WO2021022515A1 - 一种通信的方法、装置及系统 - Google Patents

一种通信的方法、装置及系统 Download PDF

Info

Publication number
WO2021022515A1
WO2021022515A1 PCT/CN2019/099602 CN2019099602W WO2021022515A1 WO 2021022515 A1 WO2021022515 A1 WO 2021022515A1 CN 2019099602 W CN2019099602 W CN 2019099602W WO 2021022515 A1 WO2021022515 A1 WO 2021022515A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
rrc
terminal
terminal device
security mode
Prior art date
Application number
PCT/CN2019/099602
Other languages
English (en)
French (fr)
Inventor
樊建霞
姚琴波
王小峰
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201980082128.8A priority Critical patent/CN113396637B/zh
Priority to PCT/CN2019/099602 priority patent/WO2021022515A1/zh
Publication of WO2021022515A1 publication Critical patent/WO2021022515A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management

Definitions

  • This application relates to the field of communication, and specifically to a communication method, device and system.
  • 3rd generation partnership project 3rd generation partnership project, 3GPP
  • the role of 3GPP technical specifications is to achieve a smooth transition from the second generation network to the third generation network. And to ensure the backward compatibility of future technologies (such as fifth-generation networks), support easy network construction and roaming and compatibility between systems.
  • UE user equipment
  • radio access network radio access network
  • RAN radio access network
  • Messages sent by the client should be processed securely to prevent malicious attacks on the device from monitoring. If the exchange message between the UE and the RAN device requires security processing, the UE needs to activate the security mode after establishing a radio resource control (RRC) connection with the RAN device or re-establishing the RRC connection.
  • RRC radio resource control
  • the security mode may not be activated during the process of establishing an RRC connection or re-establishing an RRC connection between the UE and the RAN device. Therefore, the malicious attack device can monitor the interaction messages between the UE and the RAN device in this process, and use the time gap when the security mode is not activated to pretend to be the RAN device to send the RRC release message to the UE. The UE cannot use the security mode to perform the RRC release message.
  • the RRC release message is sent by the RAN device, so that the UE erroneously releases the RRC connection with the RAN device according to the RRC release message, which causes the communication service between the UE and the RAN device to be unable to proceed normally, malicious
  • the attacking behavior of the attacking device succeeded.
  • the embodiments of the present application provide a communication method, device, and system to prevent a malicious attack device from sending an RRC release message when the security mode is not activated during the RRC connection establishment process and the RRC connection re-establishment process of the terminal device The attack on terminal equipment succeeded.
  • the first aspect of the embodiments of the present application provides a communication method, including:
  • the RRC connection is maintained.
  • the RRC connection is maintained. Assuming that during the initial establishment of the RRC connection, according to normal message exchange logic, if the RRC release message is sent by the access network device, the access network device will not send the first message to the terminal after sending the RRC release message. Therefore, if the terminal receives the preset first message within the first time period, it means that the previously received RRC release message was not sent by the access network device, but by the malicious attacking device. Therefore, the RRC release message is not released according to the RRC. The message releases the RRC connection, but keeps the RRC connection. This prevents malicious attackers from using RRC release messages to attack the terminal during the initial establishment of the RRC connection. This improves the connection between the terminal and the access network device. The security of the connection ensures the secure communication of the terminal.
  • the preset first message is used to request the terminal to establish a secure communication mechanism with the access network device or the core network device.
  • the preset first message includes an authentication request message, and the authentication request message is used for Request the terminal and the core network device to perform mutual authentication, so as to ensure the secure communication between the terminal and the core network device.
  • the preset first message includes a non-access stratum (NAS) Security establishment request message
  • the NAS security mode command message is used to request the terminal to establish a NAS secure connection with the core network device, so that the terminal and the core network device are mutually authenticated, and the relationship between the terminal and the core network device is further improved.
  • NAS non-access stratum
  • the first message includes a safe mode command message, which is used to request the terminal to activate The security mode enables the RRC connection to enter a secure connection state, thereby ensuring the secure communication between the terminal and the access network device.
  • the RRC release message includes the RRC connection release information element, and the RRC The connection release cell carries redirected carrier information.
  • the terminal is in long term evolution (LTE) or LTE-advanced (LTE-A). ) Communication system.
  • LTE long term evolution
  • LTE-A LTE-advanced
  • the RRC release message in the seventh possible implementation manner, is in an inactive safe state, and the terminal is in In the new radio (NR) communication standard, the RRC release message does not include the RRC connection release cell carrying the redirected carrier information.
  • NR new radio
  • the method further includes: receiving a safe mode command message within the first time period and passing the safe mode command message During security verification, the security mode is activated and the RRC connection enters the secure connection state.
  • the method before receiving the RRC release message, the method further includes:
  • the preset first message includes an RRC setup message.
  • the preset first message is an RRC re-establishment message
  • the method further includes: when the RRC re-establishment message is received within the first time period and the RRC re-establishment message passes the safety verification, activating the safety mode, so that the RRC connection enters the safety connection state.
  • a second aspect of the present application provides a communication device, where the communication device is configured to perform the communication method in the first aspect or any one of the possible implementations of the first aspect.
  • the communication device may include a module for executing the communication method in the first aspect or any one of the possible implementation manners of the first aspect.
  • a third aspect of the present application provides a communication device.
  • the communication device includes a processor, the processor is coupled to a memory, the memory is used to store instructions, and the processor is used to execute instructions stored in the memory. Execution of the instructions stored in the memory enables the processor to execute the communication method in the first aspect or any one of the possible implementation manners of the first aspect.
  • the communication device further includes the memory.
  • a fourth aspect of the present application provides a terminal.
  • the terminal includes a processor, a memory, and a transceiver.
  • the transceiver is used to receive and send data.
  • the memory stores program codes.
  • the processor calls the memory The program code for executing the first aspect or the communication method in any one of the possible implementation manners of the first aspect.
  • a fifth aspect of the present application provides a computer-readable storage medium that stores instructions in the computer-readable storage medium, which when run on a computer, causes the computer to execute any one of the above-mentioned first aspect or the first aspect.
  • the method of communication in the realization mode is not limited to:
  • a sixth aspect of the present application provides a communication system.
  • the communication system includes the aforementioned terminal, and the communication system further includes the aforementioned access network device and core network device.
  • the terminal in the process of initially establishing an RRC connection or re-establishing an RRC connection between the terminal and the access network device, after the terminal sends an RRC establishment request message, it receives an RRC release message, which is used for Instruct the terminal to release the RRC connection; and keep the RRC connection when the terminal receives the preset first message within the first time period after receiving the RRC release message. It is assumed that during the initial establishment of the RRC connection or the re-establishment of the RRC connection, according to the normal message exchange logic, after the access network device sends the RRC release message, the first message will not be sent to the terminal.
  • the terminal receives the preset first message within the first period of time after receiving the RRC release message, it means that the previously received RRC release message was not sent by the access network device, but by the malicious attacking device.
  • the RRC connection is not released according to the RRC release message. This method can prevent the malicious attack device from successfully attacking the terminal by sending the RRC release message, improve the security of the connection between the terminal and the access network device, and ensure the communication security of the terminal.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of this application.
  • FIG. 2 is a schematic flowchart of a communication method provided by an embodiment of this application.
  • FIG. 3 is a schematic diagram of the signaling interaction of the initial RRC connection establishment and security mode activation process provided by an embodiment of the application;
  • FIG. 4 is a schematic flowchart of a communication method provided by an embodiment of this application.
  • FIG. 5 is a schematic diagram of the interaction of initial RRC connection establishment and authentication process signaling provided by an embodiment of this application;
  • FIG. 6 is a schematic diagram of the signaling interaction of the process of reestablishing an RRC connection provided by an embodiment of this application;
  • FIG. 7 is a schematic diagram of the interaction of signaling in the process of reestablishing an RRC connection provided by an embodiment of this application;
  • FIG. 8 is a schematic flowchart of a communication method provided by an embodiment of this application.
  • FIG. 9 is a schematic structural diagram of a communication device provided in an embodiment of this application.
  • FIG. 10 is a schematic structural diagram of a communication device provided in an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of a terminal provided in an embodiment of the application.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the application.
  • the technical solution in the embodiment of the application can be applied to the communication system shown in FIG. 1.
  • the communication system includes malicious attack equipment and access network equipment.
  • Terminal equipment optionally, also includes core network equipment.
  • the access network device can provide access network services to the cell covered by it. When the terminal device is located in the cell covered by the access network device, it can establish an RRC connection with the access network device, so as to pass the access
  • the network equipment is connected to the operator's network to use the network service provided by the corresponding operator.
  • the access network device is connected to the terminal device, and can receive data from the terminal device and send it to the core network device, or can receive the data sent by the core network device and forward it to the terminal device.
  • Malicious attack devices are usually devices that can threaten the communication security of terminal devices, such as pseudo base stations.
  • a malicious attack device can use the vulnerability of the terminal device and the access network device that the security mode is not activated when establishing an RRC connection or re-establishing an RRC connection, pretending to be the access network device sending an RRC release message to the terminal device, so that The terminal device releases the RRC connection between the terminal device and the access network device according to the RRC release message, so as to achieve the attack purpose that the terminal device cannot normally access the operator's network.
  • LTE long term evolution
  • UMTS universal mobile telecommunications system
  • UMTS terrestrial radio access network
  • UTRAN universal mobile telecommunications system
  • GSM global system for mobile communication
  • EDGE enhanced data rate for GSM evolution
  • GSM EDGE radio access network GSM EDGE radio access network
  • the functions of the mobility management entity are completed by the serving general packet radio service (GPRS) support node (serving GPRS support, SGSN), and the service gateway (
  • GPRS general packet radio service
  • SGW serving gateway
  • PGW public data network gateway
  • GGSN gateway GPRS support node
  • PLMN public land mobile network
  • 5G 5th generation mobile communication technology
  • the access network device involved in the embodiments of the present application may also be referred to as a radio access network (radio access network, RAN) device.
  • the access network device is connected to the terminal device, and is used to receive data from the terminal device and send it to the core network device.
  • Access network equipment corresponds to different equipment in different communication systems. For example, in the 2nd generation mobile communication technology (2G) system, it corresponds to the base station and the base station controller.
  • 2G 2nd generation mobile communication technology
  • corresponding base station and radio network controller (RNC) in the 3rd generation mobile communication technology (3G) system corresponds to the access network equipment in the new radio (NR) system in the 5G system (for example, next generation node B (gNB)).
  • RNC Radio Network Controller
  • eNB evolved node B
  • NR new radio
  • gNB next generation node B
  • the communication method provided by the embodiment of the present application may be executed by a terminal device, or may be executed by a chip or circuit inside the terminal device.
  • the terminal device may be a device that includes wireless transceiver functions and can cooperate with network devices to provide users with communication services.
  • terminal equipment may refer to user equipment (UE), access terminal, user unit, user station, mobile station, mobile station, remote station, remote terminal, mobile equipment, user terminal, terminal, wireless communication equipment, User agent or user device.
  • the terminal device may be a cellular phone, a cordless phone, a session initiation protocol (session initiation protocol, SIP) phone, a wireless local loop (WLL) station, a personal digital assistant (PDA), a wireless Handheld devices with communication functions, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices, terminal devices in 5G networks or networks after 5G, etc. are not limited in this embodiment of the application.
  • Description of the terminal device In this application, all devices that can perform data communication with the access network device can be regarded as terminal devices. In this application, the UE will be introduced in a general sense.
  • the terminal device and the access network device initially establish an RRC connection.
  • the malicious attack device uses the gap between the terminal device and the access network device when the security mode is not activated, and sends an RRC release message to the terminal device.
  • the embodiment of this application provides a communication method.
  • a detailed description will be given by taking the method for the terminal device to execute the communication in the embodiment of the present application as an example.
  • the communication method in the embodiment of the present application may also be executed by a chip in a terminal device, which is not specifically limited here.
  • the method in which the terminal device executes the communication in the embodiment of the present application is taken as an example for description below.
  • FIG. 2 is a schematic flowchart of a communication method provided by an embodiment of the application.
  • the communication method in the embodiment of the present application may include:
  • the terminal device sends an RRC Setup Request (RRCSetupRequest) message.
  • RRCSetupRequest RRC Setup Request
  • the terminal device when the terminal device needs to access the operator's network, it needs to establish an RRC connection with the access network device of the cell where it is located, so as to access the operator's network through the access network device.
  • the terminal device According to the 3GPP technical specification TS 38.331V15.5.0, the terminal device must first send an RRC establishment request message to the corresponding access network device.
  • the RRC establishment request message is used to request the access network device to establish an RRC connection, and then the terminal device and the access network
  • the device can complete the initial establishment of the RRC connection according to the interaction process specified in the 3GPP technical specification TS 38.331 V15.5.0.
  • the terminal device and the access network device After the terminal device and the access network device initially establish an RRC connection, the terminal device and the access network device also need to perform a security establishment process, that is, the terminal device activates the security mode according to the security mode command message sent by the access network device, so that the terminal The RRC connection between the device and the access network device enters a secure connection state.
  • the terminal equipment During the initial establishment of the RRC connection and security activation of the terminal equipment, the terminal equipment not only interacts with the access network equipment, but also interacts with the core network equipment.
  • the terminal equipment, the access network equipment and the core network The interaction process between the three parties is shown in Figure 3.
  • the process of initially establishing an RRC connection between the terminal device and the access network device is specifically: the terminal device sends an RRC establishment request message to the access network device, and the RRC establishment request message is used to request the connection.
  • the network access device establishes an RRC connection with the terminal device.
  • the access network device After receiving the RRC setup request message sent by the terminal device, the access network device sends an RRC setup message (RRCSetup) to the terminal device in response to the RRC setup request message.
  • RRC setup message is used to indicate that the terminal device can establish an RRC connection.
  • the terminal device sends an RRC Setup Complete (RRCSetupcomplete) message to the access network device, so that the access network device confirms that the RRC connection has been established, thereby completing the initial establishment of the RRC connection.
  • the terminal device After the terminal device establishes the RRC connection, it will send an RRC establishment complete message to the access network device, which carries the registration information of the terminal device, and the access network device sends an initial UE message (Initial UE message) to the core network device.
  • the message carries the registration information of the terminal device, and the core network device sends a downlink NAS transmission message to the access network device, so that the access network device passes the authentication request (Authentication request) message carried in the downlink NAS transmission message through the downlink information
  • the forwarding (DLInformationTransfer) message is forwarded to the terminal device, and the authentication request message is used to request the terminal device and the core network device to perform mutual authentication.
  • the terminal device After receiving the authentication request message, the terminal device sends an authentication response (Authentication response) message to the access network device through an uplink information forwarding (ULInformationTransfer) message, so that the access network device transmits the authentication response message through the uplink NAS
  • the message is forwarded to the core network device, indicating that the core network device can perform mutual authentication with the terminal device.
  • the core network equipment and terminal equipment continue to transmit messages through the method of access network equipment forwarding, and still use downlink NAS transmission messages, uplink NAS transmission messages, downlink information forwarding messages, or uplink information forwarding messages as the core network equipment and terminal equipment.
  • the carrier of interactive content is used to transmit messages through the method of access network equipment forwarding, and still use downlink NAS transmission messages, uplink NAS transmission messages, downlink information forwarding messages, or uplink information forwarding messages.
  • the terminal device After the terminal device receives the authentication request message and performs security verification on the authentication message according to the protocol, if it passes the security verification, it sends an authentication response message to the core network device to notify the core network device and the terminal device to perform mutual authentication , That is, mutual authentication. After the two parties pass the authentication, the core network device forwards the NAS Security Mode Command message to the terminal device through the access network device. The message is used to request the terminal device to establish a NAS secure connection with the core network device. If it fails, an authentication failure (Authentication Failure) message is sent to the terminal device. After the terminal device establishes a NAS secure connection, the interactive message between the terminal device and the core network device is encrypted by NAS, which ensures the security of the connection between the terminal device and the core network device. After the NAS security connection is established, a security mode is established between the terminal device and the access network device.
  • NAS Security Mode After the terminal device establishes a NAS secure connection, the interactive message between the terminal device and the core network device is encrypted by
  • the access network device sends a security mode command (Security Mode Command) message to the terminal device to request the terminal device to activate the security mode.
  • a security mode command Security Mode Command
  • the terminal device activates the security mode so that the initially established RRC connection enters the secure connection state, and sends a security mode completion message to the access network device to indicate that the security mode of the access network device has been activated, thereby completing
  • the terminal device receives an RRC release (RRCRelease) message.
  • RRC release RRCRelease
  • the access network device will send an RRC release message to the terminal device.
  • the RRC release message is used to instruct the terminal device to release the RRC connection.
  • the content of the RRC release message may be different in different communication standards.
  • the RRC release message includes the RRC connection release information element, and the RRC connection release information element carries the redirected carrier information (redirectedCarrierInfo) .
  • the terminal device When the terminal device is in the LTE or LTE-A communication standard, after the terminal device receives the RRC release message carrying the redirected carrier information, the terminal device will not immediately release the RRC connection, but will access the designated cell based on the redirected carrier information , And then release the RRC connection established in the original cell.
  • the security mode is not activated when the terminal device initially establishes an RRC connection or re-establishes an RRC connection, so the security mode is not activated in this process.
  • the RRC release message is in an inactive security state, and the RRC release message sent by the access network device to the terminal device does not carry redirection carrier information.
  • the terminal equipment in the NR communication standard should directly release the RRC connection and switch from the connected state to the idle state.
  • the terminal equipment may access the core network of the NR communication standard through the access network equipment of the LTE or LTE-A communication standard.
  • the terminal device may receive the RRC release message sent by the access network device to carry redirected carrier information.
  • the terminal equipment should ignore the redirection carrier information in the RRC release message, and directly release the RRC connection and enter the idle state.
  • the terminal device is in the NR communication mode. After the terminal device receives the RRC release message, it should release the RRC connection. However, when the terminal device sends an RRC establishment request message to the access network device, the malicious attack device may be After listening to the RRC establishment request message, it pretends to be the access network device sending an RRC release message to the terminal device, and because the security mode is not activated between the terminal device and the access network device, the terminal device cannot use the security mode to control the received RRC The release message is subjected to security verification, that is, the terminal device cannot determine whether the received RRC release message is sent by the access network device. If the RRC release message received by the terminal device is sent by a malicious attack device, and the terminal device releases the RRC connection according to the RRC release message, the attack behavior of the malicious attack device will succeed.
  • the terminal device after the terminal device receives the RRC release message, the terminal device will have a delay time for the RRC release operation. The terminal device will not process the received RRC release message temporarily. The terminal device will not process the received RRC release message during the delay time. The further action is to determine the source of the received RRC release message to determine whether to release the RRC connection with the access network device according to the first RRC release message.
  • the terminal device maintains the RRC connection when receiving the preset first message within the first time period after receiving the RRC release message.
  • the terminal device needs to ignore the RRC release message and maintain the RRC connection.
  • the terminal device receives the RRC release message after sending the RRC establishment request message, and the RRC release message is used to instruct the terminal device to release the RRC connection ;
  • the RRC connection is maintained, which prevents the malicious attacking device from sending the RRC release during the initial establishment of the RRC connection.
  • the preset first message is used to request the terminal device to establish a secure communication mechanism with the access network device or the core network device based on the RRC connection, and the secure communication mechanism It is a mechanism used to ensure the communication security between terminal equipment and access network equipment or core network equipment.
  • the access network device will send authentication request messages to the terminal device in turn according to the process shown in Figure 3. , NAS security mode command message, thereby establishing a NAS security connection, ensuring the communication security between the terminal device and the core network device.
  • the access network device sends a security mode command message to the terminal device to instruct the terminal device to activate the security mode, so that the RRC connection enters a secure connection state, and the communication security between the terminal device and the access network device is guaranteed.
  • the access network device sends an RRC release message to the terminal device during the initial establishment of the RRC connection, the first message will not be sent to the terminal in the subsequent process. Because the first message instructs the terminal device to establish a corresponding secure communication mechanism on the basis of the RRC connection, this is inconsistent with the RRC release message instructing the terminal device to release the RRC connection.
  • the terminal device receives the preset first message within the first time period after receiving the RRC release message, it means that the RRC release message previously received by the terminal device is not credible, and the terminal device will not release the RRC according to the RRC release message. Connect to prevent malicious attacks on the device from succeeding.
  • the preset first message may be an authentication request message.
  • the authentication request message is used to request the terminal device and the core network device to perform mutual authentication, which is the establishment of the terminal device and the core network device. A prerequisite for a secure communication mechanism between devices.
  • the preset first message may be a NAS security mode command message.
  • the terminal device may establish a NAS security connection with the core network device, thereby completing the establishment and core network device. Secure communication mechanism between network devices.
  • the preset first message may be a security mode command message, which instructs the terminal device to activate the security mode, so that the RRC connection enters a secure connection state, thereby completing the establishment of the connection with the access network device Secure communication mechanism.
  • this embodiment may also include:
  • the terminal device When the terminal device receives the security mode command message within the first time period and the security mode command message passes the integrity security verification (hereinafter referred to as "security verification"), the terminal device activates the security mode to make the RRC connection enter the secure connection state .
  • security verification integrity security verification
  • the terminal device after the terminal device receives the security mode command message, it can perform security verification on the security mode command message through the integrity protection algorithm carried in the security mode command message and the key configured by the terminal device itself.
  • the terminal device activates the security mode, so that the RRC connection after the initial establishment is completed enters the secure connection state.
  • the terminal device when communicating between the terminal device and the access network device, in addition to the data interaction on the common channel, other data interactions are performed through the RRC connection in the secure connection state to prevent malicious attack devices from monitoring the terminal device and the access network.
  • the interaction messages between devices can also identify malicious messages sent by malicious attacking devices to terminal devices, so it can prevent malicious attacking devices from using RRC release messages to attack terminal devices.
  • the preset first message may be an authentication request message, a NAS security mode command message, or a security mode command message.
  • the terminal device may receive the RRC release message multiple times at different stages. For example, the terminal device may receive the RRC release message before receiving the authentication request message. After receiving the authentication request message and before receiving the NAS security mode command message, the RRC release message may be received. It is also possible to receive the RRC release message after receiving the NAS security mode command message and before receiving the security mode command message.
  • the terminal device receives the RRC release message before receiving the authentication request message forwarded by the access network device, and the terminal device can wait to receive the message forwarded by the access network device within the first time period.
  • the authentication request message determines whether to release the RRC connection according to the RRC release message.
  • the terminal device may wait for the NAS security mode command message or the security mode command message forwarded by the access network device within the second time period to determine whether to release the RRC release message according to the received RRC The message releases the RRC connection. Description will be given below in conjunction with the embodiment of FIG. 4.
  • FIG. 4 is a schematic flowchart of a communication method provided by an embodiment of this application.
  • this embodiment may include:
  • the terminal device sends an RRC establishment request message.
  • Step 401 is similar to the above step 201, and the specific content can be understood in combination with the content of the above step 201.
  • the terminal device receives the first RRC release message.
  • the first RRC release message is received by the terminal device during the RRC establishment process and before the terminal device receives the authentication request message forwarded by the access network device for the core network device.
  • the first RRC release message is used for Instruct the terminal device to release the RRC connection. Because the security mode is not activated between the terminal device and the access network device, the terminal device cannot use the security mode to perform security verification on the received first RRC release message, that is, the terminal device cannot determine whether the received first RRC release message is a connection. Sent by the connected device. If the first RRC release message received by the terminal device is sent by a malicious attack device, and the terminal device releases the RRC connection according to the first RRC release message, the attack behavior of the malicious attack device will succeed.
  • the terminal device after the terminal device receives the first RRC release message, the terminal device will have a delay time for the RRC release operation. The terminal device will not process the received first RRC release message temporarily, and according to the delay time The authentication message forwarding action of the access network device determines the source of the received first RRC release message to determine whether to release the RRC connection with the access network device according to the first RRC release message.
  • the terminal device maintains the RRC connection when receiving the authentication request message within the first time period after receiving the first RRC release message.
  • the authentication request message is used to request the terminal device and the core network device to perform mutual authentication.
  • the core network device authenticates the terminal device according to the authentication response message sent by the terminal device.
  • the terminal device can command the message according to the NAS security mode of the core network device Establish a NAS secure connection with the core network equipment to ensure the security of interaction between the terminal equipment and the core network equipment.
  • the terminal device When the terminal device receives the authentication request message forwarded by the access network device within the first time period, the RRC connection is maintained. Because according to the normal message interaction logic, if the first RRC release message is sent by the access network device, after the access network device sends the first RRC release message, it should not forward the authentication sent by the core network device to the terminal device. If the terminal device receives the authentication request message within the first time period, it means that the first RRC release message received before was not sent by the access network device, but by the malicious attacking device. Therefore, it is not based on this The first RRC release message releases the RRC connection.
  • This method can prevent the terminal device from successfully attacking the terminal device by sending the RRC release message before the terminal device activates the security mode, and there is no need to set an excessively long waiting time to wait for receiving the security mode command message, which avoids receiving The execution delay of the RRC release message sent by the connected device is too long.
  • the terminal device receives the second RRC release message.
  • the terminal device after receiving the first RRC release message, the terminal device does not perform the RRC release operation according to the first RRC release message when receiving the authentication message within the first time period.
  • the malicious attack device may still send an RRC release message to the terminal device.
  • the foregoing second RRC release message may be sent by a malicious attack device, or may be sent by an access network device.
  • the terminal device maintains the RRC connection when receiving the NAS security mode command message or the security mode command message within the first time period after receiving the second RRC release message.
  • the terminal device waits to receive the NAS security mode command message or the security mode command message within the first time period after receiving the second RRC release message.
  • the terminal device When the terminal device receives the NAS security mode command message or the security mode command message within the first time period, the RRC connection is maintained. Because after the terminal device receives the authentication request message and before the terminal device receives the security mode command message, according to the normal message interaction logic, if the second RRC release message is sent by the access network device, the access network device sends the first 2. After the RRC releases the message, it should not send the NAS security mode command message or the security mode command message to the terminal device. Therefore, the terminal device receives the NAS security mode command message or the security mode command message within the first time period. The received second RRC release message is not sent by the access network device, but sent by the malicious attack device, so the RRC connection is not released according to the second RRC release message.
  • This method can prevent malicious attacking devices from successfully attacking terminal devices by sending RRC release messages during the initial establishment of the RRC connection and before the completion of the subsequent security mode establishment process. This improves the terminal device and connection.
  • the security of the connection between the access network equipment ensures that the communication service between the terminal equipment and the access network equipment can proceed normally.
  • the terminal device When the terminal device receives the safe mode command message within the first time period and the safe mode command message passes the security verification, the terminal device activates the safe mode, so that the RRC connection enters the safe connection state.
  • step 406 is similar to step 204 described above, and the specific content can be understood in conjunction with step 204 described above.
  • the preset first message may be any one of an authentication request message, a NAS security mode command message, or a security mode command message, and as shown in FIG. 3, the authentication request message , NAS security mode command messages and security mode command messages are received in sequence in the signaling interaction process, so the first duration should be set to be sufficient to wait for the security mode command messages that are in the latter order among the above three messages
  • the length of time may be in different interaction stages during the initial establishment of the RRC connection. Therefore, the first duration can be set according to the stage of the RRC release message receiving time, as shown in Figure 5 below.
  • the interaction diagram of the communication process signaling shown in FIG. 1 illustrates the following three situations in detail.
  • the terminal device when the time when the terminal device receives the RRC release message is between the two steps of the terminal device sending the RRC establishment request message and the terminal device receiving the RRC establishment message in the interaction process shown in FIG. Data statistics technology, the terminal device sends the RRC establishment request message during the initial establishment of the RRC connection to the completion of the initial establishment of the RRC connection, the time required to receive the security mode command message is calculated, and an appropriate time length is determined according to the statistical data As the first duration, it is possible to ensure that the terminal device is likely to receive the authentication request message, the NAS security mode command message, and the security mode command message during the first duration. When the terminal device receives the RRC release message, it can time according to the first time length according to its own configured timer or module with timing function.
  • the terminal device If within the first time length, the terminal device receives the authentication request message, NAS security At least one of the mode command message and the safety mode command message, the terminal device will not perform the RRC release according to the previously received RRC release message. If the first duration is reached and the terminal device does not receive at least one of the authentication request message, the NAS security mode command message, and the security mode command message, the terminal device normally performs RRC release according to the first RRC release message.
  • the technical solution can be used Big data statistics technology, which counts the time required for the terminal device to receive the RRC establishment message during the initial RRC connection establishment and after the initial establishment of the RRC connection is completed, to receive the security mode command message, and determine according to the statistical data as determined in Case 1.
  • Big data statistics technology which counts the time required for the terminal device to receive the RRC establishment message during the initial RRC connection establishment and after the initial establishment of the RRC connection is completed, to receive the security mode command message, and determine according to the statistical data as determined in Case 1.
  • Different durations are used as the first duration to try to ensure that the terminal device is likely to receive authentication request messages, NAS security mode command messages, and security mode command messages during the first duration, and it can also avoid setting the first duration too long As a result, the message processing delay is too long.
  • the terminal device when the terminal device receives the RRC release message, it can perform timing according to the first duration corresponding to case 2 according to its own configured timer or module with timing function. If within the first duration, the terminal When the device receives at least one of the authentication request message, the NAS security mode command message, and the security mode command message, the terminal device will not perform the RRC release according to the previously received RRC release message. If the first duration is reached, and the terminal device does not receive at least one of the authentication request message, the NAS security mode command message, and the security mode command message, the terminal device normally performs RRC release according to the RRC release message.
  • Case 3 The time when the terminal device receives the RRC release message is between the two steps of the terminal device sending the RRC establishment complete message and the terminal device receiving the security mode command message.
  • the technical solution may Using big data statistics technology, the terminal device sends the RRC establishment completion message during the initial establishment of the RRC connection to the time required for the terminal device to receive the security mode command message after the initial establishment of the RRC connection is completed, and determines the situation according to the statistical data 1.
  • the different time lengths determined in case 2 are used as the first time length to ensure that the terminal device is likely to receive the authentication request message, the NAS security mode command message, and the security mode command message during the first time period. Avoid too long the first time and cause too long message processing delay.
  • the terminal device when the terminal device receives the RRC release message, it can perform timing according to the first duration corresponding to case 3 according to its own configured timer or a module with timing function. If within the first duration, the terminal When the device receives at least one of the authentication request message, the NAS security mode command message, and the security mode command message, the terminal device will not perform the RRC release according to the previously received RRC release message. If the first duration is reached, and the terminal device does not receive at least one of the authentication request message, the NAS security mode command message, and the security mode command message, the terminal device normally performs RRC release according to the RRC release message.
  • the authentication request message in FIG. 5 is forwarded by the access network device from the core network device to the terminal device, and the authentication response message is forwarded by the terminal device to the core network device through the access network device.
  • the security of the connection between the device and the access network device ensures that the communication service between the terminal device and the access network device can be performed normally.
  • the setting of the first duration can be made more accurate, which can ensure that the terminal device can receive authentication request messages and NAS security within the first duration.
  • At least one of the mode command message and the safe mode command message has sufficient waiting time, which can also prevent the waiting time from being too long, leading to excessive delay in message processing.
  • the malicious attack device can easily monitor the RRC re-establishment request message sent by the terminal device, and send the message to the terminal device before receiving the RRC establishment message or the RRC re-establishment message.
  • the terminal device sends an RRC release message to destroy the RRC connection between the terminal device and the access network device.
  • the malicious attack device uses the gap of the inactive security mode between the terminal device and the access network device to attack by sending an RRC release message to the terminal device.
  • the embodiment of this application also provides another communication method. The detailed description is given below.
  • FIG. 8 is a schematic flowchart of a communication method provided by an embodiment of this application.
  • the communication method in the embodiment of the present application may include:
  • the terminal device sends an RRC establishment request message.
  • Step 801 is similar to the above step 201, and the specific content can be understood in combination with the content of the above step 201.
  • the terminal device sends an RRC re-establishment request message.
  • the terminal device In the case that the terminal device has completed the initial establishment of the RRC connection and the activation of the security mode, when some abnormal situation occurs in the terminal device, it needs to re-establish the RRC connection with the access network device.
  • the interaction process is shown in Figure 6 or Figure 7. .
  • the terminal device sends an RRC re-establishment request message to the access network device.
  • the RRC re-establishment request message is used to request the access network device and the terminal device to re-establish a previously established RRC connection.
  • the RRC re-establishment request message is not securely encrypted.
  • the access network device will find and verify the context corresponding to the terminal device locally. If it cannot find or verify the context, the access network device sends an RRC setup message to the terminal device to Instruct the terminal device to establish a new RRC connection, as shown in Figure 6.
  • the process is similar to the initial RRC establishment process. If the access network device finds and verifies the context corresponding to the terminal device, it sends an RRC re-establishment message to the terminal device to instruct the terminal device to re-establish the previously established RRC connection without establishing a new RRC connection, as shown in the figure 7 shown.
  • the RRC re-establishment message carries a key derivation parameter
  • the terminal device can derive a key according to the parameter to use the derived key to perform security verification on the RRC re-establishment message.
  • the terminal device activates the security mode.
  • the terminal device when a terminal device needs to re-establish an RRC connection with an access network device due to an abnormal situation, the terminal device can send RRC to the corresponding access network device.
  • a reestablishment request message (RRCReestablishmentRequest), the RRC reestablishment request message is used to request the access network device to re-establish an RRC connection, and then the terminal device and the access network device complete the reestablishment of the RRC connection.
  • the terminal device receives the RRC release message.
  • the terminal device after the terminal device receives the RRC release message, it should release the RRC connection according to the 3GPP technical specifications. However, because the terminal device sends an RRC re-establishment request message to the access network device, the malicious attacking device may listen to the RRC connection.
  • the RRC re-establishment request message pretends to be an access network device sending an RRC release message to the terminal device, and because the security mode between the terminal device and the access network device is in an inactive state during the RRC re-establishment process, the terminal device cannot use it
  • the security mode performs security verification on the received RRC release message, that is, the terminal device cannot determine whether the received RRC release message is sent by the access network device. If the RRC release message received by the terminal device is sent by a malicious attack device, and the terminal device releases the RRC connection according to the RRC release message, the attack behavior of the malicious attack device will succeed.
  • the terminal device after the terminal device receives the RRC release message, the terminal device will have a delay time for the RRC release operation. The terminal device will not process the received RRC release message temporarily. The terminal device will not process the received RRC release message during the delay time. The action determines the source of the received RRC release message to determine whether to release the RRC connection with the access network device according to the RRC release message.
  • the terminal device maintains the RRC connection when receiving the preset first message within the first time period after receiving the RRC release message.
  • the preset first message is a message used to instruct the terminal device to re-establish an RRC connection.
  • the preset first message may be the foregoing RRC establishment message or an RRC reestablishment (RRC Reestablishment) message.
  • RRC Reestablishment RRC reestablishment
  • the terminal device After the message is established and the RRC connection is re-established according to the RRC reestablishment message, the terminal device sends an RRC reestablishment complete (RRCReestablishmentComplete) message to the access network device.
  • RRC reestablishment Complete RRCReestablishmentComplete
  • the access network device sends an RRC release message to the terminal device during the process of reestablishing the RRC connection, it will not send the RRC establishment message or the RRC re-establishment message to the terminal device.
  • the terminal device is When an RRC setup message or an RRC re-establishment message is received within a period of time, it indicates that the RRC release message received by the terminal device is untrustworthy, so the terminal device maintains an RRC connection to prevent malicious attacks on the device from succeeding.
  • this embodiment may also include:
  • the terminal device activates the security mode, so that the RRC connection enters the secure connection state.
  • the terminal device after the terminal device receives the RRC re-establishment message, it can derive a key through the key derivation parameter carried in the RRC re-establishment message, so as to use the derived key to perform the RRC re-establishment message. safety verification.
  • the terminal device activates the security mode, so that the RRC connection after the re-establishment is completed enters a secure connection state.
  • the terminal device communicates with the access network device, it communicates through the RRC connection in a secure connection state to prevent malicious attack devices from monitoring the interactive messages between the terminal device and the access network device, and it can also identify malicious attack devices Malicious messages sent to terminal devices.
  • the terminal device in the process of re-establishing the RRC connection between the terminal device and the access network device, receives the RRC release message after sending the RRC re-establishment request message; the first time after the terminal device receives the RRC release message When the preset first message is received within a period of time, the RRC connection is maintained. Because in the process of re-establishing the RRC connection, according to the normal message interaction logic, after the access network device sends the RRC release message, it will no longer send the first message to the terminal device, and the terminal device will not proceed according to the preset first message. The RRC connection is re-established.
  • the terminal device receives the preset first message within the first time period after receiving the RRC release message, it means that the access network device instructs the terminal device to perform RRC re-establishment normally, and then the previously received RRC release message is not It is sent by the access network device, but sent by the malicious attack device, so the terminal device does not release the RRC connection according to the RRC release message.
  • This method can prevent malicious attack devices from successfully attacking terminal devices by sending RRC release messages during the process of re-establishing the RRC connection, which improves the security of the connection between the terminal device and the access network device. This ensures that the communication service between the terminal equipment and the access network equipment can proceed normally.
  • the terminal device may receive the RRC establishment message or the RRC re-establishment message after sending the RRC re-establishment request message.
  • the receiving time may be different.
  • This technical solution can also use big data statistics to calculate the waiting time of these two messages, and select a waiting time compatible with the two messages as the first time according to the statistical data to avoid the terminal.
  • the device makes the wrong decision and executes the RRC connection release operation according to the RRC release message, which leads to the success of the malicious attack device.
  • the communication device 90 provided in the embodiment of the present application may be applied inside a terminal, and it may be a chip or a circuit inside the terminal.
  • the communication device 90 may include:
  • the sending unit 901 is configured to send an RRC establishment request message, where the RRC establishment request message is used to request an access network device to establish an RRC connection;
  • the receiving unit 902 is configured to receive an RRC release message, where the RRC release message is used to instruct the terminal to release the RRC connection;
  • the processing unit 903 is configured to maintain the RRC connection when a preset first message is received within a first period of time after receiving the RRC release message.
  • the preset first message is used to request the terminal to establish a secure communication mechanism with the access network device or the core network device based on the RRC connection.
  • the preset first message may be an authentication request message, and the authentication request message is used to request the terminal and the core network device to perform mutual authentication.
  • the preset first message may be a NAS security mode command message, and the NAS security mode command message is used to request the terminal to establish a NAS security connection with the core network device.
  • the preset first message may be a safe mode command message, and the safe mode command message is used to request the terminal to activate the safe mode, so that the RRC connection enters the safe connection state.
  • the RRC release message includes an RRC connection release information element, and the RRC connection release information element carries redirection carrier information.
  • the terminal device is in the LTE or LTE-A communication standard.
  • the RRC release message is in an inactive security state, that is, the RRC release message has not undergone security processing in the security mode, and the terminal is in NR communication mode at this time, and the RRC release message does not include carrying redirection carrier information
  • the RRC connection releases the cell.
  • the processing unit 903 is further configured to activate the security mode when the security mode command message is received within the first time period and the security mode command message passes security verification, so that the RRC The connection enters the secure connection state.
  • the sending unit 901 is further configured to send an RRC re-establishment request message before the receiving unit 902 receives the RRC release message, and the RRC re-establishment request message is used to request access
  • the network equipment re-establishes the RRC connection.
  • the preset first message also includes an RRC setup message.
  • the preset first message may include an RRC re-establishment message
  • the processing unit 903 is further configured to:
  • processing unit 903 in the embodiment of the present application may be implemented by a processor or processor-related circuit components, and the sending unit 901 and the receiving unit 902 may be implemented by a transceiver or transceiver-related circuit components.
  • an embodiment of the present application also provides a communication device 100 applied in a terminal.
  • the communication device 100 includes a processor 1001, a memory 1002, and a transceiver 1003.
  • the memory 1002 stores instructions or programs and processes
  • the device 1001 is used to execute instructions or programs stored in the memory 1002.
  • the processor 1001 is used to perform the operations performed by the processing unit 903 in the foregoing embodiment
  • the transceiver 1003 is used to perform the operations performed by the sending unit 901 and the receiving unit 902 in the foregoing embodiment .
  • the communication device 90 or the communication device 100 may correspond to the chip or circuit inside the terminal device in the method embodiment shown in FIG. 2, FIG. 4, or FIG. 8.
  • the operations and/or functions of the various modules in the communication device 90 or the communication device 100 are to implement the corresponding processes in the method embodiments shown in FIG. 2, FIG. 4, or FIG. 8, respectively.
  • FIG. 2, FIG. 4, or FIG. 8, For brevity, details are not repeated here.
  • an embodiment of the present application further provides a terminal 110, and the terminal 110 includes:
  • the processor 1101, the memory 1102, and the transceiver 1103, and the processor 1101, the memory 1102 and the transceiver 1103 are connected by a bus;
  • the transceiver 1103 can be used to receive and send data under the control of the processor 1101;
  • the memory 1102 stores program codes, and the processor 1101 executes the program codes in the memory 1102 to implement operations performed by the terminal device in the embodiments shown in FIG. 2, FIG. 4, or FIG. 8.
  • a computer-readable storage medium is provided, and an instruction is stored thereon.
  • the instruction is executed, the method of the terminal device in the foregoing method embodiment is executed.
  • a computer program product containing instructions is provided, when the instructions are executed, the method of the terminal device in the foregoing method embodiment is executed.
  • processors mentioned in the embodiments of the present invention may be a central processing unit (central processing unit, CPU), or other general-purpose processors, digital signal processors (digital signal processors, DSP), and application-specific integrated circuits ( application specific integrated circuit (ASIC), ready-made programmable gate array (field programmable gate array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc.
  • CPU central processing unit
  • DSP digital signal processors
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory mentioned in the embodiments of the present invention may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electronic Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • synchronous dynamic random access memory synchronous DRAM, SDRAM
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • synchronous connection dynamic random access memory serial DRAM, SLDRAM
  • direct rambus RAM direct rambus RAM, DR RAM
  • the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component
  • the memory storage module
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种通信的方法，应用于终端或终端内部的电子装置，包括：发送无线资源控制RRC建立请求消息，该RRC建立请求消息用于请求接入网设备建立RRC连接；接收RRC释放消息，该RRC释放消息用于指示终端释放RRC连接；在接收到RRC释放消息之后的第一时长内接收到预设的第一消息时，保持RRC连接。本申请实施例还提供了相应的通信装置。本申请技术方案中，终端在RRC连接建立过程中，通过在第一时长内是否接收到预设的第一消息来判断此前收到的RRC释放消息是否可信，可以防止恶意攻击设备通过发送RRC释放消息的方式进行攻击的行为得逞，保障了终端的安全通信。

Description

一种通信的方法、装置及系统 技术领域
本申请涉及通信领域，具体涉及一种通信的方法、装置及系统。
背景技术
随着接入网技术的发展，第三代合作伙伴计划(3rd generation partnership project，3GPP)技术规范被制定出来，3GPP技术规范的作用是实现由第二代网络到第三代网络的平滑过渡，并且保证未来技术(例如第五代网络)的后向兼容性，支持轻松建网及系统间的漫游和兼容性。出于信息安全的考虑，用户设备(user equipment，UE)和无线接入网(radio access network，RAN)设备之间或者UE与核心网设备之间在进行通信时，从对端接收或者向对端发送的消息应当进行安全处理，以防止恶意攻击设备的监听。UE和RAN设备之间进行通信时的交互消息若需要进行安全处理，则需要UE在与RAN设备建立无线资源控制(radio resource control，RRC)连接或者重建立RRC连接后，激活安全模式。
根据3GPP技术规范TS 38.331 V15.5.0，UE和RAN设备在建立RRC连接或者重建立RRC连接的过程中，安全模式可能未被激活。所以恶意攻击设备可以监听到此过程中UE和RAN设备的交互消息，从而利用安全模式未激活的时间间隙，伪装成RAN设备向UE发送RRC释放消息，UE无法利用安全模式对该RRC释放消息进行安全验证，只能默认该RRC释放消息是RAN设备发送的，以致UE错误地根据该RRC释放消息释放与RAN设备之间的RRC连接，导致UE和RAN设备之间的通信业务无法正常进行，恶意攻击设备的攻击行为得逞。
发明内容
本申请实施例提供了一种通信的方法、装置及系统，用于防止在终端设备进行RRC连接建立过程和RRC连接重建立过程中，安全模式未被激活时，恶意攻击设备通过发送RRC释放消息对终端设备进行攻击的行为得逞。
有鉴于此，本申请实施例第一方面提供一种通信的方法，包括：
发送RRC建立请求消息，该RRC建立请求消息用于请求接入网设备建立RRC连接；
接收RRC释放消息，该RRC释放消息用于指示终端释放RRC连接；
在接收到RRC释放消息之后的第一时长内接收到预设的第一消息时，保持RRC连接。
由上述第一方面可知，在接收RRC释放消息后，在第一时长内，接收到预设的第一消息时，保持该RRC连接。假设在初始建立RRC连接过程中，按照正常的消息交互逻辑，如果该RRC释放消息是接入网设备发送的，则接入网设备发送RRC释放消息后，不会再向终端发送第一消息。因此，若终端在第一时长内接收到该预设的第一消息，则说明此前收到的RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以不根据该RRC释放消息释放RRC连接，而是保持RRC连接，从而防止在初始建立RRC连接的过程中，恶意攻击设备使用发送RRC释放消息的方式对终端进行攻击的行为得逞，提升了终端和接入网设备之间的连接的安全性，保障了终端安全通信。
可选的，结合上述第一方面，在第一种可能的实现方式中，该预设的第一消息用于请求终端建立与接入网设备或者核心网设备之间的安全通信机制。
可选的，结合上述第一方面或第一方面第一种可能的实现方式，在第二种可能的实现方式中，预设的第一消息包括鉴权请求消息，该鉴权请求消息用于请求终端与核心网设备进行相互认证，从而保障终端与核心网设备之间的安全通信。
可选的，结合上述第一方面或第一方面第一种可能的实现方式，在第三种可能的实现方式中，预设的第一消息包括非接入层(non-access stratum，NAS)安全建立请求消息，该NAS安全模式命令消息用于请求终端建立与核心网设备之间的NAS安全连接，从而在终端与核心网设备进行了相互认证的基础上，进一步提高终端与核心网设备之间进行通信的安全性。
可选的，结合上述第一方面或第一方面第一种可能的实现方式，在第四种可能的实现方式中，第一消息包括安全模式命令消息，该安全模式命令消息用于请求终端激活安全模式，以使得RRC连接进入安全连接的状态，从而保障了终端与接入网设备之间的安全通信。
可选的，结合上述第一方面、第一方面第一种至第四种中任意一种可能的实现方式，在第五种可能的实现方式中，RRC释放消息包括RRC连接释放信元，RRC连接释放信元携带重定向载波信息。
可选的，结合上述第一方面第五种可能的实现方式，在第六种可能的实现方式中，终端处于长期演进(long term evolution，LTE)或高级长期演进(LTE-advanced，LTE-A)通信制式。
可选的，结合上述第一方面、第一方面第一种至第四种中任意一种可能的实现方式，在第七种可能的实现方式中，RRC释放消息处于未激活安全状态，终端处于新无线(new radio，NR)通信制式，RRC释放消息中不包括携带重定向载波信息的RRC连接释放信元。
可选的，结合上述第一方面第四种可能的实现方式，在第八种可能的实现方式中，该方法还包括：在第一时长内接收到安全模式命令消息且该安全模式命令消息通过安全验证时，激活安全模式，RRC连接进入安全连接状态。
可选的，结合上述第一方面或者第一方面第一种可能的实现方式，在第九种可能的实现方式中，在接收RRC释放消息之前，该方法还包括：
发送RRC重建立请求消息，该RRC重建立请求消息用于请求接入网设备重建立RRC连接；
由上述第一方面第九种可能的实现方式可知，假设在终端设备和接入网设备重建立RRC连接的过程中，按照正常的消息交互逻辑，接入网设备发送RRC释放消息后，不会再向终端设备发送第一消息。因此，若终端设备在第一时长内接收到预设的第一消息，则说明此前收到的RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以终端设备不根据该RRC释放消息释放RRC连接，而是保持RRC连接，从而可以防止在重建立RRC连接的过程中，恶意攻击设备使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，提升了终端设备和接入网设备之间的连接的安全性，保障了终端设备与接入网设备之间的通信业务可以正常进行。
可选的，结合上述第一方面第九种可能的实现方式，在第十种可能的实现方式中，预设的第一消息包括RRC建立消息。
可选的，结合上述第一方面第九种可能的实现方式，在第十一种可能的实现方式中，预设的第一消息为RRC重建立消息；
该方法还包括：在第一时长内接收到RRC重建立消息且RRC重建立消息通过安全验证时，激活安全模式，以使得RRC连接进入安全连接状态。
本申请第二方面提供一种通信装置，所述通信装置用于执行上述第一方面或第一方面任意一种可能的实现方式中的通信的方法。具体地，所述通信装置可以包括用于执行第一方面或第一方面任意一种可能的实现方式中的通信的方法的模块。
本申请第三方面提供一种通信装置，所述通信装置包括处理器，所述处理器与存储器耦合，所述存储器用于存储指令，所述处理器用于执行所述存储器存储的指令，并且对所述存储器中存储的指令的执行使得所述处理器执行第一方面或第一方面任意一种可能的实现方式中的通信的方法。可选的，所述通信装置还包括所述存储器。
本申请第四方面提供一种终端，所述终端包括处理器、存储器和收发器，所述收发器用于接收和发送数据，所述存储器中存储有程序代码，所述处理器调用所述存储器中的程序代码时执行第一方面或第一方面任意一种可能的实现方式中的通信的方法。
本申请第五方面提供一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面任意一种可能的实现方式中的通信的方法。
本申请第六方面提供一种通信系统，所述通信系统包括上述终端，所述通信系统还包括上述接入网设备和核心网设备。
本申请实施例提供的技术方案中，在终端和接入网设备初始建立RRC连接或重建立RRC连接的过程中，终端发送RRC建立请求消息后，接收到RRC释放消息，该RRC释放消息用于指示终端释放该RRC连接；在终端在接收到RRC释放消息之后的第一时长内，接收到预设的第一消息时，保持该RRC连接。假设在初始建立RRC连接或重建立RRC连接过程中，按照正常的消息交互逻辑，接入网设备发送RRC释放消息后，不会再向终端发送第一消息。因此，若终端在接收到RRC释放消息之后的第一时长内接收到预设的第一消息则说明此前收到的RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以不根据该RRC释放消息释放RRC连接。这种方法可以防止恶意攻击设备使用发送RRC释放消息的方式对终端进行攻击的行为得逞，提升了终端和接入网设备之间的连接的安全性，保障了终端的通信安全。
附图说明
图1为本申请实施例所提供的一种通信系统的结构示意图；
图2为本申请实施例所提供的一种通信的方法的流程示意图；
图3为本申请实施例所提供的初始建立RRC连接及安全模式激活过程信令的交互示意图；
图4为本申请实施例所提供的一种通信的方法的流程示意图；
图5为本申请实施例所提供的初始建立RRC连接和鉴权过程信令的交互示意图；
图6为本申请实施例所提供的一种重建立RRC连接过程信令的交互示意图；
图7为本申请实施例所提供的一种重建立RRC连接过程信令的交互示意图；
图8为本申请实施例所提供的一种通信的方法流程示意图；
图9为本申请实施例中提供的一种通信装置的结构示意图；
图10为本申请实施例中提供的一种通信装置的结构示意图；
图11为本申请实施例中提供的一种终端的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例例如能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
图1为本申请实施例所提供的一种通信系统的结构示意图，本申请实施例中的技术方案可应用于图1所示的通信系统中，该通信系统包括恶意攻击设备、接入网设备、终端设备，可选的，还包括核心网设备。接入网设备可以向其所覆盖的蜂窝小区提供接入网服务，在终端设备位于该接入网设备覆盖的蜂窝小区中时，可以与该接入网设备建立RRC连接，从而通过该接入网设备接入运营商网络，以使用对应的运营商提供的网络服务。接入网设备与终端设备连接，可以接收终端设备的数据并发送给核心网设备，也可以接收核心网设备发送的数据并转发给终端设备。恶意攻击设备通常是伪基站等可以威胁终端设备通信安全的设备。在此场景中，恶意攻击设备可以利用终端设备和接入网设备在建立RRC连接或者重建立RRC连接时安全模式未激活的漏洞，伪装为接入网设备向终端设备发送RRC释放消息，从而使得终端设备根据该RRC释放消息释放其与接入网设备之间的RRC连接，以达到终端设备无法正常接入运营商网络的攻击目的。
应理解，本申请实施例的技术方案可以应用于长期演进(long term evolution，LTE)架构，还可以应用于通用移动通信系统(universal mobile telecommunications system，UMTS)陆地无线接入网(UMTS terrestrial radio access network，UTRAN)架构，或者全球移动通信系统(global system for mobile communication，GSM)/增强型数据速率GSM演进(enhanced data rate for GSM evolution，EDGE)系统的无线接入网(GSM EDGE radio access network，GERAN)架构。在UTRAN架构或/GERAN架构中，移动性管理实体(mobility management entity，MME)的功能由服务通用分组无线业务(general packet radio service，GPRS)支持节点(serving GPRS support，SGSN)完成，服务网关(serving gateway，SGW)\公共数据网网关(public data network gateway，PGW)的功能由网关 GPRS支持节点(gateway GPRS support node，GGSN)完成。本申请实施例的技术方案还可以应用于其他通信系统，例如公共陆地移动网络(public land mobile network，PLMN)系统，以及第五代移动通信技术(the 5th generation mobile communication technology，5G)通信系统或5G之后的通信系统等，本申请实施例对此不作限定。
本申请实施例中涉及的接入网设备也可称为无线接入网(radio access network，RAN)设备。接入网设备与终端设备连接，用于接收终端设备的数据并发送给核心网设备。接入网设备在不同通信系统中对应不同的设备，例如，在第二代移动通信技术(the 2nd generation mobile communication technology，2G)系统中对应基站与基站控制器，在第三代移动通信技术(the 3rd generation mobile communication technology，3G)系统中对应基站与无线网络控制器(radio network controller，RNC)，在第四代移动通信技术(the 4th generation mobile communication technology，4G)系统中对应演进型节点B(evolved node B，eNB)，在5G系统中对应新无线(new radio，NR)系统中的接入网设备(例如下一代节点B(next generation node B，gNB))。
在本申请实施例中，本申请实施例提供的通信的方法可以是由终端设备所执行的，也可以是由终端设备内部的芯片或电路所执行的。终端设备可以为包含无线收发功能、且可以与网络设备配合为用户提供通讯服务的设备。具体地，终端设备可以指用户设备(user equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置。例如，终端设备可以是蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络或5G之后的网络中的终端设备等，本申请实施例对此不作限定。对终端设备的说明：本申请中，和接入网设备可以进行数据通信的都可以看为终端设备，本申请中将以一般意义上的UE来介绍。
为解决现有接入网架构中，终端设备与接入网设备初始建立RRC连接恶意攻击设备利用终端设备与接入网设备之间的安全模式未激活的间隙，通过向终端设备发送RRC释放消息的方式进行攻击的问题，本申请实施例提供了一种通信的方法。以下将以终端设备执行本申请实施例中通信的方法为例进行详细说明。应理解，本申请实施例中通信的方法也可以由终端设备中的芯片执行，具体此处不作限定。下面以终端设备执行本申请实施例中通信的方法作为示例进行说明。
图2为本申请实施例所提供的一种通信的方法的流程示意图。
如图2所示，本申请实施例中通信的方法可以包括：
201、终端设备发送RRC建立请求(RRCSetupRequest)消息。
在本实施例中，在终端设备需要接入运营商网络时，需要与所在蜂窝小区的接入网设备建立RRC连接，从而通过该接入网设备接入运营商网络。根据3GPP技术规范TS 38.331V15.5.0，终端设备首先要向对应的接入网设备发送RRC建立请求消息，该RRC建立请求消息用于请求接入网设备建立RRC连接，然后终端设备与接入网设备可根据3GPP技术规范 TS 38.331 V15.5.0中规定的交互过程完成RRC连接的初始建立。在终端设备与接入网设备在初始建立RRC连接后，终端设备和接入网设备还需要进行安全建立过程，即终端设备根据接入网设备发送的安全模式命令消息激活安全模式，以使得终端设备与接入网设备之间的RRC连接进入安全连接状态。
终端设备在初始建立RRC连接和进行安全激活的过程中，终端设备不仅仅和接入网设备之间存在交互行为，还与核心网设备之前存在交互行为，终端设备、接入网设备与核心网设备三方之间的交互过程如图3所示。
参见图3，在安全模式激活之前，终端设备和接入网设备之间初始建立RRC连接的过程具体为：终端设备向接入网设备发送RRC建立请求消息，该RRC建立请求消息用于请求接入网设备与终端设备建立RRC连接。接入网设备收到终端设备发送的RRC建立请求消息后，响应于该RRC建立请求消息，向终端设备发送RRC建立消息(RRCSetup)，该RRC建立消息用于指示终端设备可以建立RRC连接。终端设备建立RRC连接完成后，向接入网设备发送RRC建立完成(RRCSetupcomplete)消息，以使得接入网设备确认RRC连接已建立完成，从而完成初始建立RRC连接。
终端设备建立RRC连接完成后，会向接入网设备发送RRC建立完成消息，该消息中携带有终端设备的注册信息，接入网设备则向核心网设备发送初始UE消息(Initial UE message)，该消息中携带终端设备的注册信息，核心网设备则向接入网设备发送下行NAS传输消息，以使得接入网设备将下行NAS传输消息中携带的鉴权请求(Authentication request)消息通过下行信息转发(DLInformationTransfer)消息转发给终端设备，该鉴权请求消息用于请求终端设备与核心网设备进行相互认证。终端设备收到鉴权请求消息后，则通过上行信息转发(ULInformationTransfer)消息向接入网设备发送鉴权响应(Authentication response)消息，以使得接入网设备将该鉴权响应消息通过上行NAS传输消息转发至核心网设备，指示核心网设备可以与终端设备进行相互认证。此后核心网设备与终端设备之间继续通过接入网设备转发的方法传输消息，依然使用下行NAS传输消息、上行NAS传输消息、下行信息转发消息或上行信息转发消息作为核心网设备和终端设备之间的交互内容的载体。
终端设备收到鉴权请求消息，且根据协议对鉴权消息进行安全验证后，如果通过了安全验证，则向核心网设备发送鉴权响应消息，以通知核心网设备和终端设备进行相互鉴权，也即相互认证。双方鉴权通过后，核心网设备则通过接入网设备向终端设备转发NAS安全模式命令(NAS Security Mode Command)消息，该消息用于请求终端设备与核心网设备建立NAS安全连接，若鉴权不通过，则向终端设备发送鉴权失败(Authentication Failure)消息。终端设备建立NAS安全连接后，终端设备和核心网设备之间的交互消息是经过NAS加密的，保障了终端设备和核心网设备之间的连接安全性。NAS安全连接建立后，终端设备和接入网设备之间进行安全模式建立。
接入网设备向终端设备发送安全模式命令(Security Mode Command)消息，以请求终端设备激活安全模式。终端设备响应于该安全模式命令消息，激活安全模式，使得初始建立的RRC连接进入安全连接状态，并且向接入网设备发送安全模式完成消息，以指示接 入网设备安全模式已激活，从而完成终端设备和接入网设备之间的安全建立过程，此后终端设备和接入网设备便可以通过安全连接进行通信，防止恶意攻击设备对交互消息进行监听。
202、终端设备接收RRC释放(RRCRelease)消息。
在正常情况下，在接入网设备需要中断与终端设备之间的RRC连接时，接入网设备便会向终端设备发送RRC释放消息，该RRC释放消息用于指示终端设备释放RRC连接。
需要说明的是，在不同的通信制式中，RRC释放消息的内容可能有所不同。在LTE或LTE-A通信制式中，根据相应的3GPP技术规范，例如3GPP技术规范TS 36.331，RRC释放消息中包括RRC连接释放信元，该RRC连接释放信元中携带重定向载波信息(redirectedCarrierInfo)。在终端设备处于LTE或LTE-A通信制式时，终端设备接收到携带重定向载波信息的RRC释放消息后，终端设备不会马上释放RRC连接，而会根据重定向载波信息接入到指定的小区，然后才释放在原来的小区中建立的RRC连接。然而，在NR通信制式中，根据相应的3GPP技术规范，例如3GPP技术规范TS 38.331，终端设备在初始建立RRC连接或者重建立RRC连接的过程中，安全模式未被激活，所以在这个过程中的RRC释放消息处于未激活安全状态，且接入网设备向终端设备发送的RRC释放消息是不携带重定向载波信息的。在理论上，在NR通信制式中的终端设备接收到RRC释放消息后，应当直接释放RRC连接，从连接态转换为空闲态。在一种可能的情况中，由于NR通信架构中采用了非独立组网的原因，终端设备可能会通过LTE或LTE-A通信制式的接入网设备接入到NR通信制式的核心网，因此终端设备收到接入网设备发送的RRC释放消息有可能是携带重定向载波信息的。在这种情况下，终端设备应当忽略RRC释放消息中的重定向载波信息，直接释放RRC连接，进入空闲态。
在本实施例中，假设终端设备处于NR通信制式，终端设备接收到RRC释放消息后，原本应该释放RRC连接，但是由于终端设备向接入网设备发送RRC建立请求消息时，恶意攻击设备可能会监听到该RRC建立请求消息，从而伪装为接入网设备向终端设备发送RRC释放消息，并且因为终端设备与接入网设备之间没有激活安全模式，终端设备无法利用安全模式对收到的RRC释放消息进行安全验证，即终端设备无法确定收到的RRC释放消息是否为接入网设备发送的。如果终端设备收到的RRC释放消息是恶意攻击设备发送的，终端设备根据该RRC释放消息释放RRC连接，便会使恶意攻击设备的攻击行为得逞。
在本实施例中，终端设备收到RRC释放消息后，终端设备会有一段RRC释放操作的延迟时间，终端设备暂时不会对收到RRC释放消息进行处理，在延迟时间内根据接入网设备的进一步动作判断收到的RRC释放消息的来源，以决定是否根据该第一RRC释放消息释放与接入网设备之间的RRC连接。
203、终端设备在接收到RRC释放消息之后的第一时长内接收到预设的第一消息时，保持RRC连接。
假设在终端设备初始建立RRC连接的过程中，按照正常的消息交互逻辑，如果接入网设备发送RRC释放消息后，则不会再向终端发送第一消息。因此，若终端设备在接收到RRC释放消息之后的第一时长内接收到预设的第一消息则说明此前收到的RRC释放消息不是接 入网设备发送的，而是恶意攻击设备发送的，所以终端设备需忽略该RRC释放消息，保持RRC连接。
在本实施例中，在终端设备和接入网设备初始建立RRC连接的过程中，终端设备发送RRC建立请求消息后，接收到RRC释放消息，该RRC释放消息用于指示终端设备释放该RRC连接；在终端设备在接收到RRC释放消息之后的第一时长内，接收到预设的第一消息时，保持该RRC连接，防止了在初始建立RRC连接的过程中，恶意攻击设备使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，提升了终端设备和接入网设备之间的连接的安全性，保障了终端设备与接入网设备之间的通信业务可以正常进行。
可选的，在本实施例中，该预设的第一消息用于请求终端设备在RRC连接的基础上，建立与接入网设备或者核心网设备之间的安全通信机制，该安全通信机制是用于保障终端设备和接入网设备或核心网设备之间的通信安全的机制。例如，在终端设备与接入网设备之间依据3GPP技术规范TS 38.331 V15.5.0要求完成RRC连接初始建立时，接入网设备会根据图3所示的流程依次向终端设备发送鉴权请求消息、NAS安全模式命令消息，从而建立NAS安全连接，保障终端设备与核心网设备之间的通信安全。其后，接入网设备向终端设备发送安全模式命令消息，以指示终端设备激活安全模式，使得RRC连接进入安全连接的状态，保障了终端设备和接入网设备之间的通信安全。在正常的交互逻辑中，接入网设备若在初始建立RRC连接的过程中向终端设备发送了RRC释放消息，则在后续流程中不会向终端发送第一消息。因为第一消息指示终端设备在RRC连接的基础上建立相应的安全通信机制，而这与RRC释放消息指示终端设备释放RRC连接相矛盾。所以如果终端设备接收RRC释放消息之后在第一时长内接收到预设的第一消息，则说明终端设备此前收到的RRC释放消息是不可信的，终端设备不会根据该RRC释放消息释放RRC连接，以防止恶意攻击设备的攻击行为得逞。
可选的，该预设的第一消息可以是鉴权请求消息，如上所述，该鉴权请求消息用于用于请求终端设备与核心网设备进行相互认证，这是终端设备建立与核心网设备之间的安全通信机制的前提条件。
可选的，该预设的第一消息可以是NAS安全模式命令消息，终端设备接收到该NAS安全模式命令消息后，则可以建立与核心网设备之间的NAS安全连接，从而完成建立与核心网设备之间的安全通信机制。
可选的，该预设的第一消息可以是安全模式命令消息，该安全模式命令消息指示终端设备激活安全模式，以使得RRC连接进入安全连接的状态，从而完成建立与接入网设备之间的安全通信机制。
可选的，本实施例还可以包括：
204、终端设备在第一时长内接收到安全模式命令消息且该安全模式命令消息通过完整性安全验证(以下简称“安全验证”)时，终端设备激活安全模式，以使得RRC连接进入安全连接状态。
在本实施例中，终端设备接收到安全模式命令消息后，可以通过安全模式命令消息中携带的完整性保护算法以及终端设备自身配置的密钥对安全模式命令消息进行安全验证，在该安全模式命令消息通过安全验证时，终端设备激活安全模式，使得初始建立完成后的 RRC连接进入安全连接的状态。此后在终端设备与接入网设备之间进行通信时，除了在公共信道上的数据交互，其它的数据交互都通过安全连接状态的RRC连接进行，防止恶意攻击设备监听到终端设备和接入网设备之间的交互消息，也可以识别恶意攻击设备向终端设备发送的恶意消息，所以可以防止恶意攻击设备利用RRC释放消息对终端设备进行攻击的行为。
在一种具体的实施例中，该预设的第一消息可以是鉴权请求消息，也可以是NAS安全模式命令消息，还可以是安全模式命令消息。而终端设备在建立RRC连接和激活安全模式的过程中，终端设备有可能在不同的阶段多次收到RRC释放消息，例如终端设备在接收鉴权请求消息之前收到RRC释放消息，也有可能在接收鉴权请求消息之后，且在接收NAS安全模式命令消息之前收到RRC释放消息，还有可能在接收NAS安全模式命令消息之后，且在接收安全模式命令消息之前收到RRC释放消息。所以，在一种具体的实施例中，终端设备在收到接入网设备转发的鉴权请求消息之前收到RRC释放消息，终端设备可以通过在第一时长内等待接收接入网设备转发的鉴权请求消息来决定是否根据该RRC释放消息释放RRC连接。在终端设备再次接收到RRC释放消息时，终端设备可以通过在第二时长内等待接收接入网设备转发的NAS安全模式命令消息或安全模式命令消息，来决定是否根据该再次收到的RRC释放消息释放RRC连接。下面结合图4实施例进行说明。
图4为本申请实施例所提供的一种通信的方法的流程示意图。
如图4所示，该实施例可以包括：
401、终端设备发送RRC建立请求消息。
步骤401与上述步骤201类似，具体内容可结合上述步骤201的内容进行理解。
402、终端设备接收第一RRC释放消息。
在本实施例中，第一RRC释放消息是终端设备在RRC建立的过程中，且终端设备接收接入网设备为核心网设备转发的鉴权请求消息之前接收的，第一RRC释放消息用于指示终端设备释放RRC连接。因为终端设备与接入网设备之间没有激活安全模式，终端设备无法利用安全模式对收到的第一RRC释放消息进行安全验证，即终端设备无法确定收到的第一RRC释放消息是否为接入网设备发送的。如果终端设备收到的第一RRC释放消息是恶意攻击设备发送的，终端设备根据该第一RRC释放消息释放RRC连接，便会使恶意攻击设备的攻击行为得逞。
在本实施例中，终端设备收到第一RRC释放消息后，终端设备会有一段RRC释放操作的延迟时间，终端设备暂时不会对收到第一RRC释放消息进行处理，在延迟时间内根据接入网设备的鉴权消息转发动作判断收到的第一RRC释放消息的来源，以决定是否根据该第一RRC释放消息释放与接入网设备之间的RRC连接。
403、终端设备在接收到第一RRC释放消息之后的第一时长内，接收到鉴权请求消息时，保持RRC连接。
在本实施例中，鉴权请求消息用于请求终端设备与核心网设备进行相互认证的。该鉴权请求消息通过终端设备的安全验证后，核心网设备根据终端设备发送的鉴权响应消息对终端设备进行鉴权，鉴权通过后，终端设备可以根据核心网设备的NAS安全模式命令消息， 建立与核心网设备之间的NAS安全连接，保证了终端设备和核心网设备之间的交互安全。
在终端设备在第一时长内，接收到接入网设备转发的鉴权请求消息时，保持该RRC连接。因为按照正常的消息交互逻辑，如果该第一RRC释放消息是接入网设备发送的，则接入网设备发送第一RRC释放消息后，理应不会再向终端设备转发核心网设备发送的鉴权请求消息，所以终端设备在第一时长内接收到鉴权请求消息，则说明此前收到的第一RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以不根据该第一RRC释放消息释放RRC连接。这种方法可以防止终端设备激活安全模式前，恶意攻击设备使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，也无需设置过长的等待时间来等待接收安全模式命令消息，避免了接入网设备发送的RRC释放消息执行时延过长。
404、终端设备接收第二RRC释放消息。
在本实施例中，终端设备收到第一RRC释放消息后，在第一时长内接收鉴权消息时，不根据该第一RRC释放消息执行RRC释放操作。在这之后，由于终端设备仍处于未激活安全模式的状态，所以恶意攻击设备仍有可能向终端设备发送RRC释放消息。上述第二RRC释放消息可能是恶意攻击设备发送的，也可能是接入网设备发送的。
405、终端设备在接收到第二RRC释放消息之后的第一时长内，接收到NAS安全模式命令消息或安全模式命令消息时，保持RRC连接。
在本实施例中，终端设备接收第二RRC释放消息之后的第一时长内，等待接收NAS安全模式命令消息或安全模式命令消息。
在终端设备在第一时长内，接收到NAS安全模式命令消息或安全模式命令消息时，保持该RRC连接。因为在终端设备接收鉴权请求消息之后且在终端设备接收安全模式命令消息之前，按照正常的消息交互逻辑，如果该第二RRC释放消息是接入网设备发送的，则接入网设备发送第二RRC释放消息后，理应不会再向终端设备发送NAS安全模式命令消息或安全模式命令消息，所以终端设备在第一时长内接收到NAS安全模式命令消息或安全模式命令消息，则说明此前收到的第二RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以不根据该第二RRC释放消息释放RRC连接。这种方法可以防止在初始建立RRC连接的过程中以及后续的安全模式建立过程完成之前，恶意攻击设备多次使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，提升了终端设备和接入网设备之间的连接的安全性，保障了终端设备与接入网设备之间的通信业务可以正常进行。
406、终端设备在第一时长内接收到安全模式命令消息且该安全模式命令消息通过安全验证时，终端设备激活安全模式，以使得RRC连接进入安全连接状态。
在本实施例中，步骤406与上述步骤204相似，具体内容可结合上述步骤204进行理解。
在一种具体的实施例中，该预设的第一消息可以是鉴权请求消息、NAS安全模式命令消息或安全模式命令消息中的任意一种，而如图3所示，鉴权请求消息、NAS安全模式命令消息和安全模式命令消息的接收在信令交互流程中是有先后顺序的，所以应该将第一时长设置为足够用于等待以上三种消息中顺序在后的安全模式命令消息的时长。而且终端设备接收到RRC释放消息的时间可能位于初始建立RRC连接过程中的不同交互阶段，因此第一时长可以根据RRC释放消息的接收时间所处的阶段来进行相应的设置，下面将结合图5 中所示的通信过程信令的交互示意图来对以下三种情况进行详细说明。
情况1、终端设备接收RRC释放消息的时间位于终端设备发送RRC建立请求消息和终端设备接收RRC建立消息两个步骤之间。
作为一个实施例，在终端设备在接收RRC释放消息的时间位于图3所示交互流程中终端设备发送RRC建立请求消息和终端设备接收RRC建立消息这两个步骤之间时，本方案可以利用大数据统计技术，对初始建立RRC连接过程中终端设备发送RRC建立请求消息到初始建立RRC连接完成后，接收到安全模式命令消息所需要的时长进行统计，并根据统计数据确定一个合适的时长用于作为第一时长，以尽量保证终端设备在第一时长皆有可能接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息。终端设备在接收到RRC释放消息时，可以根据其自身配置的计时器或者具有计时功能的模块，按照第一时长进行计时，如果在第一时长内，终端设备接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备不会根据此前接收的RRC释放消息进行RRC释放。如果达到第一时长，而终端设备没有接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备根据第一RRC释放消息正常进行RRC释放。
情况2、终端设备在接收RRC释放消息的时间位于终端设备接收RRC建立消息和终端设备发送RRC建立完成消息两个步骤之间。
作为一个实施例，在终端设备在接收RRC释放消息的时间位于图3所示交互流程中终端设备接收RRC建立消息和终端设备发送RRC建立完成消息这两个步骤之间时，本技术方案可以利用大数据统计技术，对初始建立RRC连接过程中终端设备接收RRC建立消息到初始建立RRC连接完成后，接收到安全模式命令消息所需要的时长进行统计，并根据统计数据确定与情况1中确定的时长不同的时长用于作为第一时长，以尽量保证终端设备在第一时长皆有可能接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息，也可以避免第一时长设置过长而导致消息处理延时过大。同样的，终端设备在接收到RRC释放消息时，可以根据其自身配置的计时器或者具有计时功能的模块，按照情况2所对应的的第一时长进行计时，如果在该第一时长内，终端设备接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备不会根据此前接收的RRC释放消息进行RRC释放。如果达到第一时长，而终端设备没有接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备根据RRC释放消息正常进行RRC释放。
情况3、终端设备在接收RRC释放消息的时间位于终端设备发送RRC建立完成消息和终端设备接收安全模式命令消息两个步骤之间。
作为一个实施例，在终端设备在接收RRC释放消息的时间位于图3所示交互流程中终端设备发送RRC建立完成消息和终端设备接收安全模式命令消息这两个步骤之间时，本技术方案可以利用大数据统计技术，对初始建立RRC连接过程中终端设备发送RRC建立完成消息到初始建立RRC连接完成后，终端设备接收到安全模式命令消息所需要的时长进行统计，并根据统计数据确定与情况1、情况2中确定的时长不同的时长用于作为第一时长，以尽量保证终端设备在第一时长皆有可能接收到鉴权请求消息、NAS安全模式命令消息和 安全模式命令消息，也可以避免第一时长过长而导致消息处理延时过大。同样的，终端设备在接收到RRC释放消息时，可以根据其自身配置的计时器或者具有计时功能的模块，按照情况3所对应的的第一时长进行计时，如果在该第一时长内，终端设备接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备不会根据此前接收的RRC释放消息进行RRC释放。如果达到第一时长，而终端设备没有接收到鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种，则终端设备根据RRC释放消息正常进行RRC释放。
应理解，图5中的鉴权请求消息是接入网设备从核心网设备转发至终端设备的，鉴权响应消息是终端设备通过接入网设备向核心网设备转发的。
在上述实施例中，可以防止在初始建立RRC连接的过程中以及后续的安全模式建立过程完成之前，恶意攻击设备多次使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，提升了终端设备和接入网设备之间的连接的安全性，保障了终端设备与接入网设备之间的通信业务可以正常进行。通过根据不同的RRC释放消息接收场景对第一时长的设置进行相应的调整，可以使得第一时长的设置更加准确，既能保证终端设备在第一时长内可以对接收鉴权请求消息、NAS安全模式命令消息和安全模式命令消息中的至少一种有足够的等待时间，也可以避免等待时长过大，导致消息处理的时延过大。
由于在RRC连接重建立的过程中，安全模式处于未激活状态，所以恶意攻击设备容易监听到终端设备发送的RRC重建立请求消息，并且在终端设备接收到RRC建立消息或者RRC重建立消息之前向终端设备发送RRC释放消息，以破坏终端设备和接入网设备之间的RRC连接。
为解决终端设备与接入网设备重建立RRC连接过程中，恶意攻击设备利用终端设备与接入网设备之间的安全模式未激活的间隙，通过向终端设备发送RRC释放消息的方式进行攻击的问题，本申请实施例还提供了另一种通信的方法。以下进行详细说明。
图8为本申请实施例所提供的一种通信的方法流程示意图。
如图8所示，本申请实施例中通信的方法可以包括：
801、终端设备发送RRC建立请求消息。
步骤801与上述步骤201类似，具体内容可结合上述步骤201的内容进行理解。
802、终端设备发送RRC重建立请求消息。
在终端设备均已完成初始建立RRC连接和激活安全模式的情况下，在终端设备发生某些异常情况时，需要与接入网设备重建立RRC连接，该交互过程如图6或图7所示。根据3GPP技术规范TS 38.331 V15.5.0的规定，重建立RRC连接时，安全模式处于未激活状态，该重建立RRC连接的具体过程为：终端设备向接入网设备发送RRC重建立请求消息，该RRC重建立请求消息用于请求接入网设备与终端设备重建立之前已经建立完成的RRC连接。该RRC重建立请求消息是未经过安全加密的，接入网设备会在本地查找并且验证该终端设备对应的上下文，如果无法查找或者验证，则接入网设备向终端设备发送RRC建立消息，以指示终端设备建立新的RRC连接，如图6所示。该过程与初始建立RRC过程相似。如果接入网设备查找到并验证了该终端设备对应的上下文，则向终端设备发送RRC重建立消息， 以指示终端设备重建立此前建立好的RRC连接，而无需建立新的RRC连接，如图7所示。且该RRC重建立消息携带有密钥派生参数，终端设备可以根据该参数派生密钥从而利用派生出来的密钥对该RRC重建立消息进行安全验证，通过安全验证时，终端设备激活安全模式。
在本实施例中，根据3GPP技术规范TS 38.331 V15.5.0的规定，终端设备由于出现异常情况所述需要与接入网设备重建立RRC连接时，终端设备可以向对应的接入网设备发送RRC重建立请求消息(RRCReestablishmentRequest)，该RRC重建立请求消息用于请求接入网设备重建立RRC连接，然后终端设备与接入网设备完成RRC连接的重建立。
803、终端设备接收RRC释放消息。
在本实施例中，终端设备接收到RRC释放消息后，原本应该依据3GPP技术规范释放RRC连接，但是由于终端设备向接入网设备发送RRC重建立请求消息时，恶意攻击设备可能会监听到该RRC重建立请求消息，从而伪装为接入网设备向终端设备发送RRC释放消息，并且因为在重建立RRC过程中终端设备与接入网设备之间的安全模式处于未激活状态，终端设备无法利用安全模式对收到的RRC释放消息进行安全验证，即终端设备无法确定收到的RRC释放消息是否为接入网设备发送的。如果终端设备收到的RRC释放消息是恶意攻击设备发送的，终端设备根据该RRC释放消息释放RRC连接，便会使恶意攻击设备的攻击行为得逞。
在本实施例中，终端设备收到RRC释放消息后，终端设备会有一段RRC释放操作的延迟时间，终端设备暂时不会对收到RRC释放消息进行处理，在延迟时间内根据接入网设备的动作判断收到的RRC释放消息的来源，以决定是否根据该RRC释放消息释放与接入网设备之间的RRC连接。
804、终端设备在接收到RRC释放消息之后的第一时长内接收到预设的第一消息时，保持RRC连接。
在本实施例中，该预设的第一消息是用于指示终端设备重建立RRC连接的消息。可选的，该预设的第一消息可以是上述RRC建立消息也可以是RRC重建立(RRCReestablishment)消息。如图6和图7所示，在终端设备收到RRC建立消息并根据该RRC建立消息建立新的RRC连接后，终端设备向接入网设备发送RRC建立完成消息，在终端设备收到RRC重建立消息并根据该RRC重建立消息重建立RRC连接后，终端设备向接入网设备发送RRC重建立完成(RRCReestablishmentComplete)消息。在正常的交互逻辑中，接入网设备若在重建立RRC连接的过程中向终端设备发送了RRC释放消息，则不会向终端设备发送RRC建立消息或RRC重建立消息，因此终端设备在第一时长内接收到RRC建立消息或RRC重建立消息时，则说明终端设备收到的RRC释放消息是不可信的，所以终端设备保持RRC连接，以防止恶意攻击设备的攻击行为得逞。
可选的，本实施例还可以包括：
805、在该预设的第一消息为RRC重建立消息且该RRC重建立消息通过安全验证时，终端设备激活安全模式，以使得RRC连接进入安全连接状态。
在本实施例中，终端设备接收到RRC重建立消息后，可以通过RRC重建立消息中携带的密钥派生参数来派生出一个密钥，从而利用派生出来的密钥对该RRC重建立消息进行安 全验证。当该RRC重建立消息通过安全验证时，终端设备激活安全模式，使得重建立完成后的RRC连接进入安全连接的状态。此后当终端设备与接入网设备之间进行通信时，通过安全连接状态的RRC连接进行通信，防止恶意攻击设备监听到终端设备和接入网设备之间的交互消息，也可以识别恶意攻击设备向终端设备发送的恶意消息。
在本实施例中，在终端设备和接入网设备重建立RRC连接的过程中，终端设备发送RRC重建立请求消息后，接收到RRC释放消息；在终端设备在接收到RRC释放消息之后的第一时长内接收到预设的第一消息时，保持该RRC连接。因为在重建立RRC连接过程中，按照正常的消息交互逻辑，接入网设备发送RRC释放消息后，不会再向终端设备发送第一消息，终端设备则不会根据预设的第一消息进行RRC连接重建立。因此，若终端设备在接收到RRC释放消息之后的第一时长内接收到预设的第一消息则说明接入网设备指示终端设备正常进行RRC重建立，则进而此前收到的RRC释放消息不是接入网设备发送的，而是恶意攻击设备发送的，所以终端设备不根据该RRC释放消息释放RRC连接。这种方法可以防止在重建立RRC连接的过程中，恶意攻击设备使用发送RRC释放消息的方式对终端设备进行攻击的行为得逞，提升了终端设备和接入网设备之间的连接的安全性，保障了终端设备与接入网设备之间的通信业务可以正常进行。
可选的，在本实施例中，由于重建立RRC过程存在两种可能的情况，即终端设备发送RRC重建立请求消息后可能接收到RRC建立消息或RRC重建立消息，这两种消息的等待接收时长可能不同，本技术方案同样可利用大数据统计的方式对这两种消息的等待接收时长进行统计，并且根据统计数据选择一个可以兼容两种消息的等待时长作为第一时长，以避免终端设备做出错误决策，错误地根据RRC释放消息执行RRC连接释放操作，导致恶意攻击设备的攻击目的得逞。
上面对本申请实施例中的通信的方法进行了描述，下面对本申请实施例提供的通信装置进行描述。
本申请实施例提供的通信装置90可以应用于终端内部，其可以是终端内部的的芯片或者电路。
请参阅图9，该通信装置90可以包括：
发送单元901，用于发送RRC建立请求消息，该RRC建立请求消息用于请求接入网设备建立RRC连接；
接收单元902，用于接收RRC释放消息，该RRC释放消息用于指示终端释放RRC连接；
处理单元903，用于在接收到所述RRC释放消息之后的第一时长内接收到预设的第一消息时，保持所述RRC连接。
在一种可能的设计中，该预设的第一消息用于请求终端基于RRC连接建立与接入网设备或者核心网设备之间的安全通信机制。
在一种可能的设计中，该预设的第一消息可以是鉴权请求消息，该鉴权请求消息用于请求终端与核心网设备进行相互认证。
在一种可能的设计中，该预设的第一消息可以是NAS安全模式命令消息，该NAS安全模式命令消息用于请求终端建立与核心网设备之间的NAS安全连接。
在一种可能的设计中，该预设的第一消息可以是安全模式命令消息，该安全模式命令消息用于请求终端激活安全模式，以使得RRC连接进入安全连接的状态。
在一种可能的设计中，RRC释放消息包括RRC连接释放信元，该RRC连接释放信元携带重定向载波信息，此时的终端设备处于LTE或者LTE-A通信制式。
在一种可能的设计中，RRC释放消息处于未激活安全状态，即该RRC释放消息未经过安全模式的安全处理，此时的终端处于NR通信制式，该RRC释放消息不包括携带重定向载波信息的RRC连接释放信元。
在一种可能的设计中，处理单元903还用于在所述第一时长内接收到所述安全模式命令消息且所述安全模式命令消息通过安全验证时，激活安全模式，以使得所述RRC连接进入安全连接状态。
在一种可能的设计中，所述发送单元901，还用于在所述接收单元902接收所述RRC释放消息之前，发送RRC重建立请求消息，所述RRC重建立请求消息用于请求接入网设备重建立RRC连接。
在一种可能的设计中，该预设的第一消息还包括RRC建立消息。
在一种可能的设计中，该预设的第一消息好包括RRC重建立消息，所述处理单元903还用于：
在所述第一时长内接收到所述RRC重建立消息且所述RRC重建立消息通过安全验证时，激活安全模式，所述RRC连接进入安全连接状态。
应理解，本申请实施例中的处理单元903可以由处理器或处理器相关电路组件实现，发送单元901和接收单元902可以由收发器或收发器相关电路组件实现。
如图10所示，本申请实施例还提供一种应用于终端内部的通信装置100，该通信装置100包括处理器1001，存储器1002与收发器1003，其中，存储器1002中存储指令或程序，处理器1001用于执行存储器1002中存储的指令或程序。存储器1002中存储的指令或程序被执行时，该处理器1001用于执行上述实施例中处理单元903执行的操作，收发器1003用于执行上述实施例中发送单元901和接收单元902执行的操作。
应理解，根据本申请实施例的通信装置90或通信装置100可以对应于图2、图4或图8所示方法实施例中终端设备内部的芯片或者电路。并且通信装置90或通信装置100中的各个模块的操作和/或功能分别为了实现图2、图4或图8所示方法实施例中的相应流程，为了简洁，在此不再赘述。
如图11所示，本申请实施例还提供一种终端110，该终端110包括：
处理器1101、存储器1102和收发器1103，处理器1101、存储器1102和收发器1103通过总线连接；
收发器1103可以在处理器1101的控制下，用于接收和发送数据；
所述存储器1102中存储有程序代码，所述处理器1101执行所述存储器1102中的程序代码，实现如图2、图4或图8所示的实施例中终端设备执行的操作。
作为本实施例的另一种形式，提供一种计算机可读存储介质，其上存储有指令，该指令被执行时执行上述方法实施例中终端设备的方法。
作为本实施例的另一种形式，提供一种包含指令的计算机程序产品，该指令被执行时 执行上述方法实施例中终端设备的方法。
应理解，本发明实施例中提及的处理器可以是中央处理单元(central processing unit，CPU)，还可以是其他通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)、现成可编程门阵列(field programmable gate array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
还应理解，本发明实施例中提及的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，当处理器为通用处理器、DSP、ASIC、FPGA或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件时，存储器(存储模块)集成在处理器中。
应注意，本文描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者 说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (27)

  1. 一种通信的方法，其特征在于，应用于终端或终端内部的电子装置，包括：
    发送无线资源控制RRC建立请求消息，所述RRC建立请求消息用于请求接入网设备建立RRC连接；
    接收RRC释放消息，所述RRC释放消息用于指示所述终端释放所述RRC连接；
    在接收到所述RRC释放消息之后的第一时长内接收到预设的第一消息时，保持所述RRC连接。
  2. 根据权利要求1所述的方法，其特征在于，所述预设的第一消息用于请求所述终端建立与所述接入网设备或者核心网设备之间的安全通信机制。
  3. 根据权利要求1或2所述的方法，其特征在于，所述预设的第一消息包括鉴权请求消息，所述鉴权请求消息用于请求所述终端与核心网设备进行相互认证。
  4. 根据权利要求1或2所述的方法，其特征在于，所述预设的第一消息包括非接入层NAS安全模式命令消息，所述NAS安全模式命令消息用于请求所述终端建立与核心网设备之间的NAS安全连接。
  5. 根据权利要求1或2所述的方法，其特征在于，所述预设的第一消息包括安全模式命令消息，所述安全模式命令消息用于请求所述终端激活安全模式，所述RRC连接进入安全连接的状态。
  6. 根据权利要求1-5任一所述的方法，其特征在于，所述RRC释放消息包括RRC连接释放信元，所述RRC连接释放信元携带重定向载波信息。
  7. 根据权利要求6所述的方法，其特征在于，所述终端处于长期演进LTE或高级长期演进LTE-A通信制式。
  8. 根据权利要求1-5任一所述的方法，其特征在于，所述RRC释放消息处于未激活安全状态，所述终端处于新无线NR通信制式。
  9. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    在所述第一时长内接收到所述安全模式命令消息且所述安全模式命令消息通过安全验证时，激活安全模式，所述RRC连接进入安全连接状态。
  10. 根据权利要求1或2所述的方法，其特征在于，在所述接收RRC释放消息之前，所述方法还包括：
    发送RRC重建立请求消息，所述RRC重建立请求消息用于请求接入网设备重建立RRC连接。
  11. 根据权利要求10所述的方法，其特征在于，所述预设的第一消息包括RRC建立消息。
  12. 根据权利要求10所述的方法，其特征在于，所述预设的第一消息包括RRC重建立消息，所述方法还包括：
    在所述第一时长内接收到所述RRC重建立消息且所述RRC重建立消息通过安全验证时，激活安全模式，所述RRC连接进入安全连接状态。
  13. 一种应用在终端内部的通信装置，其特征在于，包括：
    发送单元，用于发送无线资源控制RRC建立请求消息，所述RRC建立请求消息用于请 求接入网设备建立RRC连接；
    接收单元，用于接收RRC释放消息，所述RRC释放消息用于指示所述终端释放所述RRC连接；
    处理单元，用于在接收到所述RRC释放消息之后的第一时长内接收到预设的第一消息时，保持所述RRC连接。
  14. 根据权利要求13所述的通信装置，其特征在于，所述预设的第一消息用于请求所述终端基于所述RRC连接，建立与所述接入网设备或者核心网设备之间的安全通信机制。
  15. 根据权利要求13或14所述的通信装置，其特征在于，所述预设的第一消息包括鉴权请求消息，所述鉴权请求消息用于请求所述终端与核心网设备进行相互认证。
  16. 根据权利要求13或14所述的通信装置，其特征在于，所述预设的第一消息包括非接入层NAS安全模式命令消息，所述NAS安全模式命令消息用于请求所述终端建立与核心网设备之间的NAS安全连接。
  17. 根据权利要求13或14所述的通信装置，其特征在于，所述预设的第一消息包括安全模式命令消息，所述安全模式命令消息用于请求所述终端激活安全模式，所述RRC连接进入安全连接的状态。
  18. 根据权利要求13-17任一所述的通信装置，其特征在于，所述RRC释放消息包括RRC连接释放信元，所述RRC连接释放信元携带重定向载波信息。
  19. 根据权利要求18所述的通信装置，其特征在于，所述终端处于长期演进LTE或高级长期演进LTE-A通信制式。
  20. 根据权利要求13-17任一所述的通信装置，其特征在于，所述RRC释放消息处于未激活安全状态，所述终端处于新无线NR通信制式。
  21. 根据权利要求17所述的通信装置，其特征在于，所述处理单元还用于：
    在所述第一时长内接收到所述安全模式命令消息且所述安全模式命令消息通过安全验证时，激活安全模式，所述RRC连接进入安全连接状态。
  22. 根据权利要求13或14所述的通信装置，其特征在于，
    所述发送单元，还用于在所述接收单元接收所述RRC释放消息之前，发送RRC重建立请求消息，所述RRC重建立请求消息用于请求接入网设备重建立RRC连接。
  23. 根据权利要求22所述的通信装置，其特征在于，所述预设的第一消息包括RRC建立消息。
  24. 根据权利要求22所述的通信装置，其特征在于，所述预设的第一消息包括RRC重建立消息；
    所述处理单元还用于：
    在所述第一时长内接收到所述RRC重建立消息且所述RRC重建立消息通过安全验证时，激活安全模式，所述RRC连接进入安全连接状态。
  25. 一种终端，其特征在于，包括：
    处理器、存储器和收发器；
    所述收发器用于接收和发送数据；
    所述存储器中存储有程序代码，所述处理器调用所述存储器中的程序代码时执行如权 利要求1至12中任一项所述的方法。
  26. 一种计算机可读存储介质，包括指令，当所述指令在计算机上运行时，使得计算机执行如权利要求1至12中任意一项所述的方法。
  27. 一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行如权利要求1至12中任意一项所述的方法。
PCT/CN2019/099602 2019-08-07 2019-08-07 一种通信的方法、装置及系统 WO2021022515A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980082128.8A CN113396637B (zh) 2019-08-07 2019-08-07 一种通信的方法、装置及系统
PCT/CN2019/099602 WO2021022515A1 (zh) 2019-08-07 2019-08-07 一种通信的方法、装置及系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/099602 WO2021022515A1 (zh) 2019-08-07 2019-08-07 一种通信的方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2021022515A1 true WO2021022515A1 (zh) 2021-02-11

Family

ID=74503695

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/099602 WO2021022515A1 (zh) 2019-08-07 2019-08-07 一种通信的方法、装置及系统

Country Status (2)

Country Link
CN (1) CN113396637B (zh)
WO (1) WO2021022515A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115065998B (zh) * 2021-12-22 2023-04-11 荣耀终端有限公司 通话处理方法及装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103313420A (zh) * 2012-03-15 2013-09-18 中兴通讯股份有限公司 一种释放终端链路的方法、接入网装置及终端
WO2014063572A1 (zh) * 2012-10-24 2014-05-01 华为技术有限公司 无线链路释放的方法、控制器和终端

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP2621234A1 (en) * 2012-01-30 2013-07-31 Alcatel Lucent Providing information on a mobile terminal to a radio resource management entity of a wireless communication network
US20140269637A1 (en) * 2013-03-15 2014-09-18 Qualcomm Incorporated Detecting missing rrc connection release message
US9788208B2 (en) * 2015-12-31 2017-10-10 Mediatek Inc. Apparatuses and methods for recovering from security mode command failures
CN111182539B (zh) * 2017-03-24 2023-04-07 华为技术有限公司 通信方法与设备
CN109474932A (zh) * 2017-09-08 2019-03-15 华为技术有限公司 一种伪基站识别以及防御方法和终端
CN109842881B (zh) * 2017-09-15 2021-08-31 华为技术有限公司 通信方法、相关设备以及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103313420A (zh) * 2012-03-15 2013-09-18 中兴通讯股份有限公司 一种释放终端链路的方法、接入网装置及终端
WO2014063572A1 (zh) * 2012-10-24 2014-05-01 华为技术有限公司 无线链路释放的方法、控制器和终端
CN103781193A (zh) * 2012-10-24 2014-05-07 华为技术有限公司 无线链路释放的方法、控制器和终端

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
TECHNICAL SPECIFICATION GROUP CORE NETWORK AND TERMINALS: "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS)", 3GPP TS 24.301 V16.1.1, 30 June 2019 (2019-06-30), XP051754279 *

Also Published As

Publication number Publication date
CN113396637A (zh) 2021-09-14
CN113396637B (zh) 2022-12-13

Similar Documents

Publication Publication Date Title
EP3576443B1 (en) Communication method and device
US11419160B2 (en) Network access method, terminal device, and network device
EP3531731B1 (en) Computer readable medium and apparatus for authentication
CN110999523A (zh) 重新连接与无线接入网节点的无线资源控制连接的方法和用户设备
WO2016062210A1 (zh) 一种传输下行数据的方法和设备
WO2013040962A1 (zh) 数据发送和接收方法及设备
US20160165572A1 (en) Method of transmission scheme switch, ue and base station
US11889301B2 (en) Security verification when resuming an RRC connection
EP3664570A1 (en) Session establishment method and apparatus
US20220345883A1 (en) Security key updates in dual connectivity
JP2024026229A (ja) Ｓｌユニキャストにおけるセキュリティの改善
WO2021022515A1 (zh) 一种通信的方法、装置及系统
EP4331269A1 (en) Managing conditional secondary node change
WO2022067815A1 (zh) 一种通信方法、装置及设备
CN116783986A (zh) 用于数据发射处理的方法及设备
WO2016078352A1 (zh) Ssd更新方法、移动交换中心、通信系统及相关存储介质
US20240147524A1 (en) Managing data communication before and after a state transition
WO2022205374A1 (zh) 一种处理无线链路失败的方法及装置、通信设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19940930

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19940930

Country of ref document: EP

Kind code of ref document: A1