WO2021026875A1 - 一种数据传输的方法及装置 - Google Patents

一种数据传输的方法及装置 Download PDF

Info

Publication number
WO2021026875A1
WO2021026875A1 PCT/CN2019/100765 CN2019100765W WO2021026875A1 WO 2021026875 A1 WO2021026875 A1 WO 2021026875A1 CN 2019100765 W CN2019100765 W CN 2019100765W WO 2021026875 A1 WO2021026875 A1 WO 2021026875A1
Authority
WO
WIPO (PCT)
Prior art keywords
user equipment
security context
network element
management network
mobility management
Prior art date
Application number
PCT/CN2019/100765
Other languages
English (en)
French (fr)
Inventor
胡力
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2019/100765 priority Critical patent/WO2021026875A1/zh
Publication of WO2021026875A1 publication Critical patent/WO2021026875A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W72/00—Local resource management
    • H04W72/04—Wireless resource allocation

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for data transmission.
  • the characteristics of data transmission are that the amount of data is small and the data arrival time is not determine.
  • RRC radio resource control
  • the system overhead is too large, the resource utilization efficiency is low, the power consumption of the terminal is too large, and the data transmission delay cannot be met Claim.
  • the network device if downlink data from a terminal arrives on the network side, the network device wakes up the user equipment through a paging message to enable it to access the network.
  • the network device may send downlink data to the user equipment during the random access process of the terminal after receiving an uplink signal (such as a random access preamble) sent by the terminal to realize early transmission of downlink data.
  • the applicant's research found that the existing message 2 (MSG2) data early transmission process did not consider the related security process, for example, did not consider how to synchronize and activate the security context between the user equipment and the network equipment to protect the downlink data.
  • MSG2 message 2
  • the present application provides a data transmission method and device, which are used to activate the security context on the communication device during the early transmission of downlink data, so as to avoid related security issues in the early transmission of data.
  • the present application provides a data transmission method.
  • the method includes: a user equipment receives a paging message for early downlink data transmission from an access network device, wherein the paging message includes specific resource information;
  • the user equipment uses the current security context of the user equipment to activate the non-access stratum NAS security protection according to the paging message;
  • the user equipment sends a random access request to the access network equipment, the random access request Including the specific resource information;
  • the user equipment receives a first downlink NAS message sent by the mobility management network element through the access network device, and the first downlink NAS message includes the information used by the mobility management network element
  • the downlink data after the security protection of the current security context of the mobility management network element; in the case that the current security context of the user equipment is used to unsecure the security protection of the first downlink NAS message, the access network device sends
  • the mobility management network element sends feedback information, and the feedback information is encapsulated in a first uplink NAS message that uses the current security context
  • the user equipment after the user equipment receives the paging message for early transmission of downlink data, it activates NAS security protection, and uses the current security context to desecure the downlink NAS message received after the random access request to Get the downlink data. And after the downlink data is successfully obtained, the security-protected feedback information is sent to the mobility management network element, so that the mobility management network element can accurately learn that the downlink data has been correctly transmitted to the user equipment.
  • the security-protected feedback information is sent to the mobility management network element, so that the mobility management network element can accurately learn that the downlink data has been correctly transmitted to the user equipment.
  • the paging message further includes indication information for indicating early transmission of downlink data.
  • the indication information of early downlink data transmission is used to instruct the user equipment to receive downlink data through the downlink data early transmission procedure.
  • the instructing the user equipment to receive the downlink data through a downlink data early transmission procedure may refer to: instructing the user equipment to receive the downlink data through a random access response (MSG2) message.
  • MSG2 random access response
  • the indication information of the early transmission of downlink data includes an indication of early transmission of downlink data or an indication of the amount of downlink data of the downlink data.
  • the indication information for the early transmission of downlink data may be a direct explicit indication, such as an early downlink data transmission indication (MT-EDT indication); it may also be an indirect implicit indication, such as the downlink data volume of the downlink data Instructions.
  • the user equipment can determine that it needs to receive the downlink data through the downlink data early transmission process according to the implicit instruction.
  • the using the current security context to activate the non-access stratum NAS security protection according to the paging message includes: determining to use the current security context of the user equipment according to the specific resource information Activate the non-access stratum NAS security protection; or, if the paging message also includes indication information for indicating early transmission of downlink data, according to the indication information for indicating early transmission of downlink data and/or the specific It is determined to use the current security context of the user equipment to activate the non-access stratum NAS security protection.
  • the user equipment can activate its own NAS security protection according to the specific information in the paging message. In other words, the user terminal determines that the paging message is transmitted early for downlink data based on the specific information in the paging message. Therefore, in order to ensure the security of communication data, both the user terminal and the mobility management network element on the network side need to enable NAS Security protection to avoid subsequent downstream data leakage.
  • the method further includes: in the case where the first downlink NAS message fails to be protected by using the current security context of the user equipment, the user equipment passes through the access network device Send a second uplink NAS message for security protection using the current security context of the user equipment to the mobility management network element, where the second uplink NAS message includes a first security context identifier and an identifier of the user equipment, wherein: The first security context identifier is used to indicate the current security context of the user equipment; the user equipment receives a second downlink NAS message sent by the mobility management network element through the access network device, and the second downlink The NAS message includes the downlink data after the mobility management network element uses the current security context of the user equipment to securely protect the downlink data; the current security context of the user equipment is used to unsecure and protect the second downlink NAS message to obtain the downlink data .
  • the user equipment When the user equipment fails to desecurely protect the first downlink NAS message using the current security context of the user equipment, it indicates that the current security contexts on the user equipment and the mobility management network element are not the same.
  • the user equipment sends the identifier corresponding to the current security context (for example, the key identifier KSI) used by the user equipment to the mobility management network element to achieve context synchronization with the mobility management network element, and then use the synchronized The security context of the security protection to be transmitted downstream data.
  • the identifier corresponding to the current security context for example, the key identifier KSI
  • the second uplink NAS message is a control plane service request CPSR message. Since the CPSR message is a special NAS message, the mobility management network element obtains the corresponding security context according to the S-TMSI and KSI in the CPSR message, and sets the obtained security context as the current security context, thereby realizing user equipment and mobility management Synchronization of the current security context of the network element.
  • the identifier of the user equipment is the system architecture evolution temporary mobile user identifier S-TMSI.
  • the method further includes: the user equipment obtains the user The current security context of the device.
  • the user equipment acquiring the current security context of the user equipment includes: the user equipment acquiring the current security context of the user equipment stored by itself; or the user equipment triggering the mobility management
  • the network element re-authenticates the user equipment, and then establishes the same current security context on the user equipment and the mobility management network.
  • the user equipment accesses the network and completes the authentication and activates the security protection, the user equipment and the mobility management network element will have the same/corresponding current security context.
  • the user equipment may be The current security context is lost.
  • one possible implementation is to set other security contexts saved by itself as the current security context, and another possible implementation is to trigger the mobile management network element to perform the operation on the user equipment. Re-authentication, and then re-establish a new and same current security context.
  • the paging message further includes a second security context identifier, and the second security context identifier is used to indicate the current security context of the mobility management network element; and the user equipment is based on the paging
  • the message, using the current security context of the user equipment to activate the non-access stratum NAS security protection includes: if there is a security context corresponding to the second security context identifier in the security context stored in the user equipment itself, it will contact The security context corresponding to the second security context identifier is set as the current security context of the user equipment, and the newly set current security context is used to activate NAS security protection; or, the security context does not exist in the security context stored in the user equipment itself.
  • the user equipment triggers the mobility management network element to re-authenticate the user equipment, and then establishes the same on the user equipment and the mobility management network Current security context; use the newly established current security context to activate NAS security protection.
  • the network layer sends the identification of the current security context used by the mobility management network element to the user equipment through a paging request. Before receiving the downlink data, it implements context synchronization, thereby avoiding data reconfiguration caused by asynchronization of the security contexts at both ends. pass.
  • a data transmission method includes: a mobility management network element receives a downlink data notification message sent by a session management network element, the downlink data notification message includes first indication information; the mobility management network element According to the first instruction information, the current security context of the mobility management network element is used to activate the non-access stratum NAS security protection; the mobility management network element uses the current security context of the mobility management network element to perform the downlink of the user equipment The data is secured, and the secured downlink data is encapsulated in a first downlink NAS message; the mobility management network element sends the first downlink NAS message to the user equipment through an access network device.
  • the mobility management network element after the mobility management network element receives the downlink data notification message sent by the session management network element, it activates the NAS security protection, uses the current security context to perform security protection on the downlink data, and then transfers the secured downlink data Sent to the user device.
  • the mobility management network element After the method of the embodiment of the present application, it can be ensured that the downlink data of the user equipment will not be intercepted by an illegal device.
  • the method further includes: the mobility management network element sends a first paging request to the access network device ,
  • the first paging request includes the identifier of the user equipment and second indication information;
  • the second indication information includes an indication of early transmission of downlink data or an indication of the amount of downlink data of the downlink data;
  • the mobility management network The element receives a downlink data acquisition request sent by the access network device, where the downlink data acquisition request includes an identifier of the user equipment.
  • the mobility management network element in the embodiment of this application determines that it needs to use the downlink data early transmission process to transmit the downlink data, so it will be issued when the user equipment is paged to the access network device
  • the second indication information facilitates the access network equipment to allocate specific resources to the user equipment.
  • the access network device may request downlink data from the mobility management network element and forward it to the user equipment.
  • the method further includes: the mobility management network element receiving feedback information sent by the user equipment, the feedback information being encapsulated in the first security protection using the current security context of the user equipment In the uplink NAS message; the mobility management network element uses the current security context of the mobility management network element to desecurely protect the first uplink NAS message, and obtains the feedback information; the mobility management network element according to the feedback information To delete the cached downlink data.
  • the mobility management network element 102 may always store the downlink data before receiving the feedback information sent by the user equipment 105, and delete the downlink data stored by itself until the feedback information is received. This can ensure that the correct user equipment can receive the downlink data.
  • the method further includes: the mobility management network element receives a security-protected second uplink NAS message sent by the user equipment, where the second uplink NAS message includes a first security context identifier and The identifier of the user equipment; wherein the first security context identifier is used to indicate the current security context of the user equipment; the second uplink NAS message uses the current security context of the user equipment for security protection; the mobility management The network element performs security context synchronization with the user equipment according to the first security context identifier, so that the mobility management network element and the user equipment establish the same current security context; the mobility management network element uses The current security context of the mobility management network element securely protects the downlink data, and encapsulates the secured downlink data in a second downlink NAS message; the mobility management network element sends a message to the access network device through the access network device.
  • the user equipment sends the second downlink NAS message.
  • a method for context synchronization between the user equipment and the mobility management network element is provided.
  • the mobility management network element uses the synchronized current security context to securely protect the downlink data, and sends the secured downlink data to the user equipment. Because the security context synchronization has been performed between the user equipment and the mobility management network element, it can be ensured that the user equipment can correctly unsecure the downlink NAS message, and then obtain the downlink data.
  • the mobility management network element performs security context synchronization with the user equipment according to the first security context identifier, including: the mobility management network element stores the information stored in itself with the first security The security context corresponding to the context identifier is set to its current security context; or, the mobility management network element determines that it does not store the security context corresponding to the first security context identifier; the mobility management network element passes through the re-authentication process To establish the same current security context as the user equipment.
  • the second uplink NAS message is a control plane service request CPSR message.
  • the first downlink NAS message further includes a second security context identifier, and the second security context identifier is used to indicate the current security context of the mobility management network element.
  • the mobility management network element when the mobility management network element sends out security-protected downlink data, it synchronously informs the user equipment of the security context used for the security protection of the downlink data, so that the user equipment can use the correct security context for the security protection Downlink NAS message to obtain downlink data.
  • the first paging request further includes a second security context identifier; the second security context identifier is used to indicate the current security context of the mobility management network element.
  • the mobility management network element notifies the user equipment of the security context used for security protection of the subsequent downlink data through a paging request before issuing security protected downlink data, so that the user equipment can use the correct security context Perform security protection for subsequent downlink NAS messages to obtain downlink data.
  • the first indication information includes: an indication of early transmission of downlink data or an indication of the amount of data of the downlink data.
  • a data transmission system which includes a mobility management network element and a session management network element;
  • the session management network element is configured to send a downlink data notification message to the mobility management network element, where the downlink notification message includes first indication information; the mobility management network element is configured to according to the first indication information, Use the current security context of the mobility management network element to activate the non-access layer NAS security protection; use the current security context of the mobility management network element to securely protect the downlink data of the user equipment, and encapsulate the secured downlink data in the first In a downlink NAS message; sending the first downlink NAS message to the user equipment through an access network device.
  • the mobility management network element is further configured to receive feedback information sent by the user equipment, and the feedback information is encapsulated in a first uplink NAS that uses the current security context of the user equipment for security protection In the message; use the current security context of the mobility management network element to unsecure the first uplink NAS message to obtain the feedback information; delete the cached downlink data according to the feedback information.
  • the mobility management network element is further configured to send a first paging request to the access network device after receiving a downlink data notification message sent by the session management network element, the first paging request Includes the identifier of the user equipment and second indication information; the second indication information includes an early downlink data transmission indication or an indication of the downlink data volume of the downlink data; receiving a downlink data acquisition request sent by the access network device , The downlink data acquisition request includes the identifier of the user equipment.
  • the mobility management network element is further configured to receive a security-protected second uplink NAS message sent by the user equipment, where the second uplink NAS message includes a first security context identifier and the The identifier of the user equipment; wherein the first security context identifier is used to indicate the current security context of the user equipment; the second uplink NAS message uses the current security context of the user equipment for security protection; according to the first security The context identifier is used to synchronize the security context with the user equipment so that the mobility management network element and the user equipment establish the same current security context; use the current security context of the mobility management network element to perform the downlink The data is secured, and the secured downlink data is encapsulated in a second downlink NAS message; the second downlink NAS message is sent to the user equipment through the access network device.
  • the mobility management network element is further configured to receive feedback information sent by the user equipment, and the feedback information is encapsulated in a third uplink NAS that uses the current security context of the user equipment for security protection In the message; use the current security context of the mobility management network element to unsecure the third uplink NAS message to obtain the feedback information; delete the cached downlink data according to the feedback information.
  • the mobility management network element is configured to perform security context synchronization with the user equipment according to the first security context identifier, including: storing the mobility management network element itself with the The security context corresponding to the first security context identifier is set as its current security context; or, in the case where the security context corresponding to the first security context identifier is not stored by itself, the authentication process is re-authenticated to establish a connection with the user equipment The same current security context.
  • the second uplink NAS message is a control plane service request CPSR message.
  • the first downlink NAS message further includes a second security context identifier, and the second security context identifier is used to indicate the current security context of the mobility management network element.
  • the first paging request further includes a second security context identifier; the second security context identifier is used to indicate the current security context of the mobility management network element.
  • the first indication information includes: an indication of early transmission of downlink data or an indication of the amount of data of the downlink data.
  • a communication device which has the function of realizing any one of the above-mentioned first aspect and the first aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device can be a chip or an integrated circuit.
  • the device includes a transceiver and a processor, the transceiver is used to communicate with other communication devices, and the processor is used to couple with the memory to execute the program stored in the memory.
  • the device can Perform the method described in the first aspect and any one of the possible designs of the first aspect.
  • the device also includes a memory for storing programs executed by the processor.
  • the device is a terminal or a chip in the terminal.
  • a communication device which has the function of realizing any one of the above-mentioned second aspect and the second aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device can be a chip or an integrated circuit.
  • the device includes a transceiver and a processor, the transceiver is used to communicate with other communication devices, and the processor is used to couple with the memory to execute the program stored in the memory.
  • the device can Perform the method described in any one of the possible designs of the second aspect and the second aspect.
  • the device also includes a memory for storing programs executed by the processor.
  • the device is a mobile management network element.
  • a chip is provided, the chip is connected to a memory or the chip includes a memory, and is used to read and execute a software program stored in the memory, so as to implement the above-mentioned first, second, and first aspects.
  • a computer storage medium which stores a computer program, and the computer program includes instructions for executing the foregoing aspects and any possible design method in each aspect.
  • a computer program product containing instructions which when running on a computer, causes the computer to execute the above-mentioned aspects and the method in any possible design of each aspect.
  • a data transmission method which includes a user equipment receiving a paging message for early transmission of downlink data from an access network device, wherein the paging message includes specific resource information;
  • the access network device sends a random access request, where the random access request includes the specific resource information;
  • the user equipment receives a first downlink NAS message sent by the mobility management network element through the access network device ,
  • the first downlink NAS message includes downlink data that is secured by the mobility management network element using the current security context of the mobility management network element and a second security context identifier; the second security context identifier is used to indicate The current security context of the mobility management network element;
  • the user equipment activates the non-access layer NAS security protection according to the second security context identifier;
  • the user equipment uses the current security context of the user equipment to unsecure the first A downlink NAS message to obtain the downlink data;
  • the user equipment sends feedback information to the mobility management network element through the access network device, and the feedback information is encapsulated in the current security
  • the downlink NAS message received by the user equipment includes the indication information of the security context used by the mobility management device to securely protect the downlink NAS message (that is, the identifier of the second security context), and the user equipment according to the security
  • the indication information of the context is synchronized with the security context of the mobility management network element, so that the downlink data can be obtained by correctly desecuting the downlink NAS message.
  • the paging message further includes indication information for indicating early transmission of downlink data.
  • the indication information of the early transmission of downlink data includes an indication of early transmission of downlink data or an indication of the amount of downlink data of the downlink data.
  • the user equipment activating the non-access stratum NAS security protection according to the second security context identifier includes: the user equipment associates its stored security context with the second second security context identifier The corresponding security context is set to the current security context, and the newly set current security context is used to activate NAS security protection; or, there is no security context corresponding to the second security context identifier in the security context stored in the user equipment itself
  • the user equipment triggers the mobility management network element to re-authenticate the user equipment, and then establish the same current security context on the user equipment and the mobility management network.
  • a communication device which has the function of realizing any one of the above-mentioned first aspect and the first aspect.
  • the function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the device can be a chip or an integrated circuit.
  • the device includes a transceiver and a processor, the transceiver is used to communicate with other communication devices, and the processor is used to couple with the memory to execute the program stored in the memory.
  • the device can Perform the method described in the first aspect and any one of the possible designs of the first aspect.
  • the device also includes a memory for storing programs executed by the processor.
  • the device is a terminal or a chip in the terminal.
  • Figure 1 is a schematic diagram of the system architecture in an embodiment of the application
  • FIG. 2 is a schematic diagram of a flow of early downlink data transmission in an embodiment of this application
  • FIG. 3 is a schematic diagram of another flow chart of early downlink data transmission in an embodiment of this application.
  • FIG. 4 is a schematic diagram of another flow of early downlink data transmission in an embodiment of this application.
  • FIG. 5 is a schematic diagram of another flow of early downlink data transmission in an embodiment of this application.
  • FIG. 6 is one of the schematic diagrams of the structure of the communication device in the embodiment of the application.
  • FIG. 7 is the second schematic diagram of the structure of the communication device in the embodiment of the application.
  • the embodiments of the present application provide a data transmission method and device, which are used to activate the security context on the communication device during the early transmission of downlink data, so as to avoid related security issues in the early transmission of data.
  • the method and the device are based on the same concept. Since the principles of the method and the device to solve the problem are similar, the implementation of the device and the method can be referred to each other, and the repetition will not be repeated.
  • "and/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, and both A and B exist at the same time. There are three cases of B.
  • the security context is the locally established state of the terminal device and the service network, which can be represented by stored security data. These security data can include the Key Set Identifier (KSI) and the root key Kamse/Kamf. Optionally, it may also include one or more of the NAS encryption key Knas-enc, the NAS integrity key Knas-int, the encryption algorithm used and the integrity protection algorithm. Among them, the key set identifier is used to identify the security context. Specifically, it can be used to identify the key set in the security context, such as the root key, the NAS encryption key, and the NAS integrity key.
  • KKI Key Set Identifier
  • the security context may also include other parameters, such as uplink and downlink non-access stratum (Non-Access Stratum, NAS) counters (COUNT), etc., which are not limited in this application.
  • NAS Non-Access Stratum
  • COUNT uplink and downlink non-access stratum
  • the "same” here can also be understood as “corresponding”, that is, the key set identifier, root key, NAS encryption key Knas-enc, NAS integrity key Knas-int in the security context of the two communicating entities, The encryption algorithm and the integrity protection algorithm used need to be the same, and individual parameters may be different.
  • Current security context The security context that was recently activated in the terminal device and network device. Wherein, activating the security context refers to using the security context to securely protect the message. The most recently activated security context is the security context used when the message was recently secured.
  • Non-current security context other security contexts other than the current security context stored in terminal devices and network devices.
  • Encryption protection protect the confidentiality of data during transmission (so it can also be called confidentiality protection). Confidentiality means that the true content cannot be seen directly. Encryption protection can generally be realized by encrypting data using keys and encryption algorithms. Decryption can generally be achieved by decrypting encrypted data using a key and encryption algorithm. For specific methods of encryption protection and decryption, please refer to 3GPP TS 33.401f50 section 8.2 or 33.501f50 section 6.4.4 standard descriptions, which will not be repeated here.
  • Integrity check and protection are used to determine whether the content of a message has been changed during the delivery process, and it can also be used as identity verification to confirm the source of the message. Integrity check and protection requires the use of Message Authentication Code (MAC).
  • MAC Message Authentication Code
  • the receiving end can compare the received MAC with the MAC generated by itself (called XMAC in the standard) to verify the integrity, thereby verifying the identity of the sending end or judging whether the message has been tampered with. If the MAC and XMAC are the same, the receiving end determines that the received MAC is verified, so that the receiving end can confirm that the sending end has passed the authentication and trusts the received message; if the MAC and XMAC are not the same, the receiving end can confirm that the received MAC is not Through the verification, the receiving end can determine that the sending end has not passed the authentication. Normally, if the integrity check fails, the receiving end directly discards the message.
  • XMAC the MAC generated by itself
  • NAS integrity protection Once NAS integrity protection is activated, it means that the integrity protection of subsequent uplink/downlink NAS messages needs to be processed in a consistent manner based on the NAS integrity key and NAS integrity protection algorithm of the current security context. All messages without NAS integrity protection are not accepted and need to be discarded, but some special NAS messages can be excluded, such as attachment requests, location area update requests, service requests, control plane service requests, authentication requests, identity requests, etc.
  • the user equipment activates NAS integrity protection
  • every time it sends an uplink NAS message it will perform integrity protection on the uplink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context; each time it receives downlink NAS Messages will perform integrity verification on the downlink NAS message according to the NAS integrity key of the current security context and the NAS integrity protection algorithm.
  • the mobility management network element After the mobility management network element activates NAS integrity protection, every time it receives an uplink NAS message, it will perform an integrity check on the uplink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context, and each time it is sent The downlink NAS message will perform integrity protection for the downlink NAS message according to the NAS integrity key and NAS integrity protection algorithm of the current security context.
  • NAS encryption protection Once NAS encryption protection is activated, it means that subsequent encryption protection of uplink/downlink NAS messages needs to be processed in a consistent manner based on the NAS encryption key and NAS encryption algorithm of the current security context. All messages without NAS encryption protection are not accepted and need to be discarded. For example, after the user equipment activates NAS integrity protection, every time it sends an uplink NAS message, it will encrypt the uplink NAS message according to the NAS encryption key and NAS encryption algorithm of the current security context. Each time it receives a downlink NAS message, it will The downlink NAS message is decrypted according to the NAS encryption key and NAS encryption algorithm of the current security context.
  • the mobile management network element After the mobile management network element activates NAS integrity protection, it will decrypt the upstream NAS message according to the NAS encryption key and NAS encryption algorithm of the current security context every time it receives an upstream NAS message.
  • the downlink NAS message is encrypted and protected according to the NAS encryption key and NAS encryption algorithm of the current security context.
  • FIG. 1 shows the architecture of a possible communication system to which the data transmission method provided by the embodiment of the present application is applicable.
  • the communication system 100 includes an access network device 101, a mobility management network element 102, and session management.
  • the user equipment 105 may also be included. It should be noted that this application does not limit the number of each type of network element included in the foregoing system.
  • the foregoing system may include one or more access network devices 101.
  • Each access network device 101 can provide access services for one or more user equipment 105 within the coverage area.
  • Multiple access network devices 101 may be connected through an interface (for example, X2 interface or Xn interface) for communication, and the access network device 101 and mobility management network element 102 may be connected through an interface (for example, S1 interface or N2 interface) Connect to communicate.
  • the mobility management network element 102 and the session management network element 103 are connected through an interface (for example, an S11 interface or an N11 interface) for communication.
  • the session management network element 103 and the user plane function network element 104 are connected through an interface (for example, an S5 interface or an N4 interface) for communication.
  • the forms of the access network device 101, the mobility management network element 102, the session management network element 103, the user plane management network element 104, and the user equipment 105 included in the communication system are described as examples.
  • the access network device 101 is a device with a wireless transceiver function or a chip that can be installed in the device.
  • the device includes but is not limited to: evolved Node B (eNB), radio network controller (RNC) ), Node B (NB), base station controller (BSC), base transceiver station (BTS), home base station (for example, home evolved NodeB, or home Node B, HNB), Baseband unit (BBU), access point (AP), wireless relay node, wireless backhaul node, and transmission point (transmission and reception point, TRP) in wireless fidelity (WIFI) systems Or transmission point, TP), etc.
  • eNB evolved Node B
  • RNC radio network controller
  • NB Node B
  • BSC base station controller
  • BTS base transceiver station
  • home base station for example, home evolved NodeB, or home Node B, HNB
  • BBU Baseband unit
  • AP access point
  • WIFI wireless fidelity
  • TP transmission point
  • the panel or, may also be a network node that constitutes a gNB or transmission point, such as a baseband unit (BBU), or a distributed unit (DU), etc.
  • the gNB may include a centralized unit (CU) and a DU.
  • the gNB may also include a radio unit (RU).
  • CU implements some functions of gNB
  • DU implements some functions of gNB
  • CU implements radio resource control (RRC), packet data convergence protocol (PDCP) layer functions
  • DU implements wireless link
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • RLC radio link control
  • MAC media access control
  • PHY physical
  • high-level signaling such as RRC layer signaling or PDCP layer signaling can also be considered to be sent by DU, or sent by DU+RU.
  • the access network device 101 may be a CU node, or a DU node, or a device including a CU node and a DU node.
  • the specific form of the access network device 101 is not limited here.
  • the mobile management network element 102 may be, for example, the mobile management entity (MME) in the fourth generation (4th Generation, 4G) system, and the access and mobility management functions in the fifth generation (5th Generation, 5G) system. (access and mobility management function, AMF) or a network element with similar functions in the subsequent evolution system.
  • the mobility management network element 102 is used to be responsible for the access and mobility management of the user equipment 105.
  • MME mobile management entity
  • 4G fourth generation
  • 5G fifth generation
  • AMF access and mobility management function
  • the mobility management network element 102 is used to be responsible for the access and mobility management of the user equipment 105.
  • the functions of MME in a 4G system can refer to 3GPP TS 23.401g10 4.4.2 Chapter related descriptions
  • the functions of AMF in the 5G system can refer to 3GPP TS23.501f50 6.2.1 chapter related descriptions.
  • the access network device 101 and the mobility management network element 102 are connected through an S1 or N2 interface, and messages exchanged between the access network device 101 and the mobility management network element 102 are transmitted.
  • the user equipment 105 communicates with the mobility management network element 102 through the NAS protocol, and messages exchanged between the user equipment 105 and the mobility management network element 102 are usually transferred from the access network device 101 to the mobility management network element 102.
  • the session management network element 103 may be, for example, the Serving Gateway (S-GW) in the fourth generation (4th Generation, 4G) system, and the session management function (Session Management Function) in the fifth generation (5th Generation, 5G) system. , SMF) or a network element with similar functions in the subsequent evolution system.
  • the session management network element 103 is responsible for functions such as session management of the user equipment 105.
  • functions of S-GW in a 4G system refer to 3GPP TS 23.401 g10 section 4.4.3.2
  • the functions of SMF in the 5G system can refer to the related descriptions in section 6.2.2 of 3GPP TS23.501 f50.
  • the user plane management network element 104 may be, for example, the packet data network gateway (P-GW) in the fourth generation (4th Generation, 4G) system, and the user plane in the fifth generation (5th Generation, 5G) system.
  • Function User Plane Function, UPF
  • the user plane management network element 104 is a transmission anchor point for user plane data, and is responsible for transmitting the user plane data of the user equipment 105.
  • the functions of P-GW in 4G systems can refer to 3GPP TS 23.401 g10 4.4.3.3
  • the functions of UPF in 5G systems can refer to 3GPP TS 23.501 f506. .2.3 Related descriptions in section.
  • the user equipment 105 is also called an access terminal, a user unit, a user station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communication device, a user agent, or a user device.
  • the user equipment in the embodiments of the present application may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal, an augmented reality (AR) terminal, Wireless terminals in industrial control, wireless terminals in self-driving, wireless terminals in remote medical, wireless terminals in smart grid, transportation safety (transportation safety) ), the wireless terminal in the smart city (smart city), the wireless terminal in the smart home (smart home), and so on.
  • the embodiment of this application does not limit the application scenario.
  • a terminal with a wireless transceiver function and a chip that can be set in the aforementioned terminal are collectively referred to as user equipment.
  • the communication between the user equipment 105 and the network side equipment needs to rely on multiple protocol layers.
  • the user equipment 105 communicates with the access network device 101 through a radio resource control (RRC) layer, and communicates with the AMF through a non-access stratum (NAS).
  • RRC radio resource control
  • NAS non-access stratum
  • the RRC layer and the NAS layer do not affect each other, but in some special cases, the RRC layer and the NAS layer will also communicate and exchange some parameters.
  • the communication between the user equipment 105 and the access network device 101 includes control plane communication and user plane communication, where the control plane interacts through the RRC protocol.
  • the user plane management network element 104 in this application can perform data communication with an external network, and the external network can be the Internet, a private IP network, or other data networks.
  • the data early transmission solution of this application can be applied in a machine type communication (MTC) scenario or a narrowband Internet of Things (NB-IoT) communication scenario.
  • MTC machine type communication
  • NB-IoT narrowband Internet of Things
  • the downlink data in this application is transmitted to the session management network element 103 through the user plane management network element 104, and then transmitted to the mobile management network element 102 through the session management network element 103, and the mobile management network element 102 is transmitted to the user equipment through NAS messages.
  • MTC machine type communication
  • NB-IoT narrowband Internet of Things
  • the data transmission method provided in the embodiments of the present application can be applied to various communication systems.
  • it can be applied to the fourth generation (4G) communication system, the fifth generation (5G) communication system, or various future communication systems.
  • the method provided in the embodiments of this application can be applied to the application scenario of downlink data early transmission (mobile terminated early data transmission, MT-EDT).
  • the downlink data transmitted early can have any one or more of the following Features:
  • the downlink data can be transmitted in one time, that is, the downlink data of the terminal can be transmitted in one message.
  • a single downlink data packet that is, the mobility management network element 102 can send the downlink data of the terminal through a data packet (for example, a network protocol IP data packet), which is expressed as a single downlink data packet (single packet), or a single downlink data (single DL) data).
  • a data packet for example, a network protocol IP data packet
  • single packet single downlink data packet
  • single DL single downlink data
  • the downlink small data packet can be understood as the data volume (data volume) of the downlink data to be sent to the user equipment 105 is less than a threshold.
  • the downlink data is sent to the user equipment 105 in a random access response message (MSG2).
  • MSG2 random access response message
  • the user plane management network element 104 receives the downlink data of the user equipment 105, it sends the downlink data to the session management network element 103, and the session management network element 103 receives the downlink data of the user equipment 105 from the user plane management network element 104. data.
  • the session management network element 103 sends a downlink data notification (downlink data notification) message to the mobility management network element 102.
  • the mobility management network element 102 receives the downlink data notification message from the session management network element 103.
  • the downlink data notification message is used to indicate the arrival of downlink data of the user equipment 105.
  • the downlink data notification message may carry the first indication information.
  • the first indication information is used to indicate whether to initiate an MT-EDT process to transmit the downlink data.
  • the first indication information may specifically be an MT-EDT indication or an indication of a data volume (data volume) of the downlink data.
  • the MT-EDT indication is used to indicate whether to initiate the downlink data early transmission process. Specifically, when the MT-EDT instructs to take the first preset value, it represents the need to initiate the downlink data early transmission process; when the MT-EDT instructs to take the second preset value, it represents the need to initiate the downlink data early transmission process.
  • the MT-EDT indication may be a two-level parameter. A value of 1 means that the downlink data early transmission process is initiated, and a value of 0 means that the downlink data early transmission process is not initiated.
  • the MT-EDT indication itself is used to indicate that the downlink data early transmission process needs to be initiated. For example, when the downlink data notification message carries the MT-EDT indication, it means that the downlink data early transmission process needs to be initiated; otherwise, it means that the downlink data does not need to be initiated. Early transmission process.
  • the data amount of the downlink data is used to indicate the size/length of the downlink data, and the data amount of the downlink data can be used to determine whether to initiate the downlink data early transmission process. For example, if the data amount is less than a certain threshold, the mobility management network element 102 Decide to initiate the downlink data early transmission process, otherwise the mobility management network element 102 decides not to initiate the downlink data early transmission process.
  • the downlink data notification message may also carry the downlink data.
  • the downlink data may be sent in the subsequent interaction process between the mobility management network element and the session management network element.
  • the mobility management network element 102 sends a downlink data notification acknowledgement (downlink data notification ACK) message to the session management network element 103.
  • the session management network element 103 receives the downlink data notification confirmation message from the mobility management network element 102.
  • step 202a If the downlink data notification message in step 202a carries the downlink data, the mobility management network element 102 buffers the downlink data.
  • the mobility management network element 102 sends a first paging request to the access network device 101, where the first paging request includes second indication information.
  • the access network device 101 receives the first paging request from the mobility management network element 102.
  • the second indication information is used to indicate whether to initiate an MT-EDT procedure to transmit the downlink data.
  • the second indication information may specifically be an MT-EDT indication or an indication of the data volume (data volume) of the downlink data.
  • the first paging request carries an identifier that requires the user equipment 105, such as a System Architecture Evolution Temporary Mobile Station Identifier (S-TMSI).
  • S-TMSI System Architecture Evolution Temporary Mobile Station Identifier
  • the access network device 101 sends a second paging request to the user equipment 105.
  • the access network device 101 determines that a specific resource needs to be allocated to the user equipment 105 to transmit the downlink data according to the second indication information carried in the first paging request. For example, when the first paging request carries the MT-EDT indication, the access network device 101 determines according to the MT-EDT indication that specific resources need to be allocated to the user equipment 105 to transmit downlink data; when the first paging request carries the downlink data When the amount of data is data, the access network device 101 determines that a specific resource needs to be allocated to the user equipment 105 to transmit the downlink data based on that the amount of downlink data is less than a preset threshold.
  • the specific resource may be a resource used for downlink early transmission data transmission, and the resource may be, for example, a dedicated physical random access channel (PRACH) resource.
  • PRACH dedicated physical random access channel
  • the PRACH resource may include a random access preamble (preamble).
  • the second paging request includes the specific resource.
  • the access network device 101 broadcasts the second paging request within the service range, and the second paging request further includes the identification of the terminal device 105 (such as S-TMSI), and the terminal device 105
  • the identifier of is used to indicate the object to be paged by the second paging request.
  • a user equipment receives a second paging request, it will respond to the second paging request only if its own identity is the same as the identity of the terminal device 105 in the second paging request . Further, the access network device 101 saves the correspondence between the identifier of the user equipment 105 and a specific resource.
  • the second paging request further includes third indication information.
  • the third indication information is used to indicate whether to initiate an MT-EDT procedure to transmit the downlink data.
  • the third indication information may specifically be an MT-EDT indication, an indication of the data volume of the downlink data, or any other parameters that may be used to instruct the user equipment 105 to initiate an MT-EDT process to transmit the downlink data.
  • the user equipment 105 initiates the MT-EDT process to transmit the downlink data. Specifically, it may mean that the user equipment 105 initiates a random access request through a specific resource allocated by the access network device 101, and in the subsequent random access response (MSG2) Analyze and obtain the downlink data sent by the network side.
  • MSG2 random access response
  • first indication information the second indication information, and the third indication information in each step of the embodiment of this application are all similar, that is, they are used to indicate whether to initiate the MT-EDT process to transmit downlink data, but they are different.
  • the format of the instruction information in the steps may be different, which is not limited in the embodiment of the present application.
  • the indication information in S202a, S204, and S205 in the embodiment of this application can be implemented in multiple possible ways:
  • the downlink data notification message carries the first indication information as an MT-EDT indication, the second indication information included in the first paging request is also an MT-EDT indication, and the second paging request includes The third indication information of is also an MT-EDT indication;
  • the downlink data notification message carries an indication that the first indication information is the data volume of the downlink data, and the second indication information included in the first paging request is an MT-EDT indication; that is, the mobility management network
  • the element 102 needs to determine whether to initiate the downlink data early transmission process according to the data volume of the downlink data, and instruct the access network device 101 whether to initiate the downlink data early transmission process through the MT-EDT instruction;
  • the second paging request includes
  • the third indication information is also an MT-EDT indication;
  • the downlink data notification message carries the first indication information as an indication of the amount of downlink data, and the second indication information included in the first paging request is also an indication of the amount of downlink data.
  • the third indication information included in the paging request is an MT-EDT indication; in this case, the access network device 101 needs to determine whether to initiate a downlink data early transmission process according to the data volume of the downlink data;
  • the downlink data notification message carries the first indication information as an indication of the amount of downlink data, and the second indication information included in the first paging request is also an indication of the amount of downlink data.
  • the third indication information included in the paging request is also an indication of the data volume of the downlink data; in this case, the user equipment 105 needs to determine whether to initiate the downlink data early transmission process according to the data volume of the downlink data.
  • the user equipment 105 determines to execute the random access procedure of S207 according to the specific resource and/or the third indication information, and analyzes the random access response received in subsequent S209, Obtain the downlink data.
  • the user equipment 105 sends a random access request to the access network equipment 101, and the access network equipment 101 receives the random access request sent by the user equipment 105.
  • the user equipment 105 may initiate a random access procedure to the access network device 101 according to the specific resource allocated by the access network device 101 to the user equipment 105, such as the PRACH resource.
  • the random access request is also called message 1 (MSG1), which is used to request uplink synchronization.
  • the random access request includes a specific resource allocated by the access network device 101 to the user equipment 105, for example, the PRACH resource.
  • the random access request includes the random access preamble.
  • the access network device 101 sends a downlink data acquisition request to the mobility management network element 102, where the downlink data acquisition request is used to encapsulate the downlink data requesting the user equipment 105 to the mobility management network element 102.
  • the mobility management network element 102 receives the downlink data acquisition request sent by the access network device 101.
  • the downlink data acquisition request may be a non-access layer protocol data unit (protocol data unit, PDU) request (NAS PDU Request).
  • PDU protocol data unit
  • the access network device 101 After the access network device 101 receives the random access request sent by the user equipment 105, according to the specific resource in the random access request, it is determined that the user equipment 105 needs to use the MT-EDT process to transmit data. Describe the downstream data. Further, the access network device 101 determines the identity of the user equipment 105 according to the specific resource in the random access request. Wherein, the access network device 101 determining the identity of the user equipment 105 according to the specific resource in the random access request includes: the access network device 101 according to the random access request The specific resource and the corresponding relationship saved in step 205 determine the identity of the user equipment 105, such as S-TMSI.
  • the mobility management network element 102 If the mobility management network element 102 has received the downlink data from the session management network element 103 (that is, the downlink data is carried in the downlink data notification in S202a), the mobility management network element 102 informs the user through the access network device 101 The device 105 sends the downlink data; otherwise, the mobility management network element 102 obtains the downlink data from the session management network element, and then sends the downlink data to the user equipment 105 through the access network device 101. Correspondingly, the user equipment 105 receives the downlink data sent by the mobility management network element 102 through the access network device 101.
  • the mobility management network element 102 obtains the downlink data according to the identifier of the user equipment 105 carried in the downlink data obtaining request request, and then carries the downlink data in a downlink NAS message and sends it to the user equipment 105.
  • the mobility management network element 102 sends the downlink data to the user equipment 105 through the access network device 101, specifically: the mobility management network element 102 sends a downlink NAS message to the access network device 101, where the downlink NAS message includes the downlink data
  • the access network device 101 forwards the downlink NAS message to the user equipment 105.
  • the access network device 101 may forward the downlink NAS message to the user equipment 105 through a random access response message (MSG2).
  • MSG2 random access response message
  • the downlink NAS message may be a downlink NAS transport (downlink NAS transport) or a NAS security mode command message.
  • the user equipment 105 After successfully receiving the downlink data, the user equipment 105 sends feedback information to the mobility management network element 102 through the access network device 101.
  • the feedback information is used to indicate to the mobility management network element 102 that the user equipment 105 has successfully received the downlink data.
  • the mobility management network element 102 may delete the downlink message and/or release the S1/N2 connection.
  • the method flow of early downlink data transmission shown in FIG. 2 is only an example, and the embodiment of the present application is not limited to the method flow, and may also be applicable to other application scenarios of early downlink data transmission.
  • step 205 in the embodiment of FIG. 2 above since the second paging request sent by the access network device 101 to the user equipment 105 is broadcast and has no security protection, Any user equipment within the service range of the access network device 101 can receive the second paging request. If a malicious user equipment forgedly causes the user equipment 105 to send a random access request to the access network device 101 and perform subsequent related steps, then the downlink data of the user equipment 105 will be acquired by the malicious user’s equipment, and the mobile management network element 102 may delete the downlink data in S213, so the user equipment 105 will not be able to obtain the downlink data.
  • this embodiment of the present application provides another data as shown in FIG. 3 The method of transmission. Specifically, during the early transmission of downlink data, the user equipment 105 and the mobility management network element 102 respectively use their current security contexts to activate NAS security protection, and perform security protection on the downlink data to be sent to the user equipment 105.
  • the embodiment of the present application because there is no NAS message interaction between the user equipment 105 and the mobility management network element 102 before the downlink data is transmitted, the current security context on the user equipment 105 and the mobility management network element 102 may not be Similarly, the embodiment of the present application also provides specific details of the method for synchronizing the current security context on the user equipment 105 and the mobility management network element 102, as described below.
  • S301-S303 are the same as S201-S203 in the embodiment in FIG. 2.
  • the mobility management network element 102 determines to activate the NAS security protection using the current security context.
  • activating NAS security protection may include activating NAS integrity protection and activating NAS encryption protection.
  • the mobility management network element 102 determines to use the current security context to de-secure the subsequent received uplink NAS messages; where the de-secure protection may include integrity check and decryption of the received uplink NAS message.
  • the mobility management network element 102 determines to use the current security context to perform security protection on the downstream NAS message sent subsequently; where the security protection may include integrity protection and encryption of the downlink NAS message to be sent. Specifically, the mobility management network element 102 determines to initiate a process for acquiring downlink data according to the first indication information, and further needs to use the current security context to securely protect the downlink NAS message sent subsequently. Optionally, the mobility management network element 102 further determines to perform security protection on the subsequently received uplink NAS message according to the first indication information.
  • the mobility management network element 102 determines, according to the first indication information, to activate the NAS security protection with the current security context.
  • the mobility management network element 102 uses the integrity protection key Knas-int and the integrity protection algorithm in the current security context to activate NAS integrity protection, and the mobility management network element 102 uses the encryption key Knas-int of the current security context to activate NAS integrity protection.
  • -enc and encryption algorithm activate NAS encryption protection.
  • the non-current security context stored by itself is set as the current security context, and the current security context is used to activate NAS security. If the current security context does not include the NAS integrity protection key Knas-int or the NAS encryption key Knas-enc, the MME derives the corresponding NAS based on the root key Kasme and the encryption and integrity algorithm contained in the non-current security context Encryption key and NAS integrity protection key.
  • the mobility management network element 102 re-authenticates the user equipment 105 and establishes a new security Context. After the mobility management network element 102 and the user equipment 105 pass the authentication process, they will have the same current security context.
  • the process of re-establishing the security context through the authentication process is specifically by re-executing the authentication process shown in 3GPP TS 33.401 f40 Chapter 6.1 or 3GPP TS 33.501 f50 Chapter 6.1 and 3GPP TS 33.401 f407.2.4.4 or 3GPP TS 33.501 f50
  • the security activation process shown in Chapter 6.7.2 re-establishes and activates the security context, which will not be repeated here.
  • the user equipment 105 is notified to establish the security context.
  • the erroneous integrity of the mobility management network element protects the downlink NAS message to trigger steps S316-S321.
  • the mobility management network element can randomly generate the MAC of the downlink NAS message, so that the user equipment 105 fails to verify the message.
  • S305-S307 are the same as S204-S206 in the embodiment in FIG. 2.
  • the user equipment 105 determines to use the current security context to activate the NAS security protection.
  • activating NAS security protection may include activating NAS integrity protection and activating NAS encryption protection.
  • the user equipment 105 determines to use the current security context to unsecure the downlink NAS message received subsequently.
  • the de-secure protection may include integrity verification and decryption of the received downlink NAS message.
  • the user equipment 105 also determines to use the current security context to perform security protection for the subsequent uplink NAS message.
  • security protection may include integrity protection and encryption protection of the uplink NAS message to be sent.
  • the user equipment 105 determines to use the current security context to activate NAS security protection according to the third indication information and/or the specific resource. That is, according to the third indication information or the specific resource, it is determined to initiate the process of acquiring downlink data, and the current security context is used to de-secure the subsequent received downlink NAS messages and the subsequent uplink NAS messages to be sent For safety protection.
  • the user equipment 105 uses the integrity protection key Knas-int and the integrity protection algorithm in the current security context to activate NAS integrity protection, and the user equipment 105 uses the encryption key Knas-enc and the integrity protection algorithm in the current security context.
  • the encryption algorithm activates NAS encryption protection.
  • S309-S310 are the same as S207-S208 in the embodiment in FIG. 2.
  • the mobility management network element 102 uses the current security context to perform the downlink data The data is secured; otherwise, the mobility management network element 102 first obtains the downlink data from the session management network element 103, and then uses the current security context to perform security protection on the downlink data.
  • the mobility management network element 102 obtains the downlink data according to the identifier of the user equipment 105 carried in the downlink data obtaining request, and then uses the current security context to protect the downlink data.
  • S311 can be executed at any time between S304-S312, and the embodiment of the present application does not limit its execution order.
  • the mobility management network element 102 sends the secured downlink data to the user equipment 105 through the access network device 101; correspondingly, the user equipment 105 receives the security protection sent by the mobility management network element 102 through the access network device 101; Downstream data.
  • the mobility management network element 102 may carry the secured downlink data in a downlink NAS message and send it to the user equipment 105.
  • a downlink NAS message For the specific form of the downlink NAS message, refer to the related description in S209.
  • the user equipment 105 performs security protection on the received downlink NAS message, and if the security protection is successful, executes S314-S15; if the security protection fails, executes S316-S321.
  • the user equipment 105 performs security protection on the received downlink NAS message, including:
  • the user equipment 105 uses the Knas-int and the integrity protection algorithm of the current security context to perform integrity verification on the downlink NAS message. After the verification is passed, it uses the Knas-enc and encryption algorithm of the current security context to perform the integrity verification on the downlink NAS message. Decrypt to obtain plaintext downstream data.
  • the downlink NAS message is not encrypted and protected.
  • the user equipment 105 and the mobility management network element 102 each store a current security context and/or a non-current security context. To be able to communicate normally between the user equipment 105 and the mobility management network element 102, the same current security context must be used. However, in some cases, the current security contexts of the user equipment 105 and the mobility management network element 102 may be inconsistent, which may be caused by the following reasons:
  • the user equipment 105 autonomously deletes the current security context, and sets the non-current security context as the current security context;
  • the user equipment 105 has no current security context
  • the mobility management network element 102 autonomously deletes the current security context and sets the non-current security context as the current security context
  • the mobility management network element 102 has no current security context.
  • steps S316-S321 are executed to synchronize the current security context of the user equipment 105 and the mobility management network element 102.
  • the user equipment 105 sends the security-protected feedback information to the mobility management network element 102 through the access network device 101.
  • the user equipment 105 may send feedback information confirming the successful reception of the downlink data to the mobility management network element 102.
  • the feedback information may be carried in an uplink NAS message (referred to by the first uplink NAS message), and the user equipment 105 may use the current security context to perform security protection on the first uplink NAS message.
  • the mobility management network element 102 After receiving the first uplink NAS message from the user equipment 105 through the access network device 101, the mobility management network element 102 performs security protection on the received first uplink NAS message, and obtains the feedback information.
  • the mobility management network element 102 may delete the buffered downlink data and/or release the S1/N2 connection.
  • the mobility management network element 102 Since the first uplink NAS message is secured by the user equipment 105, when the mobility management network element 102 de-secures the received first uplink NAS message, and after obtaining the feedback information, the mobility management network element 102 can determine The user equipment 105 has obtained the downlink data. Since other illegal devices cannot forge the user equipment 105 to send the uplink NAS message, a malicious device can pretend to be the real user equipment 105 to obtain the downlink data, so that the real user equipment 105 cannot obtain the downlink data. .
  • the user equipment 105 sends a security-protected second uplink NAS message to the mobility management network element 102 through the access network device 101, where the second uplink NAS message includes the first security context identifier and the user equipment identifier (for example, S -TMSI).
  • the first security context identifier is used to indicate the current security context used by the user equipment 105, and the first security context identifier may be a key identifier or information indicating that the user equipment 105 does not have a current security context.
  • the second uplink NAS message may be a control plane service request (CPSR) message.
  • CPSR control plane service request
  • the second uplink NAS message specifically includes the first security context identifier, the identifier of the user equipment, and the first MAC.
  • the first security context identifier KSI is used to indicate the key identifier in the current security context of the user equipment 105 itself, for example, it may be a key identifier saved in the current security context of the user equipment 105;
  • the MAC is a MAC generated by the user equipment 105 by performing integrity protection on the second uplink NAS message according to its current security context.
  • the second uplink NAS message includes the first security context identifier and the user equipment identifier.
  • the first security context identifier is used to indicate that the user equipment 105 has no current security context.
  • the first security context identifier may be a special key identifier, such as the binary "0111" or " 1111", of course, can also be other preset instructions.
  • the mobility management network element 102 After the mobility management network element 102 receives the second uplink NAS message, if the mobility management network element 102 has the security context indicated by the first security context identifier, the security context pair corresponding to the first security context identifier is used It is the second NAS information to unsecure the protection. After the unsecure protection is successful, the security context corresponding to the first security context identifier is activated, and the newly activated security context is used to securely protect the downlink data.
  • An implementation manner is that the mobility management network element 102 obtains the security context of the user equipment 105 according to the key identifier KSI in the second uplink NAS message and the identity of the user equipment, and obtains the security context of the user equipment 105 according to the obtained Knas- int and integrity protection algorithm perform integrity verification on the uplink NAS message (that is, calculate the second MAC based on the Knas-int and integrity protection algorithm in the acquired security context, and compare whether the first MAC is the same as the second MAC; If the same, the integrity verification is successful, otherwise, it fails.) After the integrity verification is successful, the mobility management network element 102 activates the security context corresponding to the KSI, and uses the newly activated security context to securely protect the downlink data.
  • the mobility management network element 102 activates the security context corresponding to the KSI, and uses the newly activated security context to securely protect the downlink data.
  • the mobility management network element 102 If the mobility management network element 102 does not have the security context indicated by the first security context identifier or the first security context identifier indicates that the user equipment 105 does not have the current security context, the mobility management network element 102 re-authenticates the user equipment 105 and establishes a new The security context. After the mobile management network element 102 and the user equipment 105 pass the authentication process, they will have the same current security context.
  • the process of re-establishing the security context through the authentication process is specifically by re-executing the authentication process shown in 3GPP TS 33.401 f40 Chapter 6.1 or 3GPP TS 33.501 f50 Chapter 6.1 and 3GPP TS 33.401 f40 Chapter 7.2.4.4 or 3GPP TS 33.501 f50
  • the security activation process shown in Chapter 6.7.2 re-establishes and activates the security context, which will not be repeated here.
  • An implementation manner is that the mobility management network element 102 decides to re-authenticate the user equipment 105 according to the key identifier KSI in the second uplink NAS message indicating “0111”, and the mobility management network element 102 sends the authentication to the user equipment 105 In the right request message, the user equipment 105 replies to an authentication response message of the mobility management network element 102 to complete the authentication. After that, the mobility management network element 102 sends a security mode command message to the user equipment 105, and the user equipment 105 replies to the security mode completion message of the mobility management network element 102, completes the establishment of the security context, and activates a new security context. The mobility management network element 102 uses the newly activated security context to securely protect the downlink data.
  • S318 can refer to the description of S312.
  • the difference is that the security-protected downlink data sent by the mobility management network element 102 in S318 and S312 are different. Specifically, the mobility management network element 102 uses a different security context. The downlink data is secured.
  • the reason why the user equipment 105 fails to resolve the security protection is because the mobility management network element 102 and the user equipment 105 use different security contexts.
  • the user equipment 105 performs de-security protection on the received downlink NAS data packet.
  • S320-S321 are the same as S314-S315.
  • the mobility management network element 102 uses its current security context to activate NAS security protection, and page the user equipment 105 through the access network device 101.
  • the user equipment 105 uses its current security context to activate NAS security protection.
  • the mobility management network element 102 uses its current security context to securely protect the downlink data, encapsulates the downlink data in a downlink NAS message and sends it to the user equipment 105.
  • the user equipment 105 After the user equipment 105 receives the downlink NAS message, it uses its current security context to de-secure the received downlink NAS message. If the de-secure protection is successful, the user equipment 105 sends the downlink data to the mobility management network element 102 successfully.
  • the feedback information uses the current security context of the user equipment 105 for security protection; if the security protection fails, the user equipment 105 and the mobility management network element 102 perform security context synchronization, and after the security context is synchronized, the mobility management The network element 102 uses the synchronized current security context to securely protect the downlink data, and the mobility management network element 102 uses its current security context to securely protect the downlink data, and encapsulates the downlink data in a downlink NAS message and sends it to the user equipment. 105.
  • the user equipment 105 After receiving the downlink NAS message, the user equipment 105 uses its current security context to de-secure the received downlink NAS message to obtain the downlink data. Then, the user equipment 105 sends the downlink data to the mobility management network element 102 successfully. Feedback information.
  • the mobility management network element 102 may always store the downlink data before receiving the feedback information sent by the user equipment 105, and delete the downlink data stored by itself until the feedback information is received.
  • the embodiment of the present application provides a method for the mobility management network element 102 to securely send downlink data to the user equipment 105 through the NAS message of the control plane.
  • the embodiment of the present application provides a method for activating the NAS security protection of the user equipment 105 and the mobility management network element 102 in the MT-EDT scenario, and the current security contexts of the user equipment 105 and the mobility management network element 102 are inconsistent.
  • a method for context synchronization between the user equipment 105 and the mobility management network element 102 is provided.
  • the embodiment of the present application provides yet another data transmission method as shown in FIG. 4. Specifically, during the early transmission of downlink data, the mobility management network element 102 uses the current security context to activate NAS security protection, and informs the user equipment 105 of the current security context it uses during the process of paging the user equipment 105. After receiving the page, the user equipment 105 uses the same security context as the mobility management network element 102 to activate NAS security protection. Therefore, the early data transmission between the user equipment 105 and the mobility management network element 102 is securely protected.
  • the specific technical details are as follows:
  • S401-S404 are the same as S301-S304 in the embodiment of FIG. 3.
  • S405-S406 are the same as S305-S306 in the embodiment of FIG. 3.
  • the difference is that the first paging message and the second paging message need to carry the mobility management network element 102 for use
  • the second security context identifier corresponding to the current security context of, the second security context identifier is used to indicate the current security context used by the mobility management network element 102, for example, may correspond to the current security context used by the mobility management network element 102 KSI.
  • S407 is the same as S307 in the embodiment in FIG. 3.
  • the user equipment 105 activates NAS security protection according to the second security context identifier.
  • the user equipment 105 may determine its own stored security context according to the second security context identifier, and use the determined security context to activate NAS security protection. That is, the user equipment 105 sets the security context corresponding to the second security context identifier in the security context stored in itself as the current security context, and activates the NAS security protection using the newly set current security context.
  • the user equipment 105 may trigger the mobility management network element 102 to re-authenticate the user equipment 105 and establish a new security context. After the mobile management network element 102 and the user equipment 105 pass the authentication process, they will have the same current security context.
  • the process of re-establishing the security context through the authentication process is specifically by re-executing the authentication process shown in 3GPP TS 33.401 f40 Chapter 6.1 or 3GPP TS 33.501 f50 Chapter 6.1 and 3GPP TS 33.401 f40 Chapter 7.2.4.4 or 3GPP TS 33.501 f50
  • the security activation process shown in Chapter 6.7.2 re-establishes and activates the security context, which will not be repeated here.
  • S409-S415 are the same as S309-S315 in the embodiment of FIG. 3.
  • the user equipment 105 and the mobility management network element 102 have performed security context synchronization before S413, the user equipment 105 can successfully unsecure the downlink NAS message in S413.
  • the embodiment of the present application also provides a data transmission method as shown in FIG. 5. Specifically, during the early transmission of downlink data, the mobility management network element 102 uses the current security context to activate NAS security protection, and sends the downlink NAS message to the user equipment to notify the user equipment 105 of the current security context it uses. After receiving the downlink NAS message, the user equipment 105 uses the same security context as the mobility management network element 102 to activate NAS security protection. And use the corresponding security context to unsecure the received downlink NAS message. Therefore, the early data transmission between the user equipment 105 and the mobility management network element 102 is securely protected.
  • the specific technical details are as follows:
  • S501-S510 are the same as S301-S310 in the embodiment of FIG. 3.
  • S511 is the same as S312 in the embodiment of FIG. 3.
  • the downlink NAS message needs to carry the second security context identifier corresponding to the current security context used by the mobility management network element 102
  • the second security context identifier is used to indicate the current security context used by the mobility management network element 102, and may be, for example, the KSI corresponding to the current security context used by the mobility management network element 102.
  • the user equipment 105 activates NAS security protection according to the second security context identifier.
  • the user equipment 105 may determine its own stored security context according to the second security context identifier, and use the determined security context to activate NAS security protection.
  • the user equipment 105 may trigger the mobility management network element 102 to re-authenticate the user equipment 105 and establish a new security context. After the mobile management network element 102 and the user equipment 105 pass the authentication process, they will have the same current security context.
  • the process of re-establishing the security context through the authentication process is specifically by re-executing the authentication process shown in 3GPP TS 33.401 f40 Chapter 6.1 or 3GPP TS 33.501 f50 Chapter 6.1 and 3GPP TS 33.401 f40 Chapter 7.2.4.4 or 3GPP TS 33.501 f50
  • the security activation process shown in Chapter 6.7.2 re-establishes and activates the security context, which will not be repeated here.
  • the mobility management network element 102 can use the new security context to securely protect the downlink data, and encapsulate the secured downlink data in a downlink NAS message and send it to the user equipment 105, that is, re-execute 411 and 412 steps.
  • S513-S515 are the same as S413-S415 in the embodiment of FIG. 4.
  • an embodiment of the present application further provides a communication device 600, which has the function of executing the user equipment 105 or the mobility management network element 102 in the foregoing method embodiment.
  • the function of the operation. This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the communication device 600 includes a processing unit 601 and a communication unit 602.
  • the communication unit 602 is configured to perform the sending and/or receiving steps in the method embodiment.
  • the processing unit 601 is used to perform other steps except sending and receiving.
  • the communication unit 602 may include a sending unit and/or a receiving unit.
  • the communication device 600 may be a terminal, or a chip or a functional module inside the terminal.
  • the communication unit 602 is configured to receive a paging message for early transmission of downlink data from an access network device, where the paging message includes specific resource information;
  • the processing unit 601 is configured to use the current security context of the user equipment to activate non-access stratum NAS security protection according to the paging message;
  • the communication unit 602 is further configured to send a random access request to the access network device, where the random access request includes the specific resource information; and receive the first data sent by the mobility management network element through the access network device.
  • a downlink NAS message, the first downlink NAS message includes downlink data that is secured by the mobility management network element using the current security context of the mobility management network element; and the current security context solution of the user equipment is used
  • feedback information is sent to the mobility management network element through the access network device, and the feedback information is encapsulated in the current security context of the user equipment for security In the protected first uplink NAS message.
  • the paging message further includes indication information for indicating early transmission of downlink data.
  • the indication information of the early transmission of downlink data includes an indication of early transmission of downlink data or an indication of the amount of downlink data of the downlink data.
  • the processing unit 601 is configured to use the current security context of the user equipment to activate the non-access stratum NAS security protection according to the paging message, specifically: according to the specific resource information, It is determined to use the current security context of the user equipment to activate the non-access stratum NAS security protection; or, if the paging message also includes indication information for indicating early transmission of downlink data, according to the indication for indicating early downlink data
  • the transmitted instruction information and/or the specific resource information determines to use the current security context of the user equipment to activate the non-access stratum NAS security protection.
  • the communication unit 602 is further configured to: in the case where the first downlink NAS message fails to be protected by the current security context of the user equipment, the access network device sends the message to the The mobility management network element sends a second uplink NAS message that uses the current security context of the user equipment for security protection, and the second uplink NAS message includes a first security context identifier and an identifier of the user equipment, wherein the The first security context identifier is used to indicate the current security context of the user equipment; to receive a second downlink NAS message sent by the mobility management network element through the access network device, where the second downlink NAS message includes the mobile
  • the management network element uses the current security context of the user equipment to securely protect the downlink data; the processing unit 601 is further configured to use the current security context of the user equipment to unsecure the second downlink NAS message to obtain the downlink data.
  • the processing unit 601 is further configured to obtain the current security context of the user equipment before using the current security context of the user equipment to activate the non-access stratum NAS security protection according to the paging message.
  • the processing unit 601 is configured to obtain the current security context of the user equipment, specifically: obtaining the current security context of the user equipment stored by itself; or triggering the mobility management network element to re-authenticate the user equipment Right, and then establish the same current security context on the user equipment and the mobility management network.
  • the communication unit 602 is configured to receive a paging message for early transmission of downlink data from an access network device, where the paging message includes specific resource information;
  • the network device sends a random access request, where the random access request includes the specific resource information; and receives a first downlink NAS message sent by the mobility management network element through the access network device, the first downlink
  • the NAS message includes downlink data secured by the mobility management network element using the current security context of the mobility management network element and a second security context identifier; the second security context identifier is used to indicate that the mobility management network element is currently Security context;
  • the processing unit 601 is configured to activate the non-access stratum NAS security protection according to the second security context identifier; and use the current security context of the user equipment to desecurely protect the first downlink NAS message to obtain the downlink data;
  • the communication unit 602 is further configured to send feedback information to the mobility management network element through the access network device, the feedback information being encapsulated in a first uplink NAS message that uses the current security context of the user equipment for security protection .
  • the communication device 600 may be a mobility management network element, or a chip or a functional module inside the mobility management network element.
  • the processing unit 601 is configured to The dispatch communication unit 602 communicates with other devices.
  • the communication unit 602 is configured to receive a downlink data notification message sent by a session management network element, where the downlink data notification message includes first indication information; the processing unit 601 is configured to use the The current security context of the mobility management network element activates the non-access layer NAS security protection; the current security context of the mobility management network element is used to securely protect the downlink data of the user equipment, and the secured downlink data is encapsulated in the first In the downlink NAS message; the communication unit 602 is further configured to send the first downlink NAS message to the user equipment through the access network device.
  • the communication unit 602 is further configured to send a first paging request to the access network device after the mobility management network element receives the downlink data notification message sent by the session management network element, where the first paging request includes all The identifier of the user equipment and the second indication information; the second indication information includes an indication of early transmission of downlink data or an indication of the amount of downlink data of the downlink data; receiving a downlink data acquisition request sent by the access network device, The downlink data acquisition request includes the identifier of the user equipment.
  • the communication unit 602 is further configured to receive feedback information sent by the user equipment, where the feedback information is encapsulated in a first uplink NAS message that uses the current security context of the user equipment for security protection;
  • the processing unit 601 is further configured to use the current security context of the mobility management network element to unsecure the first uplink NAS message to obtain the feedback information; and delete the cached downlink data according to the feedback information.
  • the communication unit 602 is further configured to receive a security-protected second uplink NAS message sent by the user equipment, where the second uplink NAS message includes a first security context identifier and an identifier of the user equipment
  • the first security context identifier is used to indicate the current security context of the user equipment
  • the second uplink NAS message uses the current security context of the user equipment for security protection
  • the processing unit 601 is also used to
  • the first security context identifier performs security context synchronization with the user equipment, so that the mobility management network element and the user equipment establish the same current security context; and use the current mobility management network element
  • the security context securely protects the downlink data, and encapsulates the secured downlink data in a second downlink NAS message
  • the communication unit 602 is also configured to send to the user equipment through the access network device The second downlink NAS message.
  • processing unit 601 and the communication unit 602 may also perform other corresponding operations in the foregoing method embodiments, and details are not described herein again.
  • an embodiment of the present application further provides a communication device 700, which is used to implement the user equipment 105 and/or the mobile management network in the foregoing method embodiment. Operations performed by element 102.
  • FIG. 7 only shows the main components of the communication device 700.
  • the communication device 700 includes: a transceiver 701, a processor 702, and a memory 703.
  • the transceiver 701 is used to transmit messages or signaling with other communication devices.
  • the processor 702 is coupled with the memory 703 and is used to call a program in the memory 703.
  • the communication device 700 executes the above method embodiments. Operations performed by the user equipment 105 and/or the mobility management network element 102.
  • the memory 703 is used to store a program executed by the processor 702.
  • the transceiver 701 may include a transmitter and/or a receiver, which respectively implement the transceiver function.
  • the number of processors 702 may be one or more.
  • the memory 703 may be located in the processor 702 or may exist separately.
  • FIG. 7 only shows a memory and a processor. In the actual user equipment 105 and/or the mobility management network element 102, there may be multiple processors and memories.
  • the memory may also be referred to as a storage medium or a storage device, etc., which is not limited in the embodiment of the present application.
  • the processor 702 is mainly used to process communication protocols and communication data, and to control the entire user equipment 105 and/or the mobile management network element 102, execute software programs, and process data of the software programs, for example, to support terminals and/or
  • the network device executes the actions described in the above method embodiments.
  • the memory 703 is mainly used to store software programs and data.
  • the communication device When the function of the user equipment is executed, for example, when the processor 702 executes the program instructions in the memory 703, the communication device is caused to perform the following operations: receive a paging message for early downlink data transmission from the access network device, where: The paging message includes specific resource information; according to the paging message, the current security context of the user equipment is used to activate non-access layer NAS security protection; a random access request is sent to the access network device, so The random access request includes the specific resource information; a first downlink NAS message sent by the mobility management network element through the access network device is received, and the first downlink NAS message includes the use of the mobility management network element The downlink data after the security protection of the current security context of the mobility management network element; in the case that the first downlink NAS message is successfully decrypted by using the current security context of the user equipment, the access network device Send feedback information to the mobility management network element, where the feedback information is encapsulated in a first uplink NAS message that uses the current security context of the
  • the communication device is caused to perform the following operations: receiving a downlink data notification message sent by a session management network element, the downlink data notification message Including first indication information, the first indication information is used to indicate whether to initiate an MT-EDT process to transmit the downlink data; according to the first indication information, use the current security context of the mobility management network element to activate the contactless Inbound NAS security protection; use the current security context of the mobility management network element to securely protect the downlink data of the user equipment, and encapsulate the secured downlink data in the first downlink NAS message; through the access network device Sending the first downlink NAS message to the user equipment.
  • the communication device can also perform other operations or functions performed by the user equipment 105 and/or the mobility management network element 102 in the foregoing method embodiment, and the repetitions are not repeated here. .
  • the processor 702 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.
  • CPU central processing unit
  • NP network processor
  • the processor 702 may further include a hardware chip.
  • the aforementioned hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (generic array logic, GAL), or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL general array logic
  • the memory 703 may include volatile memory (volatile memory), such as random-access memory (RAM); the memory 703 may also include non-volatile memory (non-volatile memory), such as flash memory (flash memory). memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 703 may also include a combination of the foregoing types of memories.
  • volatile memory volatile memory
  • non-volatile memory non-volatile memory
  • flash memory flash memory
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 703 may also include a combination of the foregoing types of memories.
  • Part or all of the operations and functions performed by the user equipment 105 or the mobility management network element 102 described in the foregoing method embodiments of the present application may be completed by chips or integrated circuits.
  • an embodiment of the present application further provides a chip, including a processor, for supporting the communication device to implement the user equipment 105 or the mobility management network element in the foregoing method embodiment 102 functions involved.
  • the chip is connected to a memory or the chip includes a memory, and the memory is used to store the necessary program instructions and data of the communication device.
  • the embodiment of the present application provides a computer storage medium storing a computer program, and the computer program includes instructions for executing the foregoing method embodiments.
  • the embodiments of the present application provide a computer program product containing instructions, which when run on a computer, cause the computer to execute the foregoing method embodiments.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • a computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种数据传输的方法、装置及系统，用于在下行数据早传的过程中，激活通信设备上的安全上下文，从而避免数据早传过程中相关的安全问题。该方法包括：用户设备从接入网设备接收针对下行数据早传的寻呼消息，寻呼消息包括特定的资源信息；根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护；向所述接入网设备发送随机接入请求；接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用移动管理网元当前的安全上下文安全保护后的下行数据；在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息成功的情况下，通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。

Description

一种数据传输的方法及装置 技术领域
本申请涉及通信技术领域，特别涉及一种数据传输的方法及装置。
背景技术
对类似于机器类型通信(machine type communication，MTC)和窄带物联网(narrow band internet of thing，NB-IoT)等一些通信场景，其数据传输的特点是，数据量较小，且数据到达时间不确定。传输小数据量的数据包，若使用传统的无线资源控制(radio resource control，RRC)连接建立过程，系统开销过大，资源利用效率低下，终端的功耗过大，并且无法满足数据传输时延要求。在现有技术中，若网络侧有终端的下行数据到达，网络设备通过寻呼消息将用户设备唤醒，使其接入网络。为实现下行数据早传，网络设备可以在接收到终端发送的上行信号(例如随机接入前导码)后，在终端随机接入过程中向用户设备发送下行数据，实现下行数据早传。
申请人研究发现，现有的message 2(MSG2)数据早传流程并没有考虑相关的安全流程，例如，并没有考虑如何同步并激活用户设备和网络设备之间的安全上下文，以保护下行数据。
发明内容
本申请提供一种数据传输的方法及装置，用于在下行数据早传的过程中，激活通信设备上的安全上下文，从而避免数据早传过程中相关的安全问题。
一方面，本申请提供一种数据传输的方法，该方法包括：用户设备从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；所述用户设备根据所述寻呼消息，使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；所述用户设备向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；所述用户设备接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据；在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息成功的情况下，通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
本申请实施例中，用户设备在接收到针对下行数据早传的寻呼消息之后，激活NAS安全保护，并使用当前安全上下文对随机接入请求之后收到的下行NAS消息进行解安全保护，以获得下行数据。并且在成功获得下行数据之后，向移动管理网元发送经过安全保护的反馈信息，以便于移动管理网元准确的获知下行数据已经正确的传输到用户设备。通过本申请实施例的方法，可以确保用户设备的下行数据不会被非法设备截取，也能保证下行数据在正确传递到所述用户设备之前不被删除。
在一个可能的设计中，所述寻呼消息还包括用于指示下行数据早传的指示信息。该下 行数据早传的指示信息用于指示用户设备通过下行数据早传流程来接收下行数据。所述指示用户设备通过下行数据早传流程来接收下行数据，可以是指：指示用户设备通过随机接入响应(MSG2)消息来接收下行数据。
在一个可能的设计中，所述下行数据早传的指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示。所述下行数据早传的指示信息可以是一个直接的显式指示，例如下行数据早传指示(MT-EDT indication)；也可以是一个间接的隐式指示，例如所述下行数据的下行数据量的指示。用户设备可以根据隐式指示，确定需要通过下行数据早传流程来接收下行数据。
在一个可能的设计中，所述根据所述寻呼消息，使用当前的安全上下文激活非接入层NAS安全保护，包括：根据所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；或者，如果所述寻呼消息还包括用于指示下行数据早传的指示信息，则根据所述用于指示下行数据早传的指示信息和/或所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护。用户设备可以根据寻呼消息中的特定信息，激活自身的NAS安全保护。换句话说，用户终端根据寻呼消息中的特定信息，确定该寻呼消息是针对下行数据早传的，所以为了保证通信数据的安全，用户终端和网络侧的移动管理网元都需要开启NAS安全保护，以避免后续下发的下行数据泄露。
在一个可能的设计中，所述方法还包括：在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息失败的情况下，所述用户设备通过所述接入网设备向所述移动管理网元发送使用所述用户设备当前的安全上下文进行安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识，其中，所述第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述用户设备接收所述移动管理网元通过所述接入网设备发送的第二下行NAS消息，所述第二下行NAS消息包括所述移动管理网元使用所述用户设备当前的安全上下文安全保护后的下行数据；使用所述用户设备当前的安全上下文解安全保护所述第二下行NAS消息，获得所述下行数据。当用户设备使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息失败时，说明用户设备和移动管理网元上的当前的安全上下文并不相同。本申请实施例中，用户设备将自己使用的当前的安全上下文对应的标识(例如，密钥标识符KSI)发送给移动管理网元，以实现与移动管理网元的上下文同步，进而使用同步后的安全上下文对待传输的下行数据进行安全保护。
在一个可能的设计中，所述第二上行NAS消息为控制面服务请求CPSR消息。由于CPSR消息属于特殊的NAS消息，移动管理网元根据CPSR消息中的S-TMSI和KSI获得对应的安全上下文，并将获得的安全上下文设置为当前的安全上下文，从而实现了用户设备和移动管理网元的当前的安全上下文的同步。
在一个可能的设计中，所述用户设备的标识为系统架构演进临时移动用户标识S-TMSI。
在一个可能的设计中，在所述用户设备根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护之前，所述方法还包括：所述用户设备获取所述用户设备当前的安全上下文。
在一个可能的设计中，所述用户设备获取所述用户设备当前的安全上下文，包括：所述用户设备获取自身存储的所述用户设备当前的安全上下文；或者所述用户设备触发所述移动 管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文。当用户设备接入网络，并完成鉴权并激活安全保护之后，用户设备和移动管理网元上将建立有相同/相应的当前的安全上下文，但是因为某些原因，可能会导致用户设备上的当前的安全上下文丢失。当用户设备找不到当前的安全上下文的时候，一种可能的实现是将自身保存的其他安全上下文设置为当前的安全上下文，另一种可能的实现方式是触发移动管理网元对用户设备进行重新鉴权，进而重新建立新的相同的当前的安全上下文。
在一个可能的设计中，所述寻呼消息还包括第二安全上下文标识，所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文；所述用户设备根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护，包括：在所述用户设备自身存储的安全上下文中存在与所述第二安全上下文标识对应的安全上下文的情况下，将与所述第二安全上下文标识对应的安全上下文设置为用户设备当前的安全上下文，使用新设置的当前的安全上下文激活NAS安全保护；或者，在所述用户设备自身存储的安全上下文中不存在与所述第二安全上下文标识对应的安全上下文的情况下，所述用户设备触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文；使用新建立的当前的安全上下文激活NAS安全保护。网络层将移动管理网元使用的当前的安全上下文的标识通过寻呼请求下发给用户设备，在接收下行数据之前，先实现上下文的同步，从而避免了两端安全上下文不同步导致的数据重传。
第二方面，提供一种数据传输的方法，该方法包括：移动管理网元接收会话管理网元发送的下行数据通知消息，所述下行数据通知消息包括第一指示信息；所述移动管理网元根据所述第一指示信息，使用所述移动管理网元当前的安全上下文激活非接入层NAS安全保护；所述移动管理网元使用所述移动管理网元当前的安全上下文对用户设备的下行数据进行安全保护，并将安全保护后的下行数据封装在第一下行NAS消息中；所述移动管理网元通过接入网设备向所述用户设备发送所述第一下行NAS消息。本申请实施例中，移动管理网元在接收到会话管理网元发送的下行数据通知消息之后，激活NAS安全保护，并使用当前安全上下文下行数据进行安全保护，然后再将安全保护后的下行数据发送给用户设备。通过本申请实施例的方法，可以确保用户设备的下行数据不会被非法设备截取。
在一个可能的设计中，在所述移动管理网元接收会话管理网元发送的下行数据通知消息之后，所述方法还包括：所述移动管理网元向接入网设备发送第一寻呼请求，所述第一寻呼请求包括所述用户设备的标识和第二指示信息；所述第二指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示；所述移动管理网元接收所述接入网设备发送的下行数据获取请求，所述下行数据获取请求包括所述用户设备的标识。本申请实施例中移动管理网元根据会话管理网元的第一指示信息，确定需要使用下行数据早传流程传输所述下行数据，所以向所述接入网设备寻呼用户设备的时候会下发第二指示信息，以便于接入网设备为用户设备分配特定的资源。后续用户设备使用分配的特定的资源发起随机接入流程时，接入网设备可以向移动管理网元请求下行数据，并转发给用户设备。
在一个可能的设计中，所述方法还包括：所述移动管理网元接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中；所述移动管理网元使用所述移动管理网元当前的安全上下文解安全保护 所述第一上行NAS消息，获取所述反馈信息；所述移动管理网元根据所述反馈信息，删除缓存的所述下行数据。本申请实施例的中，移动管理网元102在收到用户设备105发送的反馈信息之前可以一直存储所述下行数据，直到收到所述反馈信息之后，再删除自身存储的所述下行数据，这样可以确保正确的用户设备可以接收到所述下行数据。
在一个可能的设计中，所述方法还包括：所述移动管理网元接收所述用户设备发送的经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识；其中，第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述第二上行NAS消息使用所述用户设备当前的安全上下文进行安全保护；所述移动管理网元根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，以使得所述移动管理网元和所述用户设备建立有相同的当前的安全上下文；所述移动管理网元使用所述移动管理网元当前的安全上下文对所述下行数据进行安全保护，并将安全保护后的下行数据封装在第二下行NAS消息中；所述移动管理网元通过所述接入网设备向所述用户设备发送所述第二下行NAS消息。在用户设备和移动管理网元各自的当前安全上下文不一致的情况下，提供了用户设备和移动管理网元之间进行上下文同步的方法。移动管理网元使用同步后的当前的安全上下文重新安全保护下行数据，并将安全保护后的下行数据发送给用户设备。因为用户设备和移动管理网元之间已经进行了安全上下文同步，所以可以确保用户设备可以正确的解安全保护所述下行NAS消息，进而获得所述下行数据。在一个可能的设计中，所述移动管理网元根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，包括：所述移动管理网元将自身存储的与所述第一安全上下文标识对应的安全上下文设置为自身当前的安全上下文；或者，所述移动管理网元确定自身没有存储与所述第一安全上下文标识对应的安全上下文；所述移动管理网元通过重新鉴权流程，建立与所述用户设备相同的当前的安全上下文。
在一个可能的设计中，所述第二上行NAS消息为控制面服务请求CPSR消息。
在一个可能的设计中，所述第一下行NAS消息中还包括第二安全上下文标识，所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。本申请实施例中，移动管理网元在下发安全保护的下行数据时，同步通知用户设备对所述下行数据进行安全保护所使用的安全上下文，以便于用户设备使用正确的安全上下文进行解安全保护下行NAS消息，获得下行数据。
在一个可能的设计中，所述第一寻呼请求中还包括第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。本申请实施例中，移动管理网元在下发安全保护的下行数据之前，通过寻呼请求通知用户设备对后续所述下行数据进行安全保护所使用的安全上下文，以便于用户设备使用正确的安全上下文进行解安全保护后续的下行NAS消息，获得下行数据。
在一个可能的设计中，所述第一指示信息包括：下行数据早传指示或所述下行数据的数据量的指示。
第三方面，提供一种数据传输的系统，该系统包括移动管理网元和会话管理网元；
所述会话管理网元，用于向所述移动管理网元发送下行数据通知消息，所述下行通知消息包括第一指示信息；所述移动管理网元，用于根据所述第一指示信息，使用移动管理网元当前的安全上下文激活非接入层NAS安全保护；使用所述移动管理网元当前的安全上下文对用户设备的下行数据进行安全保护，并将安全保护后的下行数据封装在第一下行 NAS消息中；通过接入网设备向所述用户设备发送所述第一下行NAS消息。
在一个可能的设计中，所述移动管理网元，还用于接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中；使用所述移动管理网元当前的安全上下文解安全保护所述第一上行NAS消息，获取所述反馈信息；根据所述反馈信息，删除缓存的所述下行数据。
在一个可能的设计中，所述移动管理网元，还用于在接收会话管理网元发送的下行数据通知消息之后，向接入网设备发送第一寻呼请求，所述第一寻呼请求包括所述用户设备的标识和第二指示信息；所述第二指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示；接收所述接入网设备发送的下行数据获取请求，所述下行数据获取请求包括所述用户设备的标识。
在一个可能的设计中，所述移动管理网元，还用于接收所述用户设备发送的经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识；其中，第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述第二上行NAS消息使用所述用户设备当前的安全上下文进行安全保护；根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，以使得所述移动管理网元和所述用户设备建立有相同的当前的安全上下文；使用所述移动管理网元当前的安全上下文对所述下行数据进行安全保护，并将安全保护后的下行数据封装在第二下行NAS消息中；通过所述接入网设备向所述用户设备发送所述第二下行NAS消息。
在一个可能的设计中，所述移动管理网元，还用于接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第三上行NAS消息中；使用所述移动管理网元当前的安全上下文解安全保护所述第三上行NAS消息，获取所述反馈信息；根据所述反馈信息，删除缓存的所述下行数据。
在一个可能的设计中，所述移动管理网元，用于根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，包括：将所述移动管理网元自身存储的与所述第一安全上下文标识对应的安全上下文设置为自身当前的安全上下文；或者，在自身没有存储与所述第一安全上下文标识对应的安全上下文的情况下，重新鉴权流程，建立与所述用户设备相同的当前的安全上下文。
在一个可能的设计中，所述第二上行NAS消息为控制面服务请求CPSR消息。
在一个可能的设计中，所述第一下行NAS消息中还包括第二安全上下文标识，所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。
在一个可能的设计中，所述第一寻呼请求中还包括第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。
在一个可能的设计中，所述第一指示信息包括：下行数据早传指示或所述下行数据的数据量的指示。
第四方面，提供一种通信装置，该装置具有实现上述第一方面和第一方面的任一种可能的设计的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，该装置可以是芯片或者集成电路。
在一个可能的设计中，该装置包括收发器和处理器，收发器用于与其他通信设备进行通信，处理器用于与存储器进行耦合，执行存储器存储的程序，当程序被执行时，所述装 置可以执行上述第一方面和第一方面的任一种可能的设计中所述的方法。
在一个可能的设计中，该装置还包括存储器，用于存储处理器执行的程序。
在一个可能的设计中，该装置为终端或者终端内的芯片。
第五方面，提供一种通信装置，该装置具有实现上述第二方面和第二方面的任一种可能的设计的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，该装置可以是芯片或者集成电路。
在一个可能的设计中，该装置包括收发器和处理器，收发器用于与其他通信设备进行通信，处理器用于与存储器进行耦合，执行存储器存储的程序，当程序被执行时，所述装置可以执行上述第二方面和第二方面的任一种可能的设计中所述的方法。
在一个可能的设计中，该装置还包括存储器，用于存储处理器执行的程序。
在一个可能的设计中，该装置为移动管理网元。
第六方面，提供一种芯片，该芯片与存储器相连或者该芯片包括存储器，用于读取并执行所述存储器中存储的软件程序，以实现如上述第一方面、第二方面、第一方面的任一种可能的设计或第二方面的任一种可能的设计中所述的方法。
第七方面，提供一种计算机存储介质，存储有计算机程序，该计算机程序包括用于执行上述各方面和各方面的任一可能的设计中方法的指令。
第八方面，提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述各方面和各方面的任一可能的设计中所述的方法。
第九方面、提供了一种数据传输的方法，包括用户设备从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；所述用户设备向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；所述用户设备接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据以及第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文；所述用户设备根据所述第二安全上下文标识，激活非接入层NAS安全保护；所述用户设备使用用户设备当前的安全上下文解安全保护所述第一下行NAS消息以获得所述下行数据；所述用户设备通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。本申请实施例中，用户设备接收到的下行NAS消息中包括了移动管理设备安全保护所述下行NAS消息所使用的安全上下文的指示信息(即第二安全上下文的标识)，用户设备根据该安全上下文的指示信息，与所述移动管理网元进行安全上下文同步，从而正确的解安全保护下行NAS消息获取所述下行数据。
在一个可能的设计中，所述寻呼消息还包括用于指示下行数据早传的指示信息。
在一个可能的设计中，所述下行数据早传的指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示。
在一个可能的设计中，所述用户设备根据第二安全上下文标识，激活非接入层NAS安全保护，包括：所述用户设备将自身存储的安全上下文中与所述第二第二安全上下文标识相对应的安全上下文设置为当前的安全上下文，并使用新设置的当前的安全上下文激活NAS安全保护；或者，在所述用户设备自身存储的安全上下文中不存在与所述第二安全上 下文标识对应的安全上下文的情况下，所述用户设备触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文。
第十方面，提供一种通信装置，该装置具有实现上述第一方面和第一方面的任一种可能的设计的功能。所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
在一个可能的设计中，该装置可以是芯片或者集成电路。
在一个可能的设计中，该装置包括收发器和处理器，收发器用于与其他通信设备进行通信，处理器用于与存储器进行耦合，执行存储器存储的程序，当程序被执行时，所述装置可以执行上述第一方面和第一方面的任一种可能的设计中所述的方法。
在一个可能的设计中，该装置还包括存储器，用于存储处理器执行的程序。
在一个可能的设计中，该装置为终端或者终端内的芯片。
其中，第三方面至第十方面中任一种设计方式所带来的技术效果可参见上述第一方面或第二方面中不同设计方式所带来的技术效果，此处不再赘述。
附图说明
图1为本申请实施例中系统架构示意图；
图2为本申请实施例中的一种下行数据早传的流程示意图；
图3为本申请实施例中的又一种下行数据早传的流程示意图；
图4为本申请实施例中的又一种下行数据早传的流程示意图；
图5为本申请实施例中的又一种下行数据早传的流程示意图；
图6为本申请实施例中通信装置结构示意图之一；
图7为本申请实施例中通信装置结构示意图之二。
具体实施方式
下面将结合附图，对本申请实施例的方案进行详细描述。
本申请实施例提供一种数据传输的方法及装置，用于在下行数据早传的过程中，激活通信设备上的安全上下文，从而避免数据早传过程中相关的安全问题。其中，方法和装置是基于同一构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。本申请实施例的描述中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。本申请中所涉及的至少一个是指一个或多个；多个，是指两个或两个以上。另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
下面将对本申请实施例涉及的名称或术语进行介绍：
安全上下文：安全上下文是终端设备和服务网络在本地建立的状态，可以通过存储的安全数据表示，这些安全数据可以包含密钥集标识(Key Set Identifier,KSI)，根密钥Kamse/Kamf。可选的，还可以包含NAS加密密钥Knas-enc，NAS完整性密钥Knas-int，使 用的加密算法和完整性保护算法中的一个或者多个。其中，密钥集标识用于标识安全上下文，具体的，可以用于标识安全上下文中的密钥集，例如根密钥，NAS加密密钥，NAS完整性密钥等。安全上下文中可能还包括其他参数，例如，上行和下行非接入层(Non-Access Stratum,NAS)计数器(COUNT)等，本申请不作限定。需要说明的是，两个通信实体要能够安全的进行数据交换，必须要有相同的安全上下文。这里的“相同”也可以理解为“相应”，也就是说两个通信实体安全上下文中的密钥集标识、根密钥、NAS加密密钥Knas-enc，NAS完整性密钥Knas-int，使用的加密算法和完整性保护算法需要相同，也可能会存在个别参数不一样。当前的安全上下文：终端设备和网络设备中最近被激活的安全上下文。其中，激活安全上下文，是指使用该安全上下文对消息进行安全保护。最近被激活的安全上下文，即最近对消息进行安全保护时使用的安全上下文。
非当前的安全上下文：终端设备和网络设备中存储的除了当前的安全上下文以外的其他安全上下文。
加密保护：保护数据在传输过程中的机密性(因此又可以被称作机密性保护)，机密性是指无法被直接看出真实内容。加密保护一般可以使用密钥和加密算法对数据进行加密来实现。解密一般可以使用密钥和加密算法对加密数据进行解密来实现。加密保护和解密的具体方法可以参考3GPP TS 33.401f50中8.2节或33.501f50中6.4.4节标准相关描述，这里不再赘述。
完整性校验和保护：完整性校验和保护用于判断消息在传递过程中，其内容是否被更改，也可以用于作为身份验证，以确认消息的来源。完整性校验和保护需要使用消息认证码(Message Authentication Code,MAC)。完整性校验和保护的具体方法可以参考3GPP TS33.401f50中8.1节或33.501f50中6.4.3节标准相关描述，这里不再赘述。
对于接收端来说，接收端可以将接收到的MAC与自身生成的MAC(标准中称为XMAC)进行比对，以校验完整性，从而验证发送端的身份或判断消息是否被篡改。若MAC与XMAC相同，则接收端确定接收到的MAC通过验证，从而接收端能够确定发送端通过身份验证并信任接收的消息；若MAC与XMAC不相同，则接收端能够确定接收到的MAC未通过验证，从而接收端能够确定发送端未通过身份验证。通常情况下，完整性校验未通过，接收端直接丢弃该消息。
激活NAS完整性保护：一旦激活NAS完整性保护，代表后续上行/下行NAS消息的完整性保护都需要根据当前的安全上下文的NAS完整性密钥和NAS完整性保护算法采取一致的处理。所有没有NAS完整性保护的消息都不被接受，需要被丢弃，但部分特殊的NAS消息可以除外，如附着请求、位置区更新请求、服务请求、控制面服务请求、认证请求、身份请求等。例如，用户设备激活NAS完整性保护后，每次发送上行NAS消息，都会对上行NAS消息根据当前的安全上下文的NAS完整性密钥和NAS完整性保护算法进行完整性保护；每次接收下行NAS消息，都会对下行NAS消息根据当前的安全上下文的NAS完整性密钥和NAS完整性保护算法进行完整性校验。移动管理网元激活NAS完整性保护后，每次收到上行NAS消息，都会对上行NAS消息根据当前的安全上下文的NAS完整性密钥和NAS完整性保护算法进行完整性校验，每次发送下行NAS消息，都会对下行NAS消息根据当前的安全上下文的NAS完整性密钥和NAS完整性保护算法进行完整性保护。
激活NAS加密保护：一旦激活NAS加密保护，代表后续对于上行/下行NAS消息的加密保护都需要根据当前的安全上下文的NAS加密密钥和NAS加密算法采取一致的处理。所 有没有NAS加密保护的消息都不被接受，需要被丢弃。例如，用户设备激活NAS完整性保护后，每次发送上行NAS消息，都会对上行NAS消息根据当前的安全上下文的NAS加密密钥和NAS加密算法进行加密保护，每次接受下行NAS消息，都会对下行NAS消息根据当前的安全上下文的NAS加密密钥和NAS加密算法进行解密。移动管理网元激活NAS完整性保护后，每次收到上行NAS消息，都会对上行NAS消息根据当前的安全上下文的NAS加密密钥和NAS加密算法进行解密，每次发送下行NAS消息，都会对下行NAS消息根据当前的安全上下文的NAS加密密钥和NAS加密算法进行加密保护。
图1示出了本申请实施例提供的数据传输方法适用的一种可能的通信系统的架构，参阅图1所示，通信系统100中包括接入网设备101、移动管理网元102、会话管理网元103以及用户面功能网元104。可选的，还可以包括用户设备105。需要说明的是，本申请对上述系统中包括的每一种网元的数量并不做限定，例如，上述系统中可能包括一个或者多个接入网设备101。每个接入网设备101可以为覆盖范围内的一个或多个用户设备105提供接入服务。多个接入网设备101之间可以通过接口(例如，X2接口或者Xn接口)相连以进行通信，接入网设备101与移动管理网元102之间通过接口(例如，S1接口或者N2接口)相连以进行通信。移动管理网元102与会话管理网元103之间通过接口(例如，S11接口或者N11接口)相连以进行通信。会话管理网元103与用户面功能网元104之间通过接口(例如，S5接口或者N4接口)相连以进行通信。以下对通信系统中包括的接入网设备101、移动管理网元102、会话管理网元103、用户面管理网元104以及用户设备105的形态进行举例说明。
接入网设备101为具有无线收发功能的设备或可设置于该设备的芯片，该设备包括但不限于：演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved NodeB，或home Node B，HNB)、基带单元(baseband unit，BBU)，无线保真(wireless fidelity，WIFI)系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission and reception point，TRP或者transmission point，TP)等，还可以为5G(如NR)系统中的基站gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)等。在一些部署中，gNB可以包括集中式单元(centralized unit，CU)和DU。gNB还可以包括射频单元(radio unit，RU)。CU实现gNB的部分功能，DU实现gNB的部分功能，比如，CU实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能，DU实现无线链路控制(radio link control，RLC)、媒体接入控制(media access control，MAC)和物理(physical，PHY)层的功能。由于RRC层的信息最终会变成PHY层的信息(即通过PHY层发送)，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令或PDCP层信令，也可以认为是由DU发送的，或者，由DU+RU发送的。可以理解的是，接入网设备101可以为CU节点、或DU节点、或包括CU节点和DU节点的设备。接入网设备101的具体形态在此不做限制。
移动管理网元102例如可以是第四代(4th Generation，4G)系统中的移动管理实体 (mobile management entity，MME)、第五代(5th Generation，5G)系统中的接入和移动性管理功能(access and mobility management function，AMF)或者是后续演进系统中具有类似功能的网元。移动管理网元102用于负责用户设备105的接入和移动性管理等，具体的功能可以参考现有标准中的相关描述，例如4G系统中的MME的功能可以参考3GPP TS 23.401g10 4.4.2章节相关描述，5G系统中的AMF的功能可以参考3GPP TS23.501f50 6.2.1章节相关描述。接入网设备101与移动管理网元102之间通过S1或N2接口相连，传输接入网设备101与移动管理网元102之间交互的消息。用户设备105与移动管理网元102通过NAS协议进行通信，用户设备105和移动管理网元102交互的消息通常由接入网设备101中转到移动管理网元102。
会话管理网元103例如可以是第四代(4th Generation，4G)系统中的服务网关(Serving Gateway，S-GW)、第五代(5th Generation，5G)系统中的会话管理功能(Session Management Function，SMF)或者是后续演进系统中具有类似功能的网元。会话管理网元103用于负责用户设备105的会话管理等功能，具体的功能可以参考现有标准中的相关描述，例如4G系统中的S-GW的功能可以参考3GPP TS 23.401 g10 4.4.3.2章节相关描述，5G系统中的SMF的功能可以参考3GPP TS23.501 f50 6.2.2章节相关描述。
用户面管理网元104例如可以是第四代(4th Generation，4G)系统中的分组数据网络网关(Packet Data Network Gateway，P-GW)、第五代(5th Generation，5G)系统中的用户面功能(User Plane Function，UPF)或者是后续演进系统中具有类似功能的网元。用户面管理网元104是用户面数据的传输锚点，负责传输用户设备105的用户面数据。具体的功能可以参考现有标准中的相关描述，例如4G系统中的P-GW的功能可以参考3GPP TS 23.401 g10 4.4.3.3章节相关描述，5G系统中的UPF的功能可以参考3GPP TS23.501 f506.2.3章节相关描述。
用户设备105又称接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、用户终端、终端、无线通信设备、用户代理或用户装置等。本申请的实施例中的用户设备可以是手机(mobile phone)、平板电脑(Pad)、带无线收发功能的电脑、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请的实施例对应用场景不做限定。本申请中将具有无线收发功能的终端及可设置于前述终端的芯片统称为用户设备。用户设备105与网络侧设备进行通信需要依靠多个协议层。例如，用户设备105通过无线资源控制(radio resource control,RRC)层与接入网设备101进行通信，通过非接入层(Non-Access Stratum,NAS)与AMF进行通信。通常情况下，RRC层与NAS层相互不影响，但是在某些特殊情况下，RRC层与NAS层之间也会进行通信，交换一些参数。用户设备105和接入网设备101之间的通信包括控制面通信和用户面通信，其中，控制面通过RRC协议进行交互。
本申请中的用户面管理网元104可以与外部网络进行数据通信，外部网络可以是因特网(internet)，私有的IP网，或其它数据网等。
本申请的数据早传方案可以应用在机器类通信(Machine Type Communication，MTC) 场景或者窄带物联网(Narrow Band Internet of Things，NB-IoT)通信场景下。在这类场景下，由于传输的数据量较小，且传输间隔较大，所以数据传输不使用传统的用户面作为数据传输通道，而是使用控制面作为数据传输通道。因此，本申请中下行数据是通过用户面管理网元104传输至会话管理网元103，再通过会话管理网元103传输至移动管理网元102，移动管理网元102通过NAS消息传输到用户设备105。
本申请实施例提供的数据传输的方法可以应用于各种通信系统。例如，可以应用于第四代(4th generation，4G)通信系统、第五代(5th generation，5G)通信系统或未来的各种通信系统。
本申请实施例提供的方法可以应用于下行数据早传(mobile terminated early data transmission，MT-EDT)的应用场景，在MT-EDT的应用场景下，早传的下行数据可以具有以下任意一个或多个特点：
1、下行数据可一次传输完成，即终端的下行数据可以通过一条消息传输完。
2、单个下行数据包，即移动管理网元102可以通过一个数据包(例如网络协议IP数据包)发送终端的下行数据，表示为单个下行数据包(single packet)，或者单个下行数据(single DL data)。
3、下行小数据包，或小数据包，可以理解为待发送给用户设备105的下行数据的数据量(data volume)小于一个阈值。
4、下行数据在随机接入响应消息(MSG2)中发送给用户设备105。
需要说明的是，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
为方便对下行数据早传的场景的理解，如图2所示，一种可能的下行数据早传的方法流程如下所述。
S201、用户面管理网元104接收到用户设备105的下行数据时，将该下行数据发送至会话管理网元103，会话管理网元103从用户面管理网元104接收用户设备105的所述下行数据。
S202a、会话管理网元103向移动管理网元102发送下行数据通知(downlink data notification)消息。移动管理网元102从会话管理网元103接收该下行数据通知消息。
所述下行数据通知消息用于指示用户设备105的下行数据到达。
该下行数据通知消息可以携带第一指示信息。该第一指示信息用于指示是否发起MT-EDT流程以传输所述下行数据。该第一指示信息具体可以是MT-EDT指示或该下行数据的数据量(data volume)的指示。
其中，MT-EDT指示用于指示是否发起下行数据早传流程。具体的，当MT-EDT指示取第一预设值的时候，代表需要发起下行数据早传流程；当MT-EDT指示取第二预设值的时候，代表不需要发起下行数据早传流程。例如，该MT-EDT指示可以是一个二级制的参数，取值为1代表发起下行数据早传流程，取值为0代表不发起下行数据早传流程。或者，MT-EDT指示本身用于指示需要发起下行数据早传流程，例如，当下行数据通知消息中携带MT-EDT指示时，代表需要发起下行数据早传流程；否则，代表不需要发起下行数据早传流 程。
下行数据的数据量用于指示下行数据的大小/长度，所述下行数据的数据量可以用于判断是否发起下行数据早传流程，例如，若数据量小于某个阈值，则移动管理网元102决定发起下行数据早传流程，否则移动管理网元102决定不发起下行数据早传流程。
可选的，该下行数据通知消息还可以携带该下行数据。或者，该下行数据可以在后续移动管理网元与会话管理网元交互过程中发送。
S202b、移动管理网元102向会话管理网元103发送下行数据通知确认(downlink data notification ACK)消息。会话管理网元103从移动管理网元102接收该下行数据通知确认消息。
S203、若步骤202a中的下行数据通知消息中携带该下行数据，则移动管理网元102缓存该下行数据。
S204、移动管理网元102向接入网设备101发送第一寻呼请求，该第一寻呼请求中包括第二指示信息。接入网设备101从移动管理网元102接收该第一寻呼请求。
该第二指示信息用于指示是否发起MT-EDT流程以传输所述下行数据。该第二指示信息具体可以是MT-EDT指示或该下行数据的数据量(data volume)的指示。
其中，该第一寻呼请求携带需要所述用户设备105的标识，例如系统架构演进临时移动用户标识(System Architecture Evolution Temporary Mobile Station Identifier，S-TMSI)。
S205、接入网设备101向用户设备105发送第二寻呼请求。
接入网设备101根据第一寻呼请求中携带的所述第二指示信息，确定需要为用户设备105分配特定的资源以传输所述下行数据。例如，当第一寻呼请求中携带MT-EDT指示时，接入网设备101根据MT-EDT指示确定需要为用户设备105分配特定的资源以传输下行数据；当第一寻呼请求中携带下行数据的数据量时，接入网设备101根据下行数据的数据量小于预设的阈值，确定需要为用户设备105分配特定的资源以传输下行数据。
该特定的资源可以是用于下行早传数据传输的资源，该资源例如可以是专有的物理随机接入信道(physical random access channel,PRACH)资源。所述PRACH资源可以包括随机接入前导码(preamble)。
所述第二寻呼请求包括所述特定的资源。可选的，接入网设备101在服务范围内广播所述第二寻呼请求，所述第二寻呼请求还包括所述终端设备105的标识(如S-TMSI)，所述终端设备105的标识用于指示所述第二寻呼请求寻呼的对象。当一个用户设备接收到第二寻呼请求时，只有在自身的标识与所述第二寻呼请求中的所述终端设备105的标识相同的情况下，才会响应所述第二寻呼请求。进一步的，所述接入网设备101保存所述用户设备105的标识和特定的资源的对应关系。
可选的，所述第二寻呼请求还包括第三指示信息。所述第三指示信息用于指示是否发起MT-EDT流程以传输所述下行数据。该第三指示信息具体可以是MT-EDT指示、该下行数据的数据量(data volume)的指示，或者其他任意可以用于指示用户设备105发起MT-EDT流程以传输所述下行数据的参数。用户设备105发起MT-EDT流程以传输所述下行数据，具体可以是指用户设备105通过接入网设备101分配的特定资源发起随机接入请求，并且在后续的随机接入响应(MSG2)中解析获取网络侧下发的下行数据。
需要说明的是，本申请实施例各个步骤中第一指示信息、第二指示信息以及第三指示 信息的作用都是类似的，即用于指示是否发起MT-EDT流程以传输下行数据，但是不同步骤中的指示信息的形式可能是不一样的，本申请实施例对此不作限制。
例如，本申请实施例中S202a、S204以及S205中的指示信息有多种可能的实现方式：
(1)所述下行数据通知消息携带第一指示信息为MT-EDT指示，所述第一寻呼请求中包括的第二指示信息也是MT-EDT指示，以及所述第二寻呼请求中包括的第三指示信息也是MT-EDT指示；
(2)所述下行数据通知消息携带第一指示信息为下行数据的数据量的指示，所述第一寻呼请求中包括的第二指示信息是MT-EDT指示；即，所述移动管理网元102需要根据所述下行数据的数据量判断是否发起下行数据早传流程，并通过MT-EDT指示指示接入网设备101是否发起下行数据早传流程；所述第二寻呼请求中包括的第三指示信息也是MT-EDT指示；
(3)所述下行数据通知消息携带第一指示信息为下行数据的数据量的指示，所述第一寻呼请求中包括的第二指示信息也是下行数据的数据量的指示，所述第二寻呼请求中包括的第三指示信息是MT-EDT指示；这种情况下，接入网设备101需要根据所述下行数据的数据量判断是否发起下行数据早传流程；
(4)所述下行数据通知消息携带第一指示信息为下行数据的数据量的指示，所述第一寻呼请求中包括的第二指示信息也是下行数据的数据量的指示，所述第二寻呼请求中包括的第三指示信息也是下行数据的数据量的指示；这种情况下，用户设备105需要根据所述下行数据的数据量判断是否发起下行数据早传流程。S206、用户设备105接收接入网设备101发送的第二寻呼请求。具体的，用户设备105获取所述第二寻呼请求中的所述特定的资源，并确定通过下行数据早传流程获取所述下行数据。
一种可能的实现方式中，用户设备105根据所述特定的资源和/或所述第三指示信息，确定执行S207的随机接入流程，并通过解析后续S209中接收到的随机接入响应，获取所述下行数据。
S207、用户设备105向接入网设备101发送随机接入请求，接入网设备101接收用户设备105发送的所述随机接入请求。
用户设备105可以根据所述接入网设备101为用户设备105分配的特定的资源，如所述PRACH资源，向接入网设备101发起随机接入流程。
所述随机接入请求也称消息1(MSG1)，用于请求获得上行同步。
其中，所述随机接入请求包括所述接入网设备101为用户设备105分配的特定的资源，例如所述PRACH资源。一种可能的实现方式是，所述随机接入请求包括所述随机接入前导码(preamble)。
S208、接入网设备101向移动管理网元102发送下行数据获取请求，所述下行数据获取请求用于向移动管理网元102封装请求所述用户设备105的所述下行数据。相应的，所述移动管理网元102接收接入网设备101发送的下行数据获取请求。
可选的，所述下行数据获取请求可以是非接入层协议数据单元(protocol data unit，PDU)请求(NAS PDU Request)。
具体的，接入网设备101接收到用户设备105发送的随机接入请求之后，根据所述随机接入请求中的所述特定的资源，确定所述用户设备105需要采用MT-EDT流程传输所述下行数据。进一步的，接入网设备101根据所述随机接入请求中的所述特定的资源确定所 述用户设备105的标识。其中，所述接入网设备101根据所述随机接入请求中的所述特定的资源，确定所述用户设备105的标识包括：接入网设备101根据所述随机接入请求中的所述特定的资源以及步骤205中保存的对应关系，确定所述用户设备105的标识，例如S-TMSI。
S209：如果移动管理网元102已经从会话管理网元103接收到所述下行数据(即S202a中下行数据通知中携带所述下行数据)，则移动管理网元102通过接入网设备101向用户设备105发送所述下行数据；否则，移动管理网元102从所述会话管理网元获取所述下行数据，然后再通过接入网设备101向用户设备105发送所述下行数据。相应的，用户设备105通过接入网设备101接收移动管理网元102发送的所述下行数据。
具体的，移动管理网元102根据下行数据获取请求请求携带的用户设备105的标识，获得所述下行数据，然后将所述下行数据携带在下行NAS消息中发送给用户设备105。
移动管理网元102通过接入网设备101向用户设备105发送所述下行数据，具体为：移动管理网元102向接入网设备101发送下行NAS消息，所述下行NAS消息包括所述下行数据；所述接入网设备101将所述下行NAS消息转发给用户设备105。具体的，接入网设备101可以通过随机接入响应消息(MSG2)将所述下行NAS消息转发给用户设备105。
在一种可能的实现中，所述下行NAS消息可以是下行NAS传输(downlink NAS transport)或者NAS安全模式命令消息。
S210：用户设备105成功接收到所述下行数据之后，通过接入网设备101向移动管理网元102发送反馈信息。所述反馈信息用于向移动管理网元102指示用户设备105已经成功收到所述下行数据。
S211：可选的，所述移动管理网元102接收到所述反馈信息之后，可以删除所述下行消息和/或释放S1/N2连接。
上述图2所示的下行数据早传的方法流程仅仅是一种举例，本申请实施例不局限于该方法流程，还可以适用于其它下行数据早传的应用场景。
进一步的，申请人在研究过程中发现在上述图2实施例中的步骤205中，由于接入网设备101向用户设备105发送第二寻呼请求是广播的并且是没有安全保护的，所以在所述接入网设备101服务范围内的任意用户设备都可以接收到该第二寻呼请求。如果一个恶意的用户设备伪造成用户设备105向接入网设备101发送随机接入请求并执行后续的相关步骤，那么用户设备105的下行数据将被恶意用户的设备获取，并且由于移动管理网元102在S213可能会删除所述下行数据，所以用户设备105也将无法获取所述下行数据。
为了确保用户设备105的下行数据不被恶意的用户设备非法截取，以及确保该下行数据可以被正确的发送给所述用户设备105，本申请实施例提供了又一种如图3所示的数据传输的方法。具体的，在下行数据早传过程中，用户设备105和移动管理网元102会分别使用各自当前的安全上下文激活NAS安全保护，对待发送给用户设备105的下行数据进行安全保护。此外，在本申请实施例中由于在传输下行数据之前，由于用户设备105和移动管理网元102之间没有NAS消息交互，所以用户设备105和移动管理网元102上的当前安全上下文可能并不相同，本申请实施例还提供了对用户设备105和移动管理网元102上的当前安全上下文进行同步的方法具体的细节，如下所述。
S301-S303同图2实施例中S201-S203，相关步骤请参考图2实施例相关描述，这里不再赘述。
S304、移动管理网元102确定使用当前的安全上下文激活NAS安全保护。其中，激活NAS安全保护可以包含激活NAS完整性保护和激活NAS加密保护。
可选的，移动管理网元102确定使用当前的安全上下文对后续接收的上行NAS消息进行解安全保护；其中，解安全保护可以包含对接收到的上行NAS消息进行完整性校验和解密。
可选的，移动管理网元102确定使用当前的安全上下文对后续发送的下行NAS消息进行安全保护；其中，安全保护可以包含对待发送的下行NAS消息进行完整性保护和加密。具体的，移动管理网元102根据所述第一指示信息，确定发起获取下行数据的流程，进而需要使用当前的安全上下文对后续发送的下行NAS消息进行安全保护。可选的，移动管理网元102根据所述第一指示信息，还确定对后续接收的上行NAS消息进行安全保护。
可选的，移动管理网元102根据所述第一指示信息确定以当前的安全上下文激活NAS安全保护。
具体的，移动管理网元102以当前的安全上下文中的完整性保护密钥Knas-int和完整性保护算法激活NAS完整性保护，并且，移动管理网元102以当前安全上下文的加密密钥Knas-enc和加密算法激活NAS加密保护。
可选的，如果移动管理网元102上不存在当前的安全上下文，则将自身存储的非当前的安全上下文设置为当前的安全上下文，并使用当前的安全上下文激活NAS安全。若当前的安全上下文中不包含NAS完整性保护密钥Knas-int或NAS加密密钥Knas-enc，则MME根据非当前的安全上下文包含的根密钥Kasme以及加密和完整性算法衍生相应的NAS加密密钥和NAS完整性保护密钥。
可选的，如果移动管理网元102上不存在所述用户设备105的任何安全上下文或者不存在当前的安全上下文，则所述移动管理网元102重新鉴权用户设备105，并建立新的安全上下文。移动管理网元102和用户设备105通过鉴权流程之后，将会拥有相同的当前的安全上下文。其中，通过鉴权流程重新建立安全上下文的流程具体为通过重新执行3GPP TS 33.401 f40 6.1章或3GPP TS 33.501 f50 6.1章所示的鉴权流程以及3GPP TS 33.401 f407.2.4.4章或3GPP TS 33.501 f50 6.7.2章所示的安全激活流程重新建立并激活安全上下文，这里不再赘述。
可选的，如果移动管理网元102上不存在当前的安全上下文，则通知所述用户设备105以建立安全上下文。一种实现方式为，移动管理网元错误的完整性保护下行NAS消息以触发步骤S316-S321，例如，移动管理网元可以随机生成下行NAS消息的MAC，以使得用户设备105校验消息失败。
S305-S307同图2实施例中S204-S206，相关步骤请参考图2实施例相关描述，这里不再赘述。
S308、用户设备105确定使用当前的安全上下文激活NAS安全保护。其中，激活NAS安全保护可以包含激活NAS完整性保护和激活NAS加密保护。
可选的，用户设备105确定使用当前的安全上下文对后续接收到的下行NAS消息进行解安全保护。其中，解安全保护可以包含对接收到的下行NAS消息进行校验完整性和解密。
可选的，用户设备105还确定使用当前的安全上下文对后续发送的上行NAS消息进行安全保护。其中，安全保护可以包含对待发送的上行NAS消息进行完整性保护和加密保护。
具体的，用户设备105根据所述第三指示信息和/或所述特定的资源，确定使用当前 的安全上下文激活NAS安全保护。即根据所述第三指示信息或者所述特定的资源，确定发起获取下行数据的流程，且使用当前的安全上下文对后续接收到的下行NAS消息进行解安全保护以及对后续待发送的上行NAS消息进行安全保护。
具体的，用户设备105根以当前的安全上下文中的完整性保护密钥Knas-int和完整性保护算法激活NAS完整性保护，并且，用户设备105以当前安全上下文的加密密钥Knas-enc和加密算法激活NAS加密保护。
S309-S310同图2实施例中S207-S208，相关步骤请参考图2实施例相关描述，这里不再赘述。
S311、如果移动管理网元102已经从会话管理网元103接收到所述下行数据(即S302a中下行数据通知中携带所述下行数据)，则移动管理网元102使用当前安全上下文对所述下行数据进行安全保护；否则，移动管理网元102先从所述会话管理网元103获取所述下行数据，然后使用当前安全上下文对所述下行数据进行安全保护。
具体的，移动管理网元102根据下行数据获取请求携带的用户设备105的标识，获得所述下行数据，然后将使用当前安全上下文对所述下行数据进行安全保护。
需要说明的是，S311可以在S304-S312之间任何时候执行，本申请实施例对其执行顺序不做限定。
S312、移动管理网元102通过接入网设备101向用户设备105发送安全保护后的下行数据；相应的，用户设备105通过接入网设备101接收移动管理网元102发送的所述安全保护后的下行数据。
具体的，移动管理网元102可以将所述安全保护后的下行数据携带在下行NAS消息中发送给用户设备105。下行NAS消息具体的形式可以参考S209中相关描述。
S313、用户设备105对接收到的下行NAS消息进行解安全保护，如果解安全保护成功则执行S314-S15；如果解安全保护失败，则执行S316-S321。
具体的，用户设备105对接收到的下行NAS消息进行解安全保护，包括：
所述用户设备105使用当前安全上下文的Knas-int和完整性保护算法对所述下行NAS消息进行完整性验证，验证通过之后，再使用当前安全上下文的Knas-enc和加密算法对下行NAS消息进行解密以获得明文的下行数据。
如果完整性验证通过，且可以解密获得明文的下行数据，则表示解安全保护成功；否则解安全保护失败。例如，如下几种情况中的一种或者多种，都可以认为是解安全保护失败：
(1)完整性验证失败；
(2)完整性验证成功，但是解密失败；
(3)下行NAS消息没有完整性保护；
(4)下行NAS消息没有加密保护。
用户设备105与移动管理网元102各自存储有当前安全上下文和/或非当前安全上下文。用户设备105与移动管理网元102要能够正常的通信，必须使用相同的当前安全上下文。但是在某些情况下，用户设备105与移动管理网元102各自的当前的安全上下文可能不一致，这可能是由于以下原因引起的：
(1)用户设备105自主删除了当前的安全上下文，并将非当前的安全上下文置为当前的安全上下文；
(2)用户设备105没有当前的安全上下文；
(3)移动管理网元102自主删除了当前的安全上下文，并将非当前的安全上下文置为当前的安全上下文
(4)移动管理网元102没有当前的安全上下文。
在当前的安全上下文不一致的情况下，用户设备105在S313解安全保护将失败，因此执行步骤S316-S321以同步用户设备105和移动管理网元102的当前的安全上下文。
S314、用户设备105通过接入网设备101向移动管理网元102发送经过安全保护的反馈信息。
具体的，用户设备105对接收到的下行NAS消息进行解安全保护之后，成功获取所述下行数据之后，可以向移动管理网元102发送确认成功收到所述下行数据的反馈信息。所述反馈信息可以携带在一个上行NAS消息(用第一上行NAS消息指代)中，用户设备105可以使用当前的安全上下文对该第一上行NAS消息进行安全保护。
S315、移动管理网元102通过接入网设备101接收来自用户设备105的第一上行NAS消息之后，对接收到的第一上行NAS消息进行解安全保护，获得所述反馈信息。
可选的，所述移动管理网元102获得所述反馈信息之后，可以删除缓存的所述下行数据和/或释放S1/N2连接。
由于第一上行NAS消息是由用户设备105安全保护的，所以当移动管理网元102对接收到的第一上行NAS消息进行解安全保护，获得所述反馈信息之后，移动管理网元102可以确定用户设备105已经获得所述下行数据。由于其他非法的设备无法伪造用户设备105发送所述上行NAS消息，所以可以笔迷恶意的设备伪装成真实的用户设备105获取所述下行数据，进而使得真实的用户设备105无法获得所述下行数据。
S316、用户设备105通过接入网设备101向移动管理网元102发送经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和用户设备的标识(例如，S-TMSI)。第一安全上下文标识用于指示用户设备105使用的当前安全上下文，第一安全上下文标识可以是密钥标识符也可以是用户设备105没有当前的安全上下文的指示信息。
可选的，所述第二上行NAS消息可以是控制面服务请求(Control Plane Service Request，CPSR)消息。
其中，对于S313所述的原因(1)或(3)场景下，所述第二上行NAS消息具体包括第一安全上下文标识、用户设备的标识以及第一MAC。其中，所述第一安全上下文标识KSI用于指示用户设备105自身当前的安全上下文中的密钥标识符，例如可以是用户设备105当前的安全上下文中保存的密钥标识符；所述第一MAC是用户设备105根据自身当前的安全上下文，对所述第二上行NAS消息进行完整性保护生成的MAC。
对于S313所述的原因(2)或(4)场景下，所述第二上行NAS消息包括第一安全上下文标识以及用户设备的标识。其中，所述第一安全上下文标识用于指示用户设备105没有当前的安全上下文，例如第一安全上下文标识可以是一个特殊的密钥标识符，如置密钥标识符为二进制“0111”或“1111”，当然也可以是其他预设的指示信息。
S317、移动管理网元102接收到所述第二上行NAS消息之后，若移动管理网元102具备第一安全上下文标识所指示的安全上下文，则使用所述第一安全上下文标识对应的安全上下文对是第二NAS信息解安全保护，解安全保护成功之后，激活所述第一安全上下文标 识对应的安全上下文，并且使用新激活的安全上下文安全保护所述下行数据。
一种实现方式为，移动管理网元102根据所述第二上行NAS消息中密钥标识符KSI和用户设备的标识，获得用户设备105的安全上下文，并根据获取到的安全上下文中的Knas-int和完整性保护算法对上行NAS消息进行完整性验证(即根据获取到的安全上下文中的Knas-int和完整性保护算法计算得到第二MAC，并比较第一MAC是否与第二MAC相同；相同的话，则完整性验证成功，否则，失败。)，完整性验证成功之后，移动管理网元102激活所述KSI对应的安全上下文，并且使用新激活的安全上下文安全保护所述下行数据。
若移动管理网元102不具备第一安全上下文标识所指示的安全上下文或第一安全上下文标识指示用户设备105没有当前的安全上下文，则移动管理网元102重新鉴权用户设备105，并建立新的安全上下文。移动管理网元102和用户设备105通过鉴权流程之后，将会拥有相同的当前安全上下文。其中，通过鉴权流程重新建立安全上下文的流程具体为通过重新执行3GPP TS 33.401 f40 6.1章或3GPP TS 33.501 f50 6.1章所示的鉴权流程以及3GPP TS 33.401 f40 7.2.4.4章或3GPP TS 33.501 f50 6.7.2章所示的安全激活流程重新建立并激活安全上下文，这里不再赘述。
一种实现方式为，移动管理网元102根据所述第二上行NAS消息中密钥标识符KSI指示为“0111”，决定重新鉴权用户设备105，移动管理网元102向用户设备105发送鉴权请求消息，用户设备105回复移动管理网元102鉴权响应消息，完成鉴权。之后，移动管理网元102向用户设备105发送安全模式命令消息，用户设备105回复移动管理网元102安全模式完成消息，完成安全上下文的建立，并激活新的安全上下文。移动管理网元102使用新激活的安全上下文安全保护所述下行数据。
S318可以参考S312相关的描述，不一样的地方在于，S318和S312中移动管理网元102发送的安全保护后的下行数据并不一样，具体来说，移动管理网元102使用了不一样的安全上下文对所述下行数据进行了安全保护。在S313中，用户设备105之所以会解安全保护失败，是因为移动管理网元102和用户设备105使用了不一样的安全上下文。本申请实施例中，在S313中用户设备105对下行NAS消息解安全保护失败之后，通过S316向移动管理网元发送自身使用的安全上下文的指示信息(即用户设备105的标识和密钥标识符)，从而实现了用户设备105和移动管理网元102之间的上下文同步。
S319、用户设备105对接收到的下行NAS数据包进行解安全保护。
具体的细节可以参考S313。由于此时用户设备105和移动管理网元102的安全上下文已经同步，所以用户设备105必然可以成功解安全保护该下行NAS数据包。
S320-S321同S314-S315，相关步骤请参考图2实施例相关描述，这里不再赘述。
在本申请实施例中，移动管理网元102从会话管理网元103收到MT-EDT指示之后，使用自身的当前安全上下文激活NAS安全保护，并且通过接入网设备101寻呼用户设备105。用户设备105收到用于触发下行数据早传的寻呼消息之后，使用自身的当前安全上下文激活NAS安全保护。用户设备105响应网络侧的寻呼，发起随机接入流程之后，移动管理网元102使用自身当前的安全上下文对下行数据进行安全保护，将下行数据封装在下行NAS消息中发送给用户设备105。用户设备105接收到下行NAS消息之后，使用自身的当前的安全上下文对接收到的下行NAS消息进行解安全保护，如果解安全保护成功，则用户设备105向移动管理网元102发送成功接收下行数据的反馈信息，该反馈信息使用用户设备105自身当前的安全上下文进行安全保护；如果解安全保护失败，则用户设备105与 移动管理网元102进行安全上下文同步，并且在安全上下文同步之后，移动管理网元102使用同步后的当前的安全上下文安全保护所述下行数据，移动管理网元102使用自身当前的安全上下文对下行数据进行安全保护，并将下行数据封装在下行NAS消息中发送给用户设备105。用户设备105接收到下行NAS消息之后，使用自身的当前的安全上下文对接收到的下行NAS消息进行解安全保护得到所述下行数据，随后，用户设备105向移动管理网元102发送成功接收下行数据的反馈信息。移动管理网元102在收到用户设备105发送的反馈信息之前可以一直存储所述下行数据，直到收到所述反馈信息之后，再删除自身存储的所述下行数据。本申请实施例提供了一种移动管理网元102将下行数据通过控制面的NAS消息安全的发送给用户设备105的方法。具体的，本申请实施例提供了一种在MT-EDT场景下，激活用户设备105和移动管理网元102NAS安全保护的方法，并且在用户设备105和移动管理网元102各自的当前安全上下文不一致的情况下，提供了用户设备105和移动管理网元102之间进行上下文同步的方法。
本申请实施例提供了又一种如图4所示的数据传输的方法。具体的，在下行数据早传过程中，移动管理网元102使用当前的安全上下文激活NAS安全保护，并在寻呼用户设备105的过程中将自己使用的当前的安全上下文通知给用户设备105。用户设备105收到寻呼之后，使用与移动管理网元102相同的安全上下文激活NAS安全保护。从而，对用户设备105和移动管理网元102之间的早传数据进行安全保护。具体技术细节，如下：
S401-S404同图3实施例中S301-S304，相关步骤请参考图3实施例相关描述，这里不再赘述。
S405-S406同图3实施例中S305-S306，相关步骤请参考图3实施例相关描述，不一样的地方在于，第一寻呼消息和第二寻呼消息中需要携带移动管理网元102使用的当前的安全上下文对应的第二安全上下文标识，该第二安全上下文标识用于指示移动管理网元102使用的当前的安全上下文，例如可以是移动管理网元102使用的当前的安全上下文对应的KSI。
S407同图3实施例中S307，相关步骤请参考图3实施例相关描述。
S408、用户设备105根据所述第二安全上下文标识，激活NAS安全保护。
具体的，用户设备105可以根据所述第二安全上下文标识，确定自身存储的安全上下文，并使用确定的安全上下文激活NAS安全保护。即用户设备105将自身存储的安全上下文中与所述第二安全上下文标识相对应的安全上下文设置为当前的安全上下文，并使用新设置的当前的安全上下文激活NAS安全保护。
可选的，如果用户设备105本地没有第二安全上下文标识对应的安全上下文，则用户设备105可以触发移动管理网元102重新鉴权用户设备105，并建立新的安全上下文。移动管理网元102和用户设备105通过鉴权流程之后，将会拥有相同的当前安全上下文。其中，通过鉴权流程重新建立安全上下文的流程具体为通过重新执行3GPP TS 33.401 f40 6.1章或3GPP TS 33.501 f50 6.1章所示的鉴权流程以及3GPP TS 33.401 f40 7.2.4.4章或3GPP TS 33.501 f50 6.7.2章所示的安全激活流程重新建立并激活安全上下文，这里不再赘述。
S409-S415同图3实施例中S309-S315，相关步骤请参考图3实施例相关描述，这里不再赘述。
需要说明的是，由于在S413之前，用户设备105和移动管理网元102已经进行了安 全上下文同步，所以在S413用户设备105可以成功解安全保护下行NAS消息。
本申请实施例还提供了一种如图5所示的数据传输的方法。具体的，在下行数据早传过程中，移动管理网元102使用当前的安全上下文激活NAS安全保护，并在向用户设备发送下行NAS消息中将自己使用的当前的安全上下文通知给用户设备105。用户设备105收到下行NAS消息之后，使用与移动管理网元102相同的安全上下文激活NAS安全保护。并使用相应的安全上下文对接收到的下行NAS消息进行解安全保护。从而，对用户设备105和移动管理网元102之间的早传数据进行安全保护。具体技术细节，如下：
S501-S510同图3实施例中S301-S310，相关步骤请参考图3实施例相关描述，这里不再赘述。
S511同图3实施例中S312，相关步骤请参考图3实施例相关描述，不一样的地方在于，下行NAS消息中需要携带移动管理网元102使用的当前的安全上下文对应的第二安全上下文标识，该第二安全上下文标识用于指示移动管理网元102使用的当前的安全上下文，例如可以是移动管理网元102使用的当前的安全上下文对应的KSI。
S512、用户设备105根据所述第二安全上下文标识，激活NAS安全保护。
具体的，用户设备105可以根据所述第二安全上下文标识，确定自身存储的安全上下文，并使用确定的安全上下文激活NAS安全保护。可选的，如果用户设备105本地没有第二安全上下文标识对应的安全上下文，则用户设备105可以触发移动管理网元102重新鉴权用户设备105，并建立新的安全上下文。移动管理网元102和用户设备105通过鉴权流程之后，将会拥有相同的当前安全上下文。其中，通过鉴权流程重新建立安全上下文的流程具体为通过重新执行3GPP TS 33.401 f40 6.1章或3GPP TS 33.501 f50 6.1章所示的鉴权流程以及3GPP TS 33.401 f40 7.2.4.4章或3GPP TS 33.501 f50 6.7.2章所示的安全激活流程重新建立并激活安全上下文，这里不再赘述。建立新的安全上下文之后，移动管理网元102可以使用新的安全上下文对下行数据进行安全保护，并将安全保护后的下行数据封装在下行NAS消息中发送给用户设备105，即重新执行411和412的步骤。
S513-S515同图4实施例中S413-S415，相关步骤请参考图4实施例相关描述。
基于上述方法实施例的同一构思，如图6所示，本申请实施例还提供一种通信装置600，该通信装置600具有执行上述方法实施例中用户设备105或移动管理网元102等设备执行的操作的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。例如，该通信装置600包括处理单元601和通信单元602。通信单元602用于执行方法实施例中发送和/或接收的步骤。处理单元601用于执行除发送接收外的其它步骤。进一步的，通信单元602可以包括发送单元和/或接收单元。该通信装置600可以是终端，也可以是终端内部的芯片或功能模块，当该通信装置600用于执行上述方法实施例中用户设备105执行的操作时：
通信单元602，用于从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；
处理单元601，用于根据所述寻呼消息，使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；
通信单元602，还用于向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安 全保护后的下行数据；以及在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息成功的情况下，通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
可选的，所述寻呼消息还包括用于指示下行数据早传的指示信息。其中，所述下行数据早传的指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示。
一种可能的实现方式中，处理单元601，用于根据所述寻呼消息，使用所述用户设备当前的安全上下文激活非接入层NAS安全保护，具体为：根据所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；或者，如果所述寻呼消息还包括用于指示下行数据早传的指示信息，则根据所述用于指示下行数据早传的指示信息和/或所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护。
一种可能的实现方式中，通信单元602，还用于在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息失败的情况下，通过所述接入网设备向所述移动管理网元发送使用所述用户设备当前的安全上下文进行安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识，其中，所述第一安全上下文标识用于指示所述用户设备当前的安全上下文；接收所述移动管理网元通过所述接入网设备发送的第二下行NAS消息，所述第二下行NAS消息包括所述移动管理网元使用所述用户设备当前的安全上下文安全保护后的下行数据；处理单元601，还用于使用所述用户设备当前的安全上下文解安全保护所述第二下行NAS消息，获得所述下行数据。
一种可能的实现方式中，处理单元601，还用于在根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护之前，获取所述用户设备当前的安全上下文。其中，处理单元601，用于获取所述用户设备当前的安全上下文，具体为：获取自身存储的所述用户设备当前的安全上下文；或者触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文。
在另外一种可能的实现方式中，通信单元602，用于从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；以及接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据以及第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文；
处理单元601，用于根据所述第二安全上下文标识，激活非接入层NAS安全保护；以及使用用户设备当前的安全上下文解安全保护所述第一下行NAS消息以获得所述下行数据；
通信单元602，还用于通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
该通信装置600可以是移动管理网元，也可以是移动管理网元内部的芯片或功能模块，当该通信装置600用于执行上述方法实施例中网络设备执行的操作时，处理单元601用于调度通信单元602与其他设备通信。具体的，通信单元602，用于接收会话管理网元发送 的下行数据通知消息，所述下行数据通知消息包括第一指示信息；处理单元601，用于根据所述第一指示信息，使用所述移动管理网元当前的安全上下文激活非接入层NAS安全保护；使用所述移动管理网元当前的安全上下文对用户设备的下行数据进行安全保护，并将安全保护后的下行数据封装在第一下行NAS消息中；通信单元602，还用于通过接入网设备向所述用户设备发送所述第一下行NAS消息。
所述通信单元602，还用于在所述移动管理网元接收会话管理网元发送的下行数据通知消息之后，向接入网设备发送第一寻呼请求，所述第一寻呼请求包括所述用户设备的标识和第二指示信息；所述第二指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示；接收所述接入网设备发送的下行数据获取请求，所述下行数据获取请求包括所述用户设备的标识。
可选的，所述通信单元602，还用于接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中；所述处理单元601，还用于使用所述移动管理网元当前的安全上下文解安全保护所述第一上行NAS消息，获取所述反馈信息；根据所述反馈信息，删除缓存的所述下行数据。
可选的，所述通信单元602，还用于接收所述用户设备发送的经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识；其中，第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述第二上行NAS消息使用所述用户设备当前的安全上下文进行安全保护；所述处理单元601，还用于根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，以使得所述移动管理网元和所述用户设备建立有相同的当前的安全上下文；以及使用所述移动管理网元当前的安全上下文对所述下行数据进行安全保护，并将安全保护后的下行数据封装在第二下行NAS消息中；所述通信单元602，还用于通过所述接入网设备向所述用户设备发送所述第二下行NAS消息。
可以理解的是，所述处理单元601和所述通信单元602还可以执行上述方法实施例中的其他相应操作，在此不再赘述。
基于与上述方法实施例的同一构思，如图7所示，本申请实施例还提供了一种通信装置700，该通信装置700用于实现上述方法实施例中用户设备105和/或移动管理网元102执行的操作。图7仅仅示出了通信装置700的主要部件。
通信装置700包括：收发器701、处理器702和存储器703。收发器701用于与其它通信设备进行消息或信令的传输，处理器702与存储器703耦合，用于调用存储器703中的程序，当程序被执行时，使得通信装置700执行上述方法实施例中用户设备105和/或移动管理网元102执行的操作。存储器703用于存储处理器702执行的程序。收发器701可以包括发射器和/或接收器，分别实现收发功能。处理器702可以为一个或多个。存储器703可以位于处理器702中，也可以单独存在。图6中的功能模块处理单元601可以通过处理器702来实现，通信单元602可以通过收发器701来实现。本领域技术人员可以理解，为了便于说明，图7仅示出了一个存储器和处理器。在实际的用户设备105和/或移动管理网元102中，可以存在多个处理器和存储器。存储器也可以称为存储介质或者存储设备等，本申请实施例对此不做限制。
处理器702主要用于对通信协议以及通信数据进行处理，以及对整个用户设备105和/或移动管理网元102进行控制，执行软件程序，处理软件程序的数据，例如用于支持终 端和/或网络设备执行上述方法实施例中所描述的动作。存储器703主要用于存储软件程序和数据。
当执行用户设备的功能时，例如，当处理器702执行存储器703中的程序指令时，使得所述通信装置执行如下操作：从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；根据所述寻呼消息，使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据；在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息成功的情况下，通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
当执行网络设备的功能时，例如，当处理器702执行存储器703中的程序指令时，使得所述通信装置执行如下操作：接收会话管理网元发送的下行数据通知消息，所述下行数据通知消息包括第一指示信息，所述第一指示信息用于指示是否发起MT-EDT流程以传输所述下行数据；根据所述第一指示信息，使用所述移动管理网元当前的安全上下文激活非接入层NAS安全保护；使用所述移动管理网元当前的安全上下文对用户设备的下行数据进行安全保护，并将安全保护后的下行数据封装在第一下行NAS消息中；通过接入网设备向所述用户设备发送所述第一下行NAS消息。
当处理器702执行存储器703中的程序指令时，使得所述通信装置还可以执行上述方法实施例中用户设备105和/或移动管理网元102执行的其它操作或功能，重复之处不再赘述。
处理器702可以是中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)或者CPU和NP的组合。
处理器702还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic,GAL)或其任意组合。
存储器703可以包括易失性存储器(volatile memory)，例如随机存取存储器(random-access memory，RAM)；存储器703也可以包括非易失性存储器(non-volatile memory)，例如快闪存储器(flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器703还可以包括上述种类的存储器的组合。
在本申请上述方法实施例描述的用户设备105或移动管理网元102所执行的操作和功能中的部分或全部，可以用芯片或集成电路来完成。
为了实现上述图6或图7所述的通信装置的功能，本申请实施例还提供一种芯片，包括处理器，用于支持该通信装置实现上述方法实施例中用户设备105或移动管理网元102所涉及的功能。在一种可能的设计中，该芯片与存储器连接或者该芯片包括存储器，该存储器用于保存该通信装置必要的程序指令和数据。
本申请实施例提供了一种计算机存储介质，存储有计算机程序，该计算机程序包括用 于执行上述方法实施例的指令。
本申请实施例提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述方法实施例。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的精神和范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (43)

  1. 一种数据传输的方法，其特征在于，包括：
    用户设备从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；
    所述用户设备根据所述寻呼消息，使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；
    所述用户设备向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；
    所述用户设备接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据；
    在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息成功的情况下，通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
  2. 如权利要求1所述的方法，其特征在于，所述寻呼消息还包括用于指示下行数据早传的指示信息。
  3. 如权利要求2所述的方法，其特征在于，所述下行数据早传的指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示。
  4. 如权利要求1-3任一所述的方法，其特征在于，所述根据所述寻呼消息，使用当前的安全上下文激活非接入层NAS安全保护，包括：
    根据所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护；或者，
    如果所述寻呼消息还包括用于指示下行数据早传的指示信息，则根据所述用于指示下行数据早传的指示信息和/或所述特定的资源信息，确定使用所述用户设备当前的安全上下文激活非接入层NAS安全保护。
  5. 如权利要求1～4任一项所述的方法，其特征在于，所述方法还包括：
    在使用所述用户设备当前的安全上下文解安全保护所述第一下行NAS消息失败的情况下，所述用户设备通过所述接入网设备向所述移动管理网元发送使用所述用户设备当前的安全上下文进行安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识，其中，所述第一安全上下文标识用于指示所述用户设备当前的安全上下文；
    所述用户设备接收所述移动管理网元通过所述接入网设备发送的第二下行NAS消息，所述第二下行NAS消息包括所述移动管理网元使用所述用户设备当前的安全上下文安全保护后的下行数据；
    使用所述用户设备当前的安全上下文解安全保护所述第二下行NAS消息，获得所述下行数据。
  6. 如权利要求5所述的方法，其特征在于，所述第二上行NAS消息为控制面服务请求CPSR消息。
  7. 如权利要求5或6所述的方法，其特征在于，所述用户设备的标识为系统架构演 进临时移动用户标识S-TMSI。
  8. 如权利要求1～7任一项所述的方法，其特征在于，在所述用户设备根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护之前，所述方法还包括：
    所述用户设备获取所述用户设备当前的安全上下文。
  9. 如权利要求8所述的方法，其特征在于，所述用户设备获取所述用户设备当前的安全上下文，包括：
    所述用户设备获取自身存储的所述用户设备当前的安全上下文；或者
    所述用户设备触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文。
  10. 如权利要求1-4任一所述的方法，其特征在于，所述寻呼消息还包括第二安全上下文标识，所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文；
    所述用户设备根据所述寻呼消息，使用用户设备当前的安全上下文激活非接入层NAS安全保护，包括：
    在所述用户设备自身存储的安全上下文中存在与所述第二安全上下文标识对应的安全上下文的情况下，将与所述第二安全上下文标识对应的安全上下文设置为用户设备当前的安全上下文，使用新设置的当前的安全上下文激活NAS安全保护；
    或者，
    在所述用户设备自身存储的安全上下文中不存在与所述第二安全上下文标识对应的安全上下文的情况下，所述用户设备触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文；使用新建立的当前的安全上下文激活NAS安全保护。
  11. 一种数据传输的方法，其特征在于，包括：
    移动管理网元接收会话管理网元发送的下行数据通知消息，所述下行数据通知消息包括第一指示信息；
    所述移动管理网元根据所述第一指示信息，使用所述移动管理网元当前的安全上下文激活非接入层NAS安全保护；
    所述移动管理网元使用所述移动管理网元当前的安全上下文对用户设备的下行数据进行安全保护，并将安全保护后的下行数据封装在第一下行NAS消息中；
    所述移动管理网元通过接入网设备向所述用户设备发送所述第一下行NAS消息。
  12. 如权利要求11所述的方法，其特征在于，在所述移动管理网元接收会话管理网元发送的下行数据通知消息之后，所述方法还包括：
    所述移动管理网元向接入网设备发送第一寻呼请求，所述第一寻呼请求包括所述用户设备的标识和第二指示信息；所述第二指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示；
    所述移动管理网元接收所述接入网设备发送的下行数据获取请求，所述下行数据获取请求包括所述用户设备的标识。
  13. 如权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述移动管理网元接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中；
    所述移动管理网元使用所述移动管理网元当前的安全上下文解安全保护所述第一上 行NAS消息，获取所述反馈信息；
    所述移动管理网元根据所述反馈信息，删除缓存的所述下行数据。
  14. 如权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述移动管理网元接收所述用户设备发送的经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识；其中，第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述第二上行NAS消息使用所述用户设备当前的安全上下文进行安全保护；
    所述移动管理网元根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，以使得所述移动管理网元和所述用户设备建立有相同的当前的安全上下文；
    所述移动管理网元使用所述移动管理网元当前的安全上下文对所述下行数据进行安全保护，并将安全保护后的下行数据封装在第二下行NAS消息中；
    所述移动管理网元通过所述接入网设备向所述用户设备发送所述第二下行NAS消息。
  15. 如权利要求14所述的方法，其特征在于，所述方法还包括：
    所述移动管理网元接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第三上行NAS消息中；
    所述移动管理网元使用所述移动管理网元当前的安全上下文解安全保护所述第三上行NAS消息，获取所述反馈信息；
    所述移动管理网元根据所述反馈信息，删除缓存的所述下行数据。
  16. 如权利要求14或15所述的方法，其特征在于，所述移动管理网元根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，包括：
    所述移动管理网元将自身存储的与所述第一安全上下文标识对应的安全上下文设置为自身当前的安全上下文；或者，
    所述移动管理网元确定自身没有存储与所述第一安全上下文标识对应的安全上下文；
    所述移动管理网元通过重新鉴权流程，建立与所述用户设备相同的当前的安全上下文。
  17. 如权利要求14-16任一所述的方法，其特征在于，所述第二上行NAS消息为控制面服务请求CPSR消息。
  18. 如权利要求11-13任一所述的方法，其特征在于，所述第一下行NAS消息中还包括第二安全上下文标识，所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。
  19. 权利要求11-13任一所述的方法，其特征在于，所述第一寻呼请求中还包括第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。
  20. 如权利要求11-19任一所述的方法，其特征在于，所述第一指示信息包括：下行数据早传指示或所述下行数据的数据量的指示。
  21. 一种数据传输系统，其特征在于，包括移动管理网元和会话管理网元；
    所述会话管理网元，用于向所述移动管理网元发送下行数据通知消息，所述下行通知消息包括第一指示信息；
    所述移动管理网元，用于根据所述第一指示信息，使用移动管理网元当前的安全上下文激活非接入层NAS安全保护；使用所述移动管理网元当前的安全上下文对用户设备的下 行数据进行安全保护，并将安全保护后的下行数据封装在第一下行NAS消息中；通过接入网设备向所述用户设备发送所述第一下行NAS消息。
  22. 如权利要求21所述的系统，其特征在于，所述移动管理网元，还用于在接收会话管理网元发送的下行数据通知消息之后，向接入网设备发送第一寻呼请求，所述第一寻呼请求包括所述用户设备的标识和第二指示信息；所述第二指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示；接收所述接入网设备发送的下行数据获取请求，所述下行数据获取请求包括所述用户设备的标识。
  23. 如权利要求21或22所述的系统，其特征在于，所述移动管理网元，还用于接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中；使用所述移动管理网元当前的安全上下文解安全保护所述第一上行NAS消息，获取所述反馈信息；根据所述反馈信息，删除缓存的所述下行数据。
  24. 如权利要求21或22所述的系统，其特征在于，所述移动管理网元，还用于接收所述用户设备发送的经过安全保护的第二上行NAS消息，所述第二上行NAS消息包括第一安全上下文标识和所述用户设备的标识；其中，第一安全上下文标识用于指示所述用户设备当前的安全上下文；所述第二上行NAS消息使用所述用户设备当前的安全上下文进行安全保护；根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，以使得所述移动管理网元和所述用户设备建立有相同的当前的安全上下文；使用所述移动管理网元当前的安全上下文对所述下行数据进行安全保护，并将安全保护后的下行数据封装在第二下行NAS消息中；通过所述接入网设备向所述用户设备发送所述第二下行NAS消息。
  25. 如权利要求24所述的系统，其特征在于，所述移动管理网元，还用于接收所述用户设备发送的反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第三上行NAS消息中；使用所述移动管理网元当前的安全上下文解安全保护所述第三上行NAS消息，获取所述反馈信息；根据所述反馈信息，删除缓存的所述下行数据。
  26. 如权利要求24或25所述的系统，其特征在于，所述移动管理网元，用于根据所述第一安全上下文标识，与所述用户设备进行安全上下文同步，包括：
    将所述移动管理网元自身存储的与所述第一安全上下文标识对应的安全上下文设置为自身当前的安全上下文；或者，
    在自身没有存储与所述第一安全上下文标识对应的安全上下文的情况下，重新鉴权流程，建立与所述用户设备相同的当前的安全上下文。
  27. 如权利要求24-26任一所述的系统，其特征在于，所述第二上行NAS消息为控制面服务请求CPSR消息。
  28. 如权利要求21-23任一所述的系统，其特征在于，其特征在于，所述第一下行NAS消息中还包括安全上下文的指示信息，所述安全上下文的指示信息用于指示所述移动管理网元当前的安全上下文。
  29. 如权利要求21-23任一所述的系统，其特征在于，其特征在于，所述第一寻呼请求中还包括第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文。
  30. 如权利要求21-28任一所述的系统，其特征在于，其特征在于，所述第一指示信息包括：下行数据早传指示或所述下行数据的数据量的指示。
  31. 一种通信装置，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求1-10任意一项所述的方法。
  32. 如权利要求31所述的装置，其特征在于，所述装置为终端或者终端内的芯片。
  33. 一种通信装置，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求11-20任意一项所述的方法。
  34. 一种计算机可读存储介质，其特征在于，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行如权利要求1-10任意一项所述的方法。
  35. 一种计算机可读存储介质，其特征在于，所述计算机存储介质中存储有计算机可读指令，当计算机读取并执行所述计算机可读指令时，使得计算机执行如权利要求11-20任意一项所述的方法。
  36. 一种计算机程序产品，其特征在于，当计算机读取并执行所述计算机程序产品时，使得计算机执行如权利要求1-10任意一项所述的方法。
  37. 一种计算机程序产品，其特征在于，当计算机读取并执行所述计算机程序产品时，使得计算机执行如权利要求11-20任意一项所述的方法。
  38. 一种数据传输的方法，其特征在于，包括：
    用户设备从接入网设备接收针对下行数据早传的寻呼消息，其中，所述寻呼消息包括特定的资源信息；
    所述用户设备向所述接入网设备发送随机接入请求，所述随机接入请求包括所述特定的资源信息；
    所述用户设备接收移动管理网元通过所述接入网设备发送的第一下行NAS消息，所述第一下行NAS消息包括所述移动管理网元使用所述移动管理网元当前的安全上下文安全保护后的下行数据以及第二安全上下文标识；所述第二安全上下文标识用于指示所述移动管理网元当前的安全上下文；
    所述用户设备根据所述第二安全上下文标识，激活非接入层NAS安全保护；
    所述用户设备使用用户设备当前的安全上下文解安全保护所述第一下行NAS消息以获得所述下行数据；
    所述用户设备通过所述接入网设备向所述移动管理网元发送反馈信息，所述反馈信息封装在使用所述用户设备当前的安全上下文进行安全保护的第一上行NAS消息中。
  39. 如权利要求38所述的方法，其特征在于，所述寻呼消息还包括用于指示下行数据早传的指示信息。
  40. 如权利要求39所述的方法，其特征在于，所述下行数据早传的指示信息包括下行数据早传指示或者所述下行数据的下行数据量的指示。
  41. 如权利要求38-40任一所述的方法，其特征在于，所述用户设备根据第二安全上下文标识，激活非接入层NAS安全保护，包括：
    所述用户设备将自身存储的安全上下文中与所述第二第二安全上下文标识相对应的安全上下文设置为当前的安全上下文，并使用新设置的当前的安全上下文激活NAS安全保护；或者，
    在所述用户设备自身存储的安全上下文中不存在与所述第二安全上下文标识对应的安全上下文的情况下，所述用户设备触发所述移动管理网元对所述用户设备进行重新鉴权，进而在所述用户设备和所述移动管理网上建立相同的当前的安全上下文。
  42. 一种通信装置，其特征在于，包括存储器以及与该存储器耦合的处理器；
    所述存储器中保存有程序指令，当所述处理器执行所述程序指令时，使得所述通信装置执行上述权利要求38-41任意一项所述的方法。
  43. 如权利要求42所述的装置，其特征在于，所述装置为终端或者终端内的芯片。
PCT/CN2019/100765 2019-08-15 2019-08-15 一种数据传输的方法及装置 WO2021026875A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/100765 WO2021026875A1 (zh) 2019-08-15 2019-08-15 一种数据传输的方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/100765 WO2021026875A1 (zh) 2019-08-15 2019-08-15 一种数据传输的方法及装置

Publications (1)

Publication Number Publication Date
WO2021026875A1 true WO2021026875A1 (zh) 2021-02-18

Family

ID=74570837

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/100765 WO2021026875A1 (zh) 2019-08-15 2019-08-15 一种数据传输的方法及装置

Country Status (1)

Country Link
WO (1) WO2021026875A1 (zh)

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107968999A (zh) * 2016-10-18 2018-04-27 华为技术有限公司 一种隐私保护方法及相关设备
US20190159197A1 (en) * 2018-02-07 2019-05-23 Intel Corporation Minimization of padding and resource wastage in message 3 (msg3) for early data transmission (edt)

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107968999A (zh) * 2016-10-18 2018-04-27 华为技术有限公司 一种隐私保护方法及相关设备
US20190159197A1 (en) * 2018-02-07 2019-05-23 Intel Corporation Minimization of padding and resource wastage in message 3 (msg3) for early data transmission (edt)

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
MEDIATEK INC: "Mobile-terminated Early Data Transmission", 3GPP DRAFT; R2-1818210 MT EDT, vol. RAN WG2, 16 November 2018 (2018-11-16), Spokane, WA, USA, pages 1 - 5, XP051482084 *

Similar Documents

Publication Publication Date Title
EP3211941B1 (en) Method and device for transmitting downlink data
EP2529566B1 (en) Efficient terminal authentication in telecommunication networks
US10320754B2 (en) Data transmission method and apparatus
US20170359719A1 (en) Key generation method, device, and system
CN104737570A (zh) 生成用于第一用户设备和第二用户设备之间的设备对设备通信的密钥的方法和设备
WO2019095840A1 (zh) 一种层2处理方法、cu及du
WO2017133021A1 (zh) 一种安全处理方法及相关设备
JP7405265B2 (ja) 端末装置及び基地局
US20220345296A1 (en) Managing Security Keys in a Communication System
WO2018166338A1 (zh) 一种秘钥更新方法及装置
WO2012171281A1 (zh) 一种安全参数修改方法及基站
US20220345883A1 (en) Security key updates in dual connectivity
US20220015030A1 (en) Data Transmission Method and Apparatus
WO2017128306A1 (zh) 通信方法及设备
JP2024026229A (ja) Ｓｌユニキャストにおけるセキュリティの改善
WO2023179679A1 (zh) 一种基于信道秘钥的加密方法及装置
WO2021026875A1 (zh) 一种数据传输的方法及装置
US12089046B2 (en) Method for early transmission of downlink data and apparatus
WO2021238813A1 (zh) 一种获取密钥的方法及装置
WO2021088471A1 (zh) 连接恢复方法及装置
WO2021239076A1 (zh) 密钥获取方法、装置、用户设备及网络侧设备
WO2022133764A1 (en) A method for key transfer
US20240237142A1 (en) Early data communication with configured resources
WO2019095240A1 (zh) 一种数据传输方法及装置
WO2018176273A1 (zh) 一种通信方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19941067

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19941067

Country of ref document: EP

Kind code of ref document: A1