WO2021023088A1 - 数据传输的方法和装置 - Google Patents

数据传输的方法和装置 Download PDF

Info

Publication number
WO2021023088A1
WO2021023088A1 PCT/CN2020/105744 CN2020105744W WO2021023088A1 WO 2021023088 A1 WO2021023088 A1 WO 2021023088A1 CN 2020105744 W CN2020105744 W CN 2020105744W WO 2021023088 A1 WO2021023088 A1 WO 2021023088A1
Authority
WO
WIPO (PCT)
Prior art keywords
access network
network device
terminal device
key
data transmission
Prior art date
Application number
PCT/CN2020/105744
Other languages
English (en)
French (fr)
Inventor
黄曲芳
徐小英
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021023088A1 publication Critical patent/WO2021023088A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/08—Access restriction or access information delivery, e.g. discovery data delivery

Definitions

  • This application relates to the field of communications, and in particular to a method and device for data transmission in the field of communications.
  • MTC machine type communications
  • NB-IOT narrowband-internet of things
  • RRC radio resource control
  • core network CN
  • Side connection security authentication, service channel establishment, air interface data bearer establishment, etc.
  • the base station that transmits data with the terminal device may be different each time.
  • the source base station needs to delete its data channel with the CN side each time, and the new base station establishes its data channel with the CN side.
  • the data transmission process is cumbersome .
  • the present application provides a data transmission method and device, which can simplify the data transmission process, save signaling and resource overhead, and improve the security of data transmission, thereby improving system performance.
  • a data transmission method including: a first access network device obtains a first key parameter; the first access network device receives a first message from a second access network device, so The first message is used to indicate that the terminal device has moved into the coverage area of the second access network device and that data needs to be transmitted between the terminal device and the second access network device; the first connection The network access device sends a first key to the second access network device according to the first message, where the first key is generated based on the first key parameter; the first access network The device assists the second access network device and the terminal device in data transmission; the first access network device obtains a second key parameter, and the second key parameter is used for the next time of the terminal device data transmission.
  • the first access network device assists the terminal device and the second access network device to perform data transmission without the second access network device re-establishing the data transmission channel with the core network device , But directly use the existing data transmission channel between the first access network equipment and the core network equipment, which can simplify the data transmission process and save signaling and resource overhead.
  • the first access network The device reacquires the key parameter and distributes it to the terminal device for the next data transmission, which can improve the security of data transmission and thereby improve system performance.
  • the first access network device performs data transmission with the terminal device, it means that the first access network device has established a data transmission channel from the first access network device to the core network device, that is, the terminal device can pass the data
  • the transmission channel receives downlink data from the core network device, or sends uplink data to the core network device.
  • the foregoing second message may carry the identity of the first access network device.
  • the "data" in the “data to be transmitted” mentioned above may refer to uplink data, downlink data, or both uplink data and downlink data, which is not limited in the embodiment of the present application.
  • the first access network device assisting the second access network device and the terminal device to perform data transmission includes: the first access The network device receives the decrypted uplink data from the terminal device from the second access network device; the first access network device sends the decrypted uplink data to the core network device.
  • the terminal device can send the encrypted uplink data to the second access network device, and the second access network device receives the data from the terminal device.
  • a key decrypts the data from the terminal device and sends the decrypted uplink data to the first access network device.
  • the first access network device sends the decrypted data to the core network device through the established data transmission channel. Upstream data.
  • the first access network device assisting the second access network device and the terminal device to perform data transmission includes: the first access The network device receives downlink data from the core network device; the first access network device sends the downlink data to the second access network device.
  • the core network device can send the downlink data to the first access device Network equipment, the first access network equipment sends the downlink data to the second access network equipment.
  • the second access network device encrypts the received downlink data using the aforementioned first key, and sends the encrypted downlink data to the terminal device.
  • the first message carries the identity of the terminal device and the identity of the cell of the second access network device accessed by the terminal device
  • the first key is generated according to the first key parameter and the identity of the cell of the second access network device accessed by the terminal device.
  • the first access network device can determine the above-mentioned terminal device according to the first message. Further, the first access network device may generate the first key according to the first key parameter in combination with the identity of the cell of the second access network device currently accessed by the terminal device. The first access network device sends the first key to the second access network device, so that the second access network device uses the first key to perform data transmission with the terminal device.
  • the above-mentioned first key may be a combination of the first key parameter, the source key previously saved by the first access network device, the identity of the cell of the second access network device accessed by the terminal device, All or part of the information in the frequency point of the cell of the second access network device accessed by the terminal device is generated, which is not limited in the embodiment of the present application.
  • the method further includes: the first access network device sends the The second access network device sends the second key parameter.
  • the first access network device obtains the second key parameter for the next data transmission of the terminal device. Since the terminal device is currently in the coverage area of the second access network device, the first access network device The acquired second key parameter needs to be sent to the second access network device, so that the second access network device sends the second key parameter to the terminal device.
  • the method further includes: the first access network device updates the The identification of the terminal device; the first access network device sends the updated identification of the terminal device to the second access network device.
  • the first access network device may update the identification of the terminal device, that is, re-allocate the identification to the terminal device for the next data transmission of the terminal device. If the first access network device updates the identification of the terminal device, the first access network device needs to send the updated identification to the second access network device, and then the second access network device will use the updated identification The identification is sent to the terminal device.
  • another data transmission method including: a second access network device sends a first message to a first access network device, where the first message is used to indicate that the terminal device has moved to the first access network device.
  • the second access network device is within the coverage area and data needs to be transmitted between the terminal device and the second access network device; the second access network device receives the first access network device from the first access network device A key, the first key is generated based on the first key parameter; the second access network device uses the first key, with the assistance of the first access network device , Perform data transmission with the terminal device; the second access network device receives a second key parameter from the first access network device, and the second key parameter is used for downloading of the terminal device One data transfer.
  • the second access network device uses the first key, and with the assistance of the first access network device, and the terminal device Performing data transmission includes: the second access network device receives the encrypted uplink data from the terminal device; the second access network device uses the first key to perform the encryption on the encrypted The uplink data is decrypted to obtain the decrypted uplink data; the second access network device sends the decrypted uplink data to the first access network device.
  • the second access network device uses the first key, and with the assistance of the first access network device, and the terminal device Performing data transmission includes: the second access network device receives the downlink data from the first access network device; the second access network device uses the first key to perform the downlink data Encrypting to obtain encrypted downlink data; the second access network device sends the encrypted downlink data to the terminal device.
  • the first message carries the identity of the terminal device and the identity of the cell of the second access network device accessed by the terminal device
  • the first key is generated according to the first key parameter and the identity of the cell of the second access network device accessed by the terminal device.
  • the method further includes: The second access network device sends the second key parameter to the terminal device.
  • the method further includes: the second access network device receiving an updated identification of the terminal device from the first access network device ; The second access network device sends the updated identification of the terminal device to the terminal device.
  • a data transmission device which is used to execute the foregoing aspects or the methods in any possible implementation manners of the aspects.
  • the device includes a unit for executing the above-mentioned aspects or methods in any possible implementation manners of the aspects.
  • the device may include modules that perform one-to-one correspondence of the methods/operations/steps/actions described in the above aspects.
  • the modules may be hardware circuits, software, or hardware circuits combined with software. achieve.
  • the device is a communication chip
  • the communication chip may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.
  • the device is a communication device, and the communication device may include a transmitter for sending information or data, and a receiver for receiving information or data.
  • the apparatus is used to execute the foregoing aspects or the methods in any possible implementation manners of the various aspects, and the apparatus may be configured in the foregoing first access network device or second access network device, or The device itself is the aforementioned first access network device or second access network device.
  • a communication device including a processor, a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the communication device executes any of the above aspects Any one of the possible implementation methods.
  • processors there are one or more processors and one or more memories.
  • the memory may be integrated with the processor, or the memory and the processor may be provided separately.
  • the communication device further includes a transmitter (transmitter) and a receiver (receiver).
  • the transmitter and the receiver can be arranged separately or integrated together, which is called a transceiver (transceiver).
  • a communication system which includes a device for implementing the first aspect or any possible method of the first aspect, and a device for implementing any of the second aspect or the second aspect. Possible methods of implementation.
  • the communication system may also include other devices that interact with the first access network device and/or the second access network device in the solution provided in the embodiment of the present application.
  • a computer program product includes a computer program (also called code, or instruction), which when the computer program is executed, causes a computer to execute any of the above aspects.
  • a computer program also called code, or instruction
  • a computer-readable medium stores a computer program (also called code, or instruction) when it runs on a computer, so that the computer executes any of the above aspects.
  • a computer program also called code, or instruction
  • a chip system including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that a communication device installed with the chip system executes the foregoing Any one of the possible implementation methods in each aspect.
  • the chip system may include an input circuit or interface for sending information or data, and an output circuit or interface for receiving information or data.
  • Fig. 1 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a data transmission method provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • Fig. 6 is a schematic block diagram of a data transmission device provided by an embodiment of the present application.
  • FIG. 7 is a schematic block diagram of another data transmission device provided by an embodiment of the present application.
  • Fig. 8 is a schematic structural diagram of an access network device provided by an embodiment of the present application.
  • LTE long term evolution
  • FDD frequency division duplex
  • UMTS universal mobile telecommunication system
  • 5G fifth generation
  • NR new radio
  • the terminal equipment in the embodiments of this application may also be called: user equipment (UE), mobile station (MS), mobile terminal (MT), access terminal, user unit, user station, Mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.
  • UE user equipment
  • MS mobile station
  • MT mobile terminal
  • access terminal user unit, user station, Mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, terminal, wireless communication device, user agent or user device, etc.
  • the terminal device may be a device that provides voice/data connectivity to users, for example, a handheld device with a wireless connection function, a vehicle-mounted device, and so on.
  • some examples of terminals are: mobile phones (mobile phones), tablets, notebook computers, palmtop computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, and augmented reality (augmented reality, AR) equipment, wireless terminals in industrial control, wireless terminals in self-driving (self-driving), wireless terminals in remote medical surgery, and smart grid (smart grid) Wireless terminals, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, cellular phones, cordless phones, session initiation protocols , SIP) phone, wireless local loop (WLL) station, personal digital assistant (personal digital assistant, PDA), handheld device with wireless communication function, computing device or other processing device connected to wireless modem, vehicle Devices, wearable devices, terminal devices in a 5G network, or terminal devices in a public land mobile network (PLMN) that will evolve in
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices. It is a general term for the application of wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes.
  • a wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. Wearable devices are not only a hardware device, but also realize powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized, complete or partial functions that can be achieved without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, and need to cooperate with other devices such as smart phones.
  • the terminal device may also be a terminal device in the Internet of Things (IoT) system.
  • IoT Internet of Things
  • the IoT is an important part of the development of information technology in the future. Its main technical feature is to pass items through communication technology. Connect with the network to realize the intelligent network of human-machine interconnection and interconnection of things.
  • the access network equipment and core network equipment in the embodiments of the present application may be collectively referred to as network equipment.
  • the access network device may be a device used to communicate with a terminal device.
  • the access network device may also be called a wireless access network device, which may be a transmission reception point (TRP), or an LTE system.
  • TRP transmission reception point
  • the evolved NodeB (evolved NodeB, eNB, or eNodeB) in the mobile phone can also be a home base station (for example, home evolved NodeB, or home Node B, HNB), baseband unit (BBU), or cloud wireless access.
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • BBU baseband unit
  • the wireless controller in the cloud radio access network (CRAN) scenario or the access network device can be a relay station, an access point, an in-vehicle device, a wearable device, and an access network device in a 5G network or an evolved future
  • the access network equipment in the public land mobile network (PLMN) network can be the access point (AP) in the WLAN or the new radio system (NR) system
  • PLMN public land mobile network
  • AP access point
  • NR new radio system
  • the gNB in the embodiment of the present application is not limited.
  • the access network device may include a centralized unit (CU) node, or a distributed unit (DU) node, or a RAN device including a CU node and a DU node, or a control plane CU node (CU-CP node), user plane CU node (CU-UP node) and RAN equipment of DU node.
  • CU centralized unit
  • DU distributed unit
  • RAN device including a CU node and a DU node, or a control plane CU node (CU-CP node), user plane CU node (CU-UP node) and RAN equipment of DU node.
  • CU-CP node control plane CU node
  • CU-UP node user plane CU node
  • the access network equipment provides services for the cell, and the terminal equipment communicates with the cell through the transmission resources (for example, frequency domain resources, or spectrum resources) allocated by the access network equipment.
  • the cell may belong to a macro base station (for example, a macro eNB or Macro gNB, etc.) can also belong to the base station corresponding to the small cell.
  • the small cell here can include: metro cell, micro cell, pico cell, femto cell ( Femto cells), etc. These small cells have the characteristics of small coverage and low transmit power, and are suitable for providing high-rate data transmission services.
  • the core network element in the embodiment of the application may be a core network element in a 4G network, for example, a mobile management entity (MME), a serving gateway (sGW), etc., or may be in a 5G network Core network network elements, for example, access and mobility management function (AMF) network elements, user plane function (UPF) network elements, etc., can also be core network elements with other names This is not limited in the embodiments of this application.
  • MME mobile management entity
  • sGW serving gateway
  • 5G network Core network network elements for example, access and mobility management function (AMF) network elements, user plane function (UPF) network elements, etc.
  • AMF access and mobility management function
  • UPF user plane function
  • the terminal device or the network device includes a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer.
  • the hardware layer includes hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also referred to as main memory).
  • the operating system may be any one or more computer operating systems that implement business processing through processes, for example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or windows operating system.
  • the application layer includes applications such as browsers, address books, word processing software, and instant messaging software.
  • the embodiments of the application do not specifically limit the specific structure of the execution subject of the methods provided in the embodiments of the application, as long as the program that records the codes of the methods provided in the embodiments of the application can be provided according to the embodiments of the application.
  • the execution subject of the method provided in the embodiment of the present application may be a terminal device or a network device, or a functional module in the terminal device or network device that can call and execute the program.
  • various aspects or features of the present application can be implemented as methods, devices, or products using standard programming and/or engineering techniques.
  • article of manufacture as used in this application encompasses a computer program accessible from any computer-readable device, carrier, or medium.
  • computer-readable media may include, but are not limited to: magnetic storage devices (for example, hard disks, floppy disks, or tapes, etc.), optical disks (for example, compact discs (CD), digital versatile discs (DVD)) Etc.), smart cards and flash memory devices (for example, erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.).
  • various storage media described herein may represent one or more devices and/or other machine-readable media for storing information.
  • machine-readable medium may include, but is not limited to, wireless channels and various other media capable of storing, containing, and/or carrying instructions and/or data.
  • Fig. 1 is a schematic diagram of a communication system suitable for an embodiment of the present application.
  • the communication system 100 may include a core network device 110, a first access network device 120, a second access network device 130, and a terminal device 140.
  • the terminal device 140 is within the coverage of the first access network device and can be connected to the first access network device 120 in a wireless manner, and the first access network device 120 and the second access network device 130 can be connected wirelessly. Or connect with the core network device 110 in a wired manner.
  • the core network device 110 and the first access network device 120 can be separate and different physical devices, or they can integrate the functions of the core network device 140 with the logical functions of the access network device On the same physical device, it may also be a physical device that integrates the functions of part of the core network equipment and part of the access network equipment, which is not limited in the embodiment of the present application.
  • the terminal device 140 may be movable. If the terminal device 140 moves to the coverage area of the first access network device 120, the terminal device 140 can transmit the uplink data packet to the first access network device 120, and the first access network device 120 can send it to the core network device 110 . The first access network device 120 may also transmit the downlink data packet from the core network device 110 to the terminal device 140. If the terminal device 140 moves to the coverage area of the second access network device 130, the data transmission method is the same, and will not be repeated.
  • the aforementioned access network equipment may include a baseband device and a radio frequency device.
  • the baseband device may be implemented by one node or multiple nodes. It can be implemented independently from the baseband device, or integrated into the baseband device, or partly remote and partly integrated into the baseband device.
  • the access network equipment includes a baseband device and a radio frequency device, where the radio frequency device can be arranged remotely relative to the baseband device, such as a remote radio unit (RRU) arranged remotely relative to the BBU.
  • RRU remote radio unit
  • Each of the aforementioned communication devices may be configured with multiple antennas.
  • the plurality of antennas may include at least one transmitting antenna for transmitting signals and at least one receiving antenna for receiving signals.
  • each communication device additionally includes a transmitter chain and a receiver chain.
  • Those of ordinary skill in the art can understand that they can all include multiple components related to signal transmission and reception (such as processors, modulators, multiplexers). , Demodulator, demultiplexer or antenna, etc.). Therefore, multi-antenna technology can be used to communicate between the access network device and the terminal device.
  • FIG. 1 is only a schematic diagram, and the communication system 100 may also include other network devices, such as wireless relay devices and wireless backhaul devices, which are not shown in FIG. 1.
  • the embodiment of the present application does not limit the number of core network equipment, access network equipment, and terminal equipment included in the communication system 100.
  • MTC machine type communications
  • NB-IOT narrowband-internet of things
  • RRC radio resource control
  • core network CN
  • Side connection security authentication, service channel establishment, air interface data bearer establishment, etc.
  • the base station that transmits data with the terminal device may be different each time.
  • the source base station needs to delete its data channel with the CN side each time, and the new base station establishes its data channel with the CN side.
  • the data transmission process is cumbersome. .
  • the present application provides a data transmission method that can simplify the data transmission process, save signaling and resource overhead, and improve the security of data transmission, thereby improving system performance.
  • FIG. 2 shows a schematic flowchart of a data transmission method 200 according to an embodiment of the present application.
  • the method 200 can be applied to the communication system 100 shown in FIG. 1, but the embodiment of the present application is not limited thereto.
  • the terminal device If the terminal device is in an idle state, it means that the terminal device is not connected to the access network device and not connected to the core network device. If the terminal device is in an inactive state, it means that the terminal device is not connected to the access network device, but is connected to the core network device.
  • the first access network device performs data transmission with the terminal device, it means that the first access network device has established a data transmission channel from the first access network device to the core network device, that is, the terminal device can pass the data
  • the transmission channel receives downlink data from the core network device, or sends uplink data to the core network device.
  • obtaining the first key parameter by the first access network device may mean that the first access network device obtains the first key parameter from the core network device.
  • the first access network device may obtain the first key parameter from the mobility A management entity (mobility management entity, MME) obtains the foregoing first key parameter, or the first access network device may obtain the foregoing first key parameter from an access and mobility management function network element (AMF).
  • MME mobility management entity
  • AMF access and mobility management function network element
  • the first access network device may send the aforementioned first key parameter, the identification of the terminal device, and the identification of the first access network device to the terminal device.
  • the first access network device sends an RRC release (RRC release) message to the terminal device, and the RRC release message carries the foregoing first key parameter, the identification of the terminal device, and the identification of the first access network device.
  • RRC release RRC release
  • the terminal device may save the parameters, identifiers, and source keys used in the cell where the first access network device is located, and then enter the idle state or the inactive state.
  • S220 The above-mentioned terminal device moves to the coverage of the second access network device, and there is data to be transmitted between the terminal device and the core network device, the terminal device sends a second message to the second access network device, The second message is used to request data transmission with the second access network device; then, correspondingly, the second access network device receives the second message sent by the terminal device.
  • the foregoing second message may carry the identity of the first access network device.
  • the "data" in the “data to be transmitted” mentioned above may refer to uplink data, downlink data, or both uplink data and downlink data, which is not limited in the embodiment of the present application.
  • the terminal device may obtain the identity of the cell of the second access network device currently accessed, and the frequency of the cell, and combine the stored first key parameters and the source key to generate the data transmission location for this time.
  • the new key used ie the first key.
  • the second access network device sends a first message to the first access network device according to the above second message, where the first message is used to indicate that the terminal device has moved within the coverage area of the second access network device, and Data needs to be transmitted between the terminal device and the second access network device; accordingly, the first access network device receives the first message sent by the second access network device.
  • the second access network device can determine based on the second message that the last data transmission of the terminal device was completed by the first access network device, that is, the first access network device.
  • An access network device retains the context information of the terminal device, and there is a data transmission channel between the first access network device and the core network device. Therefore, the second access network device sends the aforementioned first message to the first access network device, requesting the key of the terminal device.
  • the first message may be a context request message for requesting the context of the terminal device.
  • the foregoing first message may carry the identity of the terminal device and the identity of the cell of the second access network device currently accessed by the terminal device.
  • the first access network device generates a first key according to the first message and the first key parameter, and sends the first key to the second access network device; then, correspondingly, the second access The network device receives the first key.
  • the first key may be carried in a context response message sent by the first access network device to the second access network device.
  • the first message carries the identity of the terminal device and the identity of the cell of the second access network device accessed by the terminal device, and the first key is based on the first The key parameter and the identity of the cell of the second access network device accessed by the terminal device are generated.
  • the first access network device can determine the above-mentioned terminal device according to the first message. Further, the first access network device may generate the first key according to the first key parameter in combination with the identity of the cell of the second access network device currently accessed by the terminal device. The first access network device sends the first key to the second access network device, so that the second access network device uses the first key to perform data transmission with the terminal device.
  • the above-mentioned first key may be a combination of the first key parameter, the source key previously saved by the first access network device, the identity of the cell of the second access network device accessed by the terminal device, All or part of the information in the frequency point of the cell of the second access network device accessed by the terminal device is generated, which is not limited in the embodiment of the present application.
  • the first access network device assists the terminal device and the second access network device to transmit data.
  • the second access network device The first access network device can send uplink data to the core network device or receive downlink data from the core network device. It should be understood that the uplink data is from a terminal device, and the downlink data is sent to the terminal device.
  • the first access network device assisting the second access network device and the terminal device in data transmission includes: the first access network device receives from the second access network device The network access device receives the decrypted uplink data from the terminal device; the first access network device sends the decrypted uplink data to the core network device.
  • the terminal device can send the encrypted uplink data to the second access network device, and the second access network device receives the data from the terminal device.
  • a key decrypts the data from the terminal device and sends the decrypted uplink data to the first access network device.
  • the first access network device sends the decrypted data to the core network device through the established data transmission channel. Upstream data.
  • the first access network device assisting the second access network device and the terminal device to perform data transmission includes: the first access network device receives downlink data from a core network device Data; the first access network device sends the downlink data to the second access network device.
  • the core network device can send the downlink data to the first access device Network equipment, the first access network equipment sends the downlink data to the second access network equipment.
  • the second access network device encrypts the received downlink data using the aforementioned first key, and sends the encrypted downlink data to the terminal device.
  • S260 The first access network device obtains the second key parameter.
  • the first access network device determines that the terminal device does not enter the connected state, and the first access network device obtains the second key parameter.
  • the first access network device may determine that the terminal device does not enter the connected state according to multiple methods. Illustratively, the first access network device may determine that the terminal device does not enter the connected state according to information such as the service type and the type of the terminal device. It may also be determined that the terminal device does not enter the connected state according to the request of the terminal device, or the instruction of the second access network device, or the instruction of the application layer, which is not limited in the embodiment of the present application.
  • obtaining the second key parameter by the first access network device means that the first access network device obtains the second key parameter from the core network device.
  • the first access network device may obtain the second key parameter from the MME or AMF. The second key parameter.
  • the first access network device can obtain the second key parameter after determining that the terminal device does not enter the connected state.
  • the first access network device may obtain the second key parameter during data transmission between the terminal device and the second access network device, or the first access network device may be connected between the terminal device and the second access network device. After the data transmission of the access network device is completed, the foregoing second key parameter is obtained, which is not limited in the embodiment of the present application.
  • the first access network device assists the terminal device and the second access network device to perform data transmission without the second access network device re-establishing the data transmission channel with the core network device , But directly use the existing data transmission channel between the first access network equipment and the core network equipment, which can simplify the data transmission process and save signaling and resource overhead.
  • the first access network The device reacquires the key parameter and distributes it to the terminal device for the next data transmission, which can improve the security of data transmission and thereby improve system performance.
  • the method further includes: the first access network device sends all the parameters to the second access network device.
  • the second key parameter correspondingly, the second access network device receives the second key parameter from the first access network device, and sends the second key parameter to the terminal device.
  • the first access network device obtains the second key parameter for the next data transmission of the terminal device. Since the terminal device is currently in the coverage area of the second access network device, the first access network device The acquired second key parameter needs to be sent to the second access network device, so that the second access network device sends the second key parameter to the terminal device.
  • the first access network device may directly send the above-mentioned second key parameter to the second access network device, or may carry the above-mentioned second key parameter in an existing message (for example, an RRC release message) It is sent to the second access network device, which is not limited in this embodiment of the application.
  • an existing message for example, an RRC release message
  • the method further includes: the first access network device updates the identification of the terminal device; the first access network device sends the updated information to the second access network device The identification of the terminal device.
  • the first access network device may update the identification of the terminal device, that is, re-allocate the identification to the terminal device for the next data transmission of the terminal device. If the first access network device updates the identification of the terminal device, the first access network device needs to send the updated identification to the second access network device, and then the second access network device will use the updated identification The identification is sent to the terminal device.
  • the first access network device may directly send the above-mentioned updated identifier to the second access network device, or may carry the above-mentioned updated identifier in an existing message (for example, an RRC release message) and send it to
  • the second access network device is not limited in this embodiment of the application.
  • FIG. 3 shows a schematic flowchart of another data transmission method 300 according to an embodiment of the present application.
  • the method 300 can be applied to the system architecture 100 shown in FIG. 1, but the embodiment of the present application is not limited thereto.
  • the source eNB After the data transmission between the source eNB and the UE ends, the source eNB obtains the first Ncc from the MME, where Ncc is the key parameter, and is used to generate the key used for data transmission.
  • the source eNB sends an RRC release message to the UE, where the RRC release message carries a first identifier (also referred to as resume ID) and a first Ncc.
  • the first identifier may be divided into two parts, where one part of bits is used to identify the UE, and the other part of bits is used to identify the source eNB.
  • the UE receives the RRC release message.
  • the UE saves the source key KeNB (the key between the cell with the source eNB) used in the last data transmission, and the first identifier and the first Ncc in the RRC release message, and enters an idle state or Inactive (inactive) state.
  • KeNB the key between the cell with the source eNB
  • the UE moves to a cell covered by the new eNB, and there is uplink data transmission.
  • the UE can obtain information such as the cell ID of the new eNB and the frequency of the cell, combining the first Ncc and the source key KeNB.
  • Generate a new key KeNB* which is used by the UE in the cell of the new eNB currently accessed by the UE. Further, the UE may generate a key K_sec for encryption and a key K_inte for integrity protection according to the new key KeNB*.
  • the UE sends an RRC recovery request message and uplink data to the new eNB, where the RRC recovery request message carries the foregoing first identifier. Further, the RRC recovery request message may also carry the reason for sending the request, for example, there is uplink data to be transmitted. It should be understood that, before sending the RRC recovery request message and uplink data, the UE may use the aforementioned key K_inte for integrity protection to perform integrity protection on the RRC recovery request message, and then use the aforementioned key K_sec for encryption. Uplink data is encrypted. Correspondingly, the new eNB receives the RRC recovery request message and uplink data.
  • the new eNB determines that the UE context is stored in the source eNB according to the first identifier carried in the RRC recovery request message, and then sends a UE context request message to the source eNB.
  • the UE context request message may carry the first identifier, UE The identity (cell ID) of the cell accessed by the new eNB.
  • the source eNB receives the UE context request message sent by the new eNB. It should be understood that the UE context request message may be equivalent to the first message in the foregoing method 200.
  • the source eNB determines the UE according to the first identifier carried in the UE context request message, and then generates the UE according to the stored source key KeNB, the identifier of the cell that the UE accesses in the new eNB, and the cell frequency.
  • the first key used by the UE in the new cell is the new key KeNB*.
  • the source eNB sends a UE context response message to the new eNB, where the UE context response message carries the context information of the UE and the aforementioned new key KeNB*.
  • the new eNB receives the UE context response sent by the source eNB.
  • the new eNB generates a key K_sec for encryption and a key K_inte for integrity protection according to the new key KeNB*.
  • the new eNB uses the key K_inte to verify the integrity of the above RRC recovery request message, and uses the key K_sec to decrypt the uplink data.
  • the new eNB sends the decrypted uplink data to the source eNB.
  • the source eNB receives the decrypted uplink data sent by the new eNB.
  • the source eNB sends the decrypted uplink data to the sGW through the existing data transmission channel with the core network side.
  • the sGW receives the decrypted uplink data.
  • the source eNB determines that the UE does not enter a connected state, and the source eNB obtains the second Ncc from the MME.
  • the source eNB sends an RRC release message to the new eNB, where the RRC release message carries the second Ncc.
  • the new eNB receives the RRC release message sent by the source eNB.
  • the RRC release message may also carry the foregoing first identifier and the reason for releasing the connection (for example, no data transmission).
  • S314 The new eNB forwards the foregoing RRC release message to the UE.
  • the UE receives the RRC release message sent by the new eNB.
  • the source eNB may also re-allocate identification information for the UE, that is, update the above first identification, the updated first identification may be carried in the RRC release message and sent to the new eNB, and then forwarded to the UE by the new eNB , But the embodiment of this application does not limit this.
  • the above-mentioned source eNB may directly send the second Ncc to the new eNB.
  • the new eNB After receiving the second Ncc, the new eNB generates an RRC release message, and carries the second Ncc, the updated first identifier, and the reason for releasing the connection. Sent to the UE in the RRC release message.
  • the RRC release message received by the UE may be generated by the source eNB, or may be generated by the new eNB, which is not limited in the embodiment of the present application.
  • the UE only transmits the uplink data through the new eNB.
  • the source eNB updates the key parameters for the UE for the next data transmission. In this way, the source eNB passes The data transmission channel between the source eNB and the sGW assists the new eNB and UE to transmit data without switching paths, the process is simple, and the security is higher.
  • the network element in the embodiment of the application can be replaced with a network element in 5G.
  • the source eNB can be a gNB
  • the new eNB can be a new gNB
  • the MME can be an AMF
  • the sGW can be a UPF. The embodiment does not limit this.
  • FIG. 4 shows a schematic flowchart of another data transmission method 400 according to an embodiment of the present application.
  • the method 400 can be applied to the system architecture 100 shown in FIG. 1, but the embodiment of the present application is not limited thereto.
  • S401 to S411 are the same as S301 to S311, and will not be repeated here.
  • the sGW sends downlink data to the source eNB, and correspondingly, the source eNB receives the downlink data.
  • the source eNB determines that the UE does not enter the connected state, and the source eNB obtains the second Ncc from the MME.
  • the source eNB sends an RRC release message and the aforementioned downlink data to the new eNB, where the RRC release message carries the second Ncc.
  • the new eNB receives the RRC release message sent by the source eNB.
  • the RRC release message may also carry the foregoing first identifier and the reason for releasing the connection (for example, no data transmission).
  • the new eNB uses the key K_sec for encryption to encrypt the downlink data, and uses the key K_inte for integrity protection to protect the integrity of the RRC release message.
  • the new eNB sends an RRC release message and encrypted downlink data to the UE, and correspondingly, the UE receives the RRC release message and encrypted downlink data.
  • the RRC release message carries the second Ncc. Further, the RRC release message may also carry the aforementioned first identifier and the reason for releasing the connection (for example, no data transmission).
  • the UE saves the second Ncc, uses the key K_inte to verify the integrity of the RRC release message, and uses the key K_sec to decrypt the encrypted downlink data, so as to obtain the downlink data from the SGW. Further, if the RRC release message carries the first identifier, the UE saves the first identifier.
  • the source eNB may also re-allocate identification information for the UE, that is, update the above-mentioned first identifier.
  • the updated first identifier may be carried in the RRC release message and sent to the new eNB, and then forwarded to the UE by the new eNB.
  • the embodiment of the application does not limit this.
  • the above-mentioned source eNB may directly send the second Ncc to the new eNB.
  • the new eNB After receiving the second Ncc, the new eNB generates an RRC release message, and carries the second Ncc, the updated first identifier, and the reason for releasing the connection. Sent to the UE in the RRC release message.
  • the RRC release message received by the UE may be generated by the source eNB, or may be generated by the new eNB, which is not limited in the embodiment of the present application.
  • the UE transmits both uplink data and downlink data through the new eNB.
  • the source eNB updates the key parameters for the UE for the next data transmission.
  • the source eNB assists the new eNB and UE to transmit data through the data transmission channel between the source eNB and the sGW without switching paths, the process is simple and the security is higher.
  • the network element in the embodiment of the application can be replaced with a network element in 5G.
  • the source eNB can be a gNB
  • the new eNB can be a new gNB
  • the MME can be an AMF
  • the sGW can be a UPF. The embodiment does not limit this.
  • FIG. 5 shows a schematic flowchart of another data transmission method 500 according to an embodiment of the present application.
  • the method 500 can be applied to the system architecture 100 shown in FIG. 1, but the embodiment of the present application is not limited thereto.
  • the source eNB After the data transmission between the source eNB and the UE ends, the source eNB obtains the first Ncc from the MME, where Ncc is the key parameter, and is used to generate the key used for data transmission.
  • the source eNB sends an RRC release message to the UE.
  • the RRC release message carries a first identifier (also referred to as resume ID) and a first Ncc.
  • the first identifier may be divided into two parts, where one part of bits is used to identify the UE, and the other part of bits is used to identify the source eNB.
  • the UE receives the RRC release message.
  • the UE saves the source key KeNB (the key between the cell with the source eNB) used in the last data transmission, and the first identifier and the first Ncc in the RRC release message, and enters an idle state or Inactive (inactive) state.
  • KeNB the key between the cell with the source eNB
  • the UE moves to a cell covered by the new eNB.
  • the sGW will trigger the paging process, that is, the sGW notifies the MME, initiates paging, the MME generates a paging message, and sends it to all eNBs in the paging area
  • the paging message includes sending a paging message to the source eNB, and the paging message carries the identity of the UE.
  • the source eNB receives the paging message.
  • the source eNB sends a paging message to the new eNB and indicates in which cells the paging message is sent.
  • the new eNB receives the paging message sent by the source eNB.
  • S506 The new eNB initiates paging in the indicated cell. In this way, since the UE is in the cell of the new eNB, the UE can receive the paging message sent by the new eNB, thereby knowing that there is downlink data to be transmitted.
  • the UE obtains the cell ID of the new eNB, the frequency of the cell, and other information, and combines the first Ncc and the source key KeNB to generate a new key KeNB*, which is used by the UE in the current connection Used in the cell of the new eNB. Further, the UE can generate a key K_sec for encryption and a key K_inte for integrity protection according to the new key KeNB*.
  • the UE sends an RRC recovery request message to the new eNB, where the RRC recovery request message carries the foregoing first identifier. Further, the RRC recovery request message may also carry the reason for sending the request, for example, there is downlink data to be transmitted. It should be understood that, before sending the RRC recovery request message, the UE may use the aforementioned key K_inte for integrity protection to perform integrity protection on the RRC recovery request message. Correspondingly, the new eNB receives the RRC recovery request message.
  • the new eNB determines that the UE context is stored in the source eNB according to the first identifier carried in the RRC recovery request message, and then sends a UE context request message to the source eNB.
  • the UE context request message may carry the first identifier, UE The identity (cell ID) of the cell accessed by the new eNB.
  • the source eNB receives the UE context request message sent by the new eNB.
  • the source eNB determines the UE according to the first identifier carried in the UE context request message, and then generates the UE according to the stored source key KeNB, the identifier of the cell that the UE accesses in the new eNB, and the cell frequency.
  • the first key used by the UE in the new cell is the new key KeNB*.
  • the source eNB sends a UE context response message to the new eNB.
  • the UE context response message carries the context information of the UE and the new key KeNB*.
  • the new eNB receives the UE context response sent by the source eNB.
  • the sGW sends downlink data to the source eNB, and correspondingly, the source eNB receives the downlink data.
  • the source eNB determines that the UE does not enter a connected state, and the source eNB obtains the second Ncc from the MME.
  • the source eNB sends an RRC release message and the aforementioned downlink data to the new eNB, where the RRC release message carries the second Ncc.
  • the new eNB receives the RRC release message sent by the source eNB.
  • the RRC release message may also carry the foregoing first identifier and the reason for releasing the connection (for example, no data transmission).
  • the new eNB generates a key K_sec for encryption and a key K_inte for integrity protection according to the new key KeNB*.
  • the new eNB uses the key K_sec for encryption to encrypt the downlink data, and uses the key K_inte for integrity protection to protect the integrity of the RRC release message.
  • the new eNB sends the RRC release message and the encrypted downlink data to the UE, and correspondingly, the UE receives the RRC release message and the encrypted downlink data.
  • the RRC release message carries the second Ncc. Further, the RRC release message may also carry the foregoing first identifier and the reason for releasing the connection (for example, no data transmission).
  • the UE saves the second Ncc, uses the key K_inte to verify the integrity of the RRC release message, and uses the key K_sec to decrypt the encrypted downlink data, thereby obtaining the downlink data from the SGW. Further, if the RRC release message carries the first identifier, the UE saves the first identifier.
  • the source eNB may also re-allocate identification information for the UE, that is, update the above-mentioned first identifier, and the updated first identifier may be carried in the RRC release message and sent to the new eNB, and then forwarded to the UE by the new eNB.
  • the embodiment of the application does not limit this.
  • the above-mentioned source eNB may directly send the second Ncc to the new eNB.
  • the new eNB After receiving the second Ncc, the new eNB generates an RRC release message, and carries the second Ncc, the updated first identifier, and the reason for releasing the connection. Sent to the UE in the RRC release message.
  • the RRC release message received by the UE may be generated by the source eNB, or may be generated by the new eNB, which is not limited in the embodiment of the present application.
  • the UE only transmits the downlink data through the new eNB.
  • the source eNB updates the key parameters for the UE for the next data transmission. In this way, the source eNB passes The data transmission channel between the source eNB and the sGW assists the new eNB and UE to transmit data without switching paths, the process is simple, and the security is higher.
  • the network element in the embodiment of the application can be replaced with a network element in 5G.
  • the source eNB can be a gNB
  • the new eNB can be a new gNB
  • the MME can be an AMF
  • the sGW can be a UPF. The embodiment does not limit this.
  • Fig. 6 is a schematic block diagram of a data transmission device provided by an embodiment of the present application.
  • the apparatus 600 for data transmission can implement various steps or processes corresponding to the first access network device in the above method embodiment.
  • the apparatus 600 can be the first access network device, or be configured in the first access network device. Chip or circuit in access network equipment.
  • the device 600 may include: an acquiring unit 610, a receiving unit 620, and a sending unit 630.
  • the obtaining unit 610 is used to: obtain the first key parameter
  • the receiving unit 620 is configured to receive a first message from a second access network device, where the first message is used to indicate that the terminal device has moved within the coverage area of the second access network device and the terminal Data needs to be transmitted between the device and the second access network device;
  • the sending unit 630 is configured to send a first key to the second access network device according to the first message, where the first key is generated based on the first key parameter;
  • the receiving unit 620 and/or the sending unit 630 are further configured to: assist the second access network device and the terminal device in data transmission;
  • the obtaining unit 610 is further configured to obtain a second key parameter, which is used for the next data transmission of the terminal device.
  • the receiving unit 620 is specifically configured to: receive the decrypted uplink data from the terminal device from the second access network device; the sending unit 630 is specifically configured to: send to the core network device The decrypted uplink data.
  • the receiving unit 620 is specifically configured to receive downlink data from a core network device; the sending unit 630 is specifically configured to send the downlink data to the second access network device.
  • the first message carries the identity of the terminal device and the identity of the cell of the second access network device accessed by the terminal device, and the first key is based on the first The key parameter and the identity of the cell of the second access network device accessed by the terminal device are generated.
  • the sending unit 630 is further configured to: after acquiring the second key parameter, send the second key parameter to the second access network device.
  • the apparatus further includes: a processing unit, configured to update the identification of the terminal device after acquiring the second key parameter; and the sending unit 630 is further configured to: send a message to the second access network device Send the updated identification of the terminal device.
  • the device 600 here is embodied in the form of a functional unit.
  • the term "unit” here can refer to application specific integrated circuit (application specific integrated circuit, ASIC), electronic circuit, processor for executing one or more software or firmware programs (such as shared processor, proprietary processor or group Processor, etc.) and memory, merge logic circuits and/or other suitable components that support the described functions.
  • ASIC application specific integrated circuit
  • the apparatus 600 may be specifically the first access network device in the foregoing embodiment, and the apparatus 600 may be used to execute the method corresponding to the first access network device in the foregoing embodiment. In order to avoid repetition, the various processes and/or steps of, will not be repeated here.
  • FIG. 7 is a schematic block diagram of another data transmission device provided by an embodiment of the present application.
  • the apparatus 700 for data transmission can implement various steps or processes performed by the second access network device corresponding to the above method embodiments.
  • the apparatus 700 can be the second access network device, or be configured in the second access network device. Chip or circuit in access network equipment.
  • the apparatus 700 may include: a sending unit 710 and a receiving unit 720.
  • the sending unit 710 is configured to send a first message to the first access network device, where the first message is used to indicate that the terminal device has moved within the coverage area of the device and that the terminal device and the device are Need to transfer data between;
  • the receiving unit 720 is configured to: receive a first key from the first access network device, where the first key is generated based on the first key parameter;
  • the sending unit 710 and/or the receiving unit 720 are further configured to: use the first key to perform data transmission with the terminal device with the assistance of the first access network device;
  • the receiving unit 720 is further configured to receive a second key parameter from the first access network device, where the second key parameter is used for the next data transmission of the terminal device.
  • the receiving unit 720 is specifically configured to: receive encrypted uplink data from the terminal device; the device further includes: a processing unit, configured to use the first key to encrypt the The subsequent uplink data is decrypted to obtain the decrypted uplink data; the sending unit 710 is specifically configured to: send the decrypted uplink data to the first access network device.
  • the receiving unit 720 is specifically configured to: receive downlink data from the first access network device; the apparatus further includes: a processing unit, configured to use the first key to perform the downlink data The data is encrypted to obtain encrypted downlink data; the sending unit 710 is specifically configured to: send the encrypted downlink data to the terminal device.
  • the first message carries the identity of the terminal device and the identity of the cell of the apparatus accessed by the terminal device, and the first key is based on the first key parameter and the Generated by the identity of the cell of the device accessed by the terminal device.
  • the sending unit 710 is further configured to: after receiving the second key parameter from the first access network device, send the second key parameter to the terminal device.
  • the receiving unit 720 is further configured to: receive the updated identification of the terminal device from the first access network device; the sending unit 710 is further configured to: send the terminal device to the terminal device. The updated identification of the terminal device.
  • the device 700 here is embodied in the form of a functional unit.
  • the term "unit” here can refer to application specific integrated circuit (application specific integrated circuit, ASIC), electronic circuit, processor for executing one or more software or firmware programs (such as shared processor, proprietary processor or group Processor, etc.) and memory, merge logic circuits and/or other suitable components that support the described functions.
  • ASIC application specific integrated circuit
  • the apparatus 700 may be specifically the second access network device in the foregoing embodiment, and the apparatus 600 may be used to execute the second access network device in the foregoing method embodiment. In order to avoid repetition, the various processes and/or steps of, will not be repeated here.
  • the aforementioned device 600 has the function of realizing the corresponding steps performed by the first access network device in the aforementioned method; the aforementioned device 700 has the function of realizing corresponding steps executed by the second access network device in the aforementioned method.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the foregoing sending unit may be replaced by a transmitter
  • the foregoing receiving unit may be replaced by a receiver, respectively performing the receiving and sending operations and related processing operations in each method embodiment.
  • the sending unit and the receiving unit can be collectively referred to as a transceiver unit, and accordingly, the receiver and transmitter can be collectively referred to as a transceiver.
  • the processing unit in the above embodiments may be implemented by a processor or processor-related circuits, and the receiving unit and the sending unit may be implemented by a transceiver or a transceiver-related circuit or interface circuit.
  • a storage unit may be further included, and the storage unit is used to store a computer program, and the processing unit may call and run the computer program from the storage unit, so that the device 600 executes the foregoing method embodiments.
  • the method of the first access network device in the first access network device, or the apparatus 700 is caused to execute the method of the second access network device in the foregoing method embodiment.
  • the units in the above-mentioned embodiments may also be referred to as modules or circuits or components.
  • FIG. 8 is a schematic structural diagram of an access network device 3000 provided by an embodiment of the present application, for example, it may be a schematic structural diagram of a base station.
  • the access network device 3000 can be applied to the communication system shown in FIG. 1 to implement the steps or processes performed by the first access network device in the foregoing method embodiment, or implement the second access network device in the foregoing method embodiment The steps or processes performed.
  • the access network device 3000 may include one or more radio frequency units, such as a remote radio unit (RRU) 3100 and one or more baseband units (BBU) 3200, among which,
  • the BBU 3200 may also be referred to as a digital unit (DU), and the RRU 3100 may be referred to as a transceiver unit, which corresponds to the receiving unit and the transmitting unit in FIG. 6 and FIG. 7.
  • the RRU 3100 may also be called a transceiver, a transceiver circuit, or a transceiver, etc., and it may include at least one antenna 3101 and a radio frequency unit 3102.
  • the RRU 3100 may include a receiving unit and a sending unit.
  • the receiving unit may correspond to a receiver (or receiver or receiving circuit), and the sending unit may correspond to a transmitter (or transmitter or transmitting circuit).
  • the RRU 3100 part is mainly used for sending and receiving of radio frequency signals and conversion of radio frequency signals and baseband signals, for example, for sending instruction information to terminal equipment.
  • the 3200 part of the BBU is mainly used for baseband processing and control of access network equipment.
  • the RRU 3100 and the BBU 3200 may be physically set together, or may be physically separated, such as a distributed base station.
  • the BBU 3200 is the control center of the access network equipment, and can also be called a processing unit, which can correspond to the processing unit in the above device, and is mainly used to complete baseband processing functions, such as channel coding, multiplexing, modulation, spread spectrum, etc. Wait.
  • the BBU 3200 may be used to control the access network device to execute the operation process of the access network device in the foregoing method embodiment, for example, to generate the foregoing switching condition, or to send the switching condition.
  • the BBU 3200 may be composed of one or more single boards, and multiple single boards may jointly support a radio access network with a single access standard (such as an LTE network), or support different access standards. Wireless access network (such as LTE network, 5G network or other networks).
  • the BBU 3200 also includes a memory 3201 and a processor 3202.
  • the memory 3201 is used to store necessary instructions and data.
  • the processor 3202 is configured to control the access network device to perform necessary actions, for example, to control the access network device to execute the operation process of the access network device in the foregoing method embodiment.
  • the memory 3201 and the processor 3202 may serve one or more single boards. In other words, the memory and the processor can be set separately on each board. It can also be that multiple boards share the same memory and processor. In addition, necessary circuits can be provided on each board.
  • the access network device 3000 shown in FIG. 8 can implement various processes involving the access network device in the method embodiments of FIGS. 2 to 5.
  • the operations and/or functions of each module in the access network device 3000 are respectively for implementing the corresponding processes in the foregoing method embodiments.
  • the above-mentioned BBU 3200 can be used to perform the actions described in the previous method embodiments implemented by the access network device, and the RRU 3100 can be used to perform the access network device described in the previous method embodiment to send to or from the terminal device Receive action.
  • the RRU 3100 can be used to perform the access network device described in the previous method embodiment to send to or from the terminal device Receive action.
  • the embodiment of the present application also provides a processing device, including a processor and an interface.
  • the processor may be used to execute the method in the foregoing method embodiment.
  • the processing device may be a chip.
  • the processing device may be a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or a system on chip (SoC), or It is a central processor unit (CPU), it can also be a network processor (NP), it can also be a digital signal processing circuit (digital signal processor, DSP), or it can be a microcontroller (microcontroller unit). , MCU), it can also be a programmable logic device (PLD) or other integrated chips.
  • FPGA field programmable gate array
  • ASIC application specific integrated circuit
  • SoC system on chip
  • CPU central processor unit
  • NP network processor
  • DSP digital signal processing circuit
  • microcontroller unit microcontroller unit
  • MCU programmable logic device
  • PLD programmable logic device
  • the steps of the above method can be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the processor in the embodiment of the present application may be an integrated circuit chip with signal processing capability.
  • the steps of the foregoing method embodiments can be completed by hardware integrated logic circuits in the processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly embodied as being executed and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), and electronic Erase programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • the volatile memory may be random access memory (RAM), which is used as an external cache.
  • RAM random access memory
  • static random access memory static random access memory
  • dynamic RAM dynamic random access memory
  • DRAM dynamic random access memory
  • SDRAM synchronous dynamic random access memory
  • double data rate synchronous dynamic random access memory double data rate SDRAM, DDR SDRAM
  • enhanced synchronous dynamic random access memory enhanced SDRAM, ESDRAM
  • serial link DRAM SLDRAM
  • direct rambus RAM direct rambus RAM
  • the present application also provides a computer program product.
  • the computer program product includes computer program code.
  • the computer program code runs on a computer, the computer executes any one of the foregoing embodiments.
  • the method corresponding to any network element.
  • the present application also provides a computer-readable medium that stores program code, and when the program code runs on a computer, the computer executes the steps shown in FIGS. 2 to 5 The method corresponding to any network element in any one of the embodiments is shown.
  • the present application also provides a system, which includes the aforementioned one or more terminal devices and one or more access network devices.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • the network equipment in the above device embodiments corresponds to the network equipment or terminal equipment in the terminal equipment and method embodiments, and the corresponding modules or units execute the corresponding steps.
  • the communication unit transmits the receiving or sending in the method embodiments.
  • other steps can be executed by the processing unit (processor).
  • the processing unit processor
  • components may be, but is not limited to, a process, a processor, an object, an executable file, an execution thread, a program, and/or a computer running on a processor.
  • the application running on the computing device and the computing device can be components.
  • One or more components may reside in processes and/or threads of execution, and components may be located on one computer and/or distributed between two or more computers.
  • these components can be executed from various computer readable media having various data structures stored thereon.
  • the components may communicate through local and/or remote processes, for example, based on signals having one or more data packets (e.g., data from components with local systems, distributed systems, and/or networks).
  • At least one refers to one or more, and “multiple” refers to two or more.
  • And/or describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects are in an “or” relationship.
  • "The following at least one item (a)” or similar expressions refers to any combination of these items, including any combination of a single item (a) or plural items (a).
  • At least one item (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c or a-b-c, where a, b, and c can be single or multiple.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this application essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种数据传输的方法和装置，能够简化数据传输流程，在节省信令和资源的开销的同时，提高数据传输的安全性。该方法包括：第一接入网设备获取第一密钥参数；该第一接入网设备接收来自第二接入网设备的第一消息，该第一消息用于表示终端设备已经移动至该第二接入网设备的覆盖范围内、且该终端设备与该第二接入网设备之间需要传输数据；该第一接入网设备根据该第一消息，向该第二接入网设备发送第一密钥，该第一密钥是基于该第一密钥参数生成的；该第一接入网设备采用该第一密钥，辅助该第二接入网设备和该终端设备进行数据传输；该第一接入网设备获取第二密钥参数，该第二密钥参数用于该终端设备的下一次数据传输。

Description

数据传输的方法和装置
本申请要求于2019年8月5日提交中国专利局、申请号为201910719009.0、申请名称为“数据传输的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，特别涉及通信领域中一种数据传输的方法和装置。
背景技术
随着通信技术的发展，终端设备的类型在不断增多，例如机器类型通信(machine type communications，MTC)和窄带物联网(narrow band-internet of things，NB-IOT)等。不同类型的终端设备，应用场景不同，数据传输方式也不同。以MTC类型的终端设备为例，这类终端设备传输的数据很少，也只在有限范围内移动。而一般情况下，每次有数据传输，终端设备和网络设备之间都需要执行完整的一套流程，具体包括：建立无线资源控制(radio resource control，RRC)连接、建立核心网(core network，CN)侧连接、安全认证、业务通道建立、空口的数据承载建立等。
由于终端设备的移动性，每次与该终端设备传输数据的基站可能不同，每次都需要源基站删除其与CN侧的数据通道，新基站建立其与CN侧的数据通道，数据传输流程繁琐。且由于MTC类型的终端设备数量巨大，这样会造成大量的信令开销，浪费大量的无线资源。
发明内容
本申请提供一种数据传输的方法和装置，能够简化数据传输流程，在节省信令和资源的开销的同时，提高数据传输的安全性，进而提高系统性能。
第一方面，提供了一种数据传输的方法，包括：第一接入网设备获取第一密钥参数；所述第一接入网设备接收来自第二接入网设备的第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；所述第一接入网设备根据所述第一消息，向所述第二接入网设备发送第一密钥，所述第一密钥是基于所述第一密钥参数生成的；所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输；所述第一接入网设备获取第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
本申请实施例的数据传输的方法，通过第一接入网设备辅助终端设备和第二接入网设备进行数据传输，无需第二接入网设备重新建立与核心网设备之间的数据传输通道，而是直接采用已有的第一接入网设备与核心网设备之间的数据传输通道，能够简化数据传输流程，在节省信令和资源的开销，与此同时，由第一接入网设备重新获取密钥参数，分发给 终端设备，用于下一次数据传输，能够提高数据传输的安全性，进而提高系统性能。
应理解，由于第一接入网设备与终端设备进行了数据传输，表示该第一接入网设备建立了第一接入网设备至核心网设备的数据传输通道，即终端设备可以通过该数据传输通道接收来自核心网设备的下行数据，或者向核心网设备发送上行数据。
上述第二消息可以携带第一接入网设备的标识。上述“有数据需要传输”中的“数据”可以指上行数据，也可以指下行数据，也可以既包括上行数据又包括下行数据，本申请实施例对此不作限定。
结合第一方面，在第一方面的某些实现方式中，所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输，包括：所述第一接入网设备从所述第二接入网设备接收来自所述终端设备的、解密后的上行数据；所述第一接入网设备向核心网设备发送所述解密后的上行数据。
针对上行数据(来自终端设备，需要发送至核心网设备)，终端设备可以将加密了的上行数据发送给第二接入网设备，第二接入网设备接收来自终端设备的数据，采用上述第一密钥对来自终端设备的数据进行解密，并将解密后的上行数据发送给第一接入网设备，该第一接入网设备通过已建立的数据传输通道向核心网设备发送解密后的上行数据。
结合第一方面，在第一方面的某些实现方式中，所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输，包括：所述第一接入网设备从核心网设备接收下行数据；所述第一接入网设备向所述第二接入网设备发送所述下行数据。
针对下行数据(来自核心网设备，需要发送至终端设备)，由于核心网设备与第二接入网设备之间并未建立数据传输通道，该核心网设备可以将下行数据发送给第一接入网设备，该第一接入网设备再向第二接入网设备发送该下行数据。第二接入网设备将接收到的下行数据采用上述第一密钥进行加密，将加密后的下行数据发送给终端设备。
结合第一方面，在第一方面的某些实现方式中，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
由于第一消息携带了终端设备的标识，第一接入网设备在接收到第一消息之后，便可以根据该第一消息确定出上述终端设备。进一步地，该第一接入网设备可以根据第一密钥参数，结合终端设备当前所接入的第二接入网设备的小区的标识生成第一密钥。该第一接入网设备向第二接入网设备发送该第一密钥，以便该第二接入网设备采用该第一密钥与终端设备进行数据传输。
可选地，上述第一密钥可以是结合第一密钥参数、第一接入网设备之前保存的源密钥、终端设备所接入的所述第二接入网设备的小区的标识、终端设备所接入的第二接入网设备的小区的频点等中的全部或部分信息生成的，本申请实施例对此不作限定。
结合第一方面，在第一方面的某些实现方式中，在所述第一接入网设备获取第二密钥参数之后，所述方法还包括：所述第一接入网设备向所述第二接入网设备发送所述第二密钥参数。
应理解，第一接入网设备获取第二密钥参数是为了终端设备的下一次数据传输，由于该终端设备当前处于第二接入网设备的覆盖范围，因此，该第一接入网设备需要将获取到的第二密钥参数发送给第二接入网设备，以便该第二接入网设备将该第二密钥参数发送给 终端设备。
结合第一方面，在第一方面的某些实现方式中，在所述第一接入网设备获取第二密钥参数之后，所述方法还包括：所述第一接入网设备更新所述终端设备的标识；所述第一接入网设备向所述第二接入网设备发送更新后的所述终端设备的标识。
考虑到数据传输的安全性，第一接入网设备可以更新终端设备的标识，即重新为该终端设备分配标识，用于该终端设备的下一次数据传输。若第一接入网设备更新了终端设备的标识，该第一接入网设备需要将更新后的标识发送给第二接入网设备，再由该第二接入网设备将该更新后的标识发送给该终端设备。
第二方面，提供了另一种数据传输的方法，包括：第二接入网设备向第一接入网设备发送第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；所述第二接入网设备接收来自所述第一接入网设备的第一密钥，所述第一密钥是基于所述第一密钥参数生成的；所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输；所述第二接入网设备接收来自所述第一接入网设备的第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
结合第二方面，在第二方面的某些实现方式中，所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输，包括：所述第二接入网设备接收来自所述终端设备的、加密后的上行数据；所述第二接入网设备采用所述第一密钥，对所述加密后的上行数据进行解密，获得解密后的上行数据；所述第二接入网设备向所述第一接入网设备发送所述解密后的上行数据。
结合第二方面，在第二方面的某些实现方式中，所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输，包括：所述第二接入网设备接收来自所述第一接入网设备的下行数据；所述第二接入网设备采用所述第一密钥，对所述下行数据进行加密，获得加密后的下行数据；所述第二接入网设备向所述终端设备发送所述加密后的下行数据。
结合第二方面，在第二方面的某些实现方式中，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
结合第二方面，在第二方面的某些实现方式中，在所述第二接入网设备接收来自所述第一接入网设备的第二密钥参数之后，所述方法还包括：所述第二接入网设备向所述终端设备发送所述第二密钥参数。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：所述第二接入网设备接收来自所述第一接入网设备的更新后的所述终端设备的标识；所述第二接入网设备向所述终端设备发送所述更新后的所述终端设备的标识。
第三方面，提供了一种数据传输的装置，用于执行上述各个方面或各个方面任意可能的实现方式中的方法。具体地，该装置包括用于执行上述各个方面或各个方面任意可能的实现方式中的方法的单元。
在一种设计中，该装置可以包括执行上述各个方面中所描述的方法/操作/步骤/动作所一一对应的模块，该模块可以是硬件电路，也可是软件，也可以是硬件电路结合软件实现。
在另一种设计中，该装置为通信芯片，通信芯片可以包括用于发送信息或数据的输入电路或者接口，以及用于接收信息或数据的输出电路或者接口。
在另一种设计中，该装置为通信设备，通信设备可以包括用于发送信息或数据的发射机，以及用于接收信息或数据的接收机。
在另一种设计中，该装置用于执行上述各个方面或各个方面中任意可能的实现方式中的方法，该装置可以配置在上述第一接入网设备或第二接入网设备中，或者该装置本身即为上述第一接入网设备或第二接入网设备。
第四方面，提供了一种通信设备，包括，处理器，存储器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得该通信设备执行上述任一方面中任一种可能实现方式中的方法。
可选地，所述处理器为一个或多个，所述存储器为一个或多个。
可选地，所述存储器可以与所述处理器集成在一起，或者所述存储器与处理器分离设置。
可选地，该通信设备还包括，发射机(发射器)和接收机(接收器)，发射机和接收机可以分离设置，也可以集成在一起，称为收发机(收发器)。
第五方面，提供了一种通信系统，包括用于实现上述第一方面或第一方面的任一种可能实现的方法的装置，以及用于实现上述第二方面或第二方面的任一种可能实现的方法的装置。
在一个可能的设计中，该通信系统还可以包括本申请实施例提供的方案中与第一接入网设备和/或第二接入网设备进行交互的其他设备。
第六方面，提供了一种计算机程序产品，所述计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当所述计算机程序被运行时，使得计算机执行上述任一方面中任一种可能实现方式中的方法。
第七方面，提供了一种计算机可读介质，所述计算机可读介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述任一方面中任一种可能实现方式中的方法。
第八方面，提供了一种芯片系统，包括存储器和处理器，该存储器用于存储计算机程序，该处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片系统的通信设备执行上述各个方面中任一种可能实现方式中的方法。
其中，该芯片系统可以包括用于发送信息或数据的输入电路或者接口，以及用于接收信息或数据的输出电路或者接口。
附图说明
图1是本申请实施例提供的通信系统的示意图。
图2是本申请实施例提供的数据传输的方法的示意性流程图。
图3是本申请实施例提供的另一数据传输的方法的示意性流程图。
图4是本申请实施例提供的再一数据传输的方法的示意性流程图。
图5是本申请实施例提供的再一数据传输的方法的示意性流程图。
图6是本申请实施例提供的数据传输的装置的示意性框图。
图7是本申请实施例提供的另一数据传输的装置的示意性框图。
图8是本申请实施例提供的接入网设备的示意性结构图。
具体实施方式
本申请实施例的技术方案可以应用于各种通信系统，例如：长期演进(long term evolution，LTE)系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、第五代(5th generation，5G)系统或新无线(new radio，NR)或者其他演进的通信系统等。
本申请实施例中的终端设备也可以称为：用户设备(user equipment，UE)、移动台(mobile station，MS)、移动终端(mobile terminal，MT)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置等。
终端设备可以是一种向用户提供语音/数据连通性的设备，例如，具有无线连接功能的手持式设备、车载设备等。目前，一些终端的举例为：手机(mobile phone)、平板电脑、笔记本电脑、掌上电脑、移动互联网设备(mobile internet device，MID)、可穿戴设备，虚拟现实(virtual reality，VR)设备、增强现实(augmented reality，AR)设备、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程手术(remote medical surgery)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端、蜂窝电话、无绳电话、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备，5G网络中的终端设备或者未来演进的公用陆地移动通信网络(public land mobile network，PLMN)中的终端设备等，本申请实施例对此并不限定。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能首饰等。
此外，在本申请实施例中，终端设备还可以是物联网(internet of things，IoT)系统中的终端设备，IoT是未来信息技术发展的重要组成部分，其主要技术特点是将物品通过通信技术与网络连接，从而实现人机互连，物物互连的智能化网络。
另外，本申请实施例中的接入网设备和核心网设备可以统称为网络设备。其中，接入网设备可以是用于与终端设备通信的设备，该接入网设备也可以称为无线接入网设备，可 以是传输接收点(transmission reception point，TRP)，还可以是LTE系统中的演进型基站(evolved NodeB，eNB或eNodeB)，还可以是家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(base band unit，BBU)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，或者该接入网设备可以为中继站、接入点、车载设备、可穿戴设备以及5G网络中的接入网设备或者未来演进的陆上公用移动通信网(public land mobile network，PLMN)网络中的接入网设备等，可以是WLAN中的接入点(access point，AP),可以是新型无线系统(new radio，NR)系统中的gNB，本申请实施例并不限定。
在一种网络结构中，接入网设备可以包括集中单元(centralized unit，CU)节点、或分布单元(distributed unit，DU)节点、或包括CU节点和DU节点的RAN设备、或者控制面CU节点(CU-CP节点)和用户面CU节点(CU-UP节点)以及DU节点的RAN设备。
接入网设备为小区提供服务，终端设备通过接入网设备分配的传输资源(例如，频域资源，或者说，频谱资源)与小区进行通信，该小区可以属于宏基站(例如，宏eNB或宏gNB等)，也可以属于小小区(small cell)对应的基站，这里的小小区可以包括：城市小区(metro cell)、微小区(micro cell)、微微小区(pico cell)、毫微微小区(femto cell)等，这些小小区具有覆盖范围小、发射功率低的特点，适用于提供高速率的数据传输服务。
本申请实施例的核心网网元可以是4G网络中的核心网网元，例如，移动管理实体(mobile managenment entity，MME)、服务网关(serving gateway，sGW)等，也可以是5G网络中的核心网网元，例如，接入和移动性管理功能(access and mobility management function，AMF)网元、用户平面功能(user plane function，UPF)网元等，还可以是具有其他名称的核心网网元，本申请实施例对此不作限定。
在本申请实施例中，终端设备或网络设备包括硬件层、运行在硬件层之上的操作系统层，以及运行在操作系统层上的应用层。该硬件层包括中央处理器(central processing unit，CPU)、内存管理单元(memory management unit，MMU)和内存(也称为主存)等硬件。该操作系统可以是任意一种或多种通过进程(process)实现业务处理的计算机操作系统，例如，Linux操作系统、Unix操作系统、Android操作系统、iOS操作系统或windows操作系统等。该应用层包含浏览器、通讯录、文字处理软件、即时通信软件等应用。并且，本申请实施例并未对本申请实施例提供的方法的执行主体的具体结构特别限定，只要能够通过运行记录有本申请实施例的提供的方法的代码的程序，以根据本申请实施例提供的方法进行通信即可，例如，本申请实施例提供的方法的执行主体可以是终端设备或网络设备，或者，是终端设备或网络设备中能够调用程序并执行程序的功能模块。
另外，本申请的各个方面或特征可以实现成方法、装置或使用标准编程和/或工程技术的制品。本申请中使用的术语“制品”涵盖可从任何计算机可读器件、载体或介质访问的计算机程序。例如，计算机可读介质可以包括，但不限于：磁存储器件(例如，硬盘、软盘或磁带等)，光盘(例如，压缩盘(compact disc，CD)、数字通用盘(digital versatile disc，DVD)等)，智能卡和闪存器件(例如，可擦写可编程只读存储器(erasable programmable read-only memory，EPROM)、卡、棒或钥匙驱动器等)。另外，本文描述的各种存储介质可代表用于存储信息的一个或多个设备和/或其它机器可读介质。术语“机器可读介质” 可包括但不限于，无线信道和能够存储、包含和/或承载指令和/或数据的各种其它介质。
为便于理解本申请实施例，首先结合图1对适用于本申请实施例的通信系统进行详细说明。
图1是适用于本申请实施例的通信系统的示意图。如图1所示，该通信系统100可以包括核心网设备110、第一接入网设备120、第二接入网设备130和终端设备140。其中，终端设备140在第一接入网设备的覆盖范围内，可以通过无线的方式与第一接入网设备120相连，第一接入网设备120和第二接入网设备130可以通过无线或有线方式与核心网设备110连接。
核心网设备110与第一接入网设备120(或第二接入网设备130)可以是独立的不同的物理设备，也可以是将核心网设备140的功能与接入网设备的逻辑功能集成在同一个物理设备上，还可以是一个物理设备上集成了部分核心网设备的功能和部分的接入网设备的功能，本申请实施例对此不作限定。
此外，在本申请实施例中，终端设备140可以是可移动的。若终端设备140移动到第一接入网设备120的覆盖范围，该终端设备140可以将上行数据包传输到第一接入网络设备120，由第一接入网设备120发送到核心网设备110。第一接入网络设备120也可以将来自于核心网设备110的下行数据包传输到终端设备140。若终端设备140移动到第二接入网设备130的覆盖范围，数据传输方式同理，不再赘述。
上述接入网设备(包括第一接入网设备120和第二接入网设备130)可以包括基带装置和射频装置，其中基带装置可以由一个节点实现，也可以由多个节点实现，射频装置可以从基带装置拉远独立实现，也可以集成基带装置中，或者部分拉远部分集成在基带装置中。例如，在LTE通信系统中，接入网设备包括基带装置和射频装置，其中射频装置可以相对于基带装置拉远布置，例如射频拉远单元(remote radio unit，RRU)相对于BBU拉远布置。
上述各个通信设备，如图1中的核心网设备110、第一接入网设备120、第二接入网设备130或终端设备140，可以配置多个天线。该多个天线可以包括至少一个用于发送信号的发射天线和至少一个用于接收信号的接收天线。另外，各通信设备还附加地包括发射机链和接收机链，本领域普通技术人员可以理解，它们均可包括与信号发送和接收相关的多个部件(例如处理器、调制器、复用器、解调器、解复用器或天线等)。因此，接入网设备与终端设备之间可通过多天线技术通信。
应理解，图1只是示意图，该通信系统100中还可以包括其它网络设备，例如，无线中继设备和无线回传设备，图1中未示出。本申请实施例对该通信系统100中包括的核心网设备、接入网设备和终端设备的数量不做限定。
随着通信技术的发展，终端设备的类型在不断增多，例如机器类型通信(machine type communications，MTC)和窄带物联网(narrow band-internet of things，NB-IOT)等。不同类型的终端设备，应用场景不同，数据传输方式也不同。以MTC类型的终端设备为例，这类终端设备传输的数据很少，也只在有限范围内移动。而一般情况下，每次有数据传输，终端设备和网络设备之间都需要执行完整的一套流程，具体包括：建立无线资源控制(radio resource control，RRC)连接、建立核心网(core network，CN)侧连接、安全认证、业务通道建立、空口的数据承载建立等。
由于终端设备的移动性，每次与该终端设备传输数据的基站可能不同，每次都需要源基站删除其与CN侧的数据通道，新基站建立其与CN侧的数据通道，数据传输流程繁琐。且由于MTC类型的终端设备数量巨大，这样会造成大量的信令开销，浪费大量的无线资源。
有鉴于此，本申请提供了一种数据传输的方法，能够简化数据传输流程，在节省信令和资源的开销的同时，提高数据传输的安全性，进而提高系统性能。
下面将结合附图详细说明本申请提供的各个实施例。在下文示出的实施例中第一、第二、第三以及各种数字编号仅为描述方便进行的区分，并不用来限制本申请实施例的范围。例如，区分不同的信息、区分不同的密钥参数等。
图2示出了本申请实施例的数据传输的方法200的示意性流程图。该方法200可以应用于图1所示的通信系统100，但本申请实施例不限于此。
S210，在第一接入网设备与终端设备数据传输结束之后，第一接入网设备获取第一密钥参数，此时，终端设备进入空闲(idle)态或非激活(inactive)态。
若终端设备处于空闲态，表示该终端设备与接入网设备没有连接，且与核心网设备没有连接。若终端设备处于非激活态，表示该终端设备与接入网设备没有连接，但与核心网设备有连接。
应理解，由于第一接入网设备与终端设备进行了数据传输，表示该第一接入网设备建立了第一接入网设备至核心网设备的数据传输通道，即终端设备可以通过该数据传输通道接收来自核心网设备的下行数据，或者向核心网设备发送上行数据。
还应理解，第一接入网设备获取第一密钥参数，可以是指第一接入网设备从核心网设备获取第一密钥参数，例如，该第一接入网设备可以从移动性管理实体(mobility management entity，MME)获取上述第一密钥参数，或者，该第一接入网设备可以从接入和移动性管理功能网元(access and mobility management function，AMF)获取上述第一密钥参数。
可选地，第一接入网设备可以向终端设备发送上述第一密钥参数、终端设备的标识以及第一接入网设备的标识。例如，第一接入网设备向终端设备发送RRC释放(RRC release)消息，该RRC release消息中携带上述第一密钥参数、终端设备的标识以及第一接入网设备的标识。终端设备可以在接收到上述RRC release消息之后，保存其中的参数、标识以及在第一接入网设备所在小区所使用的源密钥，然后进入idle态或inactive态。
S220，上述终端设备移动至第二接入网设备的覆盖范围内，该终端设备与核心网设备之间有数据需要传输，则该终端设备向该第二接入网设备发送第二消息，第二消息用于请求与第二接入网设备传输数据；则对应地，第二接入网设备接收该终端设备发送的第二消息。
应理解，上述第二消息可以携带第一接入网设备的标识。上述“有数据需要传输”中的“数据”可以指上行数据，也可以指下行数据，也可以既包括上行数据又包括下行数据，本申请实施例对此不作限定。
可选地，终端设备可以获取当前所接入的第二接入网设备的小区的标识、小区的频点，结合上述保存的第一密钥参数和上述源密钥，生成本次数据传输所使用的新密钥(即第一密钥)。
S230，第二接入网设备根据上述第二消息，向第一接入网设备发送第一消息，该第一消息用于表示终端设备已经移动至第二接入网设备的覆盖范围内、且该终端设备与该第二接入网设备之间需要传输数据；则对应地，第一接入网设备接收第二接入网设备发送的第一消息。
由于第二消息携带了第一接入网设备的标识，第二接入网设备可以根据该第二消息，确定终端设备的上一次数据传输是通过第一接入网设备完成的，即该第一接入网设备处保留由该终端设备的上下文信息，且该第一接入网设备与核心网设备之间存在数据传输通道。因此，该第二接入网设备向第一接入网设备发送上述第一消息，请求终端设备的密钥。在一种可能的实现方式中，该第一消息可以为上下文请求消息，用于请求终端设备的上下文。
可选地，上述第一消息可以携带终端设备的标识以及终端设备当前所接入的第二接入网设备的小区的标识。
S240，第一接入网设备根据该第一消息，结合第一密钥参数，生成第一密钥，并向第二接入网设备发送该第一密钥；则对应地，第二接入网设备接收该第一密钥。在一种可能的实现方式中，该第一密钥可以携带在第一接入网设备发送给第二接入网设备的上下文响应消息中。
可选地，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
由于第一消息携带了终端设备的标识，第一接入网设备在接收到第一消息之后，便可以根据该第一消息确定出上述终端设备。进一步地，该第一接入网设备可以根据第一密钥参数，结合终端设备当前所接入的第二接入网设备的小区的标识生成第一密钥。该第一接入网设备向第二接入网设备发送该第一密钥，以便该第二接入网设备采用该第一密钥与终端设备进行数据传输。
可选地，上述第一密钥可以是结合第一密钥参数、第一接入网设备之前保存的源密钥、终端设备所接入的所述第二接入网设备的小区的标识、终端设备所接入的第二接入网设备的小区的频点等中的全部或部分信息生成的，本申请实施例对此不作限定。
S250，第一接入网设备辅助终端设备和第二接入网设备传输数据，换句话说，由于第一接入网设备与核心网设备之间存在数据传输通道，该第二接入网设备可以通过第一接入网设备向核心网设备发送上行数据，或者接收来自核心网设备的下行数据。应理解，该上行数据是来自终端设备的，该下行数据是发送至该终端设备的。
作为一个可选的实施例，所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输，包括：所述第一接入网设备从所述第二接入网设备接收来自所述终端设备的、解密后的上行数据；所述第一接入网设备向核心网设备发送所述解密后的上行数据。
针对上行数据(来自终端设备，需要发送至核心网设备)，终端设备可以将加密了的上行数据发送给第二接入网设备，第二接入网设备接收来自终端设备的数据，采用上述第一密钥对来自终端设备的数据进行解密，并将解密后的上行数据发送给第一接入网设备，该第一接入网设备通过已建立的数据传输通道向核心网设备发送解密后的上行数据。
作为一个可选的实施例，所述第一接入网设备辅助所述第二接入网设备和所述终端设 备进行数据传输，包括：所述第一接入网设备从核心网设备接收下行数据；所述第一接入网设备向所述第二接入网设备发送所述下行数据。
针对下行数据(来自核心网设备，需要发送至终端设备)，由于核心网设备与第二接入网设备之间并未建立数据传输通道，该核心网设备可以将下行数据发送给第一接入网设备，该第一接入网设备再向第二接入网设备发送该下行数据。第二接入网设备将接收到的下行数据采用上述第一密钥进行加密，将加密后的下行数据发送给终端设备。
S260，第一接入网设备获取第二密钥参数。
第一接入网设备确定终端设备不进入连接(connected)态，则该第一接入网设备获取第二密钥参数。第一接入网设备可以根据多种方式确定终端设备不进入连接态，示例性地，该第一接入网设备可以根据业务类型、终端设备的类型等信息确定该终端设备不进入连接态，也可以根据终端设备的请求、或者第二接入网设备的指示、或者应用层的指示，确定该终端设备不进入连接态，本申请实施例对此不作限定。
应理解，第一接入网设备获取第二密钥参数，是指第一接入网设备从核心网设备获取第二密钥参数，例如，该第一接入网设备可以从MME或AMF获取第二密钥参数。
还应理解，第一接入网设备在确定了终端设备不进入连接态之后，即可获取第二密钥参数。示例性地，上述第一接入网设备可以在终端设备与第二接入网设备数据传输过程中获取上述第二密钥参数，或者，该第一接入网设备可以在终端设备与第二接入网设备数据传输结束之后，获取上述第二密钥参数，本申请实施例对此不作限定。
本申请实施例的数据传输的方法，通过第一接入网设备辅助终端设备和第二接入网设备进行数据传输，无需第二接入网设备重新建立与核心网设备之间的数据传输通道，而是直接采用已有的第一接入网设备与核心网设备之间的数据传输通道，能够简化数据传输流程，在节省信令和资源的开销，与此同时，由第一接入网设备重新获取密钥参数，分发给终端设备，用于下一次数据传输，能够提高数据传输的安全性，进而提高系统性能。
作为一个可选的实施例，在所述第一接入网设备获取第二密钥参数之后，所述方法还包括：所述第一接入网设备向所述第二接入网设备发送所述第二密钥参数。则对应地，第二接入网设备接收来自第一接入网设备的第二密钥参数，并向终端设备发送该第二密钥参数。
应理解，第一接入网设备获取第二密钥参数是为了终端设备的下一次数据传输，由于该终端设备当前处于第二接入网设备的覆盖范围，因此，该第一接入网设备需要将获取到的第二密钥参数发送给第二接入网设备，以便该第二接入网设备将该第二密钥参数发送给终端设备。
示例性地，第一接入网设备可以将上述第二密钥参数直接发送给第二接入网设备，也可以将上述第二密钥参数携带在已有消息(例如，RRC释放消息)中发送给第二接入网设备，本申请实施例对此不作限定。
作为一个可选的实施例，所述方法还包括：所述第一接入网设备更新所述终端设备的标识；所述第一接入网设备向所述第二接入网设备发送更新后的所述终端设备的标识。
考虑到数据传输的安全性，第一接入网设备可以更新终端设备的标识，即重新为该终端设备分配标识，用于该终端设备的下一次数据传输。若第一接入网设备更新了终端设备的标识，该第一接入网设备需要将更新后的标识发送给第二接入网设备，再由该第二接入 网设备将该更新后的标识发送给该终端设备。
示例性地，第一接入网设备可以将上述更新后的标识直接发送给第二接入网设备，也可以将上述更新后的标识携带在已有消息(例如，RRC释放消息)中发送给第二接入网设备，本申请实施例对此不作限定。
下面，以终端设备为UE，第一接入网设备为源eNB，第二接入网设备为新eNB，核心网设备包括MME和sGW为例，结合图3至图5对本申请实施例进行详细说明。
图3示出了本申请实施例的另一数据传输的方法300的示意性流程图。该方法300可以应用于图1所示的系统架构100，但本申请实施例不限于此。
S301，源eNB与UE数据传输结束之后，该源eNB从MME处获取第一Ncc，这里的Ncc即为密钥参数，用于生成数据传输所采用的密钥。
S302，源eNB向UE发送RRC释放消息，该RRC释放消息中携带第一标识(也可称为resume ID)和第一Ncc。示例性地，该第一标识可以分为两部分，其中一部分比特用于标识UE，另一部分比特用于标识源eNB。则对应地，UE接收该RRC释放消息。
S303，UE保存上一次数据传输用到的源密钥KeNB(与源eNB的小区之间的密钥)，以及上述RRC释放消息中的第一标识和第一Ncc，进入空闲(idle)态或非激活(inactive)态。
S304，UE移动到新eNB覆盖的小区内，存在上行数据传输，该UE可以获取新eNB的小区的标识(cell ID)、小区的频点等信息，结合上述第一Ncc和源密钥KeNB，生成新的密钥KeNB*，该KeNB*用于UE在当前接入的新eNB的小区内使用。进一步地，UE可以根据新的密钥KeNB*，生成用于加密的密钥K_sec和用于完整性保护的密钥K_inte。
S305，UE向新eNB发送RRC恢复请求消息和上行数据，其中，RRC恢复请求消息中携带上述第一标识。进一步地，该RRC恢复请求消息中还可以携带发送该请求的原因，例如有上行数据需要传输。应理解，UE在发送该RRC恢复请求消息和上行数据之前，可以采用上述用于完整性保护的密钥K_inte对该RRC恢复请求消息进行完整性保护，再采用上述用于加密的密钥K_sec对上行数据进行加密。则对应地，新eNB接收RRC恢复请求消息和上行数据。
S306，新eNB根据RRC恢复请求消息中携带的第一标识，确定UE的上下文存储在源eNB中，便向源eNB发送UE上下文请求消息，该UE上下文请求消息中可以携带上述第一标识、UE在新eNB所接入的小区的标识(cell ID)。则对应地，源eNB接收新eNB发送的UE上下文请求消息。应理解，该UE上下文请求消息可以相当于上述方法200中的第一消息。
S307，源eNB根据该UE上下文请求消息中携带的第一标识，确定出UE，再根据存储的源密钥KeNB、以及UE在新eNB所接入的小区的标识、小区频点等信息，生成UE在新小区使用的第一密钥，即新密钥KeNB*。
S308，源eNB向新eNB发送UE上下文响应消息，该UE上下文响应消息中携带UE的上下文信息以及上述新密钥KeNB*。则对应地，新eNB接收源eNB发送的UE上下文响应。
S309，新eNB根据新密钥KeNB*，生成用于加密的密钥K_sec和用于完整性保护的密钥K_inte。新eNB采用密钥K_inte对上述RRC恢复请求消息进行完整性验证，采用密 钥K_sec对上行数据进行解密。
S310，新eNB向源eNB发送解密后的上行数据。则对应地，源eNB接收新eNB发送的解密后的上行数据。
S311，源eNB通过已有的与核心网侧的数据传输通道，向sGW发送解密后的上行数据。则对应地，sGW接收解密后的上行数据。
S312，源eNB确定UE不进入连接(connected)态，该源eNB从MME处获取第二Ncc。
S313，源eNB向新eNB发送RRC释放消息，该RRC释放消息中携带第二Ncc。则对应地，新eNB接收源eNB发送的RRC释放消息。进一步地，该RRC释放消息中还可以携带上述第一标识以及释放连接的原因(例如无数据传输)。
S314，新eNB向UE转发上述RRC释放消息。则对应地，UE接收新eNB发送的RRC释放消息。
应理解，在上述S312中，源eNB还可以重新为UE分配标识信息，即更新上述第一标识，更新的第一标识可以携带在RRC释放消息中发送给新eNB，再由新eNB转发给UE，但本申请实施例对此不作限定。
还应理解，上述源eNB可以直接将第二Ncc发送给新eNB，新eNB接收到第二Ncc后，生成RRC释放消息，将第二Ncc、更新后的第一标识以及释放连接的原因等携带在RRC释放消息中发送给UE。换句话说，UE接收到的RRC释放消息可以是源eNB生成的，也可以是新eNB生成的，本申请实施例对此不作限定。
本申请实施例的数据传输的方法，UE仅通过新eNB传输了上行数据，在上行数据传输完成后，源eNB为UE更新了密钥参数，以便下一次数据传输使用，这样，由源eNB通过源eNB与sGW之间的数据传输通道，辅助新eNB与UE传输数据，无需切换路径，流程简单，且安全性更高。
可选地，本申请实施例中的网元可以替换为5G中的网元，例如，上述源eNB可以为gNB，新eNB可以为新gNB，MME可以为AMF，sGW可以为UPF，但本申请实施例对此不作限定。
图4示出了本申请实施例的另一数据传输的方法400的示意性流程图。该方法400可以应用于图1所示的系统架构100，但本申请实施例不限于此。
S401～S411同S301～S311，此处不再赘述。
S412，sGW向源eNB发送下行数据，则对应地，源eNB接收该下行数据。
S413，源eNB确定UE不进入连接(connected)态，该源eNB从MME处获取第二Ncc。
S414，源eNB向新eNB发送RRC释放消息和上述下行数据，该RRC释放消息中携带第二Ncc。则对应地，新eNB接收源eNB发送的RRC释放消息。进一步地，该RRC释放消息中还可以携带上述第一标识以及释放连接的原因(例如无数据传输)。
S415，新eNB采用用于加密的密钥K_sec，对下行数据进行加密，采用用于完整性保护的密钥K_inte对RRC释放消息进行完整性保护。
S416，新eNB向UE发送RRC释放消息和加密后的下行数据，则对应地，UE接收该RRC释放消息和加密后的下行数据。该RRC释放消息中携带第二Ncc。进一步地，该 RRC释放消息中还可以携带上述第一标识以及释放连接的原因(例如无数据传输)。
S417，UE保存第二Ncc，采用密钥K_inte对RRC释放消息进行完整性验证，采用密钥K_sec对加密后下行数据进行解密，从而获取来自SGW的下行数据。进一步地，若RRC释放消息中携带第一标识，UE保存该第一标识。
应理解，在上述S413中，源eNB还可以重新为UE分配标识信息，即更新上述第一标识，更新的第一标识可以携带在RRC释放消息中发送给新eNB，再由新eNB转发给UE，但本申请实施例对此不作限定。
还应理解，上述源eNB可以直接将第二Ncc发送给新eNB，新eNB接收到第二Ncc后，生成RRC释放消息，将第二Ncc、更新后的第一标识以及释放连接的原因等携带在RRC释放消息中发送给UE。换句话说，UE接收到的RRC释放消息可以是源eNB生成的，也可以是新eNB生成的，本申请实施例对此不作限定。
本申请实施例的数据传输的方法，UE通过新eNB既传输了上行数据，又传输了下行数据，在数据传输完成后，源eNB为UE更新了密钥参数，以便下一次数据传输使用，这样，由源eNB通过源eNB与sGW之间的数据传输通道，辅助新eNB与UE传输数据，无需切换路径，流程简单，且安全性更高。
可选地，本申请实施例中的网元可以替换为5G中的网元，例如，上述源eNB可以为gNB，新eNB可以为新gNB，MME可以为AMF，sGW可以为UPF，但本申请实施例对此不作限定。
图5示出了本申请实施例的另一数据传输的方法500的示意性流程图。该方法500可以应用于图1所示的系统架构100，但本申请实施例不限于此。
S501，源eNB与UE数据传输结束之后，该源eNB从MME处获取第一Ncc，这里的Ncc即为密钥参数，用于生成数据传输所采用的密钥。
S502，源eNB向UE发送RRC释放消息，该RRC释放消息中携带第一标识(也可称为resume ID)和第一Ncc。示例性地，该第一标识可以分为两部分，其中一部分比特用于标识UE，另一部分比特用于标识源eNB。则对应地，UE接收该RRC释放消息。
S503，UE保存上一次数据传输用到的源密钥KeNB(与源eNB的小区之间的密钥)，以及上述RRC释放消息中的第一标识和第一Ncc，进入空闲(idle)态或非激活(inactive)态。
S504，UE移动到新eNB覆盖的小区内，若存在下行数据传输，sGW会触发寻呼流程，即sGW通知MME，发起寻呼，MME生成寻呼消息，并向寻呼区域内的所有eNB发送寻呼消息，包括向源eNB发送寻呼消息，该寻呼消息携带该UE的标识。则对应地，源eNB接收寻呼消息。
S505，该源eNB将寻呼消息发送给新eNB，并指示在哪些小区内发送该寻呼消息。则对应地，新eNB接收源eNB发送的寻呼消息。
S506，新eNB在指示的小区发起寻呼，这样，由于UE在新eNB的小区内，UE可以接收到新eNB发送的寻呼消息，从而获知有下行数据要传输。
S507，UE获取新eNB的小区的标识(cell ID)、小区的频点等信息，结合上述第一Ncc和源密钥KeNB，生成新的密钥KeNB*，该KeNB*用于UE在当前接入的新eNB的小区内使用。进一步地，UE可以根据新的密钥KeNB*，生成用于加密的密钥K_sec和用 于完整性保护的密钥K_inte。
S508，UE向新eNB发送RRC恢复请求消息，其中，RRC恢复请求消息中携带上述第一标识。进一步地，该RRC恢复请求消息中还可以携带发送该请求的原因，例如有下行数据需要传输。应理解，UE在发送该RRC恢复请求消息之前，可以采用上述用于完整性保护的密钥K_inte对该RRC恢复请求消息进行完整性保护。则对应地，新eNB接收RRC恢复请求消息。
S509，新eNB根据RRC恢复请求消息中携带的第一标识，确定UE的上下文存储在源eNB中，便向源eNB发送UE上下文请求消息，该UE上下文请求消息中可以携带上述第一标识、UE在新eNB所接入的小区的标识(cell ID)。则对应地，源eNB接收新eNB发送的UE上下文请求消息。
S510，源eNB根据该UE上下文请求消息中携带的第一标识，确定出UE，再根据存储的源密钥KeNB、以及UE在新eNB所接入的小区的标识、小区频点等信息，生成UE在新小区使用的第一密钥，即新密钥KeNB*。
S511，源eNB向新eNB发送UE上下文响应消息，该UE上下文响应消息中携带UE的上下文信息以及上述新密钥KeNB*。则对应地，新eNB接收源eNB发送的UE上下文响应。
S512，sGW向源eNB发送下行数据，则对应地，源eNB接收该下行数据。
S513，源eNB确定UE不进入连接(connected)态，该源eNB从MME处获取第二Ncc。
S514，源eNB向新eNB发送RRC释放消息和上述下行数据，该RRC释放消息中携带第二Ncc。则对应地，新eNB接收源eNB发送的RRC释放消息。进一步地，该RRC释放消息中还可以携带上述第一标识以及释放连接的原因(例如无数据传输)。
S515，新eNB根据新密钥KeNB*，生成用于加密的密钥K_sec和用于完整性保护的密钥K_inte。新eNB采用用于加密的密钥K_sec，对下行数据进行加密，采用用于完整性保护的密钥K_inte对RRC释放消息进行完整性保护。
S516，新eNB向UE发送RRC释放消息和加密后的下行数据，则对应地，UE接收该RRC释放消息和加密后的下行数据。该RRC释放消息中携带第二Ncc。进一步地，该RRC释放消息中还可以携带上述第一标识以及释放连接的原因(例如无数据传输)。
S517，UE保存第二Ncc，采用密钥K_inte对RRC释放消息进行完整性验证，采用密钥K_sec对加密后下行数据进行解密，从而获取来自SGW的下行数据。进一步地，若RRC释放消息中携带第一标识，UE保存该第一标识。
应理解，在上述S513中，源eNB还可以重新为UE分配标识信息，即更新上述第一标识，更新的第一标识可以携带在RRC释放消息中发送给新eNB，再由新eNB转发给UE，但本申请实施例对此不作限定。
还应理解，上述源eNB可以直接将第二Ncc发送给新eNB，新eNB接收到第二Ncc后，生成RRC释放消息，将第二Ncc、更新后的第一标识以及释放连接的原因等携带在RRC释放消息中发送给UE。换句话说，UE接收到的RRC释放消息可以是源eNB生成的，也可以是新eNB生成的，本申请实施例对此不作限定。
本申请实施例的数据传输的方法，UE仅通过新eNB传输了下行数据，在下行数据传 输完成后，源eNB为UE更新了密钥参数，以便下一次数据传输使用，这样，由源eNB通过源eNB与sGW之间的数据传输通道，辅助新eNB与UE传输数据，无需切换路径，流程简单，且安全性更高。
可选地，本申请实施例中的网元可以替换为5G中的网元，例如，上述源eNB可以为gNB，新eNB可以为新gNB，MME可以为AMF，sGW可以为UPF，但本申请实施例对此不作限定。
应理解，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。
上文中结合图1至图5，详细描述了根据本申请实施例的数据传输的方法，下面将结合图6至图8，详细描述根据本申请实施例的数据传输的装置和接入网设备。
图6是本申请实施例提供的数据传输的装置的示意性框图。该数据传输的装置600可实现对应于上文方法实施例中的第一接入网设备执行的各个步骤或者流程，例如，该装置600可以为第一接入网设备，或者为配置于第一接入网设备中的芯片或电路。如图所示，该装置600可以包括：获取单元610、接收单元620和发送单元630。
该获取单元610用于：获取第一密钥参数；
该接收单元620用于：接收来自第二接入网设备的第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；
该发送单元630用于：根据所述第一消息，向所述第二接入网设备发送第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
该接收单元620和/或该发送单元630还用于：辅助所述第二接入网设备和所述终端设备进行数据传输；
该获取单元610还用于：获取第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
可选地，所述接收单元620具体用于：从所述第二接入网设备接收来自所述终端设备的、解密后的上行数据；所述发送单元630具体用于：向核心网设备发送所述解密后的上行数据。
可选地，所述接收单元620具体用于：从核心网设备接收下行数据；所述发送单元630具体用于：向所述第二接入网设备发送所述下行数据。
可选地，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
可选地，所述发送单元630还用于：在获取第二密钥参数之后，向所述第二接入网设备发送所述第二密钥参数。
可选地，所述装置还包括：处理单元，用于在获取第二密钥参数之后，更新所述终端设备的标识；所述发送单元630还用于：向所述第二接入网设备发送更新后的所述终端设备的标识。
应理解，这里的装置600以功能单元的形式体现。这里的术语“单元”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多 个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置600可以具体为上述实施例中的第一接入网设备，装置600可以用于执行上述方法实施例中与第一接入网设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
图7是本申请实施例提供的另一数据传输的装置的示意性框图。该数据传输的装置700可实现对应于上文方法实施例中的第二接入网设备执行的各个步骤或者流程，例如，该装置700可以为第二接入网设备，或者为配置于第二接入网设备中的芯片或电路。如图所示，该装置700可以包括：发送单元710和接收单元720。
该发送单元710用于：向第一接入网设备发送第一消息，所述第一消息用于表示终端设备已经移动至所述装置的覆盖范围内、且所述终端设备与所述装置之间需要传输数据；
该接收单元720用于：接收来自所述第一接入网设备的第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
该发送单元710和/或该接收单元720还用于：采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输；
该接收单元720还用于：接收来自所述第一接入网设备的第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
可选地，所述接收单元720具体用于：接收来自所述终端设备的、加密后的上行数据；所述装置还包括：处理单元，用于采用所述第一密钥，对所述加密后的上行数据进行解密，获得解密后的上行数据；所述发送单元710具体用于：向所述第一接入网设备发送所述解密后的上行数据。
可选地，所述接收单元720具体用于：接收来自所述第一接入网设备的下行数据；所述装置还包括：处理单元，用于采用所述第一密钥，对所述下行数据进行加密，获得加密后的下行数据；所述发送单元710具体用于：向所述终端设备发送所述加密后的下行数据。
可选地，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述装置的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述装置的小区的标识生成的。
可选地，所述发送单元710还用于：在接收来自所述第一接入网设备的第二密钥参数之后，向所述终端设备发送所述第二密钥参数。
可选地，所述接收单元720还用于：接收来自所述第一接入网设备的更新后的所述终端设备的标识；所述发送单元710还用于：向所述终端设备发送所述更新后的所述终端设备的标识。
应理解，这里的装置700以功能单元的形式体现。这里的术语“单元”可以指应用特有集成电路(application specific integrated circuit，ASIC)、电子电路、用于执行一个或多个软件或固件程序的处理器(例如共享处理器、专有处理器或组处理器等)和存储器、合并逻辑电路和/或其它支持所描述的功能的合适组件。在一个可选例子中，本领域技术人员可以理解，装置700可以具体为上述实施例中的第二接入网设备，装置600可以用于执行上述方法实施例中与第二接入网设备对应的各个流程和/或步骤，为避免重复，在此不再赘述。
上述装置600具有实现上述方法中第一接入网设备执行的相应步骤的功能；上述装置700具有实现上述方法中第二接入网设备执行的相应步骤的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，上述发送单元可以由发射器替代，上述接收单元可以由接收器替代，分别执行各个方法实施例中的接收和发送操作以及相关的处理操作。发送单元和接收单元可以统称为收发单元，相应地，接收器和发射器可以统称为收发器。应理解，上文实施例中的处理单元可以由处理器或处理器相关电路实现，接收单元和发送单元可以由收发器或收发器相关电路或接口电路实现。
可选地，在上面各个可能设计的装置中，还可以包括存储单元，该存储单元用于存储计算机程序，处理单元可以从存储单元中调用并运行该计算机程序，使得装置600执行上述方法实施例中第一接入网设备的方法，或者，使得装置700执行上述方法实施例中第二接入网设备的方法。
上述实施例中的单元也可以称为模块或者电路或者部件等。
图8是本申请实施例提供的接入网设备3000的结构示意图，例如可以为基站的结构示意图。该接入网设备3000可应用于如图1所示的通信系统中，实现上述方法实施例中第一接入网设备执行的步骤或流程，或者实现上述方法实施例中第二接入网设备执行的步骤或者流程。
如图所示，该接入网设备3000可以包括一个或多个射频单元，如远端射频单元(remote radio unit，RRU)3100以及一个或多个基带单元(baseband unit，BBU)3200，其中，BBU 3200也可称为数字单元(digital unit，DU)，RRU 3100可以称为收发单元，与图6和图7中的接收单元、发送单元对应。可选地，该RRU 3100还可以称为收发机、收发电路、或者收发器等等，其可以包括至少一个天线3101和射频单元3102。可选地，该RRU 3100可以包括接收单元和发送单元，接收单元可以对应于接收器(或称接收机、接收电路)，发送单元可以对应于发射器(或称发射机、发射电路)。所述RRU 3100部分主要用于射频信号的收发以及射频信号与基带信号的转换，例如用于向终端设备发送指示信息。所述BBU 3200部分主要用于进行基带处理，对接入网设备进行控制等。所述RRU 3100与BBU 3200可以是物理上设置在一起，也可以物理上分离设置的，例如分布式基站。
所述BBU 3200为接入网设备的控制中心，也可以称为处理单元，可以与上述装置中的处理单元对应，主要用于完成基带处理功能，如信道编码，复用，调制，扩频等等。例如所述BBU 3200可以用于控制接入网设备执行上述方法实施例中关于接入网设备的操作流程，例如，生成上述切换条件，或者发送切换条件等。
在一个示例中，所述BBU 3200可以由一个或多个单板构成，多个单板可以共同支持单一接入制式的无线接入网(如LTE网)，也可以分别支持不同接入制式的无线接入网(如LTE网，5G网或其他网)。所述BBU 3200还包括存储器3201和处理器3202。所述存储器3201用以存储必要的指令和数据。所述处理器3202用于控制接入网设备进行必要的动作，例如用于控制接入网设备执行上述方法实施例中关于接入网设备的操作流程。所述存储器3201和处理器3202可以服务于一个或多个单板。也就是说，可以每个单板上单独设置存储器和处理器。也可以是多个单板共用相同的存储器和处理器。此外每个单板上还可以设置有必要的电路。
应理解，图8所示的接入网设备3000能够实现图2至图5方法实施例中涉及接入网设备的各个过程。接入网设备3000中的各个模块的操作和/或功能，分别为了实现上述方法实施例中的相应流程。具体可参见上述方法实施例中的描述，为避免重复，此处适当省略详述描述。
上述BBU 3200可以用于执行前面方法实施例中描述的由接入网设备内部实现的动作，而RRU 3100可以用于执行前面方法实施例中描述的接入网设备向终端设备发送或从终端设备接收的动作。具体请见前面方法实施例中的描述，此处不再赘述。
本申请实施例还提供了一种处理装置，包括处理器和接口。所述处理器可用于执行上述方法实施例中的方法。
应理解，上述处理装置可以是一个芯片。例如，该处理装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、 同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
根据本申请实施例提供的方法，本申请还提供一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行上述任意一个实施例中任意一个网元所对应的方法。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行图2至图5所示实施例中任意一个实施例中任意一个网元所对应的方法。
根据本申请实施例提供的方法，本申请还提供一种系统，其包括前述的一个或多个终端设备以及一个或多个接入网设备。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中网络设备与终端设备和方法实施例中的网络设备或终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可以例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的部件的数据)的信号通过本地和/或远程进程来通信。
在本申请中，“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和 /或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A、B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b或c中的至少一项(个)，可以表示：a，b，c，a-b，a-c，b-c或a-b-c，其中a，b，c可以是单个，也可以是多个。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各种说明性逻辑块(illustrative logical block)和步骤(step)，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (27)

  1. 一种数据传输的方法，其特征在于，包括：
    第一接入网设备获取第一密钥参数；
    所述第一接入网设备接收来自第二接入网设备的第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；
    所述第一接入网设备根据所述第一消息，向所述第二接入网设备发送第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
    所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输；
    所述第一接入网设备获取第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
  2. 根据权利要求1所述的方法，其特征在于，所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输，包括：
    所述第一接入网设备从所述第二接入网设备接收来自所述终端设备的、解密后的上行数据；
    所述第一接入网设备向核心网设备发送所述解密后的上行数据。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一接入网设备辅助所述第二接入网设备和所述终端设备进行数据传输，包括：
    所述第一接入网设备从核心网设备接收下行数据；
    所述第一接入网设备向所述第二接入网设备发送所述下行数据。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，在所述第一接入网设备获取第二密钥参数之后，所述方法还包括：
    所述第一接入网设备向所述第二接入网设备发送所述第二密钥参数。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，在所述第一接入网设备获取第二密钥参数之后，所述方法还包括：
    所述第一接入网设备更新所述终端设备的标识；
    所述第一接入网设备向所述第二接入网设备发送更新后的所述终端设备的标识。
  7. 一种数据传输的方法，其特征在于，包括：
    第二接入网设备向第一接入网设备发送第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；
    所述第二接入网设备接收来自所述第一接入网设备的第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
    所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输；
    所述第二接入网设备接收来自所述第一接入网设备的第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
  8. 根据权利要求7所述的方法，其特征在于，所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输，包括：
    所述第二接入网设备接收来自所述终端设备的、加密后的上行数据；
    所述第二接入网设备采用所述第一密钥，对所述加密后的上行数据进行解密，获得解密后的上行数据；
    所述第二接入网设备向所述第一接入网设备发送所述解密后的上行数据。
  9. 根据权利要求7或8所述的方法，其特征在于，所述第二接入网设备采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输，包括：
    所述第二接入网设备接收来自所述第一接入网设备的下行数据；
    所述第二接入网设备采用所述第一密钥，对所述下行数据进行加密，获得加密后的下行数据；
    所述第二接入网设备向所述终端设备发送所述加密后的下行数据。
  10. 根据权利要求7至9中任一项所述的方法，其特征在于，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
  11. 根据权利要求7至10中任一项所述的方法，其特征在于，在所述第二接入网设备接收来自所述第一接入网设备的第二密钥参数之后，所述方法还包括：
    所述第二接入网设备向所述终端设备发送所述第二密钥参数。
  12. 根据权利要求7至11中任一项所述的方法，其特征在于，所述方法还包括：
    所述第二接入网设备接收来自所述第一接入网设备的更新后的所述终端设备的标识；
    所述第二接入网设备向所述终端设备发送所述更新后的所述终端设备的标识。
  13. 一种数据传输的装置，其特征在于，包括：
    获取单元，用于获取第一密钥参数；
    接收单元，用于接收来自第二接入网设备的第一消息，所述第一消息用于表示终端设备已经移动至所述第二接入网设备的覆盖范围内、且所述终端设备与所述第二接入网设备之间需要传输数据；
    发送单元，用于根据所述第一消息，向所述第二接入网设备发送第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
    所述接收单元和/或所述发送单元还用于：
    辅助所述第二接入网设备和所述终端设备进行数据传输；
    所述获取单元还用于：
    获取第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
  14. 根据权利要求13所述的装置，其特征在于，所述接收单元具体用于：
    从所述第二接入网设备接收来自所述终端设备的、解密后的上行数据；
    所述发送单元具体用于：
    向核心网设备发送所述解密后的上行数据。
  15. 根据权利要求13或14所述的装置，其特征在于，所述接收单元具体用于：
    从核心网设备接收下行数据；
    所述发送单元具体用于：
    向所述第二接入网设备发送所述下行数据。
  16. 根据权利要求13至15中任一项所述的装置，其特征在于，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述第二接入网设备的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述第二接入网设备的小区的标识生成的。
  17. 根据权利要求13至16中任一项所述的装置，其特征在于，所述发送单元还用于：
    在获取第二密钥参数之后，向所述第二接入网设备发送所述第二密钥参数。
  18. 根据权利要求13至17中任一项所述的装置，其特征在于，所述装置还包括：
    处理单元，用于在获取第二密钥参数之后，更新所述终端设备的标识；
    所述发送单元还用于：
    向所述第二接入网设备发送更新后的所述终端设备的标识。
  19. 一种数据传输的装置，其特征在于，包括：
    发送单元，用于向第一接入网设备发送第一消息，所述第一消息用于表示终端设备已经移动至所述装置的覆盖范围内、且所述终端设备与所述装置之间需要传输数据；
    接收单元，用于接收来自所述第一接入网设备的第一密钥，所述第一密钥是基于所述第一密钥参数生成的；
    所述发送单元和/或所述接收单元还用于：
    采用所述第一密钥，在所述第一接入网设备的辅助下，与所述终端设备进行数据传输；
    所述接收单元还用于：
    接收来自所述第一接入网设备的第二密钥参数，所述第二密钥参数用于所述终端设备的下一次数据传输。
  20. 根据权利要求19所述的装置，其特征在于，所述接收单元具体用于：
    接收来自所述终端设备的、加密后的上行数据；
    所述装置还包括：
    处理单元，用于采用所述第一密钥，对所述加密后的上行数据进行解密，获得解密后的上行数据；
    所述发送单元具体用于：
    向所述第一接入网设备发送所述解密后的上行数据。
  21. 根据权利要求19或20所述的装置，其特征在于，所述接收单元具体用于：
    接收来自所述第一接入网设备的下行数据；
    所述装置还包括：
    处理单元，用于采用所述第一密钥，对所述下行数据进行加密，获得加密后的下行数据；
    所述发送单元具体用于：
    向所述终端设备发送所述加密后的下行数据。
  22. 根据权利要求19至21中任一项所述的装置，其特征在于，所述第一消息携带所述终端设备的标识和所述终端设备所接入的所述装置的小区的标识，所述第一密钥是根据所述第一密钥参数和所述终端设备所接入的所述装置的小区的标识生成的。
  23. 根据权利要求19至22中任一项所述的装置，其特征在于，所述发送单元还用于：
    在接收来自所述第一接入网设备的第二密钥参数之后，向所述终端设备发送所述第二密钥参数。
  24. 根据权利要求19至23中任一项所述的装置，其特征在于，所述接收单元还用于：
    接收来自所述第一接入网设备的更新后的所述终端设备的标识；
    所述发送单元还用于：
    向所述终端设备发送所述更新后的所述终端设备的标识。
  25. 一种通信系统，其特征在于，包括权利要求13至18中任一项所述的装置和权利要求19至24中任一项所述的装置。
  26. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至12中任一项所述的方法。
  27. 一种芯片系统，其特征在于，包括：处理器，用于从存储器中调用并运行计算机程序，使得安装有所述芯片系统的通信设备执行如权利要求1至12中任一项所述的方法。
PCT/CN2020/105744 2019-08-05 2020-07-30 数据传输的方法和装置 WO2021023088A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910719009.0A CN112423272A (zh) 2019-08-05 2019-08-05 数据传输的方法和装置
CN201910719009.0 2019-08-05

Publications (1)

Publication Number Publication Date
WO2021023088A1 true WO2021023088A1 (zh) 2021-02-11

Family

ID=74503295

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/105744 WO2021023088A1 (zh) 2019-08-05 2020-07-30 数据传输的方法和装置

Country Status (2)

Country Link
CN (1) CN112423272A (zh)
WO (1) WO2021023088A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338176A (zh) * 2021-12-29 2022-04-12 支付宝(杭州)信息技术有限公司 数据传输的方法、装置以及网卡

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117812584A (zh) * 2022-09-30 2024-04-02 华为技术有限公司 一种通信的方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015072782A1 (en) * 2013-11-14 2015-05-21 Samsung Electronics Co., Ltd. Apparatus and method for performing a handover in communication system supporting device to device scheme
WO2016046698A1 (en) * 2014-09-25 2016-03-31 Telefonaktiebolaget L M Ericsson (Publ) Intelligence in handover assessment for lte/volte calls to improve retainability
CN108282781A (zh) * 2017-01-06 2018-07-13 中兴通讯股份有限公司 移动过程中的数据传输的方法、终端和基站
CN108966220A (zh) * 2017-07-28 2018-12-07 华为技术有限公司 安全实现方法、相关装置以及系统

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103581899B (zh) * 2012-07-30 2016-08-10 中国移动通信集团公司 一种数据传输方法、装置、系统和相关设备
US10455414B2 (en) * 2014-10-29 2019-10-22 Qualcomm Incorporated User-plane security for next generation cellular networks
CN108632815B (zh) * 2017-03-24 2020-02-21 华为技术有限公司 通信方法与设备
CN110662267B (zh) * 2017-08-11 2020-12-08 华为技术有限公司 一种传输方法和网络设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015072782A1 (en) * 2013-11-14 2015-05-21 Samsung Electronics Co., Ltd. Apparatus and method for performing a handover in communication system supporting device to device scheme
WO2016046698A1 (en) * 2014-09-25 2016-03-31 Telefonaktiebolaget L M Ericsson (Publ) Intelligence in handover assessment for lte/volte calls to improve retainability
CN108282781A (zh) * 2017-01-06 2018-07-13 中兴通讯股份有限公司 移动过程中的数据传输的方法、终端和基站
CN108966220A (zh) * 2017-07-28 2018-12-07 华为技术有限公司 安全实现方法、相关装置以及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338176A (zh) * 2021-12-29 2022-04-12 支付宝(杭州)信息技术有限公司 数据传输的方法、装置以及网卡

Also Published As

Publication number Publication date
CN112423272A (zh) 2021-02-26

Similar Documents

Publication Publication Date Title
WO2020200034A1 (zh) 一种网络接入的方法和装置
US20230009565A1 (en) Communication method and apparatus applied to multi-link device in wireless local area network
WO2020253551A1 (zh) 通信方法和通信装置
CN109819492B (zh) 一种确定安全能力的方法和装置
WO2021036704A1 (zh) 终端设备和用户面网元之间的安全通信方法、装置及系统
EP4117354A1 (en) Method and apparatus for processing time synchronization message
EP4124107A1 (en) Communication method, access network device, terminal device and core network device
WO2021023088A1 (zh) 数据传输的方法和装置
WO2020211778A1 (zh) 小区切换方法以及装置
WO2020082395A1 (zh) 信号传输方法、发射端设备和接收端设备
WO2021017611A1 (zh) 数据传输方法和装置
WO2021056563A1 (zh) 通信方法和通信装置
US20230021397A1 (en) Time Synchronization Packet Processing Method and Apparatus
CN113727342A (zh) 网络注册的方法和装置
WO2022252867A1 (zh) 通信方法及通信装置
WO2021238813A1 (zh) 一种获取密钥的方法及装置
WO2022126641A1 (zh) 无线通信方法、终端设备、第一接入网设备以及网元
WO2022021165A1 (zh) 中继发现方法和终端
CN116491135A (zh) 授权配置方法、终端设备和网络设备
WO2023050181A1 (zh) 无线通信方法及无线通信装置
WO2023206548A1 (zh) 通信方法、网络设备和终端设备
US10979997B2 (en) Information transmission method, terminal device, and network device
WO2022183317A1 (zh) 一种获取切片信息的方法和终端设备
WO2022252969A1 (zh) 一种通信方法及装置
WO2022011684A1 (zh) 路径损失参考信号的配置方法、终端设备和网络设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20851112

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20851112

Country of ref document: EP

Kind code of ref document: A1