially in different situations), so that the second identifier can be added or modified by the secondary node. Send to the second access network device.
  • the method further includes obtaining the first security activation state.
  • a possible method for obtaining the security activation state includes: the first access network device obtains from the storage space corresponding to the storage address storing the first identifier The first logo. Before performing the obtaining step, the first access network device stores the first identifier after receiving the first identifier of the first session sent from the access management entity.
  • the first identifier can be obtained quickly, and the efficiency of obtaining the first identifier is improved.
  • the first access network device may also receive the third identifier, and the device sending the third identifier may be an access management entity or a session management entity.
  • FIG. 3 is an interactive schematic diagram of another method for determining a secure activation state according to an embodiment of the present application.
  • the method for determining the security activation state includes steps S301-S313, which are specifically as follows:
  • the first access network device sends a first session establishment request to the access management entity.
  • the user equipment sends the first session establishment request to the first access network device, and the first access network device forwards the first session establishment request to the access management entity.
  • the instruction of the first session establishment request may be: PDU Session Establishment Request.
  • S302 The access management entity sends a first session context establishment request to the first session management entity.
  • the session context request may be a session context establishment request for PDU session establishment.
  • the instruction of the first session context establishment request may be: Nsnf_PDUSession_CreateSM Context Request.
  • the first session management entity obtains the RSN indication from the unified data storage and management device (UDM).
  • UDM unified data storage and management device
  • the instruction sent when obtaining the RSN indication may be: Registration/Subscription retrieval/Subscription for updates.
  • the RSN indication information in the subscription information of the user equipment can be obtained according to the instruction.
  • the first session management entity may also select auxiliary information (S-NSSAI, Single Network Slice Selection Assistance Information), data network name (Data Network Name, DNN), user subscription information, and network slice selection based on the user equipment's subscription information signal
  • S-NSSAI Single Network Slice Selection Assistance Information
  • Data Network Name, DNN Data Network Name
  • the local policy configuration obtains or determines the RSN indication information.
  • the first session management entity performs UPF selection, and determines the required UPF in the first session and the second session.
  • the UPF required in the second session is the UPF required in the reference session.
  • the first session management forwards the RSN indication to the access management entity.
  • the message that the first session management forwards the RSN indication to the access management entity may be: Nsnf_Communication_N1N2Message Transfer.
  • the access management entity forwards the RSN indication to the first access network device.
  • the message that the access management entity forwards the RSN indication to the first access network device may be: N2PDU Session Request.
  • the first access network device obtains the first identifier and determines the second identifier.
  • the method for acquiring the first identifier and determining the second identifier by the first access network device may be the method for acquiring the first identifier and determining the second identifier in the above-mentioned embodiment, which will not be repeated here.
  • the first access network device establishes a first session with the user equipment.
  • the first access network device sends a reference session establishment response to the access management entity.
  • the reference session establishment response is used to indicate that the establishment of the reference session between the first access network device and the user equipment has been completed.
  • the reference session establishment response may specifically be: N2PDUSession Request Ack.
  • the first access network device before sending the reference session establishment response, the first access network device establishes a reference session with the user equipment.
  • the first access network device makes a joining request to the secondary node of the second access network device.
  • the secondary node joining request is used to enable the second access network device to join the redundant transmission architecture, so as to perform redundant transmission of data sent by the user equipment.
  • the secondary node joining request can be: SN Addition Request.
  • the secondary node may carry the first identifier in the joining request.
  • the first identifier indicates the security activation state of the first session, and the first identifier may be used to suggest that the second session execute the security activation state corresponding to the first identifier.
  • the secondary node joining request may also carry a second identifier, which indicates the security activation state of the second session, and the method for determining the second identifier may refer to the above-mentioned method in the above-mentioned embodiment.
  • the secondary node joining request may also carry session information of the reference session.
  • the second access network device sends a secondary node joining response to the first access network device.
  • the secondary node joining response may be: SN Addition/Modification Response or Request Acknowledge.
  • the message contains the result or indication of whether to activate according to the recommended state sent by the first access network device, for example, 0 means not turned on, 1 means turned on, which may be called activation indication/result, etc.
  • the second access network device joins the redundant transmission architecture.
  • the second access network device may establish a second session with the user equipment according to the session information of the reference session being added by the secondary node.
  • the specific process of establishing the second session refer to the foregoing establishment process in the foregoing embodiment.
  • the user equipment executes the security activation state of the second session.
  • the first access network device after receiving the secondary node joining response, sends a session offload message to the second access network device.
  • the second access network device After the second access network device receives the session offload message, the second access network device Establish a second session with the user equipment according to the session information.
  • the first access network device After the establishment of the second session is completed, the first access network device performs a radio resource control connection reconfiguration/reconfiguration complete (RRC Connection Reconfiguration/Reconfiguration complete) interaction with the user equipment, so that the user equipment follows the feedback from the first access network device
  • RRC Connection Reconfiguration/Reconfiguration complete radio resource control connection reconfiguration/reconfiguration complete
  • the second access network device may also send the selected algorithm to the first access network device through the auxiliary node joining response, and forward it to the user equipment through the first access network device. In this way, it is ensured that the user data protection context is consistent between the user equipment and the second access network device.
  • the first access network device sends a reconfiguration complete message to the second access network device.
  • the dual connection establishment process in the current embodiment occurs after the establishment of the first session and the reference session is completed. It is possible that the first access network device receives a message from the network side during the establishment of the reference session (such as step S306). ), the process of establishing a dual connection from S310 to S313 is started.
  • the allocation of air interface resources for the second session between the user equipment and the first access network device can also be performed after S311 and before S312, followed by the RRC reconfiguration process, or the reconfiguration process in step S311 is In a process, the air interface message can be configured after reconfiguration of the message. Therefore, the user equipment does not need to configure the user plane security activation state once during the session establishment process, and reconfigures it again according to the execution result of the second access network device when the dual connection is established.
  • the second identity of the second session is determined by the first access network device, and the first identity is the same as the second identity by means of assignment, so that the security activation status of the first session is the same as that of the second session.
  • the safety activation status is the same, which can improve the reliability of redundant transmission.
  • FIG. 4 is an interactive schematic diagram of another method for determining a secure activation state according to an embodiment of the application.
  • the method for determining the security activation state includes steps S401-S413, which are specifically as follows:
  • the first access network device sends a first session establishment request to an access management entity.
  • S402 The access management entity sends a first session context establishment request to the first session management entity.
  • the first session management entity obtains the RSN indication from the unified data storage and management device (UDM).
  • UDM unified data storage and management device
  • S404 The first session management entity performs UPF selection, and determines the required UPF in the first session and the second session.
  • the first session management forwards the RSN indication to the access management entity.
  • S406 The access management entity forwards the RSN indication to the first access network device.
  • Steps S401-S406 refer to the specific implementation manners of the aforementioned steps S301-S306, which will not be repeated here.
  • S407 According to the RSN indication, if the first access network device determines that the first session is a URLLC session, obtains the first identifier, and stores the session identifier and the first identifier of the first session.
  • the first access network device sends a first identifier storage message to the first session management entity.
  • the first session management entity stores the first identifier, and when the reference session is established, obtains the first identifier and sends it to the first access network device.
  • the first session management entity stores the security activation status of the first session, and when the user equipment starts to establish a second session, it searches for and obtains the security activation status indication in the second session according to the session identifier of the first session and the indication of the RSN When the information is judged, it is directly assigned and sent to the first access network device.
  • the security activation status indication information is preferred, if the first session management entity determines the second identifier of the second session, it only needs to send the second identifier to the first access network device. Assignment processing cannot be performed when.
  • the security activation state acquisition logic is to comply with the security activation state issued by the first session management entity, and the access network device cannot assign values to the identifiers for the three strategies to change the security activation state of the second session.
  • the session management entities of the first session and the second session are not the same session management entity, that is, the first session management entity and the second session management entity. Therefore, when the second session is established, the first session management entity needs to be Relevant information is obtained, and the relevant information may be, for example, a session identifier.
  • the second session management entity When obtaining relevant information, it may specifically be: when the second session management entity obtains the relevant information from the data storage and management device, the second session management entity determines the session management identifier for establishing another session for redundant data transmission, then the second session management entity Send a message query directly to the first session management entity; or, in the process of establishing the second session, the second session management entity searches the access management entity for the identity of the session management entity that transmits the same data (first session management Entity identification), so as to send query related information to the first session management entity or query related information through the access management entity (if the first session management entity and the second session management entity have no interface).
  • the first access network device establishes a first session with the user equipment.
  • S411 The first access network device sends a reference session establishment response to the access management entity.
  • the first access network device makes a joining request to the secondary node of the second access network device.
  • the second access network device sends a secondary node joining response to the first access network device.
  • S414 The user equipment executes the security activation state of the second session.
  • S415 The first access network device sends a reconfiguration complete message to the second access network device.
  • Steps S410 to S415 refer to the specific implementation manners of the aforementioned steps S308 to S313, which will not be repeated here.
  • the first identifier of the first session is stored by the first session management entity.
  • the reference session security activation status is obtained from the first session management entity, and the second identifier is finally determined .
  • the first access network device to judge the second identifier and other processing, directly use the received identifier as the second identifier of the second session, which can improve the efficiency of determining the second identifier to a certain extent, and also enable the first
  • the security activation state of one session is the same as the security activation state of the second session, so that the reliability of redundant transmission can be improved.
  • FIG. 5 is an interactive schematic diagram of another method for determining a secure activation state according to an embodiment of the present application.
  • the method for determining the security activation state includes steps S501-S516, which are specifically as follows:
  • the first access network device sends a first session establishment request to an access management entity.
  • S502 The access management entity sends a first session context establishment request to the first session management entity.
  • the first session management entity obtains the RSN indication from the unified data storage and management device (UDM).
  • UDM unified data storage and management device
  • Steps S501-S503 refer to the specific implementation manners of the aforementioned steps S301-S303, which will not be repeated here.
  • the first session management entity determines that the first session is an RSN session, it stores the session identifier in the session identifier list.
  • the first session management entity may maintain the list of session identifiers, which may specifically include: updating the list of session identifiers.
  • the first identifier corresponding to the session identifier of the first session may be used as the second identifier, the second identifier is used to indicate the security activation state of the second session, and the first identifier is used to indicate the security activation state of the first session .
  • the data transmitted in the redundant first session and the second session are the same data.
  • the second identifier can be obtained by referring to the method in step S409, which will not be repeated here.
  • the first session management entity sends the second identifier to the first access network device.
  • the first session management entity performs UPF selection, and determines the required UPF in the first session and the second session.
  • the first session management forwards the RSN indication to the access management entity.
  • the access management entity forwards the RSN indication to the first access network device.
  • Steps S507 to S509 refer to the specific implementation manners of the aforementioned steps S304-S306, which will not be repeated here.
  • the first access network device obtains the second identifier.
  • the manner of obtaining the second identifier may be to obtain the second identifier from the storage space corresponding to the storage address of the received second identifier sent by the storage session management entity.
  • the first access network device establishes a first session with the user equipment.
  • the first access network device sends a reference session establishment response to the access management entity.
  • the first access network device makes a joining request to the secondary node of the second access network device.
  • S514 The second access network device sends a secondary node joining response to the first access network device.
  • S515 The user equipment executes the security activation state of the second session.
  • S516 The first access network device sends a reconfiguration complete message to the second access network device.
  • Steps S511 to S516 refer to the specific implementation manners of the aforementioned steps S308-S313, which will not be repeated here.
  • the session identifier list can be established through the session management entity.
  • the second identifier can be determined according to the stored session identifier of the first session corresponding to the second session, so as to obtain the second session And send the second identifier to the first access network device. Therefore, there is no need for the first access network device to judge the second identifier, and directly use the received identifier as the second session of the second session.
  • the identification can improve the efficiency of determining the second identification to a certain extent, and at the same time can make the security activation state of the first session the same as the security activation state of the second session, thereby improving the reliability of redundant transmission.
  • FIG. 6 is a schematic structural diagram of an access network device according to an embodiment of this application.
  • the access network device includes a receiving unit 601, a session establishing unit 602, a first sending unit 603, and a second sending unit 604, where:
  • the receiving unit 601 is configured to receive a redundancy indication
  • the session establishment unit 602 is configured to establish a first session and a reference session with the user equipment according to a redundancy indication, and the first session and the reference session are mutually redundant sessions;
  • the first sending unit 603 is configured to send a session offload message of the reference session to the second access network device.
  • the session offload message carries the session information of the reference session.
  • the session offload message is used to instruct the second access network device to establish a connection with the session information.
  • the second sending unit 604 is configured to send a target message to the second access network device.
  • the target message carries a first identifier
  • the target message is used to instruct the second access network device to assign the second identifier to the first identifier.
  • the identifier is used to indicate the security activation state of the first session
  • the second identifier is used to indicate the security activation state of the second session.
  • the second sending unit 604 is specifically configured to:
  • the first time interval is a time interval for establishing a reference session.
  • the second sending unit 604 is specifically configured to:
  • the target message to the second access network device at any time in the second time interval, where the second time interval is a preset time interval after the establishment of the reference session is completed.
  • the access network equipment is also specifically used for:
  • the second identifier is determined.
  • the access network equipment is also specifically used for:
  • the second sending unit is also specifically configured to:
  • the target message When the target message carries the third identifier, the target message is used to instruct the second access network device to use the third identifier as the second identifier of the second session, the third identifier is used to indicate the third security activation state, and the third security activation state is The security activation status received by the first access network device.
  • the target message includes a secondary node addition or modification message.
  • FIG. 7 provides a schematic structural diagram of another access network device according to an embodiment of the application.
  • the access network device includes a first receiving unit 701, a session establishing unit 702, and a second receiving unit 703, where
  • the first receiving unit 701 is configured to receive a session offload message sent by a first access network device, where the session offload message carries session information of a reference session, and the reference session is a session between the first access network device and the user equipment;
  • the session establishment unit 702 is configured to establish a second session with the user equipment according to the session information
  • the second receiving unit 703 is configured to receive a target message sent by the first access network device.
  • the target message carries a first identifier
  • the second identifier is assigned to the first identifier
  • the first identifier is used to indicate the secure activation of the first session Status
  • the second identifier is used to indicate the security activation status of the second session
  • the first session is a session between the first access network device and the user equipment
  • the first session and the reference session are mutually redundant sessions.
  • the target message is a target message sent by the first access network device at any time in the first time interval, and the first time interval is a time interval for establishing a reference session.
  • the target message is a target message sent by the first access network device at any time in the second time interval, and the second time interval is a preset time interval after the establishment of the reference session is completed.
  • the second identifier is an identifier determined by the first access network device according to the security activation status indication information of the second session.
  • the first wave of identifiers is an identifier obtained by the first access network device from a storage space corresponding to a storage address storing the first identifier.
  • the access network device is also specifically used to:
  • the third identifier is used as the second identifier of the second session, the third identifier is used to indicate the third security activation state, and the third security activation state is the security activation state received by the first access network device.
  • the target message includes an auxiliary node addition message or an auxiliary node modification message.
  • FIG. 8 is a schematic structural diagram of a network device according to an embodiment of the application.
  • the network device may be the above-mentioned first access network device or the second access network device, and the network device is used to execute the corresponding steps of the first access network device or the second access network device in the foregoing method embodiments.
  • the network device 800 may include: one or more processors 801, a memory 802, a network interface 803, a transceiver 805, and an antenna 808. These components can be connected through a bus 804 or in other ways.
  • FIG. 8 uses a bus connection as an example. among them:
  • the network interface 803 can be used for the network device 800 to communicate with other communication devices, such as other network devices.
  • the network interface 803 may be a wired interface.
  • the transceiver 805 may be used to transmit and process the signal output by the processor 801, such as signal modulation.
  • the transceiver 805 can also be used to receive and process the mobile communication signal received by the antenna 808. For example, signal demodulation.
  • the transceiver 805 can be regarded as a wireless modem.
  • the number of the transceiver 805 may be one or more.
  • the antenna 808 can be used to convert electromagnetic energy in a transmission line into electromagnetic waves in a free space, or convert electromagnetic waves in a free space into electromagnetic energy in a transmission line.
  • the memory 802 may be coupled with the processor 801 through a bus 804 or an input/output port, and the memory 802 may also be integrated with the processor 801.
  • the memory 802 is used to store various software programs and/or multiple sets of instructions or data.
  • the memory 802 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid-state storage devices.
  • the memory 802 may store an operating system (hereinafter referred to as the system), such as embedded operating systems such as uCOS, VxWorks, and RTLinux.
  • the memory 802 may also store a network communication program, which may be used to communicate with one or more additional devices, one or more terminal devices, and one or more network devices.
  • the processor 801 may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination that implements certain functions, for example, a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the processor 801 may be used to read and execute computer-readable instructions. Specifically, the processor 801 may be configured to call a program stored in the memory 802, such as a program for implementing the information transmission method provided by one or more embodiments of the present application on the network device 800 side, and execute instructions contained in the program.
  • a program stored in the memory 802 such as a program for implementing the information transmission method provided by one or more embodiments of the present application on the network device 800 side, and execute instructions contained in the program.
  • the network device 800 can be the first access network device 101 and the second access network device 102 in the redundant transmission architecture shown in FIG. 1, and can be implemented as a base transceiver station, a wireless transceiver, and a basic service. Set (BSS), an extended service set (ESS), NodeB, eNodeB, gNB, etc.
  • BSS basic service. Set
  • ESS extended service set
  • NodeB NodeB
  • eNodeB gNodeB
  • the network device 800 shown in FIG. 8 is only an implementation manner of the embodiment of the present application. In actual applications, the network device 800 may also include more or fewer components, which is not limited here. For the specific implementation of the network device 800, reference may be made to the relevant descriptions in the foregoing method embodiments, which will not be repeated here.
  • FIG. 9 provides a schematic structural diagram of a communication chip provided in this application for an embodiment of this application.
  • the communication chip 900 may include: a processor 901 and one or more interfaces 902 coupled to the processor 901.
  • the processor 901 can be used to read and execute computer-readable instructions.
  • the processor 901 may mainly include a controller, an arithmetic unit, and a register.
  • the controller is mainly responsible for instruction decoding, and sends control signals for operations corresponding to the instructions.
  • the arithmetic unit is mainly responsible for performing fixed-point or floating-point arithmetic operations, shift operations and logical operations, etc., and can also perform address operations and conversions.
  • the register is mainly responsible for storing the register operands and intermediate operation results temporarily stored during the execution of the instruction.
  • the hardware architecture of the processor 901 can be an application specific integrated circuit (ASIC) architecture, a microprocessor without interlocked pipeline stage architecture (microprocessor without interlocked piped stages architecture, MIPS) architecture, and advanced streamlining. Instruction set machine (advanced RISC machines, ARM) architecture or NP architecture, etc.
  • the processor 901 may be single-core or multi-core.
  • the interface 902 can be used to input data to be processed to the processor 901, and can output the processing result of the processor 901 to the outside.
  • the interface 902 may be a general purpose input output (GPIO) interface, which can be connected to multiple peripheral devices (such as a display (LCD), a camera (camara), a radio frequency (RF) module, etc.) connection.
  • GPIO general purpose input output
  • the interface 902 is connected to the processor 901 through the bus 903.
  • the processor 901 can be used to call the implementation program or data on the network device or terminal device side of the information transmission method provided by one or more embodiments of the present application from the memory, so that the chip can implement the foregoing Figures 2 to 5 show the method for determining the security activation state.
  • the memory may be integrated with the processor 901, or may be coupled to the communication chip 900 through the interface 902, that is, the memory may be a part of the communication chip 900 or may be independent of the communication chip 900.
  • the interface 902 can be used to output the execution result of the processor 901. In this application, the interface 902 may be specifically used to output the decoding result of the processor 901.
  • processor 901 and the interface 902 may be implemented through hardware design, or through software design, or through a combination of software and hardware, which is not limited here.
  • the communication system includes a plurality of devices including a network device and a user device.
  • the network devices may be the first access network device and the second access network device shown in FIG. 8, and are used to execute the security activation state determination method provided in FIG. 2 to FIG. 5.
  • An embodiment of the present application provides a computer-readable storage medium, the computer storage medium stores a computer program, the computer program includes program instructions, and the program instructions when executed by a processor cause the processor to perform the foregoing implementation All or part of the methods in the example.
  • a computer program product in another embodiment of the present application, includes computer-executable instructions stored in a computer-readable storage medium; at least one processor of the device can be accessed from a computer The reading storage medium reads the computer-executed instruction, and at least one processor executes the computer-executed instruction to make the device implement the steps of the user equipment or the network device in the method for determining the security activation state provided in FIGS. 2 to 5.
  • the disclosed device may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable memory.
  • the technical solution of the present application essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, A number of instructions are included to enable a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other various media that can store program codes.
  • the program can be stored in a computer-readable memory, and the memory can include: flash disk , Read-only memory (English: Read-Only Memory, abbreviation: ROM), random access device (English: Random Access Memory, abbreviation: RAM), magnetic disk or optical disc, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Quality & Reliability (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例公开了一种安全激活状态确定方法及装置，该方法包括：第一接入网设备接收冗余指示；第一接入网设备根据冗余指示建立与用户设备之间的第一会话和参考会话，第一会话与参考会话为冗余会话；第一接入网设备向第二接入网设备发送参考会话的会话分流消息，会话分流消息用于指示第二接入网设备根据会话信息建立与用户设备之间的第二会话；第一接入网设备向第二接入网设备发送目标消息，当目标消息携带第一标识，目标消息用于指示第二接入网设备将第二标识赋值为第一标识，第一标识用于指示第一会话的安全激活状态，第二标识用于指示第二会话的安全激活状态。因此，通过上述方案可以确保冗余传输的通路的安全激活状态相同。

Description

安全激活状态确定方法及相关产品
本申请要求于2019年06月14日提交中国专利局、申请号为201910525877.5、申请名称为“安全激活状态确定方法及相关产品”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种安全激活状态确定方法及相关产品。
背景技术
随着无线通信技术的发展，通信的能力也得到了巨大的提升。在一些通信的应用场景中会使用到超高可靠低时延通信业务(Ultra-Reliable Low-Latency Communication，URLLC)，其可以保证通信的可靠性以及低时延性，现有的URLLC业务中，在确保可靠性时，其通常会采用冗余传输的方式，但现有的冗余传输方式在进行数据传输时，其传输可靠性较低，甚至会不能满足高可靠性的需求。
发明内容
本申请实施例提供一种安全激活状态确定方法及相关产品，可以确保冗余传输的通路的安全激活状态相同，从而提升冗余传输时的可靠性。
第一方面，本申请实施例提供一种安全激活状态确定方法，所述方法包括：
第一接入网设备接收冗余指示；
所述第一接入网设备根据所述冗余指示建立与用户设备之间的第一会话和参考会话，所述第一会话与所述参考会话互为冗余会话；
所述第一接入网设备向第二接入网设备发送参考会话的会话分流消息，所述会话分流消息携带所述参考会话的会话信息，所述会话分流消息用于指示所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
所述第一接入网设备向所述第二接入网设备发送目标消息，当所述目标消息携带第一标识，所述目标消息用于指示所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示所述第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态。
本示例中，通过第一接入网设备接收冗余指示，第一接入网设备根据冗余指示建立与用户设备之间的第一会话和参考会话，第一接入网设备向第二接入网设备发送会话分流消息，会话分流消息携带参考会话的会话信息，会话分流消息用于指示第二接入网设备根据会话信息建立与用户设备之间的第二会话，第一接入网设备向第二接入网设备发送目标消息，当目标消息携带第一标识，目标消息用于指示第二接入网设备将第二标识赋值为第一标识，第一标识用于指示第一会话的安全激活状态，第二标识用于指示第二会话的安全激活状态，因此，在进行冗余传输时，能够使得第一会话和第二会话具有相同的安全激活状态，从而可以提升冗余传输时的可靠性。
可选的，所述第一接入网设备向所述第二接入网设备发送目标消息，包括：
所述第一接入网设备在第一时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
本示例中，在建立参考会话的时间区间中向第二接入网设备发送目标消息，可以在参考会话建立的同时使得第二接入网设备获取到安全激活状态，从而可以在会话分流，建立第二会话后，直接确定第二会话的安全激活状态，从而可以提升安全激活状态确定时的效率。
可选的，所述第一接入网设备向第二接入网设备发送目标消息，包括：
所述第一接入网设备在第二时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
本示例中，可以在参考会话建立完成后的预设时间区间内，向第二接入网设备发送目标消息，则可以在不改变现有的机制的同时，将安全激活状态发送给第二接入网设备，从而可以提升安全激活状态发送时的灵活性。
可选的，所述方法还包括：
所述第一接入网设备接收所述第二会话的安全激活状态指示信息；
所述第一接入网设备根据所述安全激活状态指示信息，确定出所述第二标识。
可选的，所述方法还包括：
所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中，获取所述第一标识。
本示例中，无需接收其它消息或指令，从存储地址对应的空间中直接获取第一标识，可以快速的获取到第一标识，提升第一标识获取时的效率。
可选的，当所述目标消息携带第三标识，所述目标消息用于指示所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
本示例中，通过目标消息携带接收到的第三标识，从而直接将第三标识发送给第二接入网设备，并指示第二接入网设备将第三标识作为第二会话的第二标识，从而无需进行赋值，直接确定出第二标识，能够提升第二标识确定时的效率。
可选的，所述目标消息包括辅节点增加或修改消息。
第二方面，本申请实施例提供了一种安全激活状态确定方法，所述方法包括：
第二接入网设备接收第一接入网设备发送的会话分流消息，所述会话分流消息携带参考会话的会话信息，所述参考会话为所述第一接入网设备与用户设备之间的会话；
所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
所述第二接入网设备接收所述第一接入网设备发送的目标消息，当所述目标消息携带第一标识，所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态，所述第一会话为所述第一接入网设备与所述用户设备之间的会话，所述第一会话与所述参考会话互为冗余会话。
可选的，所述目标消息为所述第一接入网设备在第一时间区间中的任一时刻向所述第 二接入网设备发送的目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
可选的，所述目标消息为所述第一接入网设备在第二时间区间中的任一时刻向所述第二接入网设备发送的目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
可选的，所述第二标识为所述第一接入网设备根据所述第二会话的安全激活状态指示信息确定出的标识。
可选的，所述第一波标识为所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中获取的标识。
可选的，当所述目标消息携带第三安全激活状态，所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
可选的，所述目标消息包括辅节点增加或修改消息。
第三方面，本申请实施例提供了一种接入网设备，所述接入网设备包括接收单元、会话建立单元、第一发送单元和第二发送单元，其中，
所述接收单元，用于接收冗余指示；
所述会话建立单元，用于根据所述冗余指示建立与用户设备之间的第一会话和参考会话，所述第一会话与所述参考会话互为冗余会话；
所述第一发送单元，用于向第二接入网设备发送参考会话的会话分流消息，所述会话分流消息携带所述参考会话的会话信息，所述会话分流消息用于指示所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
所述第二发送单元，用于向所述第二接入网设备发送目标消息，当所述目标消息携带第一标识，所述目标消息用于指示所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示所述第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态。
可选的，在所述向所述第二接入网设备发送目标消息方面，所述第二发送单元具体用于：
第一时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
可选的，在所述向所述第二接入网设备发送目标消息方面，所述第二发送单元具体用于：
在第二时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
可选的，所述接入网设备还具体用于：
接收所述第二会话的安全激活状态指示信息；
根据所述安全激活状态指示信息，确定出所述第二标识。
可选的，所述接入网设备还具体用于：
从存储所述第一标识的存储地址对应的存储空间中，获取所述第一标识。
可选的，所述第二发送单元还具体用于：
当所述目标消息携带第三标识，所述目标消息用于指示所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
可选的，所述目标消息包括辅节点增加或修改消息。
第四方面，本申请实施例提供了一种接入网设备，所述接入网设备包括第一接收单元、会话建立单元、第二接收单元，其中，
所述第一接收单元，用于接收第一接入网设备发送的会话分流消息，所述会话分流消息携带参考会话的会话信息，所述参考会话为所述第一接入网设备与用户设备之间的会话；
所述会话建立单元，用于根据所述会话信息建立与所述用户设备之间的第二会话；
所述第二接收单元，用于接收所述第一接入网设备发送的目标消息，当所述目标消息携带第一标识，将第二标识赋值为所述第一标识，所述第一标识用于指示第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态，所述第一会话为所述第一接入网设备与所述用户设备之间的会话，所述第一会话与所述参考会话互为冗余会话。
可选的，所述目标消息为所述第一接入网设备在第一时间区间中的任一时刻发送的目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
可选的，所述目标消息为所述第一接入网设备在第二时间区间中的任一时刻发送的目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
可选的，所述第二标识为所述第一接入网设备根据所述第二会话的安全激活状态指示信息确定出的标识。
可选的，所述第一波标识为所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中获取的标识。
可选的，当所述目标消息携带第三安全激活状态，所述接入网设备还具体用于：
将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
可选的，所述目标消息包括辅节点增加或修改消息。
第五方面，本申请实施例提供了一种通信系统，所述通信系统包括上述第三方面的第一接入网设备、第四方面的第二接入网设备和用户设备。
第六方面，本申请实施例提供了一种计算机可读存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如第一方面和第二方面中所述的方法。
第七方面，本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述任一方面描述的安全激活状态确定方法。
第八方面，本申请实施例提供了一种通信芯片，该通信芯片包括：处理器，以及耦合于所述处理器的一个或多个接口。其中，所述处理器可用于从存储器中调用上述任一方面所提供的安全激活状态确定方法，并执行该程序包含的指令。所述接口可用于输出所述处理器的处理结果。
本发明的这些方面或其他方面在以下实施例的描述中会更加简明易懂。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请实施例提供的一种超高可靠低时延通信中的冗余传输架构的示意图；
图2为本申请实施例提供了一种安全激活状态确定方法的交互示意图；
图3为本申请实施例提供了另一种安全激活状态确定方法的交互示意图；
图4为本申请实施例提供了另一种安全激活状态确定方法的交互示意图；
图5为本申请实施例提供了另一种安全激活状态确定方法的交互示意图；
图6为本申请实施例提供了一种接入网设备的结构示意图；
图7为本申请实施例提供了另一种接入网设备的结构示意图；
图8为本申请实施例提供了一种网络设备的结构示意图；
图9为本申请实施例提供了本申请提供的一种通信芯片的结构示意图。
具体实施方式
下面结合附图对本申请的实施例进行描述。
本申请应用于超高可靠低时延的场景中，在超高可靠低时延的场景中为了确保可靠性，现有方案中，在进行数据传输时采用基于双连接架构的冗余传输方式进行数据传输，但是其可靠性较低，本方案中能够确保冗余传输通路的安全激活状态相同，以此可以提升冗余传输时的可靠性。
本申请实施例会用到一下缩略语：RRC：无线资源控制(Radio Resource Control)；UPF：用户面实体(User Plane Function)；UDM：数据统一存储和管理设备(Unified Data Management)，用户面实体可以为用户面网关等。
为了更好的理解本申请实施例提供的安全激活状态确定方法，下面首先对应用安全激活状态确定方法的超高可靠低时延通信中的冗余传输架构进行简要介绍。请参阅图1，图1为本申请实施例提供了一种超高可靠低时延通信中的冗余传输架构的示意图。如图1所示，该架构包括主基站101、从基站102、第一用户面网关103、第二用户面网关104、数据网络105、接入管理实体106、第一会话管理实体107和第二会话管理实体108，在接建立时，主基站101与接入管理实体106通过链路N2进行通信，主基站101与第一用户面网关103、从基站102与第二用户面网关104通过链路N3进行通信，第一用户面网关103与第一会话管理实体107、第二用户面网关104与第二会话管理实体108通过链路N4进行通信，第一用户面网关103、第二用户面网关104与数据网络105通过链路N6进行通信。
其中，用户设备109向主基站101发送第一会话的建立请求，第一会话可以为PDU会话，主基站101在接收到第一会话建立请求后，通过接入管理实体106转发该第一会话建立请求给第一会话管理实体107，第一会话管理实体107在接收到第一会话建立请求后，向UDM发送注册信息获取请求、签约信息获取请求，或签约信息更新请求，注册信息、签约信息均为与用户设备109相对应的注册信息、签约信息，UDM反馈签约信息给第一会 话管理实体107，该签约信息中包括冗余指示，冗余指示可以为RSN(Redundancy Sequence Number)指示，第一会话管理实体107可以根据冗余指示判断用户设备109是否需要使用冗余会话，若判断出需要使用冗余会话，则通知第一会话管理实体107进行用户面网关确认，第一会话管理实体107确定出第一会话中需要使用的第一用户面网关103，第一会话管理实体107向接入管理实体106回复带有冗余指示的消息；第一会话管理实体107向主基站101发送第一会话建立的空口资源请求消息，该空口资源请求消息携带冗余指示，冗余指示用于指示主基站101建立与用户设备109之间的第一会话和参考会话，在第一会话和参考会话建立后，可以通过第一用户面网关103与数据网络105进行数据交互，第一会话和参考会话互为冗余会话，第一会话涉及到的网络侧设备包括第一接入网设备(主基站101)、第一用户面网关103、第一会话管理实体107等，参考会话涉及到的网络侧设备包括第一接入网设备(主基站101)、第二用户面网关104、第二会话管理实体108，其中，第一会话和参考会话的会话管理实体可以为相同的会话管理实体，也可以为不同的会话管理实体。
主基站101可以采用双连接的建立流程将从基站102加入到冗余传输架构中；主基站101向从基站102发送会话分流消息，以使得从基站102根据会话分流消息建立与用户设备109之间的第二会话，在第二会话建立后，可以通过第二用户面网关104与数据网络105进行数据交互，第二会话与第一会话互为冗余会话，第二会话与参考会话涉及到的设备相同(除接入网设备不同)，第二会话、参考会话和第一会话传输的数据为相同的数据；主基站101向从基站102发送目标消息，当目标消息携带第一标识时，该目标消息用于指示从基站102将第二标识赋值为第一标识，第一标识用于指示第一会话的安全激活状态，第二标识用于指示第二会话的安全激活状态；当目标消息携带第三标识时，该目标消息用于指示从基站102将第三标识作为第二会话的第二标识，第三标识用于指示第三安全激活状态，第三安全激活状态为主基站101接收的安全激活状态，第三安全激活状态可以为从会话管理实体106处接收的安全激活状态；从基站102接收到会话分流消息，根据会话分流消息建立第二会话，并根据目标消息得到第二会话的安全激活状态。
其中，会话分流消息和目标消息可以为辅节点增加或修改消息，也可以为单独定义的其它消息；安全激活状态具体可以为：是否开启加密或是否开启完保，安全激活状态还可以具有：安全激活状态的持续时间、安全激活状态的使用条件(例如：多少数据速率下支持)等。因此，本申请实施例中，在超高可靠低时延的场景中，采用双连接进行数据传输时，能够使得第一会话和第二会话具有相同的安全激活状态，从而可以提升冗余传输时的可靠性。
需要说明的是，主基站可以为主接入网设备中的任意基站，从基站可以从接入网中的任意基站，主接入网可以理解为用户设备发起会话请求的网络，即为第一会话建立时的网络，从接入网可以理解为第二会话建立时的网络。第一接入网设备可以为主基站或从基站，第二接入网设备可以为从基站或主基站，当第一接入网设备为主基站时，第二接入网设备可以为从基站；当第一接入网设备为从基站时，第二接入网设备可以为主基站，此时，采用的安全激活状态确定方法中的第一接入网设备和第二接入网设备所具有的功能调换。用户面网关也可以是其它与会话相关的用户面设备，会话管理实体也可以称为为会话管理网 关，接入管理实体也可以称为接入管理网元。
用户设备109可以是机器类通信(machine type communication，eMTC)终端、手机(mobile phone)、平板电脑(Pad)、便携电脑、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智能汽车、智慧家庭(smart home)中的无线终端等等。本申请的实施例对应用场景不做限定。用户设备(user equipment，UE)可以称为：终端(terminal)、接入终端、UE单元、UE站、移动设备、移动站、移动台(mobile station)、移动终端、移动客户端、移动单元(mobile unit)、远方站、远程终端设备、远程单元、无线单元、无线通信设备、用户代理或用户装置等。
例如，用户设备109可以是NB-IoT终端，或者增强型机器类通信(enhanced machine type communication，eMTC)终端。为了节省功耗，降低成本，eMTC终端的工作带宽通常可能较小，小于LTE系统的工作带宽。例如eMTC终端的工作带宽可以是一个窄带NB，一个NB包括6个连续的物理资源块(physical resource block，PRB)，一个物理资源块PRB包括12个子载波(Subcarrier，SC)。终端设备102也可以包括智能家居设备，还可以包括手机等移动终端。
请参阅图2，图2为本申请实施例提供了一种安全激活状态确定方法的交互示意图。如图2所示，安全激活状态确定方法包括步骤S201-S206，具体如下：
S201、第一接入网设备接收RSN指示。
其中，第一接入网设备可以从接入管理实体接收RSN指示，RSN指示用于指示第一接入网设备建立与用户设备之间的第一会话和参考会话，RSN指示还用于指示第一接入网设备采用双连接建立流程将第二接入网设备加入到双连接架构中。
S202、第一接入网设备根据RSN指示，建立与用户设备之间的第一会话和参考会话。
其中，RSN指示携带有建立第一会话和参考会话的会话标识等信息，第一接入网设备可以根据会话标识等信息建立第一会话和参考会话；第一会话和参考会话可以为PDU会话，第一会话和参考会话互为冗余会话，即，第一会话与参考会话传输的数据为相同的数据，且在超高可靠低时延应用场景时，第一会话和参考会话传输的数据的时延较低。会话标识可以为：协议数据单元会话标识(Protocol Data Unit Session Identity，PDU Session ID)，服务质量流标识符(Quality of Service Flow Identifier，QFI(s)),服务质量概况(Quality of Service Profiles，QoS Profile(s)),核心网络通道信息(Core Network Tunnel Information，CN Tunnel Info),来自被允许的网络切片选择辅助信息的信号网络切片选择辅助信息(Single Network Slice Selection Assistance Information from the Allowed Network Slice Selection Assistance Information，S-NSSAI from the Allowed NSSAI)，会话最大汇聚比特速率(Session Aggregation Maximum Bit Rate，Session-AMBR)，协议数据单元会话类型(Protocol Data Unit Session Type，PDU Session Type)，用户面安全实施信息(User Plane Security Enforcement information),用户设备完整性保护最大数据速率(UE Integrity Protection Maximum Data Rate)等。
可选的，在第一接入网设备建立第一会话和参考会话时，可以根据RSN指示，采用双连接建立流程将第二接入网设备加入到冗余传输架构中。其中，可以采用辅节点增加或修改消息，向第二接入网设备发起双连接建立流程。
S203、第一接入网设备向第二接入网设备发送会话分流消息。
其中，会话分流消息携带参考会话的会话信息，会话信息可以为会话标识、第一接入网设备的标识信息等。
S204、第一接入网设备向第二接入网设备发送目标消息。
其中，目标消息可以携带第一标识或第三标识，第一标识用于指示第一会话的安全激活状态，第三标识用于指示第三安全激活状态，第三安全激活状态可以为第一接入网设备从接入管理实体或会话管理实体接收到的安全激活状态。
可选的，目标消息可以为辅节点增加或修改消息。
S205、第二接入网设备根据会话分流消息建立与用户设备之间的第二会话。
其中，第二接入网设备根据会话分流消息建立的第二会话与参考会话互为冗余会话。会话分流消息可以为辅节点增加或修改消息。
可选的，第二接入网设备根据会话分流消息建立与用户设备之间的第二会话可以理解为：将会话信息中的第一接入网设备的标识信息替换为第二接入网设备的标识信息，从而将参考会话分流到第二接入网设备，以得到第二接入网设备与用户设备之间的第二会话。参考会话与第二会话的区别为通过的接入网设备不同。
S206、第二接入网设备根据目标消息，确定出第二会话的安全激活状态。
可选的，当目标消息携带第一标识时，第二接入网设备将第二标识赋值为该第一标识，第二标识用于指示第二会话的安全激活状态；当目标消息携带第三标识时，第二接入网设备将第三标识作为第二会话的第二标识。
上述步骤S202、S203、S204无执行上的先后顺序。
在一个可能的实施例中，一种可能的第一接入网设备向第二接入网设备发送目标消息的方法为：
第一接入网设备在第一时间区间中的任一时刻向第二接入网设备发送目标消息，第一时间区间为建立参考会话的时间区间。
本示例中，在建立参考会话的时间区间中向第二接入网设备发送目标消息，可以在参考会话建立的同时使得第二接入网设备获取到安全激活状态，从而可以在会话分流，建立第二会话后，直接确定第二会话的安全激活状态，从而可以提升安全激活状态确定时的效率。
在一个可能的实施例中，一种可能的第一接入网设备向第二接入网设备发送目标消息的方法为：
第一接入网设备在第二时间区间中的任一时刻向第二接入网设备发送目标消息，第二时间区间为参考会话建立完成后的预设时间区间。
其中，预设时间区间可以通过经验值或历史数据设定。
本示例中，可以在参考会话建立完成后的预设时间区间内，向第二接入网设备发送目标消息，则可以在不改变现有的机制的同时，将安全激活状态发送给第二接入网设备，从 而可以提升安全激活状态发送时的灵活性。
在一个可能的实施例中，第一接入网设备还可以接收从接入管理实体发送的第二会话的安全激活状态指示信息，并根据该指示信息确定出第二会话的安全激活状态，该方法可包括步骤A1-A2，具体如下：
A1、第一接入网设备接收第二会话的安全激活状态指示信息；
A2、第一接入网设备根据安全激活状态指示信息，确定出第二标识。
其中，第二会话的安全激活状态指示信息可以为UP policy IE(User PlaneSecurity Enforcement information)消息。
根据安全激活状态指示信息确定第二标识的方法可以为：对UP policy IE消息进行判断，得到判断结果；根据判断结果来确定出第二标识。其中，判断结果包括：Not needed、Required、Preferred，每一种判断结果对应不同的安全激活状态，例如，判断结果为Not needed，则安全激活状态为无安全激活状态，即不开启加密或不开启完保，完保可以理解为完整性保护。
可选的，在确定出第二标识后，第一接入网设备将该第二标识发送给第二接入网设备，第二接入网设备将第二标识赋值为第一标识；或者，第一接入网设备将第一标识赋值给第二标识，第一接入网设备将第二标识发送给第二接入网设备。
可选的，在确定出第二标识后，第一接入网设备还可以将第二标识赋值为第一标识，然后将第二标识发送给第二接入网设备，第二接入网设备接收到第二标识后，将该第二标识指示的安全激活状态作为第二会话的安全激活状态。
本示例中，可以直接根据原有会话建立的流程，获取到第二会话的安全激活状态，并将第二标识发送给第二接入网设备，第二接入网设备直接将第二标识赋值为第一标识，从而可以在不改变现有会话建立的流程的同时，可以使得出第二会话与第一会话具有相同的安全激活状态，提升了冗余传输时的可靠性。
在一个可能的实施例中，本申请实施例还提供了另一种确定第二会话的安全激活状态的方法为：第一接入网设备从存储第一标识的存储地址对应的存储空间中获取第一标识，将第二会话的第二标识赋值为第一标识，得到第二会话的安全激活状态。在第一接入网设备确定出第二会话的安全激活状态后，可以通过第一标识替换掉该安全激活状态(特别是不同的情况下)，从而通过辅节点增加或修改消息将第二标识发送到第二接入网设备。
在一个可能的实施例中，还包括获取第一安全激活状态，一种可能的获取安全激活状态的方法包括：第一接入网设备从存储第一标识的存储地址对应的存储空间中，获取第一标识。在执行获取步骤之前，第一接入网设备在接收到从接入管理实体发送的第一会话的第一标识后，对第一标识进行存储。
本示例中，无需接收其它消息或指令，从存储地址对应的空间中直接获取第一标识，可以快速的获取到第一标识，提升第一标识获取时的效率。
在一个可能的实施例中，第一接入网设备还可以接收第三标识，发送第三标识的设备可以为接入管理实体或会话管理实体。
请参阅图3，图3为本申请实施例提供了另一种安全激活状态确定方法的交互示意图。如图3所示，安全激活状态确定方法包括步骤S301-S313，具体如下：
S301、第一接入网设备向接入管理实体发送第一会话建立请求。
其中，用户设备发送第一会话建立请求到第一接入网设备，第一接入网设备转发第一会话建立请求到接入管理实体。
可选的，第一会话建立请求的指令可以为：PDU Session Establishment Request。
S302、接入管理实体向第一会话管理实体发送第一会话上下文建立请求。
可选的，会话上下文请求可以为PDU会话建立的会话上下文建立请求。第一会话上下文建立请求的指令可以为：Nsnf_PDUSession_CreateSM Context Request。
S303、第一会话管理实体从数据统一存储和管理设备(UDM)获取RSN指示。
可选的，获取RSN指示时所发送的指令可以为：Registration/Subscription retrieval/Subscription for updates。可以根据该指令获取到用户设备的签约信息中的RSN指示信息。
可选的，第一会话管理实体还可以根据用户设备的签约信息信号网络切片选择辅助信息(S-NSSAI，Single Network Slice Selection Assistance Information)、数据网络名称(Data Network Name，DNN)，用户订阅和本地策略配置(user subscription and local policy configuration)等获取或确定出RSN指示信息。
S304、第一会话管理实体进行UPF选择，确定出第一会话和第二会话中所需的UPF。
可选的，第二会话中所需的UPF即为参考会话中所需的UPF。
S305、第一会话管理转发RSN指示给接入管理实体。
可选的，第一会话管理转发RSN指示给接入管理实体的消息可以为：Nsnf_Communication_N1N2Message Transfer。
S306、接入管理实体转发RSN指示给第一接入网设备。
可选的，接入管理实体转发RSN指示给第一接入网设备的消息可以为：N2PDU Session Request。
S307、第一接入网设备获取第一标识和确定第二标识。
可选的，第一接入网设备获取第一标识和确定第二标识的方法可以上述实施例中获取第一标识和确定第二标识的方法，此处不再赘述。
S308、第一接入网设备建立与用户设备之间的第一会话。
S309、第一接入网设备向接入管理实体发送参考会话建立响应。
其中，参考会话建立响应用于指示建立第一接入网设备与用户设备之间的参考会话已经建立完成。参考会话建立响应具体可以为：N2PDUSession Request Ack。
可选的，在发送参考会话建立响应之前，第一接入网设备建立与用户设备之间的参考会话。
S310、第一接入网设备向第二接入网设备辅节点加入请求。
其中，辅节点加入请求用于使得第二接入网设备加入冗余传输架构，从而进行对用户设备发送的数据进行冗余传输。辅节点加入请求可以为：SN Addition Request。
可选的，辅节点加入请求中可以携第一标识。该第一标识指示的第一会话的安全激活状态，该第一标识可以用于建议第二会话执行与第一标识对应的安全激活状态。
可选的，辅节点加入请求中还可以携带第二标识，该第二标识指示第二会话的安全激 活状态，第二标识确定的方法可参照上述实施例中上述的方法。
可选的，辅节点加入请求中还可以携带参考会话的会话信息。
S311、第二接入网设备向第一接入网设备发送辅节点加入响应。
可选的，辅节点加入响应可以为：SN Addition/Modification Response或Request Acknowledge。该消息中含有是否按照第一接入网设备发送的建议状态激活的结果或者指示，例如0表示未开启，1标识开启，可以称为activation indication/result等。
可选的，在第一接入网设备接收到辅节点加入响应后，第二接入网设备加入冗余传输架构中。第二接入网设备可以根据辅节点增加中的参考会话的会话信息建立与用户设备之间的第二会话。建立第二会话的具体过程可以参见上述实施例中上述的建立过程。
S312、用户设备执行第二会话的安全激活状态。
可选的，在接收到辅节点加入响应后，第一接入网设备向第二接入网设备发送会话分流消息，第二接入网设备接收到会话分流消息后，第二接入网设备根据会话信息建立与用户设备之间的第二会话。在第二会话建立完成后，第一接入网设与用户设备进行无线资源控制连接重配/重配完成(RRC Connection Reconfiguration/Reconfiguration complete)交互，使得用户设备按照第一接入网设备反馈的第二接入网设备的执行结果或指示来执行用户设备和第二接入网设备之间的安全激活状态。
可选的，第二接入网设备还可以通过辅节点加入响应将选择的算法也发送给第一接入网设备，通过第一接入网设备转发给用户设备。以此保证用户设备和第二接入网设备之间对用户数据的保护上下文一致。
S313、第一接入网设备向第二接入网设备发送重配完成消息。
需要说明的是，目前的实施例中双连接建立过程发生在第一会话和参考会话建立完成之后，可能在参考会话建立过程中即第一接入网设备收到网络侧的消息(如步骤S306)后，则开启建立S310到S313的双连接过程。但是用户设备和第一接入网设备之间的关于第二会话的空口资源的分配则也可以在S311之后S312之前进行，紧接着进行RRC重配流程，也可能步骤S311中和重配流程是一个流程，重配消息下去即可配置空口消息。因此用户设备不需要在会话建立过程中配置一次用户面安全激活状态，而在双连接建立时又根据第二接入网设备的执行结果重配再一次。
本示例中，通过第一接入网设备来确定出第二会话的第二标识，通过赋值的方式使得第一标识与第二标识相同，能使得第一会话的安全激活状态与第二会话的安全激活状态相同，从而可以提升冗余传输时的可靠性。
请参阅图4，图4为本申请实施例提供了另一种安全激活状态确定方法的交互示意图。如图4所示，安全激活状态确定方法包括步骤S401-S413，具体如下：
S401、第一接入网设备向接入管理实体发送第一会话建立请求。
S402、接入管理实体向第一会话管理实体发送第一会话上下文建立请求。
S403、第一会话管理实体从数据统一存储和管理设备(UDM)获取RSN指示。
S404、第一会话管理实体进行UPF选择，确定出第一会话和第二会话中所需的UPF。
S405、第一会话管理转发RSN指示给接入管理实体。
S406、接入管理实体转发RSN指示给第一接入网设备。
步骤S401-S406参照前述步骤S301-S306的具体实施方式，此处不再赘述。
S407、第一接入网设备根据RSN指示，若判断第一会话为URLLC会话，获取第一标识，存储第一会话的会话标识以及第一标识。
S408、第一接入网设备向第一会话管理实体发送第一标识存储消息。
S409、第一会话管理实体存储第一标识，在参考会话建立时，获取第一标识并发送给第一接入网设备。
第一会话管理实体存储该第一会话的安全激活状态，在用户设备开启建立第二会话时，则根据第一会话的会话标识和RSN的指示，查找并获取在第二会话的安全激活状态指示信息判断时直接赋值，并发送给第一接入网设备。可选的，在安全激活状态指示信息为preferred时，第一会话管理实体，若确定出第二会话的第二标识时，则仅需将该第二标识发送给第一接入网设备，此时不能进行赋值处理。本示例中，安全激活状态获取逻辑即为遵从第一会话管理实体下发的安全激活状态，接入网设备对于三种策略都不能对标识进行赋值来改变第二会话的安全激活状态。
可选的，第一会话和第二会话的会话管理实体不是同一个会话管理实体，即为第一会话管理实体和第二会话管理实体，因此，建立第二会话时需要向第一会话管理实体获取相关信息，相关信息例如可以为会话标识等。在获取相关信息时，具体可以为：在第二会话管理实体向数据同意存储和管理设备获取相关信息时，确定出冗余数据传输的另一条会话建立的会话管理标识，则第二会话管理实体直接向第一会话管理实体发送消息查询；或者，第二会话管理实体在建立第二会话的过程中，则向接入管理实体查找其传输与其相同数据的会话管理实体的标识(第一会话管理实体标识)，从而向第一会话管理实体发查询相关信息或者通过接入管理实体查询相关信息(若第一会话管理实体和第二会话管理实体没有接口)。
S410、第一接入网设备建立与用户设备之间的第一会话。
S411、第一接入网设备向接入管理实体发送参考会话建立响应。
S412、第一接入网设备向第二接入网设备辅节点加入请求。
S413、第二接入网设备向第一接入网设备发送辅节点加入响应。
S414、用户设备执行第二会话的安全激活状态。
S415、第一接入网设备向第二接入网设备发送重配完成消息。
步骤S410至步骤S415参照前述步骤S308至S313的具体实施方式，此处不在赘述。
本示例中，通过第一会话管理实体对第一会话的第一标识进行存储，在第二会话建立时，从第一会话管理实体中查询得到参考会话安全激活状态，并最终确定出第二标识，无需第一接入网设备对第二标识进行判断等处理，直接将接收到的标识作为第二会话的第二标识，可以一定程度上提升第二标识确定时的效率，同时也能使得第一会话的安全激活状态与第二会话的安全激活状态相同，从而可以提升冗余传输时的可靠性。
请参阅图5，图5为本申请实施例提供了另一种安全激活状态确定方法的交互示意图。如图5所示，安全激活状态确定方法包括步骤S501-S516，具体如下：
S501、第一接入网设备向接入管理实体发送第一会话建立请求。
S502、接入管理实体向第一会话管理实体发送第一会话上下文建立请求。
S503、第一会话管理实体从数据统一存储和管理设备(UDM)获取RSN指示。
步骤S501-S503参照前述步骤S301-S303的具体实施方式，此处不再赘述。
S504、第一会话管理实体若确定出第一会话为RSN会话，则存储会话标识至会话标识列表。
可选的，第一会话管理实体可以对会话标识列表进行维护，具体可以为：对会话标识列表进行更新等。
S505、在第二会话建立时，第一会话管理实体根据冗余的第一会话的会话标识，确定出第二标识。
可选的，可以将第一会话的会话标识对应的第一标识作为该第二标识，第二标识用于指示第二会话的安全激活状态，第一标识用于指示第一会话的安全激活状态。冗余的第一会话与第二会话传输的数据为相同的数据。
可选的，若第一会话与第二会话具有不同的会话管理实体，则可以参照步骤S409中的方法获取第二标识，此处不再赘述。
S506、第一会话管理实体将第二标识发送给第一接入网设备。
S507、第一会话管理实体进行UPF选择，确定出第一会话和第二会话中所需的UPF。
S508、第一会话管理转发RSN指示给接入管理实体。
S509、接入管理实体转发RSN指示给第一接入网设备。
步骤S507至S509参照前述步骤S304-S306的具体实施方式，此处不再赘述。
S510、第一接入网设备获取第二标识。
其中，获取第二标识的方式可以为从接收到的存储会话管理实体发送的第二标识的存储地址对应的存储空间中获取第二标识。
S511、第一接入网设备建立与用户设备之间的第一会话。
S512、第一接入网设备向接入管理实体发送参考会话建立响应。
S513、第一接入网设备向第二接入网设备辅节点加入请求。
S514、第二接入网设备向第一接入网设备发送辅节点加入响应。
S515、用户设备执行第二会话的安全激活状态。
S516、第一接入网设备向第二接入网设备发送重配完成消息。
步骤S511至S516参照前述步骤S308-S313的具体实施方式，此处不再赘述。
本示例中，可以通过会话管理实体建立会话标识列表，在第二会话建立时，则可以根据存储的与第二会话对应的第一会话的会话标识来确定出第二标识，从而得到第二会话的安全激活状态，并将第二标识发送给第一接入网设备，因此，无需第一接入网设备对第二标识进行判断等处理，直接将接收到的标识作为第二会话的第二标识，可以一定程度上提升第二标识确定时的效率，同时也能使得第一会话的安全激活状态与第二会话的安全激活状态相同，从而可以提升冗余传输时的可靠性。
请参阅图6，图6为本申请实施例提供了一种接入网设备的结构示意图。如图6所示，接入网设备包括接收单元601、会话建立单元602、第一发送单元603和第二发送单元604，其中，
接收单元601，用于接收冗余指示；
会话建立单元602，用于根据冗余指示建立与用户设备之间的第一会话和参考会话，第一会话与参考会话互为冗余会话；
第一发送单元603，用于向第二接入网设备发送参考会话的会话分流消息，会话分流消息携带参考会话的会话信息，会话分流消息用于指示第二接入网设备根据会话信息建立与用户设备之间的第二会话；
第二发送单元604，用于向第二接入网设备发送目标消息，当目标消息携带第一标识，目标消息用于指示第二接入网设备将第二标识赋值为第一标识，第一标识用于指示第一会话的安全激活状态，第二标识用于指示第二会话的安全激活状态。
可选的，在向第二接入网设备发送目标消息方面，第二发送单元604具体用于：
第一时间区间中的任一时刻向第二接入网设备发送目标消息，第一时间区间为建立参考会话的时间区间。
可选的，在向第二接入网设备发送目标消息方面，第二发送单元604具体用于：
在第二时间区间中的任一时刻向第二接入网设备发送目标消息，第二时间区间为参考会话建立完成后的预设时间区间。
可选的，接入网设备还具体用于：
接收第二会话的安全激活状态指示信息；
根据安全激活状态指示信息，确定出第二标识。
可选的，接入网设备还具体用于：
从存储第一标识的存储地址对应的存储空间中，获取第一标识。
可选的，第二发送单元还具体用于：
当目标消息携带第三标识，目标消息用于指示第二接入网设备将第三标识作为第二会话的第二标识，第三标识用于指示第三安全激活状态，第三安全激活状态为第一接入网设备接收的安全激活状态。
可选的，目标消息包括辅节点增加或修改消息。
请参阅图7，图7为本申请实施例提供了另一种接入网设备的结构示意图。如图7所示，接入网设备包括第一接收单元701、会话建立单元702、第二接收单元703，其中，
第一接收单元701，用于接收第一接入网设备发送的会话分流消息，会话分流消息携带参考会话的会话信息，参考会话为第一接入网设备与用户设备之间的会话；
会话建立单元702，用于根据会话信息建立与用户设备之间的第二会话；
第二接收单元703，用于接收第一接入网设备发送的目标消息，当目标消息携带第一标识，将第二标识赋值为第一标识，第一标识用于指示第一会话的安全激活状态，第二标识用于指示第二会话的安全激活状态，第一会话为第一接入网设备与用户设备之间的会话，第一会话与参考会话互为冗余会话。
可选的，目标消息为第一接入网设备在第一时间区间中的任一时刻发送的目标消息，第一时间区间为建立参考会话的时间区间。
可选的，目标消息为第一接入网设备在第二时间区间中的任一时刻发送的目标消息，第二时间区间为参考会话建立完成后的预设时间区间。
可选的，第二标识为第一接入网设备根据第二会话的安全激活状态指示信息确定出的 标识。
可选的，第一波标识为第一接入网设备从存储第一标识的存储地址对应的存储空间中获取的标识。
可选的，当目标消息携带第三安全激活状态，接入网设备还具体用于：
将第三标识作为第二会话的第二标识，第三标识用于指示第三安全激活状态，第三安全激活状态为第一接入网设备接收的安全激活状态。
可选的，目标消息包括辅节点增加消息或辅助节点修改消息。
请参阅图8，图8为本申请实施例提供了一种网络设备的结构示意图。该网络设备可以是上述第一接入网设备或第二接入网设备，该网络设备用于执行前述各方法实施例中对应的第一接入网设备的步骤或第二接入网设备所对应的步骤。如图8所示，网络设备800可包括：一个或多个处理器801、存储器802、网络接口803、收发器805和天线808。这些部件可通过总线804或者其他方式连接，图8以通过总线连接为例。其中：
网络接口803可用于网络设备800与其他通信设备，例如其他网络设备，进行通信。具体的，网络接口803可以是有线接口。
收发器805可用于对处理器801输出的信号进行发射处理，例如信号调制。收发器805还可用于对天线808接收的移动通信信号进行接收处理。例如信号解调。在本申请的一些实施例中，收发器805可看作一个无线调制解调器。在网络设备800中，收发器805的数量可以是一个或者多个。天线808可用于将传输线中的电磁能转换成自由空间中的电磁波，或者将自由空间中的电磁波转换成传输线中的电磁能。
存储器802可以和处理器801通过总线804或者输入输出端口耦合，存储器802也可以与处理器801集成在一起。存储器802用于存储各种软件程序和/或多组指令或者数据。具体的，存储器802可包括高速随机存取的存储器，并且也可包括非易失性存储器，例如一个或多个磁盘存储设备、闪存设备或其他非易失性固态存储设备。存储器802可以存储操作系统(下述简称系统)，例如uCOS、VxWorks、RTLinux等嵌入式操作系统。存储器802还可以存储网络通信程序，该网络通信程序可用于与一个或多个附加设备，一个或多个终端设备，一个或多个网络设备进行通信。
处理器801可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现确定功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。
本申请实施例中，处理器801可用于读取和执行计算机可读指令。具体的，处理器801可用于调用存储于存储器802中的程序，例如本申请的一个或多个实施例提供的信息传输方法在网络设备800侧的实现程序，并执行该程序包含的指令。
可以理解的，网络设备800可以是图1示出的冗余传输架构中的第一接入网设备101、第二接入网设备102，可实施为基站收发台，无线收发器，一个基本服务集(BSS)，一个扩展服务集(ESS)，NodeB，eNodeB，gNB等等。
需要说明的是，图8所示的网络设备800仅仅是本申请实施例的一种实现方式，实际 应用中，网络设备800还可以包括更多或更少的部件，这里不作限制。关于网络设备800的具体实现可以参考前述方法实施例中的相关描述，此处不再赘述。
参见图9，图9为本申请实施例提供了本申请提供的一种通信芯片的结构示意图。如图9所示，通信芯片900可包括：处理器901，以及耦合于处理器901的一个或多个接口902。示例性的：
处理器901可用于读取和执行计算机可读指令。具体实现中，处理器901可主要包括控制器、运算器和寄存器。示例性的，控制器主要负责指令译码，并为指令对应的操作发出控制信号。运算器主要负责执行定点或浮点算数运算操作、移位操作以及逻辑操作等，也可以执行地址运算和转换。寄存器主要负责保存指令执行过程中临时存放的寄存器操作数和中间操作结果等。具体实现中，处理器901的硬件架构可以是专用集成电路(application specific integrated circuits，ASIC)架构、无互锁管道阶段架构的微处理器(microprocessor without interlocked piped stages architecture，MIPS)架构、进阶精简指令集机器(advanced RISC machines，ARM)架构或者NP架构等等。处理器901可以是单核的，也可以是多核的。
示例性的，接口902可用于输入待处理的数据至处理器901，并且可以向外输出处理器901的处理结果。具体实现中，接口902可以是通用输入输出(general purpose input output，GPIO)接口，可以和多个外围设备(如显示器(LCD)、摄像头(camara)、射频(radio frequency，RF)模块等等)连接。接口902通过总线903与处理器901相连。
一种可能的实现方式中，处理器901可用于从存储器中调用本申请的一个或多个实施例提供的信息传输方法在网络设备或终端设备侧的实现程序或者数据，使得该芯片可以实现前述图2至图5所示的安全激活状态确定方法。存储器可以和处理器901集成在一起，也可以通过接口902与通信芯片900相耦合，也就是说存储器可以是通信芯片900的一部分，也可以独立于该通信芯片900。接口902可用于输出处理器901的执行结果。本申请中，接口902可具体用于输出处理器901的译码结果。关于本申请的一个或多个实施例提供的安全激活状态确定方法可参考前述各个实施例，这里不再赘述。
需要说明的，处理器901、接口902各自对应的功能既可以通过硬件设计实现，也可以通过软件设计来实现，还可以通过软硬件结合的方式来实现，这里不作限制。
一种通信系统，通信系统包括多个设备，该多个设备包括网络设备和用户设备。示例性的，网络设备可以为图8中所示的第一接入网设备和第二接入网设备，且用于执行图2至图5所提供的安全激活状态确定方法。
本申请实施例提供了一种计算机可读存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行上述实施例中的全部或部分方法。
在本申请的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得设备实施图2至图5所提供的安全激活状态确定方法中用户设备或网络设备的步骤。
需要说明的是，对于前述的各方法实施例，为了简单描述，故将其都表述为一系列的 动作组合，但是本领域技术人员应该知悉，本申请并不受所描述的动作顺序的限制，因为依据本申请，某些步骤可以采用其他顺序或者同时进行。其次，本领域技术人员也应该知悉，说明书中所描述的实施例均属于优选实施例，所涉及的动作和模块并不一定是本申请所必须的。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置，可通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储器中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储器中，包括若干指令用以使得一台计算机设备(可为个人计算机、服务器或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储器包括：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储器中，存储器可以包括：闪存盘、只读存储器(英文：Read-Only Memory，简称：ROM)、随机存取器(英文：Random Access Memory，简称：RAM)、磁盘或光盘等。
以上对本申请实施例进行了详细介绍，本文中应用了具体个例对本申请的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本申请的方法及其核心思想；同时，对于本领域的一般技术人员，依据本申请的思想，在具体实施方式及应用范围上均会有改变之处，综上上述，本说明书内容不应理解为对本申请的限制。

Claims (30)

  1. 一种安全激活状态确定方法，其特征在于，所述方法包括：
    第一接入网设备接收冗余指示；
    所述第一接入网设备根据所述冗余指示建立与用户设备之间的第一会话和参考会话，所述第一会话与所述参考会话互为冗余会话；
    所述第一接入网设备向第二接入网设备发送参考会话的会话分流消息，所述会话分流消息携带所述参考会话的会话信息，所述会话分流消息用于指示所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
    所述第一接入网设备向所述第二接入网设备发送目标消息，当所述目标消息携带第一标识，所述目标消息用于指示所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示所述第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态。
  2. 根据权利要求1所述的方法，其特征在于，所述第一接入网设备向所述第二接入网设备发送目标消息，包括：
    所述第一接入网设备在第一时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
  3. 根据权利要求1所述的方法，其特征在于，所述第一接入网设备向第二接入网设备发送目标消息，包括：
    所述第一接入网设备在第二时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备接收所述第二会话的安全激活状态指示信息；
    所述第一接入网设备根据所述安全激活状态指示信息，确定出所述第二标识。
  5. 根据权利要求1至4任一项所述的方法，其特征在于，所述方法还包括：
    所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中，获取所述第一标识。
  6. 根据权利要求1所述的方法，其特征在于，当所述目标消息携带第三标识，所述目标消息用于指示所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述目标消息包括辅节点增加或修改消息。
  8. 一种安全激活状态确定方法，其特征在于，所述方法包括：
    第二接入网设备接收第一接入网设备发送的会话分流消息，所述会话分流消息携带参考会话的会话信息，所述参考会话为所述第一接入网设备与用户设备之间的会话；
    所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
    所述第二接入网设备接收所述第一接入网设备发送的目标消息，当所述目标消息携带 第一标识，所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态，所述第一会话为所述第一接入网设备与所述用户设备之间的会话，所述第一会话与所述参考会话互为冗余会话。
  9. 根据权利要求8所述的方法，其特征在于，所述目标消息为所述第一接入网设备在第一时间区间中的任一时刻向所述第二接入网设备发送的目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
  10. 根据权利要求9所述的方法，其特征在于，所述目标消息为所述第一接入网设备在第二时间区间中的任一时刻向所述第二接入网设备发送的目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
  11. 根据权利要求8至10任一项所述的方法，其特征在于，所述第二标识为所述第一接入网设备根据所述第二会话的安全激活状态指示信息确定出的标识。
  12. 根据权利要求8至11任一项所述的方法，其特征在于，所述第一波标识为所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中获取的标识。
  13. 根据权利要求8所述的方法，其特征在于，当所述目标消息携带第三安全激活状态，所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
  14. 根据权利要求8至13任一项所述的方法，其特征在于，所述目标消息包括辅节点增加或修改消息。
  15. 一种接入网设备，其特征在于，所述接入网设备包括接收单元、会话建立单元、第一发送单元和第二发送单元，其中，
    所述接收单元，用于接收冗余指示；
    所述会话建立单元，用于根据所述冗余指示建立与用户设备之间的第一会话和参考会话，所述第一会话与所述参考会话互为冗余会话；
    所述第一发送单元，用于向第二接入网设备发送参考会话的会话分流消息，所述会话分流消息携带所述参考会话的会话信息，所述会话分流消息用于指示所述第二接入网设备根据所述会话信息建立与所述用户设备之间的第二会话；
    所述第二发送单元，用于向所述第二接入网设备发送目标消息，当所述目标消息携带第一标识，所述目标消息用于指示所述第二接入网设备将第二标识赋值为所述第一标识，所述第一标识用于指示所述第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态。
  16. 根据权利要求15所述的接入网设备，其特征在于，在所述向所述第二接入网设备发送目标消息方面，所述第二发送单元具体用于：
    第一时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
  17. 根据权利要求15所述的接入网设备，其特征在于，在所述向所述第二接入网设备发送目标消息方面，所述第二发送单元具体用于：
    在第二时间区间中的任一时刻向所述第二接入网设备发送所述目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
  18. 根据权利要求15至17任一项所述的接入网设备，其特征在于，所述装置还具体用于：
    接收所述第二会话的安全激活状态指示信息；
    根据所述安全激活状态指示信息，确定出所述第二标识。
  19. 根据权利要求15至18任一项所述的接入网设备，其特征在于，所述装置还具体用于：
    从存储所述第一标识的存储地址对应的存储空间中，获取所述第一标识。
  20. 根据权利要求15所述的接入网设备，其特征在于，所述第二发送单元还具体用于：
    当所述目标消息携带第三标识，所述目标消息用于指示所述第二接入网设备将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
  21. 根据权利要求15至20任一项所述的接入网设备，其特征在于，所述目标消息包括辅节点增加或修改消息。
  22. 一种接入网设备，其特征在于，所述装置包括第一接收单元、会话建立单元、第二接收单元，其中，
    所述第一接收单元，用于接收第一接入网设备发送的会话分流消息，所述会话分流消息携带参考会话的会话信息，所述参考会话为所述第一接入网设备与用户设备之间的会话；
    所述会话建立单元，用于根据所述会话信息建立与所述用户设备之间的第二会话；
    所述第二接收单元，用于接收所述第一接入网设备发送的目标消息，当所述目标消息携带第一标识，将第二标识赋值为所述第一标识，所述第一标识用于指示第一会话的安全激活状态，所述第二标识用于指示所述第二会话的安全激活状态，所述第一会话为所述第一接入网设备与所述用户设备之间的会话，所述第一会话与所述参考会话互为冗余会话。
  23. 根据权利要求22所述的接入网设备，其特征在于，所述目标消息为所述第一接入网设备在第一时间区间中的任一时刻发送的目标消息，所述第一时间区间为所述建立所述参考会话的时间区间。
  24. 根据权利要求22所述的接入网设备，其特征在于，所述目标消息为所述第一接入网设备在第二时间区间中的任一时刻发送的目标消息，所述第二时间区间为所述参考会话建立完成后的预设时间区间。
  25. 根据权利要求22至24任一项所述的接入网设备，其特征在于，所述第二标识为所述第一接入网设备根据所述第二会话的安全激活状态指示信息确定出的标识。
  26. 根据权利要求22至25任一项所述的接入网设备，其特征在于，所述第一波标识为所述第一接入网设备从存储所述第一标识的存储地址对应的存储空间中获取的标识。
  27. 根据权利要求22所述的接入网设备，其特征在于，当所述目标消息携带第三安全激活状态，所述接入网设备还具体用于：
    将所述第三标识作为所述第二会话的第二标识，所述第三标识用于指示第三安全激活状态，所述第三安全激活状态为所述第一接入网设备接收的安全激活状态。
  28. 根据权利要求22至27任一项所述的接入网设备，其特征在于，所述目标消息包括辅节点增加或修改消息。
  29. 一种通信系统，其特征在于，所述通信系统包括如权利要求15至21任一项所述的第一接入网设备、权利要求22至28任一项所述第二接入网设备和用户设备。
  30. 一种计算机可读存储介质，其特征在于，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1至14任一项所述的方法。
PCT/CN2020/095812 2019-06-14 2020-06-12 安全激活状态确定方法及相关产品 WO2020249083A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910525877.5 2019-06-14
CN201910525877.5A CN112087816B (zh) 2019-06-14 2019-06-14 安全激活状态确定方法及相关产品

Publications (1)

Publication Number Publication Date
WO2020249083A1 true WO2020249083A1 (zh) 2020-12-17

Family

ID=73734247

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/095812 WO2020249083A1 (zh) 2019-06-14 2020-06-12 安全激活状态确定方法及相关产品

Country Status (2)

Country Link
CN (1) CN112087816B (zh)
WO (1) WO2020249083A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN118104264A (zh) * 2022-09-26 2024-05-28 北京小米移动软件有限公司 一种多路径传输方法/装置/设备及存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108282823A (zh) * 2017-01-06 2018-07-13 株式会社Kt 用于控制冗余数据发送的方法和设备
CN108633018A (zh) * 2017-03-23 2018-10-09 华为技术有限公司 配置方法、装置及系统
CN109168161A (zh) * 2018-08-27 2019-01-08 创新维度科技（北京）有限公司 安全模式激活方法、装置、系统和计算机存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7970421B2 (en) * 2007-04-10 2011-06-28 Markettools, Inc. Session management system and method for use with stateless messaging services
US11129017B2 (en) * 2017-09-28 2021-09-21 Futurewei Technologies, Inc. System and method for security activation with session granularity
CN109586900B (zh) * 2017-09-29 2020-08-07 华为技术有限公司 数据安全处理方法及装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108282823A (zh) * 2017-01-06 2018-07-13 株式会社Kt 用于控制冗余数据发送的方法和设备
CN108633018A (zh) * 2017-03-23 2018-10-09 华为技术有限公司 配置方法、装置及系统
CN109168161A (zh) * 2018-08-27 2019-01-08 创新维度科技（北京）有限公司 安全模式激活方法、装置、系统和计算机存储介质

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
3GPP GROUP: "Security Architecture and Procedures for 5G System", 3GPP TS 33.501 V15.5.0, 13 June 2019 (2019-06-13), pages 1 - 190, XP051754085, DOI: 20200828170725A *
3GPP GROUP: "Study on the Security for 5G URLLC", 3GPP TR 33.825 V0.4.0, 13 May 2019 (2019-05-13), pages 1 - 22, XP051753835 *
HUAWEI ET AL.: "Solution #1 update", 3GPP TSG SA WG3 (SECURITY) MEETING #94 AD-HOC S3-190974, 15 March 2019 (2019-03-15), XP051697901 *

Also Published As

Publication number Publication date
CN112087816A (zh) 2020-12-15
CN112087816B (zh) 2023-05-16

Similar Documents

Publication Publication Date Title
JP6553635B2 (ja) Ｄ２ｄ関連情報の指示及びｄ２ｄ伝送リソースの決めのための方法及び装置
WO2019056383A9 (zh) 资源配置的方法、终端设备和网络设备
US11172530B2 (en) Communication establishment method and terminal
TWI681684B (zh) 使用者裝置及基地台
CN109560899B (zh) 一种进行重复传输的方法和设备
JP6961711B2 (ja) ページング方法及びページング装置
WO2018195947A1 (zh) 一种d2d通信的方法、远程用户设备及中继用户设备
US20120322479A1 (en) Communication link monitoring and failure handling in a network controlled device-to-device connection
US20180332519A1 (en) Signal Strength Measurement Method And Device
EP3629538B1 (en) Communication method and apparatus
WO2022152089A1 (zh) 一种信息传输方法及其装置
EP3702915B1 (en) Data processing method and device, storage medium, processor, and system
TWI775009B (zh) 用於行動通訊系統之基地台及其資料傳輸方法
CN115707036A (zh) 传输数据的方法和装置
WO2020249083A1 (zh) 安全激活状态确定方法及相关产品
WO2019084924A1 (zh) 传输数据的方法和设备
WO2017128185A1 (zh) 控制服务连接的方法和终端
WO2021103026A1 (zh) 在带宽部分上进行通信的方法
CN112740826A (zh) 一种能力上报方法及终端设备
US9763102B2 (en) Resources in a communication system
WO2022022394A1 (zh) 一种终端设备的状态指示方法及通信装置
US10609743B2 (en) D2D data transmission method and system, and device
WO2020238684A1 (zh) 通信方法、装置、设备及计算机可读存储介质
JP7296469B2 (ja) 接続管理方法、装置、コンピュータデバイス及び記憶媒体
CN111314272B (zh) 一种任务处理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20823050

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20823050

Country of ref document: EP

Kind code of ref document: A1