WO2021031055A1 - 通信方法及装置 - Google Patents

通信方法及装置 Download PDF

Info

Publication number
WO2021031055A1
WO2021031055A1 PCT/CN2019/101250 CN2019101250W WO2021031055A1 WO 2021031055 A1 WO2021031055 A1 WO 2021031055A1 CN 2019101250 W CN2019101250 W CN 2019101250W WO 2021031055 A1 WO2021031055 A1 WO 2021031055A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
data packet
pdcp layer
node
tunnel
Prior art date
Application number
PCT/CN2019/101250
Other languages
English (en)
French (fr)
Inventor
郭龙华
胡力
李�赫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201980096530.1A priority Critical patent/CN113841366B/zh
Priority to EP19941841.9A priority patent/EP4016949A4/en
Priority to PCT/CN2019/101250 priority patent/WO2021031055A1/zh
Publication of WO2021031055A1 publication Critical patent/WO2021031055A1/zh
Priority to US17/674,590 priority patent/US20220174761A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/14—Backbone network devices

Definitions

  • This application relates to the field of communication technology, and in particular to communication methods and devices.
  • the fifth generation (5th generation) 5G NR proposes integrated access backhaul (IAB) technology.
  • IAB integrated access backhaul
  • base stations can be divided into IAB nodes (nodes) and IAB donor base stations (donor).
  • IAB donor is used to provide the user equipment interface to the core network and to support the IAB node wireless backhaul function.
  • IAB node can support wireless access of terminals and wireless backhaul of data. Since the IAB donor and the IAB node can exchange data through the wireless backhaul link, there is no need to lay cables between the IAB donor and the IAB node. This makes the deployment of IAB node more flexible.
  • the 5G network provides a variety of services. Services represented by the Internet of Vehicles, ultra-reliable & low latency communication (URLLC) have both high reliability requirements and low latency requirements.
  • the IAB network has increased delay due to the multi-hop architecture, so it is more necessary to reduce the end-to-end delay between the terminal and the IAB-donor, so that the IAB network can be used in more scenarios.
  • This application provides a communication method and device for reducing the data transmission delay between the IAB node and the IAB donor.
  • This application provides a communication method and device for reducing the data transmission delay between the IAB node and the IAB donor.
  • a communication system including a first node and a second node.
  • a plurality of secure tunnels are established between the first node and the second node, and the multiple secure tunnels correspond to different security states.
  • the first node is used to receive the uplink data packet from the terminal; determine the packet data convergence protocol (PDCP) layer security status of the uplink data packet; according to the PDCP layer security status of the uplink data packet and multiple security tunnels
  • the security status determines the target security tunnel; the uplink data packet is sent to the second node through the target security tunnel.
  • the second node is used to receive the uplink data packet from the first node; and send the uplink data packet to the user plane network element.
  • PDCP packet data convergence protocol
  • the first node needs to perform encryption calculation and integrity protection calculation on the uplink data packet before transmitting the uplink data packet through the secure tunnel.
  • the technical solution provided by the embodiment of the present application in some cases, A node does not need to perform encryption calculation and/or integrity protection calculation on the uplink data packet before transmitting the uplink data packet through the target secure tunnel, thereby reducing the processing delay of the first node on the uplink data packet.
  • the second node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the second node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the first node is specifically configured to determine the PDCP layer security status of the uplink data packet according to whether the uplink data packet carries an integrity message authentication code (message authentication code integrity, MAC-I).
  • integrity message authentication code messages authentication code integrity
  • the first node is specifically used to determine that the PDCP layer security status of the uplink data packet is integrity protection closed if the uplink data packet does not carry MAC-I; if the uplink data packet carries MAC-I, then It is determined that the PDCP layer security status of the uplink data packet is integrity protection enabled.
  • the first node is specifically configured to determine the PDCP layer security status of the uplink data packet according to the identifier of the first transmission tunnel used to transmit the uplink data packet and the first corresponding relationship stored in advance; wherein, The first correspondence is the correspondence between the identifier of the first transmission tunnel and the security state of the PDCP layer, and the first transmission tunnel is the transmission tunnel between the first node and the second node.
  • the second node is also used to obtain the correspondence between the ID of a protocol data unit (PDU) session and the security state of the PDCP layer; and the ID of the PDU session and the ID of the first transmission tunnel
  • the corresponding relationship between the identifiers; the first corresponding relationship is generated according to the corresponding relationship between the identifier of the PDU session and the security state of the PDCP layer, and the corresponding relationship between the identifier of the PDU session and the identifier of the first transmission tunnel;
  • the node sends the first correspondence.
  • the first node is also used to receive the first correspondence.
  • the first node is specifically configured to select the security status and the uplink from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the data packet is a complementary security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is complementary to the security status of the PDCP layer of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel and the PDCP layer security status of the uplink data packet are complementary, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the uplink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the uplink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is turned off, the security status of the target security tunnel is that the integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the uplink data packet is both integrity protection and encryption protection, the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the PDCP layer security status of the upstream data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the first node is specifically configured to select the security status and the uplink from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the data packet is the same security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection turned on; (2) If the PDCP layer security status of the uplink data packet is integrity protection turned off, the security status of the target security tunnel should be integrity protection turned off.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the uplink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both off; (2) If the PDCP layer security status of the uplink data packet is that integrity protection and encryption protection are both on, then the security status of the target security tunnel is Both integrity protection and encryption protection are turned on; (3) If the PDCP layer security status of the uplink data packet is integrity protection turned on and encryption protection turned off, the security status of the target security tunnel is integrity protection turned on and encryption protection turned off; 4) If the security state of the PDCP layer of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • the second node is also used to receive downlink data packets from user plane network elements; determine the PDCP layer security status of the downlink data packet; according to the PDCP layer security status of the downlink data packet and multiple security tunnels The security status of the target security tunnel is determined, and the downlink data packet is sent to the first node through the target security tunnel.
  • the first node is also used for receiving downlink data packets from the second node; sending downlink data packets to the terminal.
  • the second node needs to perform encryption calculation and integrity protection calculation on the downlink data packet in addition to transmitting the downlink data packet through a secure tunnel.
  • the second node uses the target secure tunnel to transmit the downlink data packet, and may not perform encryption calculation and/or integrity protection calculation on the downlink data packet, thereby reducing the processing delay of the second node on the downlink data packet.
  • the first node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the first node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the second node is specifically configured to determine the PDCP layer security status of the downlink data packet according to whether the downlink data packet carries MAC-I.
  • the second node is specifically used to determine that the PDCP layer security status of the downlink data packet is integrity protection closed if the downlink data packet does not carry MAC-I; if the downlink data packet carries MAC-I, then It is determined that the PDCP layer security status of the downlink data packet is integrity protection enabled.
  • the second node is specifically configured to determine the PDCP layer security status of the downlink data packet according to the identifier of the second transmission tunnel used to transmit the downlink data packet and the second corresponding relationship stored in advance; wherein, The second correspondence is the correspondence between the identifier of the second transmission tunnel and the security state of the PDCP layer, and the second transmission tunnel is the transmission tunnel between the second node and the user plane network element.
  • the second node is also used to obtain the correspondence between the identity of the PDU session and the security state of the PDCP layer; to obtain the correspondence between the identity of the PDU session and the second transmission tunnel;
  • the corresponding relationship between the identifier and the security state of the PDCP layer, and the corresponding relationship between the PDU session and the identifier of the second transmission tunnel, generate a second corresponding relationship.
  • the second node is specifically configured to select a security state from the multiple security tunnels according to the PDCP layer security state of the downlink data packet and the security state of the multiple security tunnels A security tunnel complementary to the PDCP layer security status of the downlink data packet is used as the target security tunnel.
  • the following describes how the security status of the target security tunnel and the PDCP layer security status of the downlink data packet are complementary to each other from different perspectives of the security status.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the downlink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection, then the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, then the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the second node is specifically configured to select a security state from the multiple security tunnels according to the PDCP layer security state of the downlink data packet and the security state of the multiple security tunnels A security tunnel that is the same as the PDCP layer security status of the downlink data packet is used as the target security tunnel.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the downlink data packet based on different considerations of the security status.
  • the security state of the target security tunnel is the same as the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection on; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, then the security status of the target security tunnel should be integrity protection off.
  • the security state of the target security tunnel is the same as the PDCP layer security state of the downlink data packet, including one of the following situations: (1) If the PDCP layer security state of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the downlink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that both integrity protection and encryption protection are off; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection are on, the security status of the target security tunnel To enable both integrity protection and encryption protection; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection on and encryption protection off; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • a communication method is provided, the communication method is applied to a first node, a plurality of secure tunnels are established between the first node and a second node, and the multiple secure tunnels correspond to different security states
  • the method includes: a first node receives an uplink data packet from a terminal; the first node determines the PDCP layer security status of the uplink data packet; the first node determines the target security tunnel according to the PDCP layer security status of the uplink data packet and multiple security tunnels , Multiple security tunnels correspond to different security states; the first node sends an uplink data packet to the second node through the target security tunnel.
  • the first node needs to perform encryption calculation and integrity protection calculation on the uplink data packet in addition to transmitting the uplink data packet through the secure tunnel, the technical solution provided by the embodiment of the present application, in some cases,
  • the first node transmits the uplink data packet through the target secure tunnel, and may not perform encryption calculation and/or integrity protection calculation on the uplink data packet, thereby reducing the processing delay of the first node on the uplink data packet.
  • the second node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the second node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the first node determining the PDCP layer security status of the uplink data packet includes: the first node determines the PDCP layer security status of the uplink data packet according to whether the uplink data packet carries MAC-I. Based on this design, the first node can quickly determine whether the uplink data packet has integrity protection on the PDCP layer.
  • the first node determines the PDCP layer security status of the uplink data packet according to whether the uplink data packet carries MAC-I, including: if the uplink data packet does not carry MAC-I, the first node determines the uplink data packet The security status of the PDCP layer is integrity protection off; if the uplink data packet carries MAC-I, the first node determines that the PDCP layer security status of the uplink data packet is integrity protection on.
  • the first node determining the PDCP layer security status of the uplink data packet includes: the first node determines according to the identifier of the first transmission tunnel used to transmit the uplink data packet and the first corresponding relationship stored in advance The PDCP layer security status of the uplink data packet; where the first correspondence is the correspondence between the identity of the first transmission tunnel and the PDCP layer security status, and the first transmission tunnel is the transmission tunnel between the first node and the second node . Based on this design, the first node can accurately determine whether the uplink data packet has encryption protection and/or integrity protection on the PDCP layer.
  • the method further includes: the first node receives the first correspondence sent by the second node.
  • the first node determines the target security tunnel according to the PDCP layer security status of the uplink data packet and the security status of multiple security tunnels, including: the first node determines the target security tunnel according to the uplink data packet The security status of the PDCP layer and the security status of the multiple security tunnels, from the multiple security tunnels, a security tunnel whose security status is complementary to the security status of the PDCP layer of the uplink data packet is selected as the target security tunnel.
  • the following describes how the security status of the target security tunnel is complementary to the security status of the PDCP layer of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel and the PDCP layer security status of the uplink data packet are complementary, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the uplink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the uplink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is turned off, the security status of the target security tunnel is that the integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the uplink data packet is both integrity protection and encryption protection, the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the PDCP layer security status of the upstream data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the first node determines the target security tunnel according to the PDCP layer security status of the uplink data packet and the security status of multiple security tunnels, including: the first node determines the target security tunnel according to the uplink data packet The security status of the PDCP layer and the security status of the multiple security tunnels, from the multiple security tunnels, a security tunnel whose security status is the same as the security status of the PDCP layer of the uplink data packet is selected as the target security tunnel.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection on; (2) If the PDCP layer security status of the uplink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection off.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the uplink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both off; (2) If the PDCP layer security status of the uplink data packet is that integrity protection and encryption protection are both on, then the security status of the target security tunnel is Both integrity protection and encryption protection are turned on; (3) If the PDCP layer security status of the uplink data packet is integrity protection turned on and encryption protection turned off, the security status of the target security tunnel is integrity protection turned on and encryption protection turned off; 4) If the security state of the PDCP layer of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • a communication method is provided.
  • the communication method is applied to a second node, and multiple security tunnels are established between the second node and the first node, and the multiple security tunnels correspond to different security states.
  • the second node receives the downlink data packet from the user plane network element; the second node determines the PDCP layer security status of the downlink data packet; the second node according to the PDCP layer security status of the downlink data packet and the security status of multiple security tunnels , Determine the target security tunnel, and multiple security tunnels correspond to different security states; the second node sends a downlink data packet to the first node through the target security tunnel.
  • the second node needs to perform encryption calculation and integrity protection calculation on the downlink data packet before transmitting the downlink data packet through the secure tunnel.
  • the technical solution provided by the embodiments of the present application in some cases, when the second node transmits the downlink data packet through the target secure tunnel, it is not necessary to perform encryption calculation and/or integrity protection calculation on the downlink data packet, thereby reducing the processing delay of the downlink data packet by the second node.
  • the first node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the first node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the second node determines the PDCP layer security status of the downlink data packet according to whether the downlink data packet carries MAC-I, including: if the downlink data packet does not carry MAC-I, the second node determines the downlink data packet The security status of the PDCP layer is integrity protection off; if the downlink data packet carries MAC-I, the second node determines that the PDCP layer security status of the downlink data packet is integrity protection on.
  • the second node determining the PDCP layer security status of the downlink data packet includes: the second node determines according to the identifier of the second transmission tunnel used to transmit the downlink data packet and the second pre-stored correspondence relationship The PDCP layer security status of the downlink data packet; where the second correspondence is the correspondence between the identifier of the second transmission tunnel and the PDCP layer security status, and the second transmission tunnel is the transmission between the second node and the user plane network element tunnel. Based on this design, the second node can accurately determine whether the downlink data packet has encryption protection and/or integrity protection on the PDCP layer.
  • the method further includes: the second node obtains the correspondence between the identity of the PDU session and the security state of the PDCP layer; the second node obtains the correspondence between the identity of the PDU session and the second transmission tunnel; The second node generates a second correspondence according to the correspondence between the identifier of the PDU session and the security state of the PDCP layer, and the correspondence between the identifier of the PDU session and the second transmission tunnel.
  • the method further includes: the second node obtains the correspondence between the identity of the PDU session and the security state of the PDCP layer; the second node obtains the correspondence between the identity of the PDU session and the identity of the first transmission tunnel Relationship; the second node generates the first corresponding relationship according to the correspondence between the identity of the PDU session and the security state of the PDCP layer, and the correspondence between the identity of the PDU session and the identity of the first transmission tunnel; A node sends the first correspondence.
  • the second node determines the target security tunnel according to the PDCP layer security status of the downlink data packet and the security status of multiple security tunnels, including: the second node determines the target security tunnel according to the downlink data packet The security status of the PDCP layer and the security status of the multiple security tunnels, from the multiple security tunnels, a security tunnel whose security status is the same as the security status of the PDCP layer of the downlink data packet is selected as the target security tunnel.
  • the following describes how the security status of the target security tunnel and the PDCP layer security status of the downlink data packet are complementary to each other from different perspectives of the security status.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the downlink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection, then the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, then the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the downlink data packet based on different considerations of the security status.
  • the security state of the target security tunnel is the same as the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection on; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, then the security status of the target security tunnel should be integrity protection off.
  • the security state of the target security tunnel is the same as the PDCP layer security state of the downlink data packet, including one of the following situations: (1) If the PDCP layer security state of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the downlink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that both integrity protection and encryption protection are off; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection are on, the security status of the target security tunnel To enable both integrity protection and encryption protection; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection on and encryption protection off; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • a communication device in a fourth aspect, is provided.
  • a plurality of security tunnels are established between the communication device and a second node, and the plurality of security tunnels correspond to different security states.
  • the communication device includes: a communication module for Receive uplink data packets from the terminal.
  • the processing module is used to determine the PDCP layer security status of the uplink data packet; according to the PDCP layer security status of the uplink data packet and the security status of multiple security tunnels, determine the target security tunnel, and multiple security tunnels correspond to different security states.
  • the communication module is also used to send uplink data packets to the second node through the target security tunnel.
  • the processing module is specifically used to determine the PDCP layer security status of the uplink data packet according to whether the uplink data packet carries MAC-I.
  • the processing module is specifically used to determine that the PDCP layer security status of the uplink data packet is integrity protection closed if the uplink data packet does not carry MAC-I; if the uplink data packet carries MAC-I, then determine The PDCP layer security status of the uplink data packet is integrity protection enabled.
  • the processing module is specifically configured to determine the PDCP layer security status of the uplink data packet according to the identifier of the first transmission tunnel used to transmit the uplink data packet and the first corresponding relationship stored in advance;
  • a correspondence is the correspondence between the identifier of the first transmission tunnel and the security state of the PDCP layer, and the first transmission tunnel is the transmission tunnel between the first node and the second node.
  • the communication module is also used to receive the first correspondence sent by the second node.
  • the processing module is specifically configured to select the security status and the uplink data from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels
  • the PDCP layer security status of the packet is a complementary security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is complementary to the security status of the PDCP layer of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel and the PDCP layer security status of the uplink data packet are complementary, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the uplink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the uplink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is turned off, the security status of the target security tunnel is that the integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the uplink data packet is both integrity protection and encryption protection, the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the PDCP layer security status of the upstream data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the processing module is specifically configured to select the security status and the uplink data from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels
  • the PDCP layer security status of the packet is the same security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet based on different considerations of the security status.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection on; (2) If the PDCP layer security status of the uplink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection off.
  • the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, including one of the following situations: (1) If the PDCP layer security status of the uplink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the uplink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the uplink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the uplink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both off; (2) If the PDCP layer security status of the uplink data packet is that integrity protection and encryption protection are both on, then the security status of the target security tunnel is Both integrity protection and encryption protection are turned on; (3) If the PDCP layer security status of the uplink data packet is integrity protection turned on and encryption protection turned off, the security status of the target security tunnel is integrity protection turned on and encryption protection turned off; 4) If the security state of the PDCP layer of the uplink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • a communication device in a fifth aspect, is provided.
  • a plurality of security tunnels are established between the communication device and a first node, and the plurality of security tunnels correspond to different security states.
  • the communication device includes: a communication module for Receive downlink data packets from user plane network elements.
  • the processing module is used to determine the PDCP layer security status of the downlink data packet; according to the PDCP layer security status of the downlink data packet and the security status of multiple security tunnels, determine the target security tunnel, and multiple security tunnels correspond to different security states.
  • the communication module is used to send a downlink data packet to the first node through the target security tunnel.
  • the processing module is specifically used to determine the PDCP layer security status of the downlink data packet according to whether the downlink data packet carries MAC-I.
  • the processing module is specifically used to determine that the PDCP layer security status of the downlink data packet is integrity protection closed if the downlink data packet does not carry MAC-I; if the downlink data packet carries MAC-I, then determine The PDCP layer security status of the downlink data packet is integrity protection enabled.
  • the processing module is configured to determine the PDCP layer security status of the downlink data packet according to the identifier of the second transmission tunnel used to transmit the downlink data packet and the second corresponding relationship stored in advance; wherein, the second The correspondence is the correspondence between the identifier of the second transmission tunnel and the security state of the PDCP layer, and the second transmission tunnel is the transmission tunnel between the second node and the user plane network element.
  • the processing module is also used to obtain the correspondence between the identity of the PDU session and the security status of the PDCP layer; to obtain the correspondence between the identity of the PDU session and the second transmission tunnel; according to the identity of the PDU session
  • the correspondence between the security state of the PDCP layer and the correspondence between the PDU session and the identifier of the second transmission tunnel generates a second correspondence.
  • the processing module is also used to obtain the correspondence between the identity of the PDU session and the security status of the PDCP layer; to obtain the correspondence between the identity of the PDU session and the identity of the first transmission tunnel; according to the PDU session
  • the communication module is also used to send the first correspondence to the first node.
  • the processing module is specifically configured to select the security status and the security status from the multiple security tunnels according to the PDCP layer security status of the downlink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the downlink data packet is a complementary security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is complementary to the security status of the PDCP layer of the downlink data packet based on different considerations of the security status.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection off; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, the security status of the target security tunnel should be integrity protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection off; (2) If the PDCP layer security status of the downlink data packet is encryption protection off, the security status of the target security tunnel should be encryption protection on.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that integrity protection and encryption protection are both on; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection, then the security status of the target security tunnel Both integrity protection and encryption protection are turned off; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, then the security status of the target secure tunnel is integrity protection off and encryption protection on; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the processing module is specifically configured to select the security status and the security status from the multiple security tunnels according to the PDCP layer security status of the downlink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the downlink data packet is the same security tunnel as the target security tunnel.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the downlink data packet based on different considerations of the security status.
  • the security state of the target security tunnel is the same as the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection enabled, Then the security status of the target security tunnel should be integrity protection on; (2) If the PDCP layer security status of the downlink data packet is integrity protection off, then the security status of the target security tunnel should be integrity protection off.
  • the security state of the target security tunnel is the same as the PDCP layer security state of the downlink data packet, including one of the following situations: (1) If the PDCP layer security state of the downlink data packet is encryption protection enabled, then The security status of the target security tunnel should be encryption protection turned on; (2) If the PDCP layer security status of the downlink data packet is encryption protection turned off, the security status of the target security tunnel should be encryption protection turned off.
  • the security state of the target security tunnel is complementary to the security state of the PDCP layer of the downlink data packet, including one of the following situations: (1) If the security state of the PDCP layer of the downlink data packet is integrity protection and encryption If the protection is off, the security status of the target security tunnel is that both integrity protection and encryption protection are off; (2) If the PDCP layer security status of the downlink data packet is both integrity protection and encryption protection are on, the security status of the target security tunnel To enable both integrity protection and encryption protection; (3) If the security status of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection on and encryption protection off; 4) If the PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, the security state of the target security tunnel is integrity protection off and encryption protection on.
  • an apparatus including a processor and a communication interface.
  • the processor executes the instruction, the device realizes the communication method involved in any one of the above-mentioned second or third aspects.
  • the device further includes a communication interface, and the communication interface is used for the device to communicate with other devices.
  • a computer-readable storage medium stores instructions.
  • the computer can execute any of the above-mentioned second or third aspects.
  • a computer program product containing instructions when the computer program product runs on a computer, the computer can execute the communication method involved in any one of the above-mentioned second or third aspects.
  • a chip in a ninth aspect, includes a processor.
  • the processor executes an instruction, the processor is used to execute the communication method involved in any one of the above-mentioned second or third aspects.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit that can be used as a communication interface.
  • the present application also provides a communication method and device, which are used to reduce the verification operations that the data management network element needs to perform, and reduce the processing burden of the data management network element.
  • a communication method and device which are used to reduce the verification operations that the data management network element needs to perform, and reduce the processing burden of the data management network element.
  • a communication system including: a mobility management network element, an authentication service network element, and a data management network element.
  • the mobility management network element is used to receive the registration request message from the communication device; send the first authentication request message to the authentication service network element; in the case that the registration request message includes the first indication information, the first authentication request message includes the first Instructions.
  • the authentication service network element is configured to receive a first authentication request message; send a second authentication request message to the data management network element; in the case that the first authentication request message includes the first indication information, the second authentication request message includes the first indication information.
  • the data management network element is used to query whether the identity of the communication device is in the preset list when the second authentication request message includes the first indication information; if the identity of the communication device is in the preset list, determine that the communication device is IAB node: If the identification of the communication device is not in the preset list, the communication device is determined to be a terminal.
  • the data management network element needs to query whether the identification of the communication device is in the preset list to determine whether the communication device is an IAB node; Otherwise, the data management network element can determine that the communication device accessing the network is an ordinary terminal. That is, the data management network element only needs to perform query operations for a part of the communication devices.
  • the technical solution provided by the embodiment of the application can effectively reduce the number of data management network elements. The query operation that needs to be performed reduces the processing burden of the data management network element.
  • the data management network element is also used to determine that the communication device is a terminal when the second authentication request message does not include the first indication information.
  • a communication method including: a data management network element receives a second authentication request message, the second authentication request message includes a user identifier of the communication device; the data management network element includes a first indication in the second authentication request message
  • query whether the identification of the communication device is in the preset list if the identification of the communication device is in the preset list, the data management network element determines that the communication device is an IAB node; if the identification of the communication device is not in the preset list , The data management network element determines that the communication device is a terminal.
  • the data management network element determines that the communication device is a terminal when the second authentication request message does not include the first indication information.
  • a communication device including: a communication module, configured to receive a second authentication request message, where the second authentication request message includes a user identifier of the communication device.
  • the processing module is used to query whether the identity of the communication device is in the preset list when the second authentication request message includes the first indication information; if the identity of the communication device is in the preset list, determine that the communication device is an IAB node ; If the identification of the communication device is not in the preset list, the communication device is determined to be a terminal.
  • the processing module is further configured to determine that the communication device is a terminal when the second authentication request message does not include the first indication information.
  • a communication device including a processor and a communication interface.
  • the communication device executes the computer program instructions, the communication device is caused to implement the communication method involved in any one of the designs in the eleventh aspect.
  • the device further includes a communication interface, and the communication interface is used for the device to communicate with other devices.
  • a computer-readable storage medium stores instructions. When the instructions are run on a computer, the computer can execute any design involved in the eleventh aspect. Communication method.
  • a computer program product containing instructions is provided.
  • the computer program product runs on a computer, the computer can execute the communication method involved in any design in the eleventh aspect.
  • a chip in a sixteenth aspect, includes a processor, and when the processor executes an instruction, the processor is used to execute the communication method involved in any design in the eleventh aspect.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit that can be used as a communication interface.
  • a communication method including: the data management network element determines that the communication device is an IAB node; the data management network element sends second instruction information to the mobility management network element in the main authentication process, and the second instruction information uses It is determined that the communication equipment is an IAB node.
  • the technical solution of this application specifies the time and method for the data management network element to send the IAB authorized to the mobile management network element, so that the mobile management network element can learn whether the communication device is an IAB node before the main authentication process ends.
  • the second indication information is carried in the second authentication response message or the authentication information reply command message. It can be understood that the second indication information is carried in the existing signaling of the main authentication process, which is beneficial to reduce signaling overhead.
  • a communication device including: a processing module, configured to determine that the communication device is an IAB node.
  • the communication module is configured to send second instruction information to the mobility management network element in the main authentication process, and the second instruction information is used to determine that the communication device is an IAB node.
  • the second indication information is carried in the second authentication response message or the authentication information reply command message.
  • a communication device including a processor and a communication interface.
  • the communication device executes the computer program instructions, the communication device is caused to implement the communication method involved in any one of the above-mentioned seventeenth aspects.
  • the device further includes a communication interface, and the communication interface is used for the device to communicate with other devices.
  • a computer-readable storage medium stores instructions. When the instructions are run on a computer, the computer can execute any of the designs involved in the seventeenth aspect. Communication method.
  • a computer program product containing instructions is provided.
  • the computer program product runs on a computer, the computer can execute the communication method involved in any of the designs in the seventeenth aspect.
  • a chip in a twenty-second aspect, includes a processor, and when the processor executes an instruction, the processor is used to execute the communication method involved in any one of the designs in the seventeenth aspect.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit that can be used as a communication interface.
  • Figure 1 is a schematic diagram of the startup process of an IAB node
  • Figure 2 is a schematic diagram of a main authentication process
  • FIG. 3 is a schematic diagram of another master authentication process
  • FIG. 4 is a schematic diagram of a 5G network architecture provided by an embodiment of this application.
  • FIG. 5 is a schematic diagram of an IAB architecture provided by an embodiment of the application.
  • FIG. 6 is a schematic diagram of another IAB architecture provided by an embodiment of the application.
  • FIG. 7 is a schematic diagram of the hardware structure of a device provided by an embodiment of the application.
  • FIG. 8 is a flowchart of a communication method provided by an embodiment of this application.
  • FIG. 9 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 10 is a flowchart of another communication method provided by an embodiment of this application.
  • Figure 11 is a schematic diagram of a protocol stack of an IAB related node
  • FIG. 12 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 13 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 14 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 15 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 16 is a flowchart of another communication method provided by an embodiment of this application.
  • FIG. 17 is a schematic structural diagram of a first node provided by an embodiment of this application.
  • FIG. 18 is a schematic structural diagram of a second node provided by an embodiment of this application.
  • FIG. 19 is a schematic structural diagram of a mobility management network element provided by an embodiment of this application.
  • FIG. 20 is a schematic structural diagram of a data management network element provided by an embodiment of this application.
  • A/B can mean A or B.
  • the "and/or” in this article is only an association relationship describing the associated objects, which means that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone These three situations.
  • “at least one” means one or more
  • “plurality” means two or more. The words “first” and “second” do not limit the quantity and order of execution, and the words “first” and “second” do not limit the difference.
  • instructions can include direct instructions and indirect instructions, as well as explicit instructions and implicit instructions.
  • the information indicated by a certain piece of information (the first indication information and the second indication information as described below) is referred to as information to be indicated.
  • the information to be indicated may be directly indicated, wherein the information to be indicated itself or the index of the information to be indicated, etc.
  • the information to be indicated can also be indicated indirectly by indicating other information, where there is an association relationship between the other information and the information to be indicated.
  • it is also possible to realize the indication of specific information by means of the pre-arranged order (for example, stipulated by the agreement) of each information, thereby reducing the indication overhead to a certain extent.
  • Encryption protection protect the confidentiality of data during transmission (so it can also be called confidentiality protection). Confidentiality means that the true content cannot be seen directly. Encryption protection can generally be realized by encrypting data using keys and encryption algorithms. For the specific method of encryption protection, please refer to the relevant descriptions in section 8.2 in 3GPP TS 33.401 f50 or section 6.4.4 in 33.501 f50, which will not be repeated here.
  • Integrity protection/verification is used to determine whether the content of a message has been changed during the delivery process, and can also be used as identity verification to determine the source of the message. Integrity check and protection requires the use of Message Authentication Code (MAC).
  • MAC Message Authentication Code
  • the identifier of the communication device may be a subscription permanent identifier (subscription permanent identifier), a subscription concealed identifier (SUCI), or a 5G global unique temporary identity (5G-GUTI).
  • subscription permanent identifier subscription permanent identifier
  • SUCI subscription concealed identifier
  • 5G-GUTI 5G global unique temporary identity
  • SUPI is used to characterize the real identity of the user, and its function is similar to the international mobile subscriber identification number (IMSI) in LTE.
  • IMSI international mobile subscriber identification number
  • SUCI is generated after SUPI is encrypted with a public key.
  • the transmission of SUCI between the network device and the terminal can avoid the problem that the SUPI transmitted in plain text is stolen by an attacker. It is understandable that SUCI can be decrypted with a private key paired with a public key to obtain SUCI.
  • the startup process of IAB node includes the following steps:
  • the IAB node sends a registration request message to an access and mobility management function (AMF).
  • AMF access and mobility management function
  • the registration request message includes: IAB node's identity information.
  • IAB node's identity information For example, SUCI or 5G-GUTI.
  • the AMF integrates a security anchor function (SEAF) network element.
  • SEAF security anchor function
  • the AMF sends message 1 to an authentication server function (AUSF).
  • AUSF authentication server function
  • the message 1 may include: SUCI/SUPI, and service network name (server network name, SN name).
  • the message 1 may be Nausf_UEAuthentication_Authenticate Request.
  • ASUF sends a message 2 to unified data management (UDM).
  • UDM unified data management
  • the UDM integrates an authentication credential repository and a processing function (authentication credential repository and processing function, ARPF) network element.
  • a processing function authentication credential repository and processing function, ARPF
  • message 2 may include: SUCI/SUPI, and SN name.
  • the message 2 may be Nudm_UEAuthentication_Get Request.
  • the IAB list is used to record the identifiers of one or more IAB nodes.
  • the identifier in message 2 is SUCI/SUPI.
  • UDM can determine that the communication device accessing the network is the IAB node. Otherwise, UDM determines that the communication device accessing the network is an ordinary terminal.
  • the IAB node performs master authentication with the network side.
  • the AMF sends a non-access stratum (NAS) security mode command (security mode command, SMC) message to the IAB node.
  • NAS non-access stratum
  • SMC security mode command
  • the IAB node sends a NAS security mode complete (security mode complete, SMP) message to the AMF.
  • NAS security mode complete security mode complete, SMP
  • the NAS security context is established between the AMF and the IAB node.
  • the AMF sends an initial context setup request (initial context setup request) to the IAB donor.
  • the initial context establishment request includes IAB authorization (authorized). IAB authorized is sent by UDM to AMF.
  • the IAB donor sends an access stratum (access stratum, AS) SMC message to the IAB node.
  • AS access stratum
  • the IAB node sends an AS SMP message to the IAB donor.
  • the AS security context is established between the IAB donor and the IAB node.
  • a secure tunnel is established between IAB node and IAB donor.
  • the IAB node can provide transmission services for the terminal or other IAB nodes.
  • startup process of IAB node may also include other steps, which are not limited in the embodiment of the present application.
  • the main authentication process is introduced below. It should be noted that the main authentication process is divided into two types: one is an extensible authentication protocol (EAP)-AKA' process, and the other is a 5G-AKA process.
  • EAP extensible authentication protocol
  • 5G-AKA 5G-AKA
  • the EAP-AKA' process includes the following steps:
  • UDM generates an authentication vector.
  • the authentication vector can be AV' (RAND, AUTN, XRES, CK', IK').
  • UDM sends message 3 to AUSF.
  • the message 3 may include an authentication vector (EAP-AKA'AV).
  • the message 3 may be Nudm_UEAuthentication_Get Response.
  • message 4 may include EAP Request/AKA'-Challenge.
  • the message 4 may be Nausf_UEAuthentication_Authenticate Response.
  • the AMF sends message 5 to the IAB node.
  • the message 5 may include EAP Request/AKA'-Challenge, ngKS, and ABBA.
  • the message 5 may be Auth-Req.
  • the IAB node calculates an authentication response.
  • the IAB node sends message 6 to the AMF.
  • message 6 may include EAP Response/AKA'-Challenge.
  • the message 5 may be Auth-Resp.
  • AMF sends message 7 to AUSF.
  • message 7 may include EAP Response/AKA'-Challenge.
  • the message 7 may be Nausf_UEAuthentication_Authenticate Request.
  • IAB node and AUSF exchange other EAP messages.
  • message 8 may include EAP Success
  • the message 8 may be Nausf_UEAuthentication_Authenticate Response.
  • the AMF sends a message 9 to the IAB node.
  • the message 9 may include EAP Success, ngKSI, and ABBA.
  • the message 9 may be N1 message.
  • the 5G-AKA process includes the following steps:
  • UDM generates an authentication vector.
  • UDM sends message 10 to AUSF.
  • the message 10 may include 5G HE AV.
  • the message 10 may be Nudm_Authentication_GetResponse.
  • message 11 may include 5G SE AV.
  • the message 11 may be Nausf_UEAuthentication_AuthenticateResponse.
  • the AMF sends a message 12 to the IAB node.
  • the message 12 may be Authentication Request.
  • the IAB node calculates an authentication response (RES*).
  • the IAB node sends message 13 to the AMF.
  • the message 13 may be Authentication Response.
  • AMF calculates HRES*, and compares whether HRES* and HXRES* are consistent.
  • the AMF sends a message 14 to the AUSF.
  • the message 14 may include RES*.
  • the message 14 may be Nausf_UEAuthentication_Authenticate Request.
  • the message 15 may include the authentication result and Kseaf.
  • the message 15 may be Nausf_UEAuthentication_Authenticate Response.
  • the technical solutions provided by the embodiments of the present application can be applied to various communication systems, for example, a 5G communication system, a future evolution system, or multiple communication convergence systems, etc. are adopted.
  • the technical solution provided by this application can be applied to a variety of application scenarios, such as machine to machine (M2M), macro and micro communications, enhanced mobile broadband (eMBB), URLLC, and massive Internet of Things communications ( massive machine type communication, mMTC) and other scenarios.
  • M2M machine to machine
  • eMBB enhanced mobile broadband
  • URLLC massive Internet of Things communications
  • mMTC massive machine type communication
  • These scenarios may include, but are not limited to: a communication scenario between a communication device and a communication device, a communication scenario between a network device and a network device, a communication scenario between a network device and a communication device, and so on.
  • the application in the communication scenario between the network device and the terminal is taken as an example.
  • 5G networks can include: terminals, radio access networks (RAN) or access networks (AN) (hereinafter RAN and AN are collectively referred to as (R)AN), core networks (CN) ), and data network (DN).
  • RAN radio access networks
  • AN access networks
  • R radio access networks
  • CN core networks
  • DN data network
  • the terminal may be a device with a wireless transceiver function.
  • the terminal may have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile equipment, wireless communication equipment, terminal agent Or terminal devices, etc.
  • UE user equipment
  • the terminal can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as a ship, etc.); it can also be deployed in the air (such as aeroplane, balloon, satellite, etc.).
  • Terminals include handheld devices, vehicle-mounted devices, wearable devices, or computing devices with wireless communication capabilities.
  • the terminal may be a mobile phone, a tablet computer, or a computer with wireless transceiver function.
  • Terminal equipment can also be virtual reality (VR) terminal equipment, augmented reality (augmented reality, AR) terminal equipment, wireless terminals in industrial control, wireless terminals in unmanned driving, wireless terminals in telemedicine, and smart Wireless terminals in power grids, wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • the device for implementing the function of the terminal may be a terminal, or a device capable of supporting the terminal to implement the function, such as a chip system.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the device used to implement the functions of the terminal is an example to describe the technical solutions provided by the embodiments of the present application.
  • the access network equipment may also be called a base station.
  • the base station may include various forms of base stations, such as: macro base stations, micro base stations (also called small stations), relay stations, access points, and so on. Specifically, it can be: an access point (AP) in a wireless local area network (Wireless Local Area Network, WLAN), a Global System for Mobile Communications (GSM) or Code Division Multiple Access (Code Division)
  • the base station (Base Transceiver Station, BTS) in Multiple Access, CDMA can also be the base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), or the evolution of LTE Base station (Evolved Node B, eNB or eNodeB), or relay station or access point, or vehicle-mounted equipment, wearable equipment, and the next generation Node B (gNB) in the future 5G network or the future evolved public land
  • the base station in the mobile network Public Land Mobile Network, PLMN) network, etc.
  • a base station usually includes a baseband unit (BBU), a remote radio unit (RRU), an antenna, and a feeder for connecting the RRU and the antenna.
  • BBU baseband unit
  • RRU remote radio unit
  • the antenna is responsible for the conversion between the guided wave on the cable and the space wave in the air.
  • the distributed base station greatly shortens the length of the feeder between the RRU and the antenna, which can reduce signal loss, and can also reduce the cost of the feeder.
  • RRU plus antenna is relatively small and can be installed anywhere, making network planning more flexible.
  • all BBUs can also be centralized and placed in the central office (CO).
  • decentralized BBUs are centralized and turned into a BBU baseband pool, they can be managed and scheduled uniformly, and resource allocation is more flexible.
  • all physical base stations evolved into virtual base stations. All virtual base stations share the user's data transmission and reception, channel quality and other information in the BBU baseband pool, and cooperate with each other to realize joint scheduling.
  • the base station may include a centralized unit (CU) and a distributed unit (DU).
  • the base station may also include an active antenna unit (AAU).
  • the CU implements part of the functions of the base station, and the DU implements some of the functions of the base station.
  • the CU is responsible for processing non-real-time protocols and services, and implements radio resource control (radio resource control, RRC), packet data convergence protocol (packet data convergence protocol, PDCP) layer functions.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • the DU is responsible for processing physical layer protocols and real-time services, and realizes the functions of radio link control (radio link control, RLC), media access control (MAC) and physical (physical, PHY) layers.
  • the access network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into network devices in the RAN, or the CU can be divided into network devices in the core network (core network, CN), which is not limited here.
  • the control plane (CP) and the user plane (UP) of the CU can also be separated and implemented by different entities. That is, CU can be divided into CU-CP and CU-UP.
  • the core network includes multiple core network network elements (or called network function network elements), such as: AMF network elements, security anchor function (SEAF), session management function (session management function, SMF) network elements, and policies Control function (PCF) network elements, user plane function (UPF) network elements, application layer function (application function) network elements, AUSF network elements, and UDM network elements.
  • AMF network elements such as: security anchor function (SEAF), session management function (session management function, SMF) network elements, and policies Control function (PCF) network elements, user plane function (UPF) network elements, application layer function (application function) network elements, AUSF network elements, and UDM network elements.
  • AMF network elements such as: security anchor function (SEAF), session management function (session management function, SMF) network elements, and policies Control function (PCF) network elements, user plane function (UPF) network elements, application layer function (application function) network elements, AUSF network elements, and UDM network elements.
  • PAF user plane function
  • application function application function
  • the core network may also include some network elements not shown in FIG. 4, such as: security anchor function (SEAF) network elements and ARPF network elements, which are not described in detail in the embodiment of the present application.
  • SEAF security anchor function
  • ARPF ARPF network elements
  • the UDM network element is used to store the user's subscription information, generate authentication parameters, and so on.
  • Unified data management supporting 3GPP authentication, user identity operation, permission granting, registration and mobility management functions.
  • ARPF network elements have authentication credential storage and processing functions, which are used to store long-term authentication credentials of users, such as permanent keys K.
  • the functions of ARPF network elements can be incorporated into UDM network elements.
  • the SEAF network element is used to complete the authentication of the UE.
  • the functions of SEAF can be incorporated into AMF.
  • the AUSF network element has an authentication service function, which is used to terminate the authentication function requested by the SEAF network element. During the authentication process, it receives the authentication vector sent by the UDM and processes the authentication vector, and sends the processed authentication vector to the SEAF.
  • the AMF network element is mainly responsible for the mobility management processing part, such as: access control, mobility management, attach and detach, and SMF selection functions.
  • the AMF network element When the AMF network element provides services for the session in the terminal, it will provide storage resources of the control plane for the session to store the session identifier, the SMF identifier associated with the session identifier, and so on.
  • the above-mentioned core network elements may have other names, and the embodiment of the present application is not limited thereto.
  • the AMF network element may also be referred to as AMF or AMF entity for short
  • the UPF network element may also be referred to as UPF or UPF entity for short, and so on.
  • the terminal communicates with the AMF through the Next Generation Network (N) 1 interface (N1)
  • the RAN device communicates with the AMF through the N2 interface (N2)
  • the RAN device communicates with the UPF through the N3 interface (N3).
  • UPF Communicate with DN through the N6 interface (N6 for short).
  • Control plane network elements such as AMF, SMF, UDM, AUSF, or PCF can also interact with service-oriented interfaces.
  • AMF Accessf
  • SMF servicing interface provided by SMF
  • Nsmf the servicing interface provided by SMF
  • UDM can be Nudm
  • PCF Npcf
  • the servicing interface provided by AUSF to the outside world can be Nausf; it will not be described here.
  • 5G NR proposes IAB technology.
  • FIG. 5 it is a schematic diagram of an IAB architecture provided by an embodiment of this application.
  • the access network using IAB technology may include: IAB node and IAB-donor.
  • IAB-donor the function of IAB-donor is similar to that of traditional gNB, and is used to provide the interface of the core network. However, IAB-donor also supports IAB node's wireless backhaul (wireless backhaul) function. IAB-donor includes CU and DU. CU can be divided into CU-UP, CU-CP, and other functional modules.
  • IAB node integrates wireless access link (wireless access link) and wireless backhaul link (wireless backhaul link). Thus, IAB node can support wireless access of terminals and wireless backhaul of data.
  • the IAB node can include a mobile terminal (MT) and a DU. MT is used to support the mobile terminal function of IAB node, and assist IAB node to perform network access authentication and establish communication security.
  • MT mobile terminal
  • the IAB node and the IAB-donor-CU can communicate through the F1 interface.
  • the IAB node and IAB-donor-DU can communicate through the Uu interface.
  • Two different IAB nodes can communicate through the Uu interface.
  • IAB-donor-CU can connect to the core network through the NG interface.
  • IAB-donor-CU can be connected to gNB through Xn-c interface.
  • the devices mentioned in the embodiments of this application can all be implemented by the communication device shown in FIG. 7.
  • the device 100 includes at least one processor 101, a communication line 102, a memory 103 and at least one communication interface 104.
  • the processor 101 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 102 may include a path to transmit information between the aforementioned components.
  • the communication interface 104 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 103 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (Including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store program codes in the form of instructions or data structures and can be accessed by a computer Any other media, but not limited to this.
  • the memory can exist independently and is connected to the processor through the communication line 102.
  • the memory can also be integrated with the processor.
  • the memory 103 is used to store computer-executed instructions for executing the solution of the present application, and the processor 101 controls the execution.
  • the processor 101 is configured to execute computer-executable instructions stored in the memory 103, so as to implement the message transmission method provided in the following embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program code, which is not specifically limited in the embodiments of the present application.
  • the processor 101 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 7.
  • the apparatus 100 may include multiple processors, such as the processor 101 and the processor 107 in FIG. 7. Each of these processors can be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the apparatus 100 may further include an output device 105 and an input device 106.
  • the output device 105 communicates with the processor 101 and can display information in a variety of ways.
  • the output device 105 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 106 communicates with the processor 101 and can receive user input in a variety of ways.
  • the input device 106 may be a mouse, a keyboard, a touch screen device, or a sensor device.
  • UDM when any communication device accesses the network, UDM needs to query whether the identity of the communication device is in the IAB list to identify whether the communication device is an IAB node. This makes UDM's query overhead relatively large.
  • the communication method includes the following steps:
  • the communication device sends a registration request message to the mobility management network element, so that the mobility management network element receives the registration request message from the communication device.
  • the mobility management network element is AMF, which is described here in a unified manner, and will not be repeated in the following.
  • the registration request message is used to request registration to the network.
  • the registration request message may include the identification of using the communication device, such as SUCI or SUPI.
  • the registration request message may be carried in the N1 interface message.
  • the communication device may be an IAB node.
  • the registration request message may include first indication information, where the first indication information is used to indicate that the communication device is an IAB node.
  • the first indication information may be recorded as: IAB indicator (indicator).
  • the mobility management network element sends a first authentication request message to the authentication service network element, so that the authentication service network element receives the first authentication request message sent from the mobility management network element.
  • the authentication service network element is AUSF, which is described here in a unified manner, and will not be described in detail below.
  • the first authentication request message is used to request authentication of the communication device.
  • the first authentication request message may include the identification of the communication device.
  • the first authentication request message may also include other parameters, and the embodiment of the present application is not limited thereto.
  • the first authentication request message may be Nausf_UEAuthentication_Authenticate Request.
  • the first authentication request message sent by the mobility management network element may also include the first indication information.
  • the authentication service network element sends a second authentication request message to the data management network element, so that the data management network element receives the second authentication request message from the authentication service network element.
  • the data management network element is UDM, which is described in a unified manner here, and will not be described in detail below.
  • the second authentication request message is used to obtain an authentication vector for authenticating the communication device.
  • the second authentication request message may include the identification of the communication device.
  • the second authentication request message may also include other parameters, and the embodiment of the present application is not limited thereto.
  • the second authentication request message may be Nudm_UEAuthentication_Get Request.
  • the second authentication request message sent by the data management network element may also include the first indication information.
  • the data management network element judges whether the communication device is an IAB node.
  • the data management network element queries whether the identity of the communication device is in the preset list. If the identification of the communication device is in the preset list, the data management network element can determine that the communication device is an IAB node; if the identification of the communication device is not in the preset list, the data management network element can determine that the communication device is an ordinary terminal .
  • the preset list is used to record the identification of one or more IAB nodes.
  • the preset list can be implemented in the form of a list.
  • the preset list is an IAB list.
  • the data management network element determines that the communication device is an IAB node
  • the data management network element should send the second instruction information to the mobility management network element.
  • the second indication information is used to determine that the communication device is an IAB node.
  • the second indication information may be IAB authorized, and the embodiment of the present application is not limited thereto.
  • the data management network element determines that the communication device is a normal terminal. That is, in the case that the second authentication request message does not include the first indication information, the data management network element does not need to determine whether the communication device is an IAB node.
  • the data management network element needs to query whether the identity of the communication device is in the preset list to determine whether the communication device is an IAB node; otherwise, the data management network element can determine that the communication device connected to the network is an ordinary terminal. That is, the data management network element only needs to perform query operations on a part of the communication devices, thereby reducing the query operations that the data management network element needs to perform.
  • the technical solution provided by the embodiment of the application can effectively reduce the number of data management network elements.
  • the query operation that needs to be performed reduces the processing burden of the data management network element.
  • the data management network element determines that the communication device is an IAB node
  • the prior art does not define when the data management network element sends IAB authorized to the mobility management network element, and how to send IAB authorized.
  • the communication method includes the following steps:
  • the data management network element sends an IAB authorized to the mobility management network element, so that the mobility management network element receives the IAB authorized from the data management network element.
  • Implementation method 1 The data management network element sends IAB authorized to the mobile management network element in the main authentication process.
  • the data management network element sends a second authentication response message to the authentication service network element.
  • the authentication service network element After receiving the second authentication response message, the authentication service network element sends the first authentication response message to the mobility management network element.
  • the second authentication response message and the first authentication response message both include the second indication information.
  • the second authentication response message is used to respond to the second authentication request message.
  • the second authentication response message may be Nudm_UEAuthentication_GetResponse.
  • the first authentication response message is used to respond to the first authentication request message.
  • the first authentication response message may be Nausf_UEAuthentication_AuthenticateResponse.
  • the data management network element sends an authentication information response command message to the authentication service network element, and the authentication information response command message includes IAB authorized.
  • the authentication information reply command message can add new information elements to carry IAB authorized; or, the authentication information reply command message can select idle flag bits to carry IAB authorized.
  • the authentication information reply command message may be Authentication-Information-Answer (AIA) Command.
  • AIA Authentication-Information-Answer
  • the signaling carrying IAB authorized may also be newly added signaling in the main authentication process, and the embodiment of the present application is not limited to this.
  • Implementation manner 2 After the master authentication ends and before the registration process ends, the data management network element sends IAB authorized to the mobile management network element.
  • the technical solution shown in FIG. 5 specifies the time and method for the data management network element to send the IAB authorized to the mobile management network element, so that the mobile management network element can learn whether the communication device is an IAB node.
  • the process for the mobility management network element to learn the type of communication device connected to the network is as follows: when the communication device accesses the network, the data management network element determines whether the communication device is an IAB node, and the communication device is In the case of IAB node, the data management network element will send the IAB node to the mobile management network element so that the mobile management network element knows that the communication device connected to the network is the IAB node.
  • the above process is too cumbersome and it is necessary to improve it.
  • the communication method includes the following steps:
  • the communication device sends a registration request message to the mobility management network element, so that the mobility management network element receives the registration request message from the communication device.
  • the registration request message does not include the first indication information. If the communication device is the first node, the registration request message may include the first indication information. Wherein, the first indication information is used to indicate that the communication device is the first node. Optionally, the first indication information may be recorded as: IAB indicator (indicator).
  • the mobility management network element determines the type of the communication device according to whether the registration request message carries the first indication information.
  • the types of communication equipment include: ordinary terminals and IAB nodes.
  • the mobility management network element determines that the communication device is an IAB node. If the registration request message does not include the first indication information, after the communication device passes the master authentication, the mobility management network element determines that the communication device is a terminal.
  • the mobility management network element determines that the communication device is an IAB node, the mobility management network element sends an initial context establishment request to the IAB donor, and the initial context request includes IAB authorized.
  • the mobility management network element determines that the communication device is an IAB node. In the case that the registration request does not include the first indication information, the mobility management network element determines that the communication device is a normal terminal. Therefore, the data management network element does not need to identify the type of the communication device, and the mobile management network element does not need to learn the type of the communication device from the data management network element, which simplifies the process for the mobile management network element to learn the type of the communication device.
  • some services such as vehicle to X and URLLC, require the network to have high reliability and low latency.
  • the increased delay due to multiple hops in the IAB network will adversely affect the performance of user plane data transmission. Therefore, for the IAB network, it is extremely important to reduce the end-to-end delay between the UE and the IAB donor.
  • the low latency of the IAB network is conducive to the application of the IAB network to more business scenarios.
  • end-to-end security protection will be established between IAB node and IAB donor. That is, a secure tunnel is established between the IAB node and the IAB donor, and the secure tunnel opens integrity protection and encryption protection. That is, before the data packet is tunneled through a secure tunnel between the IAB node and the IAB donor, the IAB node/IAB donor needs to perform integrity protection and encryption protection on the data packet to ensure the confidentiality and integrity of the data packet during transmission. .
  • end-to-end security protection may also be established between the terminal and the IAB donor. That is, a user plane security state is established between the terminal and the IAB donor, so that the data packets transmitted between the terminal and the IAB donor have encryption protection and integrity protection at the PDCP layer.
  • the security protection of the data packet in the secure tunnel is unnecessary.
  • the security protection operation performed by the IAB node/IAB donor on the data packet is unnecessary.
  • the aforementioned security protection operations refer to encryption calculations and integrity protection calculations performed on data packets. Unnecessary security protection operations will only increase the processing delay of the IAB node/IAB donor for the data packet, thereby increasing the end-to-end transmission delay of the data packet from the UE to the IAB donor.
  • the security tunnel between the IAB node and the IAB donor may be an Internet protocol security (IPsec) tunnel, or other types of tunnels, and the embodiment of the present application is not limited thereto.
  • IPsec Internet protocol security
  • the process of UE receiving/sending data on the user plane involves the following nodes: UE, access IAB node, intermediate IAB node, IAB donor, and UPF.
  • access IAB node is an IAB node used to provide access services to terminals.
  • Intermediate IAB node is an IAB node that provides wireless backhaul function.
  • Intermediate IAB node is optional.
  • the UE's protocol stack may include: IP layer, service discovery application profile (SDAP) layer, PDCP layer, radio link control (RLC) layer, media access control (media access control, MAC) layer, physical layer (PHY layer).
  • SDAP service discovery application profile
  • PDCP packet data convergence protocol
  • RLC radio link control
  • MAC media access control
  • PHY layer physical layer
  • the protocol stack of the DU of the access IAB node may include: RLC layer, MAC layer and PHY layer.
  • the protocol stack of access IAB node's MT can include: general packet radio service tunnel Protocol (GTP)-user (user, U) layer, UDP layer, IPsec layer, IP layer, adaptation (Adapt) Layer, RLC layer, MAC layer, and PHY layer.
  • GTP general packet radio service tunnel Protocol
  • the protocol stack of the DU of the intermediate IAB node includes the IP layer, the Adapt layer, the RLC layer, the MAC layer, and the PHY layer.
  • the MT protocol stack of the intermediate IAB node includes: IP layer, Adapt layer, RLC layer, MAC layer, and PHY layer.
  • the protocol stack of the IAB donor DU may include: IP layer, Adapt layer, RLC layer, MAC layer, and PHY layer.
  • the protocol stack of the IAB donor CU may include: SDAP layer, PDCP layer, GTP-U layer, UDP layer, IPsec layer, and IP layer.
  • the UPF protocol stack may include: IP layer and GTP-U layer.
  • the IAB node and the IAB donor establish an IPsec tunnel on the IPsec layer to transmit data packets.
  • the embodiment of the present application provides a communication method.
  • the technical principle of the communication method is that a plurality of security tunnels with different security states can be established in advance between the IAB node and the IAB donor. In this way, when data packets are transmitted between IAB node and IAB donor, the IAB node/IAB donor can use the packet-based PDCP layer security status to determine the target security tunnel from multiple security tunnels, and the target security tunnel is used for transmission The packet.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the data packet.
  • the security status of the target security tunnel and the PDCP layer security status of the data packet are complementary, and the embodiment of the present application is not limited to this.
  • the communication method includes the following steps:
  • the first node receives an uplink data packet from a terminal.
  • the first node is a node used to support network access by the terminal.
  • the first node may be an IAB node, and the embodiment of the present application is not limited thereto.
  • the uplink data packet refers to an uplink PDCP data packet.
  • the first node determines the PDCP layer security status of the uplink data packet.
  • the security status can be considered from the perspective of integrity protection; alternatively, the security status can be considered from the perspective of encryption protection; or, the security status can be considered from the perspective of integrity protection and encryption protection.
  • step S702 may adopt any one of the following implementation manners:
  • Implementation manner 1 The first node determines the PDCP layer security status of the uplink data packet according to whether the uplink data packet carries MAC-I.
  • step S702 is applicable when the security state only considers integrity protection.
  • the PDCP layer security status of the uplink data packet includes the following situations: (1) integrity protection is off; (2) integrity protection is on.
  • the first node may determine that the PDCP layer security status of the uplink data packet is integrity protection off. If the uplink data packet carries MAC-I, the first node can determine that the PDCP layer security status of the uplink data packet is integrity protection on.
  • Implementation manner 2 The first node determines the PDCP layer security status of the uplink data packet according to the identifier of the first transmission tunnel used to transmit the uplink data packet and the first corresponding relationship stored in advance.
  • the first correspondence is: the correspondence between the identifier of the first transmission tunnel and the security state of the PDCP layer. It should be noted that the first correspondence may be obtained by the first node from the second node.
  • the first transmission tunnel is a transmission tunnel between the first node and the second node.
  • the first transmission tunnel is the F1 tunnel between the IAB node and the CU of the IAB donor.
  • the security tunnel is considered from the perspective of the protocol layer, and the first transmission tunnel is considered from the perspective of the interface.
  • One secure tunnel may include multiple first transmission tunnels. That is, when a data packet is transmitted on a first transmission tunnel, the data packet adopts the security policy of the security tunnel corresponding to the first transmission tunnel on the corresponding protocol layer.
  • the data packet when a data packet is transmitted on the first transmission tunnel, the data packet adopts the security policy of the IPsec tunnel corresponding to the first transmission tunnel on the IPsec layer.
  • the first node may determine the identifier of the first transmission tunnel for transmitting the uplink data packet according to the quintuple of the uplink data packet.
  • the five-tuple includes source IP address, source port, destination IP address, destination port, and transport layer protocol.
  • step S702 is applicable when the security state only considers integrity protection; or, the implementation two is applicable when the security state only considers encryption protection; or, the second implementation is applicable to security The state considers integrity protection and encryption protection.
  • the PDCP layer security state of the uplink data packet includes the following situations: (1) integrity protection is turned on; (2) integrity protection is turned off.
  • the PDCP layer security state of the uplink data packet includes the following situations: (1) encryption protection is turned on; (2) encryption protection is turned off.
  • the PDCP layer security status of the uplink data packet includes the following situations: (1) integrity protection and encryption protection are both enabled; (2) integrity protection and Encryption protection is off; (3) Integrity protection is on and encryption protection is off; (4) Integrity protection is off and encryption protection is on.
  • the first correspondence can be seen in Table 1.
  • the first node can determine that the PDCP layer security status of the uplink data packet is that both integrity protection and encryption protection are enabled.
  • the first transmission tunnel #1 Integrity protection and encryption protection are both on The first transmission tunnel #2 Integrity protection and encryption protection are turned off The first transmission tunnel #3 Integrity protection is on, encryption protection is off The first transmission tunnel #4 Integrity protection is off, encryption protection is on ... ...
  • step S702 whether the first node adopts implementation manner 1 or implementation manner 2, may be defined by the protocol or configured by the core network/second node.
  • the first node adopts implementation manner 2 when performing step S702.
  • the first node adopts the first implementation manner when performing step S702.
  • the first node stores the first correspondence
  • the core network or the second node configures the first node to adopt implementation manner 1
  • the first node adopts implementation manner one when performing step S702.
  • the first node determines the target security tunnel from the multiple security tunnels between the first node and the second node according to the PDCP layer security status of the uplink data packet.
  • multiple security tunnels correspond to different security states.
  • the security state only considers integrity protection
  • two security tunnels can be established between the first node and the second node.
  • the security status of the first secure tunnel is integrity protection closed.
  • the security status of the second security tunnel is integrity protection open.
  • the encryption protection may or may not be enabled for the two security tunnels, and the embodiment of the present application is not limited thereto.
  • the first node and the second node can establish two secure tunnels.
  • the security status of the first secure tunnel is encryption protection closed.
  • the security status of the second security tunnel is encryption protection enabled. It is understandable that the integrity protection may or may not be enabled for the two security tunnels, and the embodiment of the present application is not limited thereto.
  • the first node and the second node can establish four secure tunnels.
  • the security status of the first secure tunnel is that both integrity protection and encryption protection are enabled.
  • the security status of the second security tunnel is that both integrity protection and encryption protection are closed.
  • Article 3 The security status of the security tunnel is that integrity protection is turned on and encryption protection is turned off.
  • Article 4 The security status of the security tunnel is that integrity protection is off and encryption protection is on.
  • the first node selects the security status and the security status of the uplink data packet from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels.
  • the security state of the PDCP layer is a complementary security tunnel as the target security tunnel. In other words, the security status of the target security tunnel and the PDCP layer security status of the uplink data packet are complementary.
  • the following describes the complementary relationship between the security status of the target security tunnel and the PDCP layer security status of the uplink data packet in combination with different considerations of the security status.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the uplink data packet, so that the uplink data packet only receives integrity protection once. Therefore, the security status of the target security tunnel should be complementary to the PDCP layer security status of the uplink data packet, which can include one of the following situations:
  • Case 1 The PDCP layer security status of the uplink data packet is integrity protection on, and the security status of the target security tunnel should be integrity protection off.
  • the security status of the PDCP layer of the uplink data packet is integrity protection on, which indicates that the uplink data packet has integrity protection on the PDCP layer.
  • the first node may not perform integrity protection on the uplink data packet to reduce the processing delay of the uplink data packet by the first node, thereby reducing the uplink data packet in the first node. The transmission delay between the node and the second node.
  • Case 2 The PDCP layer security status of the uplink data packet is integrity protection off, and the security status of the target security tunnel should be integrity protection on.
  • the security status of the PDCP layer of the uplink data packet is integrity protection closed, which indicates that the uplink data packet does not have integrity protection on the PDCP layer.
  • the first node needs to perform integrity protection on the uplink data packet to prevent the uplink data packet from being tampered with by an attacker, and to ensure the integrity of the uplink data packet during transmission.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the uplink data packet, so that the uplink data packet only accepts encryption protection once. Therefore, the security status of the target security tunnel should be complementary to the PDCP layer security status of the uplink data packet, which can include one of the following situations:
  • Case 1 The security status of the PDCP layer of the uplink data packet is encryption protection on, and the security status of the target security tunnel should be encryption protection off.
  • the security status of the PDCP layer of the uplink data packet is encryption protection enabled, indicating that the uplink data packet is confidential at the PDCP layer.
  • the first node may not encrypt the uplink data packet to reduce the processing delay of the first node on the uplink data packet, thereby reducing the uplink data packet and the first node. Transmission delay between the second nodes.
  • Case 2 The PDCP layer security status of the uplink data packet is encryption protection off, and the security status of the target security tunnel should be encryption protection on.
  • the security status of the PDCP layer of the uplink data packet is encryption protection closed, which means that the uplink data packet does not have encryption protection on the PDCP layer.
  • the first node needs to encrypt the uplink data packet to ensure the confidentiality of the uplink data packet during transmission.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the uplink data packet, so that the uplink data packet can only receive encryption protection once And integrity protection. Therefore, the security status of the target security tunnel should be complementary to the security status of the PDCP layer of the data packet, which can include one of the following situations:
  • Case 1 The PDCP layer security state of the uplink data packet is that integrity protection and encryption protection are both off, and the security state of the target security tunnel is that both integrity protection and encryption protection are on.
  • the security status of the PDCP layer of the uplink data packet is that both integrity protection and encryption protection are turned off, indicating that the uplink data packet does not have integrity protection and encryption protection on the PDCP layer.
  • the first node performs encryption protection and integrity protection on the uplink data packet to ensure the confidentiality and integrity of the uplink data packet during transmission .
  • Case 2 The security state of the PDCP layer of the uplink data packet is that both integrity protection and encryption protection are turned on, and the security state of the target security tunnel is that both integrity protection and encryption protection are turned off.
  • the security status of the PDCP layer of the uplink data packet is that both integrity protection and encryption protection are enabled, indicating that the uplink data packet has integrity protection and encryption protection on the PDCP layer.
  • the first node does not perform encryption protection and integrity protection on the uplink data packet, which is beneficial to reduce the processing delay of the first node on the uplink data packet, thereby Reduce the transmission delay of uplink data packets between the first node and the second node.
  • Case 3 The PDCP layer security state of the uplink data packet is integrity protection on and encryption protection off, and the security state of the target secure tunnel is integrity protection off and encryption protection on.
  • the security status of the PDCP layer of the uplink data packet is integrity protection enabled, indicating that the uplink data packet has integrity protection on the PDCP layer.
  • the first node may not perform integrity protection on the uplink data packet to reduce the processing delay of the uplink data packet by the first node, thereby reducing the uplink data packet in the first node. The transmission delay between the node and the second node.
  • the security status of the PDCP layer of the uplink data packet is encryption protection closed, indicating that the uplink data packet does not have encryption protection on the PDCP layer.
  • the first node needs to encrypt the upstream data packet to ensure the confidentiality of the upstream data packet during transmission.
  • Case 4 The PDCP layer security state of the uplink data packet is integrity protection off and encryption protection on, then the security state of the target security tunnel is integrity protection on and encryption protection off.
  • the security status of the PDCP layer of the uplink data packet is encryption protection enabled, which indicates that the uplink data packet is confidential at the PDCP layer.
  • the first node may not encrypt the uplink data packet to reduce the processing delay of the first node on the uplink data packet, thereby reducing the uplink data packet in the first node.
  • the transmission delay between the node and the second node is not encrypt the uplink data packet.
  • the PDCP layer security status of the uplink data packet is integrity protection off, indicating that the uplink data packet does not have integrity protection on the PDCP layer.
  • the first node When the uplink data packet does not have integrity protection on the PDCP layer, the first node needs to perform integrity protection on the uplink data packet to prevent the uplink data packet from being tampered with by an attacker, and to ensure the integrity of the uplink data packet during transmission.
  • the first node selects the security status and the uplink data packet from the multiple security tunnels according to the PDCP layer security status of the uplink data packet and the security status of the multiple security tunnels
  • the security status of the PDCP layer is the same security tunnel as the target security tunnel. In other words, the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet.
  • the security status of the PDCP layer of the uplink data packet is determined by the core network or the base station, the security status of the security tunnel used to transmit the data packet is the same as the security status of the PDCP layer of the data packet, which will not cause additional Security risks.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet in combination with different considerations of the security status.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the uplink data packet, which can include one of the following situations:
  • the first node when the security status of the target security tunnel is integrity protection closed, the first node does not need to perform integrity protection calculations on the uplink data packet, thereby reducing the processing delay of the first node on the data packet, and thereby Reduce the transmission delay of data packets between the first node and the second node.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the uplink data packet, which can include one of the following situations:
  • Case 1 If the PDCP layer security status of the uplink data packet is encryption protection enabled, the security status of the target security tunnel should be encryption protection enabled.
  • the first node when the security status of the target security tunnel is encryption protection closed, the first node does not need to perform encryption calculation on the uplink data packet, thereby reducing the processing delay of the first node on the data packet, thereby reducing the data packet The transmission delay between the first node and the second node.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the uplink data packet, which can include one of the following situations:
  • Case 1 If the security status of the PDCP layer of the uplink data packet is that both integrity protection and encryption protection are off, the security status of the target secure tunnel is that both integrity protection and encryption protection are off.
  • the first node when the security status of the target security tunnel is that the integrity protection and encryption protection are turned off, the first node does not need to perform integrity protection calculations and encryption calculations on the uplink data packets, thereby reducing the first node’s response to the data packets.
  • the processing delay of the data packet thereby reducing the transmission delay of the data packet between the first node and the second node.
  • the first node when the security status of the target security tunnel is encryption protection closed, the first node does not need to perform encryption calculation on the uplink data packet, thereby reducing the processing delay of the first node on the data packet, thereby reducing the data packet The transmission delay between the first node and the second node.
  • the first node when the security status of the target security tunnel is integrity protection closed, the first node does not need to perform integrity protection calculations on the uplink data packet, thereby reducing the processing delay of the first node on the data packet, and thereby Reduce the transmission delay of data packets between the first node and the second node.
  • the first node uses a security tunnel whose security status is integrity protection closed and/or encryption protection closed as the target security tunnel. That is, the security status of the target security tunnel is integrity protection closed and/or encryption protection closed.
  • the first node since the security status of the target security tunnel is integrity protection shutdown and/or encryption protection, the first node does not need to perform encryption calculations and/or integrity protection calculations on the data packets, thereby reducing the first node’s data
  • the processing delay of the packet further reduces the transmission delay of the data packet between the first node and the second node.
  • the first node sends an uplink data packet to the second node through the target security tunnel, so that the second node receives the uplink data packet from the first node through the target security tunnel.
  • the second node sends an uplink data packet to the user plane network element, so that the user plane network element receives the uplink data packet from the second node.
  • UPF user plane network element
  • the first node needs to perform encryption calculation and integrity protection calculation on the uplink data packet before transmitting the uplink data packet through the secure tunnel.
  • the security status of the target secure tunnel It is complementary to the PDCP layer security status of the uplink data packet, or the security status of the target security tunnel is the same as the PDCP layer security status of the uplink data packet, so in some cases, the first node transmits the uplink data packet through the target security tunnel , It is possible not to perform encryption calculation and/or integrity protection calculation on the uplink data packet, thereby reducing the processing delay of the first node on the uplink data packet.
  • the second node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the second node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the communication method includes the following steps:
  • the second node receives a downlink data packet from a user plane network element.
  • the downlink data packet refers to a downlink PDCP data packet.
  • the user plane network element transmits the downlink data packet through the second transmission tunnel, so the second node can determine the identifier of the second transmission tunnel used to transmit the downlink data packet.
  • the second transmission tunnel is a transmission tunnel between the second node and the user plane network element.
  • the second transmission tunnel is the N3 tunnel between the CU and the UPF of the IAB donor.
  • the second node determines the PDCP layer security status of the downlink data packet.
  • the security status can be considered from the perspective of integrity protection; alternatively, the security status can be considered from the perspective of encryption protection; or, the security status can be considered from the perspective of integrity protection and encryption protection.
  • step S802 may include the following implementation manners:
  • Implementation manner 1 The second node determines the PDCP layer security status of the downlink data packet according to whether the downlink data packet carries MAC-I.
  • step S802 is applicable to the case where the security state only considers integrity protection.
  • the PDCP layer security status of the downlink data packet includes the following situations: (1) integrity protection is off; (2) integrity protection is on.
  • the second node can determine that the PDCP layer security status of the downlink data packet is integrity protection off. If the downlink data packet carries MAC-I, the second node can determine that the PDCP layer security status of the downlink data packet is integrity protection on.
  • Implementation manner 2 The second node determines the PDCP layer security status of the downlink data packet according to the identifier of the second transmission tunnel used to transmit the downlink data packet and the second pre-stored corresponding relationship.
  • the second correspondence is: the correspondence between the identifier of the second transmission tunnel and the security state of the PDCP layer. It should be noted that the second correspondence may be generated by the second node.
  • step S802 is suitable for the case where the security state only considers integrity protection; or, the second implementation method is suitable for the case where the security state only considers encryption protection; or, the second implementation method is suitable for security.
  • the state considers integrity protection and encryption protection.
  • the PDCP layer security state of the downlink data packet includes the following situations: (1) integrity protection is turned on; (2) integrity protection is turned off.
  • the PDCP layer security state of the downlink data packet includes the following situations: (1) encryption protection is turned on; (2) encryption protection is turned off.
  • the PDCP layer security status of the downlink data packet includes the following situations: (1) integrity protection and encryption protection are both enabled; (2) integrity protection and Encryption protection is off; (3) Integrity protection is on and encryption protection is off; (4) Integrity protection is off and encryption protection is on.
  • the second correspondence can be seen in Table 2.
  • the second node can determine that the PDCP layer security status of the downlink data packet is that both integrity protection and encryption protection are enabled.
  • Second transmission tunnel #1 Integrity protection and encryption protection are both on Second transmission tunnel #2 Integrity protection and encryption protection are turned off Second transmission tunnel #3 Integrity protection is on, encryption protection is off Second transmission tunnel #4 Integrity protection is off, encryption protection is on ... ...
  • step S802 when the second node executes step S802, whether the second node adopts the first implementation or the second implementation, which may be defined by a protocol or configured by the core network.
  • the second node adopts implementation manner two when performing step S802.
  • the second node adopts the first implementation manner when performing step S802.
  • the second node stores the second correspondence
  • the core network configures the second node to adopt the first implementation method
  • the second node adopts the first implementation method when performing step S802.
  • the second node determines the target security tunnel from the multiple security tunnels between the first node and the second node according to the PDCP layer security status of the downlink data packet.
  • multiple security tunnels correspond to different security states.
  • the security state only considers integrity protection
  • two security tunnels can be established between the first node and the second node.
  • the security status of the first secure tunnel is integrity protection closed.
  • the security status of the second security tunnel is integrity protection open.
  • the encryption protection may or may not be enabled for the two security tunnels, and the embodiment of the present application is not limited thereto.
  • the first node and the second node can establish two secure tunnels.
  • the security status of the first secure tunnel is encryption protection closed.
  • the security status of the second security tunnel is encryption protection enabled. It is understandable that the integrity protection may or may not be enabled for the two security tunnels, and the embodiment of the present application is not limited thereto.
  • the first node and the second node can establish four secure tunnels.
  • the security status of the first secure tunnel is that both integrity protection and encryption protection are enabled.
  • the security status of the second security tunnel is that both integrity protection and encryption protection are closed.
  • Article 3 The security status of the security tunnel is that integrity protection is turned on and encryption protection is turned off.
  • Article 4 The security status of the security tunnel is that integrity protection is off and encryption protection is on.
  • the second node selects the security status from the multiple security tunnels according to the PDCP layer security status of the downlink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the downlink data packet is a complementary security tunnel as the target security tunnel.
  • the security status of the target security tunnel is complementary to the security status of the PDCP layer of the downlink data packet.
  • the following describes how the security status of the target security tunnel and the PDCP layer security status of the downlink data packet are complementary to each other from different perspectives considered in the security status.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the downlink data packet, so that the downlink data packet only accepts integrity protection once. Therefore, the security status of the target security tunnel should be complementary to the security status of the PDCP layer of the downlink data packet, which can include one of the following situations:
  • Case 1 The security status of the PDCP layer of the downlink data packet is integrity protection on, and the security status of the target security tunnel should be integrity protection off.
  • the security status of the PDCP layer of the downlink data packet is integrity protection on, which indicates that the downlink data packet has integrity protection on the PDCP layer.
  • the second node may not perform integrity protection on the downlink data packet to reduce the processing delay of the downlink data packet by the second node, thereby reducing the time delay of the downlink data packet on the second node. The transmission delay between the node and the first node.
  • Case 2 The security state of the PDCP layer of the downlink data packet is integrity protection off, and the security state of the target security tunnel should be integrity protection on.
  • the security status of the PDCP layer of the downlink data packet is integrity protection closed, indicating that the downlink data packet does not have integrity protection on the PDCP layer.
  • the second node needs to perform integrity protection on the downlink data packet to prevent the downlink data packet from being tampered with by an attacker, and to ensure the integrity of the downlink data packet during transmission.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the downlink data packet, so that the downlink data packet only accepts encryption protection once. Therefore, the security status of the target security tunnel should be complementary to the security status of the PDCP layer of the downlink data packet, which can include one of the following situations:
  • Case 1 The security status of the PDCP layer of the downlink data packet is encryption protection on, and the security status of the target security tunnel should be encryption protection off.
  • the security status of the PDCP layer of the downlink data packet is encryption protection enabled, indicating that the downlink data packet is confidential at the PDCP layer.
  • the second node may not encrypt the downlink data packet to reduce the processing delay of the second node on the downlink data packet, thereby reducing the downlink data packet and the second node. The transmission delay between the first nodes.
  • Case 2 The security status of the PDCP layer of the downlink data packet is encryption protection off, and the security status of the target security tunnel should be encryption protection on.
  • the security status of the PDCP layer of the downlink data packet is encryption protection closed, which indicates that the downlink data packet does not have encryption protection on the PDCP layer.
  • the second node needs to encrypt the downlink data packet to ensure the confidentiality of the downlink data packet during transmission.
  • the security status of the target security tunnel should be complementary to the PDCP layer security status of the downlink data packet, so that the downlink data packet only accepts encryption protection once And integrity protection. Therefore, the security status of the target security tunnel should be complementary to the security status of the PDCP layer of the data packet, which can include one of the following situations:
  • Scenario 1 The security status of the PDCP layer of the downlink data packet is that integrity protection and encryption protection are both turned off, and the security status of the target security tunnel is that both integrity protection and encryption protection are turned on.
  • the security status of the PDCP layer of the downlink data packet is that both integrity protection and encryption protection are turned off, indicating that the downlink data packet does not have integrity protection and encryption protection on the PDCP layer.
  • the second node does not perform encryption protection and integrity protection on the downlink data packet to ensure the confidentiality and integrity of the downlink data packet during transmission .
  • Case 2 The security status of the PDCP layer of the downlink data packet is that both integrity protection and encryption protection are turned on, and the security status of the target security tunnel is that both integrity protection and encryption protection are turned off.
  • the security status of the PDCP layer of the downlink data packet is that both integrity protection and encryption protection are enabled, indicating that the downlink data packet has integrity protection and encryption protection on the PDCP layer.
  • the second node does not perform encryption protection and integrity protection on the downlink data packet, which is beneficial to reduce the processing delay of the second node on the downlink data packet, thereby Reduce the transmission delay of the downlink data packet between the second node and the first node.
  • Case 3 The security state of the PDCP layer of the downlink data packet is integrity protection on and encryption protection off, and the security state of the target secure tunnel is integrity protection off and encryption protection on.
  • the PDCP layer security status of the downlink data packet is integrity protection turned on, indicating that the downlink data packet has integrity protection on the PDCP layer.
  • the second node can perform integrity protection on the downlink data packet to reduce the processing delay of the downlink data packet by the second node, thereby reducing the downlink data packet in the second The transmission delay between the node and the first node.
  • the security status of the PDCP layer of the downlink data packet is encryption protection closed, indicating that the downlink data packet does not have encryption protection on the PDCP layer.
  • the second node needs to encrypt the downlink data packet to ensure the confidentiality of the downlink data packet during transmission.
  • Case 4 The PDCP layer security state of the downlink data packet is integrity protection off and encryption protection on, and the security state of the target secure tunnel is integrity protection on and encryption protection off.
  • the security status of the PDCP layer of the downlink data packet is encryption protection enabled, indicating that the downlink data packet is confidential at the PDCP layer.
  • the second node may not encrypt the downlink data packet to reduce the processing delay of the second node on the downlink data packet, thereby reducing the downlink data packet and the second node. The transmission delay between the first nodes.
  • the security status of the PDCP layer of the downlink data packet is integrity protection off, indicating that the downlink data packet does not have integrity protection on the PDCP layer.
  • the second node needs to perform integrity protection on the downlink data packet to prevent the downlink data packet from being tampered with by an attacker, and to ensure the integrity of the downlink data packet during transmission.
  • the second node selects the security status and the security status from the multiple security tunnels according to the PDCP layer security status of the downlink data packet and the security status of the multiple security tunnels.
  • the PDCP layer security status of the downlink data packet is the same security tunnel as the target security tunnel. In other words, the security status of the target security tunnel is the same as the PDCP layer security status of the downlink data packet.
  • the security status of the PDCP layer of the downlink data packet is determined by the core network or the base station, the security status of the security tunnel used to transmit the data packet is the same as the PDCP layer security status of the data packet, which will not cause additional Security risks.
  • the following describes how the security status of the target security tunnel is the same as the PDCP layer security status of the downlink data packet in combination with different considerations of the security status.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the downlink data packet, which can include one of the following situations:
  • Case 1 If the PDCP layer security status of the downlink data packet is integrity protection off, the security status of the target security tunnel is integrity protection off.
  • the second node when the security status of the target security tunnel is integrity protection closed, the second node does not need to perform integrity protection calculations on the downlink data packet, thereby reducing the processing delay of the second node on the data packet, and thereby Reduce the transmission delay of data packets between the second node and the first node.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the downlink data packet, which can include one of the following situations:
  • Case 1 If the PDCP layer security status of the downlink data packet is encryption protection enabled, the security status of the target security tunnel should be encryption protection enabled.
  • the second node when the security status of the target security tunnel is encryption protection closed, the second node does not need to perform encryption calculation on the downlink data packet, thereby reducing the processing delay of the second node on the data packet, thereby reducing the data packet The transmission delay between the second node and the first node.
  • the security status of the target security tunnel should be the same as the PDCP layer security status of the downlink data packet, which can include one of the following situations:
  • the second node does not need to perform integrity protection calculation and encryption calculation on the downlink data packet, thereby reducing the second node’s ability to perform the data packet The processing delay of the data packet, thereby reducing the transmission delay of the data packet between the second node and the first node.
  • Case 3 If the PDCP layer security status of the downlink data packet is integrity protection on and encryption protection off, the security status of the target secure tunnel is integrity protection on and encryption protection off.
  • the second node when the security status of the target security tunnel is encryption protection closed, the second node does not need to perform encryption calculation on the downlink data packet, thereby reducing the processing delay of the second node on the data packet, thereby reducing the data packet The transmission delay between the second node and the first node.
  • the second node when the security status of the target security tunnel is integrity protection closed, the second node does not need to perform integrity protection calculations on the downlink data packet, thereby reducing the processing delay of the second node on the data packet, and thereby Reduce the transmission delay of data packets between the second node and the first node.
  • the second node uses a security tunnel whose security status is integrity protection closed and/or encryption protection closed as the target security tunnel. That is, the security status of the target security tunnel is integrity protection closed and/or encryption protection closed.
  • the second node since the security status of the target security tunnel is integrity protection closed and/or encryption protection, the second node does not need to perform encryption calculation and/or integrity protection calculation on the data packet, thereby reducing the second node’s data
  • the processing delay of the packet further reduces the transmission delay of the data packet between the second node and the first node.
  • the second node sends a downlink data packet to the first node through the target security tunnel, so that the first node receives the downlink data packet from the second node through the target security tunnel.
  • S805 The first node sends a downlink data packet to the terminal, so that the terminal receives the downlink data packet.
  • the second node needs to perform encryption calculation and integrity protection calculation on the downlink data packet in addition to transmitting the downlink data packet through the secure tunnel.
  • the status and the PDCP layer security status of the downlink data packet are complementary, or the security status of the target security tunnel and the PDCP layer security status of the downlink packet are the same, so in some cases, the second node transmits the downlink data through the target security tunnel Packets, it is not necessary to perform encryption calculation and/or integrity protection calculation on the downlink data packet, thereby reducing the processing delay of the second node on the downlink data packet.
  • the first node does not need to perform decryption calculation and/or integrity check calculation on the data packet, thereby reducing the processing delay of the first node on the uplink data packet. That is, the technical solution provided by the present application reduces the data packet transmission delay between the first node and the second node by reducing the processing delay of the first node and the second node.
  • the operation performed by the second node is specifically performed by the CU-UP of the second node. That is, the CU-UP of the second node receives the downlink data packet from the user plane network element; the CU-UP of the second node determines the PDCP layer security status of the downlink data packet; the CU-UP of the second node is based on the downlink data packet In the PDCP layer security state of the first node and the second node, the target security tunnel is determined from the multiple security tunnels between the first node and the second node; then, the CU-UP of the second node sends a downlink data packet to the first node through the target security tunnel.
  • the terminal can access the network through the first node and create a PDU session.
  • the second node may generate the first correspondence and the second correspondence.
  • the second node generating the second correspondence includes the following steps:
  • the second node obtains the correspondence between the identifier of the PDU session and the security state of the PDCP layer.
  • the CU-CP of the second node obtains the correspondence between the identifier of the PDU session and the security state of the PDCP layer.
  • the second node can receive the N2 SM message sent by the AMF.
  • the N2 SM message includes the identifier of the PDU session, the core network address of the second transmission tunnel corresponding to the PDU session, and the user plane Security policy, etc.
  • the second node uses an RRC Connection Reconfiguration (RRC Connection Reconfiguration) process to activate the security state of the user plane.
  • RRC Connection Reconfiguration RRC Connection Reconfiguration
  • the security status of the user plane can be understood as the PDCP layer security status.
  • the security state of the user plane is that both encryption protection and integrity protection are enabled.
  • the security state of the user plane is that both encryption protection and integrity protection are turned off.
  • the security status of the user plane may be determined by the second node, or negotiated between the first node and the second node.
  • the above-mentioned first strategy can be named “required”, the second strategy can be named “no needed”, and the third strategy can be named “perferred”, which is not limited in the embodiment of the application. .
  • the second node can obtain the identifier of the PDU session and the corresponding PDCP layer security status. Therefore, the second node can establish a correspondence between the identifier of the PDU session and the security state of the PDCP layer.
  • the PDCP layer security state corresponding to the PDU session is equivalent to the user plane security state corresponding to the PDU session.
  • the correspondence between the identifier of the PDU session and the security state of the PDCP layer can be referred to Table 3.
  • PDU session PDCP layer security status PDU session #1 Integrity protection and encryption protection are both on PDU session #2 Integrity protection and encryption protection are turned off PDU session #3 Integrity protection is on, encryption protection is off PDU session #4 Integrity protection is off, encryption protection is on ... ...
  • the second node obtains the correspondence between the identifier of the PDU session and the identifier of the second transmission tunnel.
  • the CU-CP of the second node obtains the correspondence between the identifier of the PDU session and the identifier of the second transmission tunnel.
  • the second node allocates tunnel information on the second node to the PDU session, and the tunnel information includes the tunnel end address of the second node and so on.
  • the second node sends an N2 PDU Session Response to the AMF.
  • the N2 PDU Session Response includes the PDU session identifier, the N2 SM message, etc., and the N2 SM message includes the tunnel information on the second node.
  • the second node may complete the establishment of the second uplink transmission tunnel according to the core network address of the second transmission tunnel and the tunnel address of the second node; the AMF sends the N2 SM message received from the RAN to the SMF.
  • the SMF initiates the N4 reply modification process, and sends the tunnel information on the second node to the UPF to complete the establishment of the second downlink transmission tunnel.
  • the second node participates in the establishment of the second transmission tunnel.
  • the second node may obtain the identifier of the second transmission tunnel corresponding to the PDU session identifier. Therefore, the second node can establish a correspondence between the identifier of the PDU session and the identifier of the second transmission tunnel.
  • the correspondence between the identifier of the PDU session and the identifier of the second transmission tunnel can be referred to Table 4.
  • the second node generates a second correspondence according to the correspondence between the identifier of the PDU session and the security state of the PDCP layer, and the correspondence between the identifier of the PDU session and the identifier of the second transmission tunnel.
  • the CU-CP of the second node generates a second node based on the correspondence between the identity of the PDU session and the security state of the PDCP layer, and the correspondence between the identity of the PDU session and the identity of the second transmission tunnel. Correspondence.
  • the PDCP layer security state corresponding to the PDU session is the PDCP layer security state corresponding to the second transmission tunnel in the PDU session.
  • PDU session #1 the security status of the PDCP layer corresponding to PDU session #1 is both integrity protection and encryption protection enabled, and PDU session #1 corresponds to the second transmission tunnel #5, so the second transmission tunnel #5 corresponds to The security status of the PDCP layer is both integrity protection and encryption protection turned on.
  • PDU session #2 the security status of the PDCP layer corresponding to PDU session #2 is integrity protection and encryption protection are both closed, and PDU session #2 corresponds to the second transmission tunnel #6, so the second transmission tunnel #6 corresponds to The security status of the PDCP layer is that integrity protection and encryption protection are both closed.
  • the CU-CP of the second node after the CU-CP of the second node generates the second correspondence, the CU-CP of the second node sends the second correspondence to the CU-UP of the second node. After the CU-UP of the second node receives the second correspondence, the CU-UP of the second node stores the second correspondence.
  • the second node can obtain the second correspondence, so that the second node can adopt the second implementation manner when performing step S802 in FIG. 13.
  • the second node generating the first correspondence includes the following steps:
  • step S1001 is the same as step S901, and its specific description can be referred to the embodiment shown in FIG. 14, which will not be repeated here.
  • the second node obtains the correspondence between the identifier of the PDU session and the identifier of the first transmission tunnel.
  • the CU-CP of the second node obtains the correspondence between the identifier of the PDU session and the identifier of the first transmission tunnel.
  • the second node in order to transmit user plane data, the second node will establish the DRB in the PDU session for the terminal. Therefore, for a PDU session, the second node can determine the DRB in the PDU session. Thus, the second node can establish a correspondence between the identifier of the PDU session and the DRB.
  • the DRB bearer includes two parts, the bearer from the DU to the terminal and the bearer from the CU to the DU.
  • the bearer from the CU to the DU is called the first transmission tunnel. Therefore, during the DRB establishment process, the second node can obtain the identity of the first transmission tunnel. That is, the second node can establish a correspondence between the DRB and the identity of the first transmission tunnel.
  • one DRB can be configured with multiple first transmission tunnels
  • the correspondence between the DRB and the first transmission tunnel is a one-to-many correspondence.
  • the correspondence between the DRB and the identifier of the first transmission tunnel can be referred to Table 6.
  • the second node can determine the correspondence between the identity of the PDU session and the identity of the first transmission tunnel relationship.
  • Table 7 shows the correspondence between the identifier of the PDU session and the identifier of the first transmission tunnel.
  • the second node generates a first correspondence according to the correspondence between the identifier of the PDU session and the security state of the PDCP layer, and the correspondence between the identifier of the PDU session and the identifier of the first transmission tunnel.
  • the CU-CP of the second node is based on the correspondence between the identity of the PDU session and the security state of the PDCP layer, the correspondence between the identity of the PDU session and the DRB, and the identity of the DRB and the first transmission tunnel. Determine the first corresponding relationship.
  • the PDCP layer security status corresponding to the PDU session is the PDCP layer security status corresponding to the DRB in the PDU session.
  • the PDCP layer security status corresponding to the DRB is the PDCP layer security status corresponding to the first transmission tunnel configured in the DRB.
  • PDU session #1 Take Table 3 and Table 7 to illustrate.
  • the security status of the PDCP layer corresponding to PDU session #1 is both integrity protection and encryption protection turned on, and PDU session #1 corresponds to the first transmission tunnel #5 and the first transmission tunnel #6, so the first
  • the security state of the PDCP layer corresponding to a transmission tunnel #5 is that both integrity protection and encryption protection are enabled, and the security state of the PDCP layer corresponding to the first transmission tunnel #6 is that both integrity protection and encryption protection are enabled.
  • the IAB donor may generate the first corresponding relationship to the IAB node.
  • the communication method further includes step 1004 after step 1003.
  • the second node sends the first correspondence to the first node, so that the first node obtains the first correspondence.
  • the CU-CP of the second node sends the first correspondence to the first node.
  • the first node After acquiring the first correspondence, the first node stores the first correspondence.
  • the first node can obtain the first correspondence, so that the first node can adopt the second implementation manner when performing step S702 in FIG. 12.
  • the process of establishing a security tunnel between the first node and the second node will be introduced below.
  • the process of establishing a secure tunnel includes the following steps:
  • the first stage of establishing a secure tunnel is performed between the first node and the second node.
  • the first stage is used to implement identity authentication and key negotiation between the first node and the second node.
  • the initiator in the process of establishing the secure tunnel may be the first node or the second node. That is, the first node may actively send a secure tunnel establishment request to the second node; or, the second node may actively send a secure tunnel establishment request to the first node.
  • the second node is the responder. Or, if the second node is the initiator, the first node is the responder.
  • the authentication credential in the IPsec establishment process is a pre-configured digital certificate; or, the authentication credential can be a pre-shared key (PSK); or, the authentication credential can be Diffie-Hellman algorithm is negotiated and determined.
  • PSK pre-shared key
  • the authentication credential can be Diffie-Hellman algorithm is negotiated and determined.
  • the pre-shared key includes one of the following situations:
  • the pre-shared key can be Kgnb.
  • Kgnb is a key used to protect the communication security of the access layer.
  • the pre-shared key is a random number generated by the first node/second node.
  • the first node may use RRC signaling or an F1 interface setup message to carry the random number to share with the second node.
  • the second node can use RRC signaling or an F1 interface establishment message to carry the random number to share with the first node.
  • the pre-shared key is generated based on Kgnb and intermediate parameters.
  • the intermediate parameter is shared by the first node and shared by the first node to the second node.
  • the intermediate parameter is generated by the second node and shared by the second node with the first node.
  • the intermediate parameters include at least one of the following parameters: cell identifier, address of the first node, address of the CU of the second node, physical cell identifier (PCI), function counter value , FC value), constant.
  • PCI physical cell identifier
  • FC value FC value
  • the second stage is used to negotiate security parameters used by the IPsec security association to determine the IPsec security policy and the session key between the first node and the second node.
  • IPsec security policy determines the security status corresponding to the security tunnel.
  • the second stage may include the following steps:
  • the initiator first sends the key exchange material and the SA payload.
  • the key exchange materials may include: the DH value of the initiator, random numbers, and so on.
  • the DH value is the value calculated according to the Diffie-Hellman algorithm.
  • the SA payload may include: security parameter index, version number, list of encryption algorithms supported by the initiator, etc.
  • the SA load may include one or more recommended loads.
  • a suggested load can include one or more transform loads.
  • the responder replies with the selected cryptographic algorithm, the receiver's DH value, random number, etc.
  • IPsec information may be carried in RRC signaling.
  • RRC signaling may be a signaling radio bearer (signal radio bearer, SRB) message or a DRB message.
  • the SRB message carrying the IPsec information may be the SRB message in the establishment procedure of the DU of the first node.
  • the multiplexing of SRB messages is realized, which is beneficial to reduce signaling overhead.
  • the IPsec layer of the first node can send the IPsec information to the RRC layer of the first node, so that the RRC layer of the first node sends the RRC carrying the IPsec information Signaling. And, after the RRC layer of the first node receives the RRC signaling carrying the IPsec information, the RRC layer of the first node sends the IPsec information to the IPsec layer of the first node.
  • the IPsec layer of the second node can send the IPsec information to the RRC layer of the second node, so that the RRC layer of the second node sends the RRC carrying the IPsec information Signaling. And, after the RRC layer of the second node receives the RRC signaling carrying the IPsec information, the RRC layer of the second node sends the IPsec information to the IPsec layer of the second node.
  • a secure tunnel can be established between the first node and the second node.
  • the first node and the second node may only perform the first phase of the process once; then, for each of the multiple secure tunnels, Both the first node and the second node perform the second security tunnel process once.
  • both the first node and the second node can perform the first stage and the second stage The process.
  • the number of secure tunnels established between the first node and the second node may be defined in the protocol, or may be configured according to operator policies, and the embodiment of the present application is not limited to this.
  • each network element such as the first node, the second node, etc.
  • each network element includes a hardware structure or software module corresponding to each function, or a combination of both.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation. The following is an example of dividing each functional module corresponding to each function:
  • FIG. 17 it is a schematic structural diagram of a first node provided by an embodiment of this application.
  • the first node includes a processing module 201 and a communication module 202.
  • the processing module 201 is used to make the first node execute steps S702 and S703 in FIG. 12, and so on.
  • the communication module 202 is used to make the first node execute steps S701 and S704 in FIG. 12, steps S804 and S805 in FIG. 13, step S1004 in FIG. 15, steps S1101 and S1102 in FIG. 16, and so on.
  • the processing module 201 in FIG. 17 may be implemented by the processor 101 in FIG. 7, and the communication module 202 in FIG. 17 may be implemented by the communication interface 104 in FIG.
  • the embodiments of this application do not impose any restriction on this.
  • the embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on a first network element, the first network element Perform the method provided in the embodiment of this application.
  • the embodiment of the present application also provides a computer program product containing computer instructions, which when running on the first network element, enables the first network element to execute the method provided in the embodiment of the present application.
  • An embodiment of the present application provides a chip including a processor, and when the processor executes an instruction, the chip can execute the method provided in the embodiment of the present application.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit as a communication interface.
  • FIG. 18 it is a schematic structural diagram of a second node provided by an embodiment of this application.
  • the second node includes a processing module 301 and a communication module 302.
  • the processing module 301 is used to make the second node execute steps S802 and S803 in FIG. 13, steps S901-S903 in FIG. 14, steps S1001-S1003 in FIG. 15, and so on.
  • the communication module 302 is used to make the first node execute steps S704 and S705 in FIG. 12, steps S801 and S804 in FIG. 13, step S1004 in FIG. 15, steps S1101 and S1102 in FIG. 16, and so on.
  • the processing module 301 in FIG. 18 may be implemented by the processor 101 in FIG. 7, and the communication module 302 in FIG. 18 may be implemented by the communication interface 104 in FIG.
  • the embodiments of this application do not impose any restriction on this.
  • the embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on a second network element, the second network element Perform the method provided in the embodiment of this application.
  • the embodiment of the present application also provides a computer program product containing computer instructions, which when running on a second network element, enables the second network element to execute the method provided in the embodiment of the present application.
  • An embodiment of the present application provides a chip including a processor, and when the processor executes an instruction, the chip can execute the method provided in the embodiment of the present application.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit as a communication interface.
  • FIG. 19 it is a schematic structural diagram of a mobility management network element provided by an embodiment of this application.
  • the mobility management network element includes a processing module 401 and a communication module 402.
  • the processing module 401 is configured to make the mobility management network element execute step S602 in FIG. 10.
  • the communication module 402 is used to make the mobility management network element execute steps S401 and S402 in FIG. 8.
  • the processing module 401 in FIG. 19 may be implemented by the processor 101 in FIG. 7, and the communication module 402 in FIG. 19 may be implemented by the communication interface 104 in FIG.
  • the embodiments of this application do not impose any restriction on this.
  • the embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on a mobility management network element, the mobility management network element Perform the method provided in the embodiment of this application.
  • the embodiment of the present application also provides a computer program product containing computer instructions, which when it runs on the mobility management network element, enables the mobility management network element to execute the method provided in the embodiments of the present application.
  • An embodiment of the present application provides a chip including a processor, and when the processor executes an instruction, the chip can execute the method provided in the embodiment of the present application.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit as a communication interface.
  • FIG. 20 it is a schematic structural diagram of a data management network element provided by an embodiment of this application.
  • the data management network element includes a processing module 501 and a communication module 502.
  • the processing module 501 is configured to make the data management network element execute step S404 in FIG. 8.
  • the communication module 502 is used to make the data management network element execute step S403 in FIG. 8, step S501 in FIG. 9, and so on.
  • the processing module 501 in FIG. 20 may be implemented by the processor 101 in FIG. 7, and the communication module 502 in FIG. 20 may be implemented by the communication interface 104 in FIG.
  • the embodiments of this application do not impose any restriction on this.
  • the embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on a data management network element, the computer is caused to execute the present application The method provided by the embodiment.
  • the embodiment of the present application also provides a computer program product containing computer instructions, which when running on a computer, enables the data management network element to execute the method provided in the embodiment of the present application.
  • An embodiment of the present application provides a chip including a processor, and when the processor executes an instruction, the chip can execute the method provided in the embodiment of the present application.
  • the instruction can come from the internal memory of the chip or the external memory of the chip.
  • the chip also includes an input and output circuit as a communication interface.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions can be sent from a website site, computer, server, or data center to another website site, through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) Computer, server or data center for transmission.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or may include one or more data storage devices such as servers and data centers that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium, or a semiconductor medium (for example, a solid-state hard disk).
  • the devices and methods disclosed in the several embodiments provided in this application can be implemented in other ways.
  • the device embodiments described above are merely illustrative, the division of the modules or units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another device, or some features can be ignored or not implemented.
  • mutual coupling or direct coupling or communication connection shown or discussed in this application may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate parts may or may not be physically separate.
  • the parts displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of software products, which are stored in a storage medium.
  • a device which may be a single-chip microcomputer, a chip, etc.
  • a processor processor

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供一种通信方法及装置，涉及通信技术领域，用于减少IAB node与IAB donor之间的数据传输时延。该方法包括：IAB node接收来自终端的上行数据包；IAB node确定上行数据包的PDCP层安全状态；IAB node根据上行数据包的PDCP层安全状态，从IAB node与IAB donor之间的多个安全隧道中，确定目标安全隧道；IAB node通过所述目标安全隧道向IAB donor发送所述上行数据包。本申请适用于数据传输过程中。

Description

通信方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及通信方法及装置。
背景技术
为了减轻有线传输网络的建设负担，提供灵活和密集的新空口(new radio，NR)部署，第五代(5th generation)5G NR提出了接入回传一体化(integrated access backhaul，IAB)技术。基于IAB技术，基站可以分为IAB节点(node)和IAB宿主基站(donor)。IAB donor用于提供到核心网的用户设备接口，以及支持IAB node无线回传功能。IAB node能够支持终端的无线接入和数据的无线回传。由于IAB donor和IAB node之间可以通过无线回传链路进行数据交互，因此IAB donor和IAB node之间可以不用铺设线缆。这使得IAB node的部署更加灵活。
5G网络提供多种服务，以车联网、超高可靠超低时延通信(ultra-reliable&low latency communication，URLLC)为代表的业务既有高可靠性的要求，又有低时延的要求。而IAB网络由于多跳的架构导致时延增加，因此更需要减少终端到IAB-donor之间的端到端时延，以使得IAB网络可以应用于更多的场景下。
发明内容
本申请提供一种通信方法及装置，用于减少IAB node与IAB donor之间的数据传输时延。其具体内容参见第一方面至第九方面中任一方面的描述。
第一部分
第一方面，提供一种通信系统，包括第一节点和第二节点，第一节点与第二节点之间建立有多个安全隧道，多个安全隧道对应不同的安全状态。第一节点，用于接收来自终端的上行数据包；确定上行数据包的分组数据汇聚协议(packet data convergence protocol，PDCP)层安全状态；根据上行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道；通过目标安全隧道向第二节点发送上行数据包。第二节点，用于接收来自于第一节点的上行数据包；向用户面网元发送上行数据包。
相比较于现有技术中第一节点在以安全隧道传输上行数据包之前，需要对上行数据包进行加密计算和完整性保护计算，本申请实施例所提供的技术方案，在一些情况下，第一节点在以目标安全隧道传输上行数据包之前，不需要对上行数据包进行加密计算和/或完整性保护计算，从而降低第一节点对上行数据包的处理时延。相应的，第二节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第二节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
一种可能的设计中，第一节点，具体用于根据上行数据包是否携带完整性的消息认证码(message authentication code integrity，MAC-I)，确定上行数据包的PDCP层安全状态。
一种可能的设计中，第一节点，具体用于若上行数据包未携带MAC-I，则确定上行数据包的PDCP层安全状态为完整性保护关闭；若上行数据包携带MAC-I，则确定 上行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，第一节点，具体用于根据用于传输上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定上行数据包的PDCP层安全状态；其中，第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，第一传输隧道为第一节点与第二节点之间的传输隧道。
一种可能的设计中，第二节点，还用于获取协议数据单元(protocol data unit，PDU)会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话的标识与第一传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系；向第一节点发送第一对应关系。第一节点，还用于接收第一对应关系。
一种可能的设计中，第一节点，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一种可能的设计中，第一节点，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若上行数据包的PDCP 层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
一种可能的设计中，第二节点，还用于接收来自于用户面网元的下行数据包；确定下行数据包的PDCP层安全状态；根据下行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，通过目标安全隧道向第一节点发送下行数据包。第一节点，还用于接收来自于第二节点的下行数据包；向终端发送下行数据包。
相比较于现有技术中第二节点在以安全隧道传输下行数据包之外，需要对下行数据包进行加密计算和完整性保护计算，基于本申请实施例所提供的技术方案，在一些情况下，第二节点以目标安全隧道传输下行数据包，可以不对下行数据包进行加密计算和/或完整性保护计算，从而降低第二节点对下行数据包的处理时延。相应的，第一节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第一节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
一种可能的设计中，第二节点，具体用于根据下行数据包是否携带MAC-I，确定下行数据包的PDCP层安全状态。
一种可能的设计中，第二节点，具体用于若下行数据包未携带MAC-I，则确定下行数据包的PDCP层安全状态为完整性保护关闭；若下行数据包携带MAC-I，则确定下行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，第二节点，具体用于根据用于传输下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定下行数据包的PDCP层安全状态；其中，第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，第二传输隧道为第二节点与用户面网元之间的传输隧道。
一种可能的设计中，第二节点，还用于获取PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话与第二传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成第二对应关系。
一种可能的设计中，所述第二节点，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所 述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一种可能的设计中，所述第二节点，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护 开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
第二方面，提供一种通信方法，所述通信方法应用于第一节点，所述第一节点与第二节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，该方法包括：第一节点接收来自终端的上行数据包；第一节点确定上行数据包的PDCP层安全状态；第一节点根据上行数据包的PDCP层安全状态和多个安全隧道，确定目标安全隧道，多个安全隧道对应不同的安全状态；第一节点通过目标安全隧道向第二节点发送上行数据包。
相比较于现有技术中第一节点在以安全隧道传输上行数据包之外，需要对上行数据包进行加密计算和完整性保护计算，本申请实施例所提供的技术方案，在一些情况下，第一节点以目标安全隧道传输上行数据包，可以不对上行数据包进行加密计算和/或完整性保护计算，从而降低第一节点对上行数据包的处理时延。相应的，第二节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第二节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
一种可能的设计中，第一节点确定上行数据包的PDCP层安全状态，包括：第一节点根据上行数据包是否携带MAC-I，确定上行数据包的PDCP层安全状态。基于该设计，第一节点可以快速确定上行数据包是否在PDCP层上具有完整性保护。
一种可能的设计中，第一节点根据上行数据包是否携带MAC-I，确定上行数据包的PDCP层安全状态，包括：若上行数据包未携带MAC-I，则第一节点确定上行数据包的PDCP层安全状态为完整性保护关闭；若上行数据包携带MAC-I，则第一节点确定上行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，第一节点确定上行数据包的PDCP层安全状态，包括：第一节点根据用于传输上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定上行数据包的PDCP层安全状态；其中，第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，第一传输隧道为第一节点与第二节点之间的传输隧道。基于该设计，第一节点可以准确确定上行数据包是否在PDCP层上具有加密保护和/或完整性保护。
一种可能的设计中，该方法还包括：第一节点接收第二节点发送的第一对应关系。
一种可能的设计中，所述第一节点根据所述上行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，包括：所述第一节点根据所述上行数据包的PDCP层安全状态和多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态 是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一种可能的设计中，所述第一节点根据所述上行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，包括：所述第一节点根据所述上行数据包的PDCP层安全状态和多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
第三方面，提供一种通信方法，所述通信方法应用于第二节点，第二节点与第一节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，该方法包括：第二节点接收来自于用户面网元的下行数据包；第二节点确定下行数据包的PDCP层安全状态；第二节点根据下行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，多个安全隧道对应不同的安全状态；第二节点通过目标安全隧道向第一节点发送下行数据包。
相比较于现有技术中第二节点在以安全隧道传输下行数据包之前，需要对下行数据包进行加密计算和完整性保护计算，基于本申请实施例所提供的技术方案，在一些情况下，第二节点在以目标安全隧道传输下行数据包，可以不对下行数据包进行加密计算和/或完整性保护计算，从而降低第二节点对下行数据包的处理时延。相应的，第一节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第一节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
一种可能的设计中，第二节点确定下行数据包的PDCP层安全状态，包括：第二节点根据下行数据包是否携带MAC-I，确定下行数据包的PDCP层安全状态。基于该设计，第二节点可以快速确定下行数据包是否在PDCP层上具有完整性保护。
一种可能的设计中，第二节点根据下行数据包是否携带MAC-I，确定下行数据包的PDCP层安全状态，包括：若下行数据包未携带MAC-I，则第二节点确定下行数据包的PDCP层安全状态为完整性保护关闭；若下行数据包携带MAC-I，则第二节点确定下行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，第二节点确定下行数据包的PDCP层安全状态，包括：第二节点根据用于传输下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定下行数据包的PDCP层安全状态；其中，第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，第二传输隧道为第二节点与用户面网元之间的传输隧道。基于该设计，第二节点可以准确确定下行数据包是否在PDCP层上具有加密保护和/或完整性保护。
一种可能的设计中，该方法还包括：第二节点获取PDU会话的标识与PDCP层安全状态之间的对应关系；第二节点获取PDU会话与第二传输隧道的标识之间的对应关系；第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成第二对应关系。
一种可能的设计中，该方法还包括：第二节点获取PDU会话的标识与PDCP层安全状态之间的对应关系；第二节点获取PDU会话的标识与第一传输隧道的标识之间的对应关系；第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系；第二节点向第一节点发送第一对应关系。
一种可能的设计中，所述第二节点根据所述下行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，包括：所述第二节点根据所述下行数据包的PDCP层安全状态和多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若下行数据包的PDCP 层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
第四方面，提供一种通信装置，所述通信装置与第二节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述通信装置包括：通信模块，用于接收来自终端的上行数据包。处理模块，用于确定上行数据包的PDCP层安全状态；根据上行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，多个安全隧道对应不同的安全状态。通信模块，还用于通过目标安全隧道向第二节点发送上行数据包。
一种可能的设计中，处理模块，具体用于根据上行数据包是否携带MAC-I，确定上行数据包的PDCP层安全状态。
一种可能的设计中，处理模块，具体用于若上行数据包未携带MAC-I，则确定上行数据包的PDCP层安全状态为完整性保护关闭；若上行数据包携带MAC-I，则确定上行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，处理模块，具体用于根据用于传输上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定上行数据包的PDCP层安全状态；其中，第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，第一传输隧道为第一节点与第二节点之间的传输隧道。
一种可能的设计中，通信模块，还用于接收第二节点发送的第一对应关系。
一种可能的设计中，处理模块，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一种可能的设计中，处理模块，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态 是相同的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
第五方面，提供一种通信装置，所述通信装置与第一节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述通信装置包括：通信模块，用于接收来自于用户面网元的下行数据包。处理模块，用于确定下行数据包的PDCP层安全状态；根据下行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，多个安全隧道对应不同的安全状态。通信模块，用于通过目标安全隧道向第一节点发送下行数据包。
一种可能的设计中，处理模块，具体用于根据下行数据包是否携带MAC-I，确定下行数据包的PDCP层安全状态。
一种可能的设计中，处理模块，具体用于若下行数据包未携带MAC-I，则确定下行数据包的PDCP层安全状态为完整性保护关闭；若下行数据包携带MAC-I，则确定下行数据包的PDCP层安全状态为完整性保护开启。
一种可能的设计中，处理模块，用于根据用于传输下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定下行数据包的PDCP层安全状态；其中，第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，第二传输隧道为第二节点与用户面网元之间的传输隧道。
一种可能的设计中，处理模块，还用于获取PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话与第二传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成第二对应关系。
一种可能的设计中，处理模块，还用于获取PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话的标识与第一传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系。通信模块，还用于向第一节点发送第一对应关系。
一种可能的设计中，所述处理模块，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数 据包的PDCP层安全状态是如何互补的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭；(2)若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一种可能的设计中，所述处理模块，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。
下面结合安全状态的不同考虑角度，具体介绍目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何相同的。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启；(2)若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启；(2)若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
一种可能的设计中，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的，包括以下情形之一：(1)若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭；(2)若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启；(3)若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭；(4)若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
第六方面，提供一种装置，包括处理器和通信接口。当处理器执行该指令时，使 得装置实现上述第二方面或第三方面中任一种设计所涉及的通信方法。可选的，该装置还包括通信接口，该通信接口用于该装置与其他设备进行通信。
第七方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机可以执行上述第二方面或第三方面中任一种设计所涉及的通信方法。
第八方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机可以执行上述第二方面或第三方面中任一种设计所涉及的通信方法。
第九方面，提供一种芯片，该芯片包括处理器，当该处理器执行指令时，处理器用于执行上述第二方面或第三方面中任一种设计所涉及的通信方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括可以作为通信接口的输入输出电路。
其中，第四方面至第九方面中任一种设计方式所带来的技术效果可以参见上述第二方面或第三方面中不同设计方式所带来的技术效果，此处不再赘述。
本申请还提供一种通信方法及装置，用于减少数据管理网元需要执行的验证操作，降低数据管理网元的处理负担。其具体内容可以参见第十方面至第十八方面中任一方面的描述。
第二部分
第十方面，提供一种通信系统，包括：移动管理网元、认证服务网元、以及数据管理网元。移动管理网元，用于接收来自于通信设备的注册请求消息；向认证服务网元发送第一认证请求消息；在注册请求消息包括第一指示信息的情况下，第一认证请求消息包括第一指示信息。认证服务网元，用于接收第一认证请求消息；向数据管理网元发送第二认证请求消息；在第一认证请求消息包括第一指示信息的情况下，第二认证请求消息包括第一指示信息。数据管理网元，用于在第二认证请求消息包括第一指示信息的情况下，查询通信设备的标识是否在预设名单中；若通信设备的标识在预设名单中，则确定通信设备为IAB node；若通信设备的标识不在预设名单中，则确定通信设备为终端。
基于本申请的技术方案，在第二认证请求消息包括第一指示信息的情况下，数据管理网元才需要查询通信设备的标识是否在预设名单中，以判断该通信设备是否是IAB node；否则，数据管理网元可以确定接入网络的通信设备是普通的终端。也即，数据管理网元仅需要针对一部分通信设备进行查询操作。在实际应用场景中，由于接入网络的通信设备大部分是终端，而终端上报的注册请求一般不会包括第一指示信息，因此本申请实施例所提供的技术方案可以有效减少数据管理网元需要执行的查询操作，减轻了数据管理网元的处理负担。
一种可能的设计中，数据管理网元，还用于在第二认证请求消息不包括第一指示信息的情况下，确定通信设备为终端。
第十一方面，提供一种通信方法，包括：数据管理网元接收第二认证请求消息，第二认证请求消息包括通信设备的用户标识；数据管理网元在第二认证请求消息包括第一指示信息的情况下，查询通信设备的标识是否在预设名单中；若通信设备的标识 在预设名单中，则数据管理网元确定通信设备为IAB node；若通信设备的标识不在预设名单中，则数据管理网元确定通信设备为终端。
一种可能的设计中，数据管理网元在第二认证请求消息不包括第一指示信息的情况下，确定通信设备为终端。
第十二方面，提供一种通信装置，包括：通信模块，用于接收第二认证请求消息，第二认证请求消息包括通信设备的用户标识。处理模块，用于在第二认证请求消息包括第一指示信息的情况下，查询通信设备的标识是否在预设名单中；若通信设备的标识在预设名单中，则确定通信设备为IAB node；若通信设备的标识不在预设名单中，则确定通信设备为终端。
一种可能的设计中，处理模块，还用于在第二认证请求消息不包括第一指示信息的情况下，确定通信设备为终端。
第十三方面，提供一种通信装置，包括处理器和通信接口。当处理器执行计算机程序指令时，使得通信装置实现上述第十一方面中任一种设计所涉及的通信方法。可选的，该装置还包括通信接口，该通信接口用于该装置与其他设备进行通信。
第十四方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机可以执行上述第十一方面中任一种设计所涉及的通信方法。
第十五方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机可以执行上述第十一方面中任一种设计所涉及的通信方法。
第十六方面，提供一种芯片，该芯片包括处理器，当该处理器执行指令时，处理器用于执行上述第十一方面中任一种设计所涉及的通信方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括可以作为通信接口的输入输出电路。
其中，第十二方面至第十六方面中任一种设计方式所带来的技术效果可以参见上述第十一方面中不同设计方式所带来的技术效果，此处不再赘述。
第三部分
第十七方面，提供一种通信方法，包括：数据管理网元确定通信设备为IAB node；数据管理网元在主鉴权流程中向移动管理网元发送第二指示信息，第二指示信息用于确定通信设备为IAB node。本申请的技术方案规定了数据管理网元向移动管理网元发送IAB authorized的时间和方式，使得移动管理网元能够在主鉴权流程结束之前获知通信设备是否是IAB node。
一种可能的设计中，第二指示信息承载于第二认证响应消息或者鉴权信息回答命令消息中。可以理解的是，第二指示信息承载于主鉴权流程的现有信令中，有利于减少信令开销。
第十八方面，提供一种通信装置，包括：处理模块，用于确定通信设备为IAB node。通信模块，用于在主鉴权流程中向移动管理网元发送第二指示信息，第二指示信息用于确定通信设备为IAB node。
一种可能的设计中，第二指示信息承载于第二认证响应消息或者鉴权信息回答命令消息中。
第十九方面，提供一种通信装置，包括处理器和通信接口。当处理器执行计算机程序指令时，使得通信装置实现上述第十七方面中任一种设计所涉及的通信方法。可选的，该装置还包括通信接口，该通信接口用于该装置与其他设备进行通信。
第二十方面，提供一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当指令在计算机上运行时，使得计算机可以执行上述第十七方面中任一种设计所涉及的通信方法。
第二十一方面，提供一种包含指令的计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机可以执行上述第十七方面中任一种设计所涉及的通信方法。
第二十二方面，提供一种芯片，该芯片包括处理器，当该处理器执行指令时，处理器用于执行上述第十七方面中任一种设计所涉及的通信方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括可以作为通信接口的输入输出电路。
其中，第十八方面至第二十二方面中任一种设计方式所带来的技术效果可以参见上述第十七方面中不同设计方式所带来的技术效果，此处不再赘述。
附图说明
图1为一种IAB node的启动流程的示意图；
图2为一种主鉴权流程的示意图；
图3为另一种主鉴权流程的示意图；
图4为本申请实施例提供的一种5G网络的架构示意图；
图5为本申请实施例提供的一种IAB的架构示意图；
图6为本申请实施例提供的另一种IAB的架构示意图；
图7为本申请实施例提供的一种装置的硬件结构示意图；
图8为本申请实施例提供的一种通信方法的流程图；
图9为本申请实施例提供的另一种通信方法的流程图；
图10为本申请实施例提供的另一种通信方法的流程图；
图11为一种IAB相关节点的协议栈的示意图；
图12为本申请实施例提供的另一种通信方法的流程图；
图13为本申请实施例提供的另一种通信方法的流程图；
图14为本申请实施例提供的另一种通信方法的流程图；
图15为本申请实施例提供的另一种通信方法的流程图；
图16为本申请实施例提供的另一种通信方法的流程图；
图17为本申请实施例提供的一种第一节点的结构示意图；
图18为本申请实施例提供的一种第二节点的结构示意图；
图19为本申请实施例提供的一种移动管理网元的结构示意图；
图20为本申请实施例提供的一种数据管理网元的结构示意图。
具体实施方式
在本申请的描述中，除非另有说明，“/”表示“或”的意思，例如，A/B可以表示A或B。本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。 此外，“至少一个”是指一个或多个，“多个”是指两个或两个以上。“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
在本申请的描述中，“指示”可以包括直接指示和间接指示，也可以包括显式指示和隐式指示。将某一信息(如下文所述的第一指示信息、第二指示信息)所指示的信息称为待指示信息，则具体实现过程中，对所述待指示信息进行指示的方式有很多种。例如，可以直接指示所述待指示信息，其中所述待指示信息本身或者所述待指示信息的索引等。又例如，也可以通过指示其他信息来间接指示所述待指示信息，其中该其他信息与所述待指示信息之间存在关联关系。又例如，还可以仅仅指示所述待指示信息的一部分，而所述待指示信息的其他部分则是已知的或者提前约定的。另外，还可以借助预先约定(例如协议规定)的各个信息的排列顺序来实现对特定信息的指示，从而在一定程度上降低指示开销。
为了便于理解本申请的技术方案，下面对一些技术术语进行介绍。
1、加密保护
加密保护：保护数据在传输过程中的机密性(因此又可以被称作机密性保护)，机密性是指无法被直接看出真实内容。加密保护一般可以使用密钥和加密算法对数据进行加密来实现。加密保护的具体方法可以参考3GPP TS 33.401 f50中8.2节或33.501 f50中6.4.4节标准相关描述，这里不再赘述。
2、完整性保护/校验
完整性保护/校验用于判断消息在传递过程中，其内容是否被更改，也可以用于作为身份验证，以确定消息的来源。完整性校验和保护需要使用消息认证码(Message Authentication Code，MAC)。完整性保护和校验的具体方法可以参考3GPP TS 33.401 f50中8.1节或33.501 f50中6.4.3节标准相关描述，这里不再赘述。
3、通信设备的标识
在5G网络中，通信设备的标识可以为签约永久标识(subscription permanent identifier)、签约隐藏标识(subscription concealed identifier，SUCI)、或者5G全球唯一临时身份(5G globally unique temporary identity，5G-GUTI)。
需要说明的是，SUPI用于表征用户的真实身份，功能类似于LTE中的国际移动用户识别码(international mobile subscriber identification number，IMSI)。
SUCI是SUPI以公钥进行加密后生成的。网络设备与终端之间传输SUCI，可以避免明文传输的SUPI被攻击者窃取的问题。可以理解的是，SUCI可以利用与公钥成对的私钥进行解密，以得到SUCI。
为了便于理解本申请的技术方案，下面先介绍现有技术中的IAB node的启动流程。
如图1所示，IAB node的启动流程包括以下步骤：
S101、IAB node向接入与移动管理功能(access and mobility management function，AMF)发送注册请求消息。
其中，注册请求消息包括：IAB node的身份信息。例如，SUCI或者5G-GUTI。
可以理解的是，该AMF集成了安全锚功能(security anchor function，SEAF)网元。
S102、AMF向鉴权功能(authentication server function，AUSF)发送消息1。
其中，消息1可以包括：SUCI/SUPI、以及服务网络名称(server network name，SN name)。
示例性的，消息1可以为Nausf_UEAuthentication_Authenticate Request。
S103、ASUF向统一数据管理(unified data management，UDM)发送消息2。
可以理解的是，该UDM集成了认证凭证库以及处理功能(authentication credential repository and processing function，ARPF)网元。
其中，消息2可以包括：SUCI/SUPI、以及SN name。
示例性的，消息2可以为Nudm_UEAuthentication_Get Request。
S104、UDM查询消息2中的标识是否在IAB列表中。
其中，该IAB列表用于记录一个或多个IAB node的标识。
可以理解的是，消息2中的标识即为SUCI/SUPI。
从而，当消息2中的标识是否在IAB列表中，UDM可以确定接入网络的通信设备为IAB node。否则，UDM确定接入网络的通信设备为普通终端。
S105、IAB node与网络侧进行主鉴权。
S106、AMF向IAB node发送非接入层(non-access stratum，NAS)安全模式命令(security mode command，SMC)消息。
S107、IAB node向AMF发送NAS安全模式完成(security mode complete，SMP)消息。
可以理解的是，基于步骤S106和S107，AMF与IAB node之间建立NAS安全上下文。
S108、AMF向IAB donor发送初始上下文建立请求(initial context setup request)。
其中，初始上下文建立请求包括IAB授权(authorized)。IAB authorized是UDM发送给AMF的。
需要说明的是，当前协议中未定义UDM何时发送IAB authorized，以及以何种方式发送IAB authorized。
S109、IAB donor向IAB node发送接入层(access stratum，AS)SMC消息。
S110、IAB node向IAB donor发送AS SMP消息。
可以理解的是，基于步骤S109和S110，IAB donor与IAB node之间建立AS安全上下文。
S111、IAB node与IAB donor建立路由。
例如，IAB node与IAB donor之间建立安全隧道。
S112、IAB node启动DU。
需要说明的是，在IAB node的DU启动之后，IAB node可以为终端或者其他IAB node提供传输服务。
以上是对IAB node的启动流程的简单介绍。可以理解的是，IAB node的启动流程 还可以包括其他步骤，本申请实施例对此不作限定。
下面对主鉴权流程进行介绍。需要说明的是，主鉴权流程分为两种：一种为可扩展的认证协议(extensible authentication protocol，EAP)-AKA'流程，另一种为5G-AKA流程。
如图2所示，EAP-AKA'流程包括以下步骤：
S201、UDM生成认证向量。
其中，该认证向量可以为AV'(RAND,AUTN,XRES,CK',IK')。
S202、UDM向AUSF发送消息3。
其中，消息3可以包括认证向量(EAP-AKA′AV)。
示例性的，消息3可以为Nudm_UEAuthentication_Get Response。
S203、AUSF向AMF发送消息4。
其中，消息4可以包括EAP Request/AKA′-Challenge。
示例性的，消息4可以为Nausf_UEAuthentication_Authenticate Response。
S204、AMF向IAB node发送消息5。
其中，消息5可以包括EAP Request/AKA′-Challenge、ngKS、以及ABBA。
示例性的，消息5可以为Auth-Req.。
S205、IAB node计算鉴权响应。
S206、IAB node向AMF发送消息6。
其中，消息6可以包括EAP Response/AKA′-Challenge。
示例性的，消息5可以为Auth-Resp.。
S207、AMF向AUSF发送消息7。
其中，消息7可以包括EAP Response/AKA′-Challenge。
示例性的，消息7可以为Nausf_UEAuthentication_Authenticate Request。
S208、AUSF验证鉴权响应。
S209(可选的)、IAB node与AUSF之间交互其他的EAP消息。
在鉴权成功的情况下，可以执行以下步骤S210和S211。
S210、AUSF向AMF发送消息8。
其中，消息8可以包括EAP Success||Anchor Key。
示例性的，消息8可以为Nausf_UEAuthentication_Authenticate Response。
S211、AMF向IAB node发送消息9。
其中，消息9可以包括EAP Success、ngKSI、以及ABBA。
示例性的，消息9可以为N1 message。
以上是对EAP-AKA'流程的简单介绍，EAP-AKA'流程的具体描述可以参考现有技术。
如图3所示，5G-AKA流程包括以下步骤：
S301、UDM生成认证向量。
S302、UDM向AUSF发送消息10。
其中，消息10可以包括5G HE AV。
示例性的，消息10可以为Nudm_Authentication_Get Response。
S303、ASUF保存XRES*，并且计算HXRES*。
S304、AUSF向AMF发送消息11。
其中，消息11可以包括5G SE AV。
示例性的，消息11可以为Nausf_UEAuthentication_Authenticate Response。
S305、AMF向IAB node发送消息12。
示例性的，消息12可以为Authentication Request。
S306、IAB node计算鉴权响应(RES*)。
S307、IAB node向AMF发送消息13。
示例性的，消息13可以为Authentication Response。
S308、AMF计算HRES*，并且比较HRES*和HXRES*是否一致。
S309、AMF向AUSF发送消息14。
其中，消息14可以包括RES*。
示例性的，消息14可以为Nausf_UEAuthentication_Authenticate Request。
S310、ASUF验证RES*与XRES*是否一致。
S311、AUSF向AMF发送消息15。
其中，消息15可以包括鉴权结果以及Kseaf。
示例性的，消息15可以为Nausf_UEAuthentication_Authenticate Response。
以上是对5G-AKA'流程的简单介绍，5G-AKA流程的具体描述可以参考现有技术。
本申请实施例提供的技术方案可以应用于各种通信系统，例如，采用5G通信系统，未来演进系统或者多种通信融合系统等等。
本申请提供的技术方案可以应用于多种应用场景，例如，机器对机器(machine to machine，M2M)、宏微通信、增强型移动互联网(enhanced mobile broadband，eMBB)、URLLC以及海量物联网通信(massive machine type communication，mMTC)等场景。这些场景可以包括但不限于：通信设备与通信设备之间的通信场景，网络设备与网络设备之间的通信场景，网络设备与通信设备之间的通信场景等。下文中均是以应用于网络设备和终端之间的通信场景中为例进行说明的。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图4所示，为本申请实施例提供的技术方案所适用的5G网络的架构。5G网络可以包括：终端、无线接入网络(radio access network，RAN)或者接入网络(access network，AN)(下文中将RAN和AN统称为(R)AN)、核心网(core network，CN)、以及数据网(data network，DN)。
其中，终端可以是一种具有无线收发功能的设备。所述终端可以有不同的名称，例如用户设备(user equipment，UE)、接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。终端可以被部署在陆地上，包括室内或室外、手持或车载；也可以被部署在水面上(如轮船等)；还可以被部署在空中(例如飞机、气球和卫星上等)。终端包括具有无线通信 功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，终端可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请实施例中，用于实现终端的功能的装置可以是终端，也可以是能够支持终端实现该功能的装置，例如芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例中，以用于实现终端的功能的装置是终端为例，描述本申请实施例提供的技术方案。
接入网设备也可以称为基站。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。具体可以为：是无线局域网(Wireless Local Area Network，WLAN)中的接入点(access point，AP)，全球移动通信系统(Global System for Mobile Communications，GSM)或码分多址接入(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)中的基站(NodeB，NB)，还可以是LTE中的演进型基站(Evolved Node B，eNB或eNodeB)，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G网络中的下一代节点B(The Next Generation Node B，gNB)或者未来演进的公用陆地移动网(Public Land Mobile Network，PLMN)网络中的基站等。
基站，通常包括基带单元(baseband unit，BBU)、射频拉远单元(remote radio unit，RRU)、天线、以及用于连接RRU和天线的馈线。其中，BBU用于负责信号调制。RRU用于负责射频处理。天线用于负责线缆上导行波和空气中空间波之间的转换。一方面，分布式基站大大缩短了RRU和天线之间馈线的长度，可以减少信号损耗，也可以降低馈线的成本。另一方面，RRU加天线比较小，可以随地安装，让网络规划更加灵活。除了RRU拉远之外，还可以把BBU全部都集中起来放置在中心机房(central office，CO)，通过这种集中化的方式，可以极大减少基站机房数量，减少配套设备，特别是空调的能耗，可以减少大量的碳排放。此外，分散的BBU集中起来变成BBU基带池之后，可以统一管理和调度，资源调配更加灵活。这种模式下，所有的实体基站演变成了虚拟基站。所有的虚拟基站在BBU基带池中共享用户的数据收发、信道质量等信息，相互协作，使得联合调度得以实现。
在一些部署中，基站可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)。基站还可以包括有源天线单元(active antenna unit，AAU)。CU实现基站的部分功能，DU实现基站的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，简称RLC)、媒体接入控制(media access control，MAC)和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令或PDCP层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，在本申请实施例中，接 入网设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，CU可以划分为RAN中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，在此不做限制。
一种可能的设计中，对于基站来说，还可以将CU的控制面(control plane，CP)和用户面(user plane，UP)分离，以不同实体来实现。也即，CU可以分为CU-CP和CU-UP。
核心网包括多个核心网网元(或者称为网络功能网元)，例如：AMF网元、安全锚功能(security anchor function，SEAF)、会话管理功能(session management function，SMF)网元、策略控制功能(policy control function，PCF)网元、用户面功能(user plane function，UPF)网元、应用层功能(application function)网元、AUSF网元、以及UDM网元。此外，核心网还可以包括一些其他未示出的网元，本申请实施例在此不予赘述。
此外，核心网还可以包括一些图4中未示出的网元，例如：安全锚功能(security anchor function，SEAF)网元、ARPF网元，本申请实施例在此不予赘述。
其中，UDM网元用于存储用户的签约信息，生成认证参数等。统一数据管理，支持3GPP认证、用户身份操作、权限授予、注册和移动性管理等功能。
ARPF网元具有认证凭证存储和处理功能，用于存储用户的长期认证凭证，如永久密钥K等。在5G中，ARPF网元的功能可以合并到UDM网元中。
SEAF网元用于完成对UE的认证。在5G中，SEAF的功能可以合并到AMF中。
AUSF网元具有鉴权服务功能，用于终结SEAF网元请求的认证功能，在认证过程中，接收UDM发送的认证向量并对认证向量进行处理，将处理后的认证向量发送给SEAF。
AMF网元主要负责移动性管理处理部分，例如：接入控制、移动性管理、附着与去附着以及SMF选择等功能。AMF网元为终端中的会话提供服务的情况下，会为该会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF标识等。
需要说明的是，上述核心网网元可以有其他的名称，本申请实施例不限于此。例如，AMF网元也可以简称为AMF或者AMF实体，UPF网元也可以简称为UPF或者UPF实体，等。
其中，终端通过下一代网络(Next generation，N)1接口(简称N1)与AMF通信，RAN设备通过N2接口(简称N2)与AMF通信，RAN设备通过N3接口(简称N3)与UPF通信，UPF通过N6接口(简称N6)与DN通信。
AMF、SMF、UDM、AUSF、或者PCF等控制面网元也可以采用服务化接口进行交互。比如，如图4所示，AMF对外提供的服务化接口可以为Namf；SMF对外提供的服务化接口可以为Nsmf；UDM对外提供的服务化接口可以为Nudm；PCF对外提供的服务化接口可以为Npcf，AUSF对外提供的服务化接口可以为Nausf；在此不再一一描述。
为了减轻有线传输网络的建设负担，提供灵活和密集的NR部署，5G NR提出了IAB技术。如图5所示，为本申请实施例提供的一种IAB的架构示意图。如图5所示，采用IAB技术的接入网可以包括：IAB node和IAB-donor。
其中，IAB-donor的功能和作用于传统的gNB相似，用于提供核心网的接口。但是，IAB-donor还支持IAB node的无线回传(wireless backhaul)功能。IAB-donor包 括CU和DU。CU又可以分为CU-UP、CU-CP、以及其他功能模块。
IAB node集成了无线接入链路(wireless access link)和无线回传链路(wireless backhaul link)。从而，IAB node能够支持终端的无线接入和数据的无线回传。IAB node可以包括移动终端(mobile terminal，MT)以及DU。MT用于支持IAB node的移动终端功能，辅助IAB node进行入网鉴权和建立通信安全。
如图6所示，IAB node与IAB-donor-CU之间可以通过F1接口进行通信。IAB node与IAB-donor-DU之间可以通过Uu接口进行通信。不同的两个IAB node之间可以通过Uu接口进行通信。IAB-donor-CU可以通过NG接口连接核心网。IAB-donor-CU可以通过Xn-c接口连接gNB。
需要说明的是，在5G网络或者未来其他的网络中，上述各种接口，例如F1接口、Uu接口等，均可以有其他名称，本申请实施例对此不作限定。
可选的，本申请实施例所提及的设备，例如IAB node、IAB donor、终端、核心网网元等，均可以由图7所示的通信装置来实现。
如图7所示，该装置100包括至少一个处理器101，通信线路102，存储器103以及至少一个通信接口104。
处理器101可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路102可包括一通路，在上述组件之间传送信息。
通信接口104，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器103可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路102与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器103用于存储执行本申请方案的计算机执行指令，并由处理器101来控制执行。处理器101用于执行存储器103中存储的计算机执行指令，从而实现本申请下述实施例提供的报文传输方法。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器101可以包括一个或多个CPU，例如图7中的CPU0和CPU1。
在具体实现中，作为一种实施例，装置100可以包括多个处理器，例如图7中的 处理器101和处理器107。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，装置100还可以包括输出设备105和输入设备106。输出设备105和处理器101通信，可以以多种方式来显示信息。例如，输出设备105可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备106和处理器101通信，可以以多种方式接收用户的输入。例如，输入设备106可以是鼠标、键盘、触摸屏设备或传感设备等。
下面结合说明书附图，对本申请实施例所提供的技术方案进行具体阐述。
实施例一
参见图1，现有技术中，任意一个通信设备接入网络时，UDM均需要查询该通信设备的标识是否在IAB列表中，以识别该通信设备是否是IAB node。这使得UDM的查询开销较大。
为了解决上述技术问题，本申请实施例提供一种通信方法。如图8所示，该通信方法包括以下步骤：
S401、通信设备向移动管理网元发送注册请求消息，以使得移动管理网元接收来自通信设备的注册请求消息。
示例性的，在5G网络中，移动管理网元为AMF，在此统一说明，以下不再赘述。
其中，注册请求消息用于请求注册到网络。注册请求消息可以包括使用该通信设备的标识，例如SUCI或者SUPI。示例性的，注册请求消息可以承载于N1接口消息中。
在本申请实施例中，通信设备可以为IAB node。
可选的，注册请求消息可以包括第一指示信息，所述第一指示信息用于指示该通信设备为IAB node。可选的，第一指示信息可以记为：IAB指示(indicator)。
S402、移动管理网元向认证服务网元发送第一认证请求消息，以使得认证服务网元接收来自移动管理网元发送的第一认证请求消息。
示例性的，在5G网络中，认证服务网元为AUSF，在此统一说明，以下不再赘述。
其中，第一认证请求消息用于请求对通信设备进行认证。第一认证请求消息可以包含通信设备的标识。当然，第一认证请求消息还可以包括其他参数，本申请实施例不限于此。
示例性的，第一认证请求消息可为Nausf_UEAuthentication_Authenticate Request。
可以理解的是，若移动管理网元接收到的注册请求消息包括第一指示信息，则移动管理网元发送的第一认证请求消息同样可以包括第一指示信息。
S403、认证服务网元向数据管理网元发送第二认证请求消息，以使得数据管理网元接收来自认证服务网元的第二认证请求消息。
示例性的，在5G网络中，数据管理网元为UDM，在此统一说明，以下不再赘述。
其中，第二认证请求消息用于获取对通信设备进行认证的鉴权向量。第二认证请求消息可以包含所述通信设备的标识。当然，第二认证请求消息还可以包括其他参数， 本申请实施例不限于此。
示例性的，第二认证请求消息可为Nudm_UEAuthentication_Get Request。
可以理解的是，若数据管理网元接收到的第一认证请求消息包括第一指示信息，则数据管理网元发送的第二认证请求消息可以也包括第一指示信息。
S404、数据管理网元判断通信设备是否为IAB node。
作为一种实现方式，在第二认证请求消息包括第一指示信息的情况下，数据管理网元查询通信设备的标识是否在预设名单中。若通信设备的标识在预设名单中，则数据管理网元可以确定该通信设备为IAB node；若通信设备的标识不在预设名单中，则数据管理网元可以确定该通信设备为普通的终端。
其中，预设名单用于记录一个或多个IAB node的标识。可选的，预设名单可以以列表的形式实现。示例性，预设名单为IAB列表。
需要说明的是，在数据管理网元确定通信设备为IAB node的情况下，数据管理网元应向移动管理网元发送第二指示信息。其中，第二指示信息用于确定通信设备为IAB node。示例性的，第二指示信息可以为IAB authorized，本申请实施例不限于此。
可选的，在第二认证请求消息不包括第一指示信息的情况下，数据管理网元确定通信设备为普通的终端。也即，在第二认证请求消息不包括第一指示信息的情况下，数据管理网元不需要判断通信设备是否为IAB node。
基于图8所示的技术方案，在第二认证请求消息包括第一指示信息的情况下，数据管理网元才需要查询通信设备的标识是否在预设名单中，以判断该通信设备是否是IAB node；否则，数据管理网元可以确定接入网络的通信设备是普通的终端。也即，数据管理网元仅需要针对一部分通信设备进行查询操作，从而减少了数据管理网元需要执行的查询操作。
在实际应用场景中，由于接入网络的通信设备大部分是终端，而终端上报的注册请求一般不会包括第一指示信息，因此本申请实施例所提供的技术方案可以有效减少数据管理网元需要执行的查询操作，减轻了数据管理网元的处理负担。
实施例二、
在数据管理网元确定通信设备为IAB node的情况下，现有技术并未定义数据管理网元何时向移动管理网元发送IAB authorized，以及如何发送IAB authorized。
为了解决上述技术问题，本申请实施例提供一种通信方法。如图9所示，该通信方法包括以下步骤：
S501、数据管理网元向移动管理网元发送IAB authorized，以使得移动管理网元接收到来自数据管理网元的IAB authorized。
实现方式一、数据管理网元在主鉴权流程中向移动管理网元发送IAB authorized。
基于实现方式一，一种可能的设计中，在主鉴权流程中，数据管理网元向认证服务网元发送第二认证响应消息。在接收到第二认证响应消息之后，认证服务网元向移动管理网元发送第一认证响应消息。其中，第二认证响应消息和第一认证响应消息均包括第二指示信息。
需要说明的是，第二认证响应消息用于响应第二认证请求消息。示例性的，第二认证响应消息可为Nudm_UEAuthentication_Get Response。
第一认证响应消息用于响应第一认证请求消息。示例性的，第一认证响应消息可以为Nausf_UEAuthentication_Authenticate Response。
基于实现方式一，另一种可能的设计中，在主鉴权流程中，数据管理网元向认证服务网元发送鉴权信息回答命令消息，该鉴权信息回答命令消息包括IAB authorized。可选的，鉴权信息回答命令消息可以增加新的信元以承载IAB authorized；或者，鉴权信息回答命令消息可以选择空闲的标志位以承载IAB authorized。
示例性的，鉴权信息回答命令消息可以为Authentication-Information-Answer(AIA)Command。
基于实现方式一，另一种可能的设计中，承载IAB authorized的信令也可以是主鉴权流程中的新增的信令，本申请实施例不限于此。
实现方式二、在主鉴权结束之后，注册流程结束之前，数据管理网元向移动管理网元发送IAB authorized。
相比较于现有技术，图5所示的技术方案规定了数据管理网元向移动管理网元发送IAB authorized的时间和方式，以使得移动管理网元可以获知通信设备是否是IAB node。
实施例三、
现有技术中，移动管理网元获知接入网络的通信设备的类型的流程为：在通信设备接入网络的过程中，由数据管理网元判断通信设备是否是IAB node，并在通信设备为IAB node的情况下，数据管理网元会向移动管理网元发送IAB node，以使得移动管理网元获知接入网络的通信设备是IAB node。上述流程过于繁琐，有必要进行改进。
为了解决上述技术问题，本申请实施例提供一种通信方法。如图10所示，该通信方法包括以下步骤：
S601、通信设备向移动管理网元发送注册请求消息，以使得移动管理网元接收来自通信设备的注册请求消息。
若通信设备为终端，则注册请求消息不包括第一指示信息。若通信设备为第一节点，则注册请求消息可以包括第一指示信息。其中，第一指示信息用于指示该通信设备为第一节点。可选的，第一指示信息可以记为：IAB指示(indicator)。
S602、移动管理网元根据注册请求消息是否携带第一指示信息，确定通信设备的类型。
其中，通信设备的类型包括：普通的终端和IAB node。
作为一种实现方式，若注册请求消息包括第一指示信息，则在通信设备通过主鉴权之后，移动管理网元确定通信设备为IAB node。若注册请求消息不包括第一指示信息，则在通信设备通过主鉴权之后，移动管理网元确定通信设备为终端。
可以理解的是，在主鉴权流程结束之后，若移动管理网元确定通信设备为IAB node，则移动管理网元向IAB donor发送初始上下文建立请求，该初始上下文请求包括IAB authorized。
基于图10所示的技术方案，在注册请求包括第一指示信息的情况下，移动管理网元确定通信设备为IAB node。在注册请求不包括第一指示信息的情况下，移动管理网元确定通信设备为普通的终端。从而，数据管理网元无需识别通信设备的类型，并且 移动管理网元也无需从数据管理网元获知通信设备的类型，简化了移动管理网元获知通信设备的类型的流程。
实施例四、
在5G网络中，在一些业务，例如车联网(vehicle to X)、URLLC等，要求网络具有高可靠性和低时延性。但是，由于IAB网络中的多跳而增加的时延，会对用户面数据传输的性能产生不利影响。因此，对于IAB网络来说，减少UE到IAB donor之间的端到端延迟是极为重要的。IAB网络的延迟较低，有利于IAB网络应用到更多的业务场景中。
当前，IAB node与IAB donor之间会建立端到端的安全保护。也即，IAB node与IAB donor之间会建立安全隧道，该安全隧道开启完整性保护和加密保护。也即，IAB node与IAB donor之间在以安全隧道隧道数据包之前，IAB node/IAB donor需要对数据包进行完整性保护和加密保护，以保证数据包在传输过程中的保密性和完整性。
但是，在终端通过IAB node接入网络之后，终端与IAB donor之间也可能建立端到端的安全保护。也即，终端与IAB donor之间会建立用户面的安全状态，使得终端与IAB donor之间传输的数据包在PDCP层具有加密保护和完整性保护。
可以理解的是，若终端与IAB donor之间传输的数据包在PDCP层具有相应的安全保护，则数据包在安全隧道中的安全保护是不必要的。也即，IAB node/IAB donor对数据包进行的安全保护操作是不必要的。上述安全保护操作是指对数据包进行的加密计算和完整性保护计算。不必要的安全保护操作只会增加IAB node/IAB donor对于数据包的处理时延，从而增加了数据包从UE到达IAB donor端到端的传输时延。
示例性的，IAB node和IAB donor之间的安全隧道可以为互联网安全协议(internet protocol security，IPsec)隧道，或者其他类型的隧道，本申请实施例不限于此。
结合图11所示的IAB相关节点的协议栈进行说明。IAB网络中，UE在用户面上接收/发送数据的过程涉及到以下节点：UE、接入(access)IAB node、中继(intermediate)IAB node、IAB donor、以及UPF。
其中，access IAB node为用于向终端提供接入服务的IAB node。Intermediate IAB node为提供无线回传功能的IAB node。Intermediate IAB node是可选的。
如图11所示，UE的协议栈可以包括：IP层、服务发现应用规范(service discovery application profile，SDAP)层、PDCP层、无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层、物理层(PHY layer)。
access IAB node的DU的协议栈可以包括：RLC层、MAC层和PHY层。access IAB node的MT的协议栈可以包括：通用分组无线服务隧道协议(general packet radio service tunnel Protocol，GTP)-用户(user，U)层、UDP层、IPsec层、IP层、适配(Adapt)层、RLC层、MAC层、以及PHY层。
intermediate IAB node的DU的协议栈包括：IP层、Adapt层、RLC层、MAC层、以及PHY层。intermediate IAB node的MT的协议栈包括：IP层、Adapt层、RLC层、MAC层、以及PHY层。
IAB donor DU的协议栈可以包括：IP层、Adapt层、RLC层、MAC层、以及PHY层。IAB donor CU的协议栈可以包括：SDAP层、PDCP层、GTP-U层、UDP层、IPsec 层、以及IP层。
UPF的协议栈可以包括：IP层以及GTP-U层。
上述各个层的功能，例如IP层的功能、RLC层的功能，可以参考现有技术中的描述，在此不予赘述。
可以理解的是，IAB node与IAB donor在IPsec层上建立IPsec隧道，以传输数据包。
为了解决上述技术问题，本申请实施例提供一种通信方法，该通信方法的技术原理在于：IAB node与IAB donor之间可以预先建立多个不同安全状态的安全隧道。这样一来，数据包在IAB node与IAB donor之间传输时，IAB node/IAB donor可以采用基于数据包的PDCP层安全状态，从多个安全隧道中确定目标安全隧道，目标安全隧道用于传输该数据包。
可选的，目标安全隧道的安全状态应与数据包的PDCP层安全状态是互补的。或者，目标安全隧道的安全状态与数据包的PDCP层安全状态是互补的，本申请实施例不限于此。
下面结合具体实施例，来对本申请实施例所提供的技术方案进行说明。
如图12所示，为本申请实施例提供的一种通信方法，该通信方法包括以下步骤：
S701、第一节点接收来自于终端的上行数据包。
其中，第一节点为用于支持终端进行网络接入的节点。示例性的，第一节点可以为IAB node，本申请实施例不限于此。
可选的，上行数据包是指上行PDCP数据包。
S702、第一节点确定上行数据包的PDCP层安全状态。
在本申请实施例中，安全状态可以从完整性保护的角度来考虑；或者，安全状态可以从加密保护的角度来考虑；又或者，安全状态可以从完整性保护以及加密保护的角度来考虑。
可选的，步骤S702可以采用以下实现方式中的任意一种：
实现方式一、第一节点根据上行数据包是否携带MAC-I，确定上行数据包的PDCP层安全状态。
需要说明的是，步骤S702的实现方式一适用于安全状态仅考虑完整性保护的情况下。
基于实现方式一，上行数据包的PDCP层安全状态包括以下情形：(1)完整性保护关闭；(2)完整性保护开启。
需要说明的是，若上行数据包未携带MAC-I，则第一节点可以确定上行数据包的PDCP层安全状态为完整性保护关闭。若上行数据包携带MAC-I，则第一节点可以确定上行数据包的PDCP层安全状态为完整性保护开启。
实现方式二、第一节点根据用于传输该上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定上行数据包的PDCP层安全状态。
其中，第一对应关系为：第一传输隧道的标识和PDCP层安全状态之间的对应关系。需要说明的是，第一对应关系可以为第一节点从第二节点获取到的。
需要说明的是，第一传输隧道为第一节点与第二节点之间的传输隧道。示例性的， 以第一节点为IAB node，第二节点为IAB donor为例，第一传输隧道为IAB node和IAB donor的CU之间的F1隧道。
可以理解的是，对于第一节点和第二节点来说，安全隧道是从协议层的角度来考虑的，第一传输隧道是从接口的角度来考虑的。一个安全隧道可以包括多个第一传输隧道。也即，数据包在一个第一传输隧道上传输时，数据包在相应的协议层上采用该第一传输隧道所对应的安全隧道的安全策略。
以第一传输隧道为F1隧道，安全隧道为IPsec隧道为例，则数据包在第一传输隧道上传输时，数据包在IPsec层上采用该第一传输隧道所对应的IPsec隧道的安全策略。
在本申请实施例中，第一节点可以根据上行数据包的五元组，确定用于传输该上行数据包的第一传输隧道的标识。其中，五元组包括源IP地址、源端口、目的IP地址、目的端口和传输层协议。
需要说明的是，步骤S702的实现方式二适用于安全状态仅考虑完整性保护的情况下；或者，实现方式二适用于安全状态仅考虑加密保护的情况下；又或者，实现方式二适用于安全状态考虑完整性保护和加密保护的情况下。
基于实现方式二，在安全状态仅考虑完整性保护的情况下，上行数据包的PDCP层安全状态包括以下情形：(1)完整性保护开启；(2)完整性保护关闭。
基于实现方式二，在安全状态仅考虑加密保护的情况下，上行数据包的PDCP层安全状态包括以下情形：(1)加密保护开启；(2)加密保护关闭。
基于实现方式二，在安全状态考虑加密保护和完整性保护的情况下，上行数据包的PDCP层安全状态包括以下情形：(1)完整性保护和加密保护均开启；(2)完整性保护和加密保护均关闭；(3)完整性保护开启且加密保护关闭；(4)完整性保护关闭且加密保护开启。
示例性的，假设安全状态考虑加密保护和完整性保护，则第一对应关系可以参见表1。结合表1进行举例说明，假设第一节点以第一传输隧道#1传输上行数据包，则第一节点可以确定上行数据包的PDCP层安全状态为完整性保护和加密保护均开启。
表1
第一传输隧道的标识 PDCP层安全状态
第一传输隧道#1 完整性保护和加密保护均开启
第一传输隧道#2 完整性保护和加密保护均关闭
第一传输隧道#3 完整性保护开启，加密保护关闭
第一传输隧道#4 完整性保护关闭，加密保护开启
…… ……
需要说明的是，在第一节点执行步骤S702时，第一节点采用实现方式一还是实现方式二，可以是由协议定义的，或者是核心网/第二节点配置的。
可选的，在第一节点存储有第一对应关系的情况下，第一节点在执行步骤S702时采用实现方式二。在第一节点未存储有第一对应关系的情况下，第一节点在执行步骤S702时采用实现方式一。
当然，在第一节点存储有第一对应关系的情况下，若核心网或者第二节点配置第一节点采用实现方式一，则第一节点在执行步骤S702时采用实现方式一。
S703、第一节点根据上行数据包的PDCP层安全状态，从第一节点与第二节点之间的多个安全隧道中，确定目标安全隧道。
其中，多个安全隧道对应不同的安全状态。
在安全状态仅考虑完整性保护的情况下，第一节点与第二节点之间可以建立两条安全隧道。其中，第一条安全隧道的安全状态为完整性保护关闭。第二条安全隧道的安全状态为完整性保护开启。可以理解的是，这两条安全隧道可以开启加密保护，也可以不开启加密保护，本申请实施例不限于此。
在安全状态仅考虑加密保护的情况下，第一节点与第二节点可以建立两条安全隧道。其中，第一条安全隧道的安全状态为加密保护关闭。第二条安全隧道的安全状态为加密保护开启。可以理解的是，这两条安全隧道可以开启完整性保护，也可以不开启完整性保护，本申请实施例不限于此。
在安全状态考虑加密保护和完整性保护的情况下，第一节点与第二节点可以建立四条安全隧道。其中，第一条安全隧道的安全状态为完整性保护和加密保护均开启。第二条安全隧道的安全状态为完整性保护和加密保护均关闭。第三条安全隧道的安全状态为完整性保护开启且加密保护关闭。第四条安全隧道的安全状态为完整性保护关闭且加密保护开启。
作为一种可能的实现方式，第一节点根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。也就是说，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是互补的。
下面结合安全状态的不同考虑角度，来说明目标安全隧道的安全状态与上行数据包的PDCP层安全状态之间的互补关系。
1、在安全状态从完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是互补的，以使得上行数据包仅接受一次完整性保护。因此，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭。
可以理解的是，上行数据包的PDCP层安全状态为完整性保护开启，说明上行数据包在PDCP层上具有完整性保护。在上行数据包在PDCP层上具有完整性保护时，第一节点可以不对该上行数据包进行完整性保护，以减少第一节点对上行数据包的处理时延，从而减少上行数据包在第一节点和第二节点之间的传输时延。
情形二、上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
可以理解的是，上行数据包的PDCP层安全状态为完整性保护关闭，说明上行数据包在PDCP层上不具有完整性保护。上行数据包在PDCP层上不具有完整性保护时，第一节点需要对上行数据包进行完整性保护，以避免上行数据包被攻击者篡改，保证上行数据包在传输过程中的完整性。
2、在安全状态从加密保护的角度来考虑的前提下，目标安全隧道的安全状态应与 上行数据包的PDCP层安全状态是互补的，以使得上行数据包仅接受一次加密保护。因此，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭。
可以理解的是，上行数据包的PDCP层安全状态为加密保护开启，说明上行数据包在PDCP层上具有保密。在上行数据包在PDCP层上具有加密保护时，第一节点可以不对该上行数据包进行加密保护，以减少第一节点对上行数据包的处理时延，从而减少上行数据包在第一节点和第二节点之间的传输时延。
情形二、上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
可以理解的是，上行数据包的PDCP层安全状态为加密保护关闭，说明上行数据包在PDCP层上不具有加密保护。上行数据包在PDCP层上不具有加密保护时，第一节点需要对上行数据包进行加密保护，保证上行数据包在传输过程中的保密性。
3、在安全状态从加密保护和完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是互补的，以使得上行数据包仅接受一次加密保护和完整性保护。因此，目标安全隧道的安全状态应与数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启。
可以理解的是，上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，说明上行数据包在PDCP层上不具有完整性保护和加密保护。在上行数据包在PDCP层上不具有加密保护和完整性保护的情况下，第一节点对上行数据包进行加密保护和完整性保护，以保证上行数据包在传输过程中的保密性和完整性。
情形二、上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭。
可以理解的是，上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，说明上行数据包在PDCP层上具有完整性保护和加密保护。在上行数据包在PDCP层上具有完整性保护和加密保护的情况下，第一节点不对上行数据包进行加密保护和完整性保护，有利于减少第一节点对上行数据包的处理时延，从而减少上行数据包在第一节点和第二节点之间的传输时延。
情形三、上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
可以理解的是，一方面，上行数据包的PDCP层安全状态为完整性保护开启，说明上行数据包在PDCP层上具有完整性保护。在上行数据包在PDCP层上具有完整性保护时，第一节点可以不对该上行数据包进行完整性保护，以减少第一节点对上行数据包的处理时延，从而减少上行数据包在第一节点和第二节点之间的传输时延。另一方面，上行数据包的PDCP层安全状态为加密保护关闭，说明上行数据包在PDCP层上不具有加密保护。上行数据包在PDCP层上不具有加密保护时，第一节点需要对上 行数据包进行加密保护，保证上行数据包在传输过程中的保密性。
情形四、上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
可以理解的是，一方面，上行数据包的PDCP层安全状态为加密保护开启，说明上行数据包在PDCP层上具有保密。在上行数据包在PDCP层上具有加密保护时，第一节点可以不上对该上行数据包进行加密保护，以减少第一节点对上行数据包的处理时延，从而减少上行数据包在第一节点和第二节点之间的传输时延。另一方面，上行数据包的PDCP层安全状态为完整性保护关闭，说明上行数据包在PDCP层上不具有完整性保护。上行数据包在PDCP层上不具有完整性保护时，第一节点需要对上行数据包进行完整性保护，以避免上行数据包被攻击者篡改，保证上行数据包在传输过程中的完整性。
作为另一种可能的实现方式，第一节点根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。也就是说，目标安全隧道的安全状态与上行数据包的PDCP层安全状态是相同的。
可以理解的是，由于上行数据包的PDCP层安全状态是核心网或者基站决定的，因此用于传输数据包的安全隧道的安全状态和数据包的PDCP层安全状态是相同的，不会导致额外的安全风险。
下面结合安全状态的不同考虑角度，来说明目标安全隧道的安全状态与上行数据包的PDCP层安全状态是如何相同的。
1、在安全状态从完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若上行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态为完整性保护关闭。
可以理解的是，在目标安全隧道的安全状态为完整性保护关闭的情况下，第一节点不需要对上行数据包进行完整性保护计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
情形二、若上行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启。
2、在安全状态从加密保护的角度来考虑的前提下，目标安全隧道的安全状态应与上行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若上行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启。
情形二、若上行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
可以理解的是，在目标安全隧道的安全状态为加密保护关闭的情况下，第一节点不需要对上行数据包进行加密计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
3、在安全状态从加密保护和完整性保护的角度来考虑的前提下，目标安全隧道的 安全状态应与上行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭。
可以理解的是，在目标安全隧道的安全状态为完整性保护加密保护均关闭的情况下，第一节点不需要对上行数据包进行完整性保护计算和加密计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
情形二、若上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启。
情形三、若上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
可以理解的是，在目标安全隧道的安全状态为加密保护关闭的情况下，第一节点不需要对上行数据包进行加密计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
情形四、若上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
可以理解的是，在目标安全隧道的安全状态为完整性保护关闭的情况下，第一节点不需要对上行数据包进行完整性保护计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
作为另一种可能的实现方式，第一节点以安全状态为完整性保护关闭和/或加密保护关闭的安全隧道作为目标安全隧道。也就是说，目标安全隧道的安全状态为完整性保护关闭和/或加密保护关闭。
可以理解的是，由于目标安全隧道的安全状态为完整性保护关闭和/或加密保护，因此第一节点不需要对数据包进行加密计算和/或完整性保护计算，从而降低第一节点对数据包的处理时延，进而降低数据包在第一节点和第二节点之间的传输时延。
S704、第一节点通过目标安全隧道向第二节点发送上行数据包，以使得第二节点通过目标安全隧道接收到来自第一节点的上行数据包。
S705、第二节点向用户面网元发送上行数据包，以使得用户面网元接收来自第二节点的上行数据包。
需要说明的是，在5G网络中，上述用户面网元为UPF，在此统一说明，以下不再赘述。
相比较于现有技术中第一节点在以安全隧道传输上行数据包之前，需要对上行数据包进行加密计算和完整性保护计算，基于图12所示的技术方案，由于目标安全隧道的安全状态和上行数据包的PDCP层安全状态是互补的，或者目标安全隧道的安全状态和上行数据包的PDCP层安全状态是相同的，从而在一些情况下，第一节点以目标安全隧道传输上行数据包，可以不对上行数据包进行加密计算和/或完整性保护计算，从而降低第一节点对上行数据包的处理时延。相应的，第二节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第二节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
如图13所示，为本申请实施例提供的一种通信方法，该通信方法包括以下步骤：
S801、第二节点接收来自于用户面网元的下行数据包。
可选的，下行数据包是指下行PDCP数据包。
可以理解的是，用户面网元以第二传输隧道传输该下行数据包，因此第二节点可以确定用于传输该下行数据包的第二传输隧道的标识。
需要说明的是，第二传输隧道为第二节点与用户面网元之间的传输隧道。示例性的，以第二节点为IAB donor，用户面网元为UPF为例，第二传输隧道为IAB donor的CU和UPF之间的N3隧道。
S802、第二节点确定下行数据包的PDCP层安全状态。
在本申请实施例中，安全状态可以从完整性保护的角度来考虑；或者，安全状态可以从加密保护的角度来考虑；又或者，安全状态可以从完整性保护以及加密保护的角度来考虑。
可选的，步骤S802可以包括以下实现方式：
实现方式一、第二节点根据下行数据包是否携带MAC-I，确定下行数据包的PDCP层安全状态。
需要说明的是，步骤S802的实现方式一适用于安全状态仅考虑完整性保护的情况下。
基于实现方式一，下行数据包的PDCP层安全状态包括以下情形：(1)完整性保护关闭；(2)完整性保护开启。
需要说明的是，若下行数据包未携带MAC-I，则第二节点可以确定下行数据包的PDCP层安全状态为完整性保护关闭。若下行数据包携带MAC-I，则第二节点可以确定下行数据包的PDCP层安全状态为完整性保护开启。
实现方式二、第二节点根据用于传输该下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定下行数据包的PDCP层安全状态。
其中，第二对应关系为：第二传输隧道的标识和PDCP层安全状态之间的对应关系。需要说明的是，第二对应关系可以为第二节点生成的。
需要说明的是，步骤S802的实现方式二适用于安全状态仅考虑完整性保护的情况下；或者，实现方式二适用于安全状态仅考虑加密保护的情况下；又或者，实现方式二适用于安全状态考虑完整性保护和加密保护的情况下。
基于实现方式二，在安全状态仅考虑完整性保护的情况下，下行数据包的PDCP层安全状态包括以下情形：(1)完整性保护开启；(2)完整性保护关闭。
基于实现方式二，在安全状态仅考虑加密保护的情况下，下行数据包的PDCP层安全状态包括以下情形：(1)加密保护开启；(2)加密保护关闭。
基于实现方式二，在安全状态考虑加密保护和完整性保护的情况下，下行数据包的PDCP层安全状态包括以下情形：(1)完整性保护和加密保护均开启；(2)完整性保护和加密保护均关闭；(3)完整性保护开启且加密保护关闭；(4)完整性保护关闭且加密保护开启。
示例性的，假设安全状态考虑完整性保护和加密保护，则第二对应关系可以参见表2。结合表2进行举例说明，假设第二节点从第二传输隧道#1接收到下行数据包， 则第二节点可以确定下行数据包的PDCP层安全状态为完整性保护和加密保护均开启。
表2
第二传输隧道的标识 PDCP层安全状态
第二传输隧道#1 完整性保护和加密保护均开启
第二传输隧道#2 完整性保护和加密保护均关闭
第二传输隧道#3 完整性保护开启，加密保护关闭
第二传输隧道#4 完整性保护关闭，加密保护开启
…… ……
需要说明的是，在第二节点执行步骤S802时，第二节点采用实现方式一还是实现方式二，可以是由协议定义的，或者是核心网配置的。
可选的，在第二节点存储有第二对应关系的情况下，第二节点在执行步骤S802时采用实现方式二。在第二节点未存储有第二对应关系的情况下，第二节点在执行步骤S802时采用实现方式一。
当然，在第二节点存储有第二对应关系的情况下，若核心网配置第二节点采用实现方式一，则第二节点在执行步骤S802时采用实现方式一。
S803、第二节点根据下行数据包的PDCP层安全状态，从第一节点与第二节点之间的多个安全隧道中，确定目标安全隧道。
其中，多个安全隧道对应不同的安全状态。
在安全状态仅考虑完整性保护的情况下，第一节点与第二节点之间可以建立两条安全隧道。其中，第一条安全隧道的安全状态为完整性保护关闭。第二条安全隧道的安全状态为完整性保护开启。可以理解的是，这两条安全隧道可以开启加密保护，也可以不开启加密保护，本申请实施例不限于此。
在安全状态仅考虑加密保护的情况下，第一节点与第二节点可以建立两条安全隧道。其中，第一条安全隧道的安全状态为加密保护关闭。第二条安全隧道的安全状态为加密保护开启。可以理解的是，这两条安全隧道可以开启完整性保护，也可以不开启完整性保护，本申请实施例不限于此。
在安全状态考虑加密保护和完整性保护的情况下，第一节点与第二节点可以建立四条安全隧道。其中，第一条安全隧道的安全状态为完整性保护和加密保护均开启。第二条安全隧道的安全状态为完整性保护和加密保护均关闭。第三条安全隧道的安全状态为完整性保护开启且加密保护关闭。第四条安全隧道的安全状态为完整性保护关闭且加密保护开启。
作为一种可能的实现方式，所述第二节点根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。也就是说，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是互补的。
下面结合安全状态所考虑的不同角度，来说明目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何互补的。
1、在安全状态从完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是互补的，以使得下行数据包仅接受一次完整性保 护。因此，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护关闭。
可以理解的是，下行数据包的PDCP层安全状态为完整性保护开启，说明下行数据包在PDCP层上具有完整性保护。在下行数据包在PDCP层上具有完整性保护时，第二节点可以不对该下行数据包进行完整性保护，以减少第二节点对下行数据包的处理时延，从而减少下行数据包在第二节点和第一节点之间的传输时延。
情形二、下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态应为完整性保护开启。
可以理解的是，下行数据包的PDCP层安全状态为完整性保护关闭，说明下行数据包在PDCP层上不具有完整性保护。下行数据包在PDCP层上不具有完整性保护时，第二节点需要对下行数据包进行完整性保护，以避免下行数据包被攻击者篡改，保证下行数据包在传输过程中的完整性。
2、在安全状态从加密保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是互补的，以使得下行数据包仅接受一次加密保护。因此，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护关闭。
可以理解的是，下行数据包的PDCP层安全状态为加密保护开启，说明下行数据包在PDCP层上具有保密。在下行数据包在PDCP层上具有加密保护时，第二节点可以不对该下行数据包进行加密保护，以减少第二节点对下行数据包的处理时延，从而减少下行数据包在第二节点和第一节点之间的传输时延。
情形二、下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护开启。
可以理解的是，下行数据包的PDCP层安全状态为加密保护关闭，说明下行数据包在PDCP层上不具有加密保护。下行数据包在PDCP层上不具有加密保护时，第二节点需要对下行数据包进行加密保护，保证下行数据包在传输过程中的保密性。
3、在安全状态从加密保护和完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是互补的，以使得下行数据包仅接受一次加密保护和完整性保护。因此，目标安全隧道的安全状态应与数据包的PDCP层安全状态是互补的，可以包括以下情形之一：
情形一、下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均开启。
可以理解的是，下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，说明下行数据包在PDCP层上不具有完整性保护和加密保护。在下行数据包在PDCP层上不具有加密保护和完整性保护的情况下，第二节点不对下行数据包进行加密保护和完整性保护，以保证下行数据包在传输过程中的保密性和完整性。
情形二、下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均关闭。
可以理解的是，下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，说明下行数据包在PDCP层上具有完整性保护和加密保护。在下行数据包在PDCP层上具有完整性保护和加密保护的情况下，第二节点不对下行数据包进行加密保护和完整性保护，有利于减少第二节点对下行数据包的处理时延，从而减少下行数据包在第二节点和第一节点之间的传输时延。
情形三、下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
一方面，下行数据包的PDCP层安全状态为完整性保护开启，说明下行数据包在PDCP层上具有完整性保护。在下行数据包在PDCP层上具有完整性保护时，第二节点可以对该下行数据包进行完整性保护，以减少第二节点对下行数据包的处理时延，从而减少下行数据包在第二节点和第一节点之间的传输时延。
另一方面，下行数据包的PDCP层安全状态为加密保护关闭，说明下行数据包在PDCP层上不具有加密保护。下行数据包在PDCP层上不具有加密保护时，第二节点需要对下行数据包进行加密保护，保证下行数据包在传输过程中的保密性。
情形四、下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
一方面，下行数据包的PDCP层安全状态为加密保护开启，说明下行数据包在PDCP层上具有保密。在下行数据包在PDCP层上具有加密保护时，第二节点可以不对该下行数据包进行加密保护，以减少第二节点对下行数据包的处理时延，从而减少下行数据包在第二节点和第一节点之间的传输时延。
另一方面，下行数据包的PDCP层安全状态为完整性保护关闭，说明下行数据包在PDCP层上不具有完整性保护。下行数据包在PDCP层上不具有完整性保护时，第二节点需要对下行数据包进行完整性保护，以避免下行数据包被攻击者篡改，保证下行数据包在传输过程中的完整性。
作为另一种可能的实现方式，所述第二节点根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是相同的安全隧道作为所述目标安全隧道。也就是说，目标安全隧道的安全状态与下行数据包的PDCP层安全状态是相同的。
可以理解的是，由于下行数据包的PDCP层安全状态是核心网或者基站决定的，因此用于传输数据包的安全隧道的安全状态和数据包的PDCP层安全状态是相同的，不会导致额外的安全风险。
下面结合安全状态的不同考虑角度，来说明目标安全隧道的安全状态与下行数据包的PDCP层安全状态是如何相同的。
1、在安全状态从完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若下行数据包的PDCP层安全状态为完整性保护关闭，则目标安全隧道的安全状态为完整性保护关闭。
可以理解的是，在目标安全隧道的安全状态为完整性保护关闭的情况下，第二节点不需要对下行数据包进行完整性保护计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
情形二、若下行数据包的PDCP层安全状态为完整性保护开启，则目标安全隧道的安全状态应为完整性保护开启。
2、在安全状态从加密保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若下行数据包的PDCP层安全状态为加密保护开启，则目标安全隧道的安全状态应为加密保护开启。
情形二、若下行数据包的PDCP层安全状态为加密保护关闭，则目标安全隧道的安全状态应为加密保护关闭。
可以理解的是，在目标安全隧道的安全状态为加密保护关闭的情况下，第二节点不需要对下行数据包进行加密计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
3、在安全状态从加密保护和完整性保护的角度来考虑的前提下，目标安全隧道的安全状态应与下行数据包的PDCP层安全状态是相同的，可以包括以下情形之一：
情形一、若下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则目标安全隧道的安全状态为完整性保护和加密保护均关闭。
可以理解的是，在目标安全隧道的安全状态为完整性保护加密保护均关闭的情况下，第二节点不需要对下行数据包进行完整性保护计算和加密计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
情形二、若下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则目标安全隧道的安全状态为完整性保护和加密保护均开启。
情形三、若下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
可以理解的是，在目标安全隧道的安全状态为加密保护关闭的情况下，第二节点不需要对下行数据包进行加密计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
情形四、若下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则目标安全隧道的安全状态为完整性保护关闭且加密保护开启。
可以理解的是，在目标安全隧道的安全状态为完整性保护关闭的情况下，第二节点不需要对下行数据包进行完整性保护计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
作为另一种可能的实现方式，第二节点以安全状态为完整性保护关闭和/或加密保护关闭的安全隧道作为目标安全隧道。也就是说，目标安全隧道的安全状态为完整性保护关闭和/或加密保护关闭。
可以理解的是，由于目标安全隧道的安全状态为完整性保护关闭和/或加密保护，因此第二节点不需要对数据包进行加密计算和/或完整性保护计算，从而降低第二节点对数据包的处理时延，进而降低数据包在第二节点和第一节点之间的传输时延。
S804、第二节点通过目标安全隧道向第一节点发送下行数据包，以使得第一节点通过目标安全隧道接收来自第二节点的下行数据包。
S805、第一节点向终端发送下行数据包，以使得终端接收到下行数据包。
相比较于现有技术中第二节点在以安全隧道传输下行数据包之外，需要对下行数据包进行加密计算和完整性保护计算，基于图13所示的技术方案，由于目标安全隧道的安全状态和下行数据包的PDCP层安全状态是互补的，或者目标安全隧道的安全状态和下行数据包的PDCP层安全状态是相同的，从而在一些情况下，第二节点以目标安全隧道传输下行数据包，可以不对下行数据包进行加密计算和/或完整性保护计算，从而降低第二节点对下行数据包的处理时延。相应的，第一节点也无需对数据包进行解密计算和/或完整性校验计算，从而降低第一节点对上行数据包的处理时延。也即，本申请所提供的技术方案，通过降低第一节点和第二节点对数据包的处理时延，以降低数据包在第一节点和第二节点之间的传输时延。
需要说明的是，在图13中，第二节点所执行的操作具体由第二节点的CU-UP执行。也即，第二节点的CU-UP接收来自于用户面网元的下行数据包；第二节点的CU-UP确定下行数据包的PDCP层安全状态；第二节点的CU-UP根据下行数据包的PDCP层安全状态，从第一节点与第二节点之间的多个安全隧道中，确定目标安全隧道；之后，第二节点的CU-UP通过目标安全隧道向第一节点发送下行数据包。
下面对第二节点建立第一对应关系和第二对应关系的具体实现方式进行介绍。
需要说明的是，在第一节点启动之后，终端可以通过第一节点接入网络，并创建PDU会话。在PDU会话建立流程结束之后，基于PDU会话的相关信息，第二节点可以生成第一对应关系和第二对应关系。
如图14所示，第二节点生成第二对应关系，包括以下步骤：
S901、第二节点获取PDU会话的标识与PDCP层安全状态之间的对应关系。
作为一种实现方式，第二节点的CU-CP获取PDU会话的标识与PDCP层安全状态之间的对应关系。
对于一个PDU会话，在PDU会话建立流程中，第二节点可以接收到AMF发送的N2 SM消息，N2 SM消息包括PDU会话的标识、该PDU会话对应的第二传输隧道的核心网地址、用户面安全策略等。基于用户面安全策略，第二节点通过RRC连接重配置(RRC Connection Reconfiguration)流程，以激活用户面的安全状态。其中，用户面的安全状态可以理解为PDCP层安全状态。
可选的，在用户面安全策略为第一策略时，用户面的安全状态为加密保护和完整性保护均开启。在用户面安全策略为第二策略时，用户面的安全状态为加密保护和完整性保护均关闭。在用户面安全策略为第三策略时，用户面的安全状态可以由第二节点确定，或者第一节点和第二节点之间协商确定。
上述第一策略可以命名为“必须(required)”，第二策略可以命名为“不需要(no needed)”，第三策略可以命名为“优选(perferred)”，本申请实施例对此不作限定。
这样一来，对于一个PDU会话，第二节点可以获取到PDU会话的标识，以及对应的PDCP层安全状态。从而，第二节点可以建立PDU会话的标识与PDCP层安全状态之间的对应关系。
在本申请实施例中，PDU会话对应的PDCP层安全状态，相当于PDU会话对应的用户面安全状态。
示例性的，假设安全状态考虑加密保护和完整性保护，则PDU会话的标识与PDCP层安全状态之间的对应关系可以参见表3。
表3
PDU会话的标识 PDCP层安全状态
PDU会话#1 完整性保护和加密保护均开启
PDU会话#2 完整性保护和加密保护均关闭
PDU会话#3 完整性保护开启，加密保护关闭
PDU会话#4 完整性保护关闭，加密保护开启
…… ……
S902、第二节点获取PDU会话的标识与第二传输隧道的标识之间的对应关系。
作为一种实现方式，第二节点的CU-CP获取PDU会话的标识与第二传输隧道的标识之间的对应关系。
对于一个PDU会话，在PDU会话流程中，第二节点为该PDU会话分配第二节点上的隧道信息，该隧道信息包括第二节点的隧道终点地址等。第二节点向AMF发送N2 PDU Session Response，N2 PDU Session Response包括PDU会话标识、N2 SM消息等，N2 SM消息中包括第二节点上的隧道信息。第二节点可以根据第二传输隧道的核心网地址和第二节点的隧道地址，完成上行第二传输隧道的建立；AMF向SMF发送从RAN接收的N2 SM消息。SMF发起N4回复修改流程，发送第二节点上的隧道信息给UPF，以完成下行第二传输隧道的建立。
可以理解的是，对于一个PDU会话来说，第二节点参与到第二传输隧道的建立过程中。在第二传输隧道的建立过程中，第二节点可以获取到PDU会话标识对应的第二传输隧道的标识。因此，第二节点可以建立PDU会话的标识与第二传输隧道的标识之间的对应关系。
示例性的，PDU会话的标识与第二传输隧道的标识之间的对应关系可以参见表4。
表4
PDU会话的标识 第二传输隧道的标识
PDU会话#1 第二传输隧道#5
PDU会话#2 第二传输隧道#6
PDU会话#3 第二传输隧道#7
PDU会话#4 第二传输隧道#8
…… ……
S903、第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系，以及PDU会话的标识与第二传输隧道的标识之间的对应关系，生成第二对应关系。
作为一种实现方式，第二节点的CU-CP根据PDU会话的标识与PDCP层安全状态之间的对应关系，以及PDU会话的标识与第二传输隧道的标识之间的对应关系，生成第二对应关系。
可以理解的是，对于一个PDU会话来说，该PDU会话对应的PDCP层安全状态， 即为该PDU会话中的第二传输隧道对应的PDCP层安全状态。
结合表3和表4进行举例说明。以PDU会话#1为例，PDU会话#1对应的PDCP层安全状态为完整性保护和加密保护均开启，并且PDU会话#1对应第二传输隧道#5，因此第二传输隧道#5对应的PDCP层安全状态为完整性保护和加密保护均开启。以PDU会话#2为例，PDU会话#2对应的PDCP层安全状态为完整性保护和加密保护均关闭，并且PDU会话#2对应第二传输隧道#6，因此第二传输隧道#6对应的PDCP层安全状态为完整性保护和加密保护均关闭。
在本申请实施例中，第二节点的CU-CP在生成第二对应关系之后，第二节点的CU-CP向第二节点的CU-UP发送第二对应关系。第二节点的CU-UP在接收到第二对应关系之后，第二节点的CU-UP存储该第二对应关系。
基于图14所示的技术方案，第二节点可以获取到第二对应关系，从而第二节点可以在执行图13中的步骤S802时，采用实现方式二。
如图15所示，第二节点生成第一对应关系，包括以下步骤：
S1001、与步骤S901相同，其具体描述可参考图14所示的实施例，在此不再赘述。
S1002、第二节点获取PDU会话的标识与第一传输隧道的标识之间的对应关系。
作为一种实现方式，第二节点的CU-CP获取PDU会话的标识与第一传输隧道的标识之间的对应关系。
可以理解的是，为传输用户面数据，第二节点会为终端建立PDU会话中的DRB。因此，对于一个PDU会话来说，第二节点可以确定PDU会话中的DRB。从而，第二节点可以建立PDU会话的标识与DRB之间的对应关系。
示例性的，PDU会话的标识与DRB之间的对应关系可以参见表5所示。
表5
PDU会话的标识 DRB
PDU会话#1 DRB#1
PDU会话#2 DRB#2
PDU会话#3 DRB#3
PDU会话#4 DRB#4
…… ……
可以理解的是，DRB承载包括两部分，DU到终端的承载和CU到DU的承载，CU到DU的承载被称为第一传输隧道。因此，在DRB建立的过程中，第二节点可以获取到第一传输隧道的标识。也即，第二节点可以建立DRB与第一传输隧道的标识之间的对应关系。
需要说明的是，由于一个DRB可以配置多个第一传输隧道，因此DRB与第一传输隧道之间的对应关系为一对多的对应关系。
示例性的，DRB与第一传输隧道的标识之间的对应关系可以参考表6所示。
表6
DRB 第一传输隧道的标识
DRB#1 第一传输隧道#5
DRB#1 第一传输隧道#6
DRB#2 第一传输隧道#7
DRB#3 第一传输隧道#8
DRB#4 第一传输隧道#9
…… ……
因此，基于PDU会话的标识与DRB之间的对应关系，以及DRB与第一传输隧道的标识之间的对应关系，第二节点可以确定PDU会话的标识与第一传输隧道的标识之间的对应关系。
也即，结合表5和表6，表7示出PDU会话的标识与第一传输隧道的标识之间的对应关系。
表7
PDU会话的标识 第一传输隧道的标识
PDU会话#1 第一传输隧道#5
PDU会话#1 第一传输隧道#6
PDU会话#2 第一传输隧道#7
PDU会话#3 第一传输隧道#8
PDU会话#4 第一传输隧道#9
…… ……
S1003、第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系、PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系。
作为一种实现方式，第二节点的CU-CP根据PDU会话的标识与PDCP层安全状态之间的对应关系、PDU会话的标识与DRB之间的对应关系、以及DRB与第一传输隧道的标识之间的对应关系，确定第一对应关系。
可以理解的是，PDU会话所对应的PDCP层安全状态，即为该PDU会话中的DRB所对应的PDCP层安全状态。DRB所对应的PDCP层安全状态，即为该DRB中配置的第一传输隧道所对应的PDCP层安全状态。
结合表3和表7进行举例说明。以PDU会话#1为例，PDU会话#1对应的PDCP层安全状态为完整性保护和加密保护均开启，并且PDU会话#1对应第一传输隧道#5和第一传输隧道#6，因此第一传输隧道#5对应的PDCP层安全状态为完整性保护和加密保护均开启，第一传输隧道#6对应的PDCP层安全状态为完整性保护和加密保护均开启。
可选的，在IAB donor生成第一对应关系之后，IAB donor可以将第一对应关系发生给IAB node。如图15所示，该通信方法在步骤1003之后，还包括步骤1004。
S1004、第二节点向第一节点发送第一对应关系，以使得第一节点获取到第一对应关系。
作为一种实现方式，第二节点的CU-CP向第一节点发送第一对应关系。
可以理解的是，在获取到第一对应关系之后，第一节点存储该第一对应关系。
基于图15所示的技术方案，第一节点可以获取到第一对应关系，从而第一节点可以在执行图12中的步骤S702时，采用实现方式二。
下面以安全隧道为IPsec隧道为例，对第一节点和第二节点之间建立安全隧道的 流程进行介绍。
如图16所示，安全隧道的建立流程包括以下步骤：
S1101、第一节点与第二节点之间进行建立安全隧道的第一阶段。
其中，第一阶段用于实现第一节点和第二节点之间的身份认证以及协商密钥。
可选的，在第一阶段中，安全隧道建立过程中的发起方可以是第一节点，也可以是第二节点。也即，第一节点可以主动向第二节点发送安全隧道建立请求；或者，第二节点主动向第一节点发送安全隧道建立请求。
可以理解的是，若第一节点为发起方，则第二节点为响应方。或者，若第二节点为发起方，则第一节点为响应方。
在本申请实施例中，IPsec建立过程中的认证凭证是预配置的数字证书；或者，该认证凭证可以是预共享密钥(pre-shared key，PSK)；又或者，该认证凭证可以是通过Diffie-Hellman算法协商确定的。
其中，预共享密钥包括以下情形之一：
(1)预共享密钥可以为Kgnb。Kgnb为用于保护接入层通信安全的密钥。
(2)预共享密钥是第一节点/第二节点生成的随机数。
以第一节点生成随机数为例，在第一节点生成随机数之后，第一节点可以利用RRC信令或者F1接口建立消息携带该随机数，以共享给第二节点。以第二节点生成随机数为例，在第二节点生成随机数之后，第二节点可以利用RRC信令或者F1接口建立消息携带该随机数，以共享给第一节点。
(3)预共享密钥是根据Kgnb和中间参数生成的。
其中，中间参数由第一节点，并由第一节点共享给第二节点。或者，中间参数由第二节点生成，并由第二节点共享给第一节点。
可选的，中间参数包括以下参数中的至少一项：小区标识、第一节点的地址、第二节点的CU的地址、物理小区标识(physical cell identifier，PCI)、功能计数值(function counter value，FC value)、常数。
可以理解的是，第一阶段的具体实现可以参考现有技术，本申请实施例对此不予赘述。
S1102、第一节点与第二节点之间进行建立安全隧道的第二阶段。
其中，第二阶段用于协商IPsec安全联盟(security association)使用的安全参数，以确定第一节点与第二节点之间的IPsec安全策略以及会话密钥。
可以理解的是，IPsec安全策略决定安全隧道对应的安全状态。
可选的，第二阶段可以包括以下步骤：
S1、发起方先发送密钥交换材料以及SA载荷。
其中，密钥交换材料可以包括：发起方的DH值、随机数等。DH值即为根据Diffie-Hellman算法计算出来的数值。
SA载荷可以包括：安全参数索引、版本号、发起方支持的加密算法列表等。
需要说明的是，SA载荷可以包括一个或多个建议载荷。一个建议载荷可以包括一个或多个变换载荷。
需要说明的是，在IPsec建立过程中，在第二阶段中的变换载荷中认证头协议的 变换ID设置为保留(reserved)时，表示当前完整性保护未开启；变换载荷中封装安全载荷协议中变换ID设置为reserved时，表示当前加密保护未开启。
S2、响应方回复选择的密码算法、接收方的DH值、随机数等。
需要说明的是，在安全隧道建立流程中，IPsec信息可以承载于RRC信令中。需要说明的是，上述RRC信令可以为信令无线承载(signal radio bearer，SRB)消息，或者DRB消息。
可以理解的是，以SRB消息或者DRB消息携带IPsec信息，则第一节点与第二节点之间无需建立额外的传输承载。
可选的，承载IPsec信息的SRB消息，可以是第一节点的DU在建立流程中的SRB消息。这样一来，实现对SRB消息的复用，有利于减少信令开销。
在本申请实施例中，由于IPsec消息用于IPsec层，因此第一节点的IPsec层可以将IPsec信息发送给第一节点的RRC层，以使得第一节点的RRC层发送携带该IPsec信息的RRC信令。以及，第一节点的RRC层在接收到携带IPsec信息的RRC信令之后，第一节点的RRC层将该IPsec信息发送给第一节点的IPsec层。
在本申请实施例中，由于IPsec消息用于IPsec层，因此第二节点的IPsec层可以将IPsec信息发送给第二节点的RRC层，以使得第二节点的RRC层发送携带该IPsec信息的RRC信令。以及，第二节点的RRC层在接收到携带IPsec信息的RRC信令之后，第二节点的RRC层将该IPsec信息发送给第二节点的IPsec层。
基于图16所示的技术方案，第一节点与第二节点之间可以建立一条安全隧道。
在第一节点与第二节点之间建立多条安全隧道的过程中，第一节点和第二节点可以仅进行一次第一阶段的流程；之后，对于多条安全隧道中的每一条安全隧道，第一节点和第二节点均进行一次第二安全隧道的流程。
或者，在第一节点和第二节点之间建立多条安全隧道的过程中，对于多条安全隧道中的每一条安全隧道，第一节点和第二节点均可以进行第一阶段和第二阶段的流程。
可以理解的是，第一节点与第二节点之间建立的安全隧道的数目可以是协议中定义的，也可以是根据运营商策略进行配置的，本申请实施例不限于此。
上述主要从每一个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，每一个网元，例如第一节点、第二节点等，为了实现上述功能，其包含了执行每一个功能相应的硬件结构或软件模块，或两者结合。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对网络设备和终端进行功能模块的划分，例如，可以对应每一个功能划分每一个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应每一个功 能划分每一个功能模块为例进行说明：
如图17所示，为本申请实施例提供的一种第一节点的结构示意图。该第一节点包括处理模块201和通信模块202。处理模块201用于使第一节点执行图12中的步骤S702和S703，等。通信模块202用于使第一节点执行图12中的步骤S701和S704，图13中的步骤S804和S805，图15中的步骤S1004，图16中的步骤S1101和S1102，等。
作为一个示例，结合图7所示的通信装置，图17中的处理模块201可以由图7中的处理器101来实现，图17中的通信模块202可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令；当所述计算机可读存储介质在第一网元上运行时，使得该第一网元执行本申请实施例所提供的方法。
本申请实施例还提供了一种包含计算机指令的计算机程序产品，当其在第一网元上运行时，使得第一网元可以执行本申请实施例提供的方法。
本申请实施例提供一种芯片，该芯片包括处理器，该处理器执行指令时，使得该芯片可以执行本申请实施例提供的方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括作为通信接口的输入输出电路。
如图18所示，为本申请实施例提供的一种第二节点的结构示意图。该第二节点包括处理模块301和通信模块302。处理模块301用于使第二节点执行图13中的步骤S802和S803，图14中的步骤S901-S903，图15中的步骤S1001-S1003，等。通信模块302用于使第一节点执行图12中的步骤S704和S705，图13中的步骤S801和S804，图15中的步骤S1004，图16中的步骤S1101和S1102，等。
作为一个示例，结合图7所示的通信装置，图18中的处理模块301可以由图7中的处理器101来实现，图18中的通信模块302可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令；当所述计算机可读存储介质在第二网元上运行时，使得该第二网元执行本申请实施例所提供的方法。
本申请实施例还提供了一种包含计算机指令的计算机程序产品，当其在第二网元上运行时，使得第二网元可以执行本申请实施例提供的方法。
本申请实施例提供一种芯片，该芯片包括处理器，该处理器执行指令时，使得该芯片可以执行本申请实施例提供的方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括作为通信接口的输入输出电路。
如图19所示，为本申请实施例提供的一种移动管理网元的结构示意图。该移动管理网元包括处理模块401和通信模块402。其中，处理模块401用于使移动管理网元执行图10中的步骤S602。通信模块402用于使移动管理网元执行图8中的步骤S401和S402。
作为一个示例，结合图7所示的通信装置，图19中的处理模块401可以由图7中的处理器101来实现，图19中的通信模块402可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令；当所述计算机可读存储介质在移动管理网元上运行时，使得该移动管理网元执行本申请实施例所提供的方法。
本申请实施例还提供了一种包含计算机指令的计算机程序产品，当其在移动管理网元上运行时，使得移动管理网元可以执行本申请实施例提供的方法。
本申请实施例提供一种芯片，该芯片包括处理器，该处理器执行指令时，使得该芯片可以执行本申请实施例提供的方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括作为通信接口的输入输出电路。
如图20所示，为本申请实施例提供的一种数据管理网元的结构示意图。该数据管理网元包括处理模块501和通信模块502。其中，处理模块501用于使数据管理网元执行图8中的步骤S404。通信模块502用于使数据管理网元执行图8中的步骤S403，图9中的步骤S501，等。
作为一个示例，结合图7所示的通信装置，图20中的处理模块501可以由图7中的处理器101来实现，图20中的通信模块502可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令；当所述计算机可读存储介质在数据管理网元上运行时，使得该计算机执行本申请实施例所提供的方法。
本申请实施例还提供了一种包含计算机指令的计算机程序产品，当其在计算机上运行时，使得数据管理网元可以执行本申请实施例提供的方法。
本申请实施例提供一种芯片，该芯片包括处理器，该处理器执行指令时，使得该芯片可以执行本申请实施例提供的方法。该指令可以来自芯片内部的存储器，也可以来自芯片外部的存储器。可选的，该芯片还包括作为通信接口的输入输出电路。
应理解，所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输。
例如，所述计算机指令可以从一个网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质、或者半导体介质(例如固态硬盘)等。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
应该理解到，在本申请所提供的几个实施例中所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。
另外，本申请所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (78)

  1. 一种通信系统，其特征在于，包括第一节点、以及第二节点，所述第一节点与所述第二节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态；
    所述第一节点，用于接收来自终端的上行数据包；确定所述上行数据包的分组数据汇聚协议PDCP层安全状态；根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道；通过所述目标安全隧道向所述第二节点发送所述上行数据包；
    所述第二节点，用于接收来自于所述第一节点的所述上行数据包；向用户面网元发送所述上行数据包。
  2. 根据权利要求1所述的通信系统，其特征在于，
    所述第一节点，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
  3. 根据权利要求1或2所述的通信系统，其特征在于，
    所述第一节点，具体用于根据所述上行数据包是否携带完整性的消息认证码MAC-I，确定所述上行数据包的PDCP层安全状态。
  4. 根据权利要求3所述的通信系统，其特征在于，
    所述第一节点，具体用于若所述上行数据包未携带MAC-I，则确定所述上行数据包的PDCP层安全状态为完整性保护关闭；若所述上行数据包携带MAC-I，则确定所述上行数据包的PDCP层安全状态为完整性保护开启。
  5. 根据权利要求1或2所述的通信系统，其特征在于，
    所述第一节点，具体用于根据用于传输所述上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定所述上行数据包的PDCP层安全状态；其中，所述第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，所述第一传输隧道为所述第一节点与所述第二节点之间的传输隧道。
  6. 根据权利要求5所述的通信系统，其特征在于，
    所述第二节点，还用于获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话的标识与第一传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成所述第一对应关系；向所述第一节点发送所述第一对应关系；
    所述第一节点，还用于接收所述第一对应关系。
  7. 根据权利要求3至6任一项所述的通信系统，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  8. 根据权利要求5或6所述的通信系统，其特征在于，所述目标安全隧道的安全 状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述上行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  9. 根据权利要求5或6所述的通信系统，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  10. 根据权利要求1所述的通信系统，其特征在于，
    所述第二节点，还用于接收来自于所述用户面网元的下行数据包；确定所述下行数据包的PDCP层安全状态；根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道；通过所述目标安全隧道向所述第一节点发送所述下行数据包；
    所述第一节点，还用于接收来自于所述第二节点的所述下行数据包；向所述终端发送所述下行数据包。
  11. 根据权利要求10所述的通信系统，其特征在于，
    所述第二节点，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
  12. 根据权利要求10或11所述的通信系统，其特征在于，
    所述第二节点，具体用于根据所述下行数据包是否携带完整性的消息认证码MAC-I，确定所述下行数据包的PDCP层安全状态。
  13. 根据权利要求12所述的通信系统，其特征在于，
    所述第二节点，具体用于若所述下行数据包未携带MAC-I，则确定所述下行数据包的PDCP层安全状态为完整性保护关闭；若所述下行数据包携带MAC-I，则确定所述下行数据包的PDCP层安全状态为完整性保护开启。
  14. 根据权利要求10或11所述的通信系统，其特征在于，
    所述第二节点，具体用于根据用于传输所述下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定所述下行数据包的PDCP层安全状态；其中，所述第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，所述第二传输隧道为所述第二节点与所述用户面网元之间的传输隧道。
  15. 根据权利要求14所述的通信系统，其特征在于，
    所述第二节点，还用于获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话与第二传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成所述第二对应关系。
  16. 根据权利要求11至15任一项所述的通信系统，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  17. 根据权利要求14或15所述的通信系统，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述下行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  18. 根据权利要求14或15所述的通信系统，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  19. 一种通信方法，其特征在于，所述通信方法应用于第一节点，所述第一节点与第二节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述方法包括：
    所述第一节点接收来自终端的上行数据包；
    所述第一节点确定所述上行数据包的分组数据汇聚协议PDCP层安全状态；
    所述第一节点根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道，所述多个安全隧道对应不同的安全状态；
    所述第一节点通过所述目标安全隧道向所述第二节点发送所述上行数据包。
  20. 根据权利要求19所述的通信方法，其特征在于，所述第一节点根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道，包括：
    所述第一节点根据所述上行数据包的PDCP层安全状态和多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层安全状态是互补 的安全隧道作为所述目标安全隧道。
  21. 根据权利要求19或20所述的通信方法，其特征在于，所述第一节点确定所述上行数据包的PDCP层安全状态，包括：
    所述第一节点根据所述上行数据包是否携带完整性的消息认证码MAC-I，确定所述上行数据包的PDCP层安全状态。
  22. 根据权利要求21所述的通信方法，其特征在于，所述第一节点根据所述上行数据包是否携带完整性的消息认证码MAC-I，确定所述上行数据包的PDCP层安全状态，包括：
    若所述上行数据包未携带MAC-I，则所述第一节点确定所述上行数据包的PDCP层安全状态为完整性保护关闭；
    若所述上行数据包携带MAC-I，则所述第一节点确定所述上行数据包的PDCP层安全状态为完整性保护开启。
  23. 根据权利要求19或20所述的通信方法，其特征在于，所述第一节点确定所述上行数据包的PDCP层安全状态，包括：
    所述第一节点根据用于传输所述上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定所述上行数据包的PDCP层安全状态；其中，所述第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，所述第一传输隧道为所述第一节点与所述第二节点之间的传输隧道。
  24. 根据权利要求23所述的通信方法，其特征在于，所述方法还包括：
    所述第一节点接收所述第二节点发送的所述第一对应关系。
  25. 根据权利要求21至24任一项所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  26. 根据权利要求23或24所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述上行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  27. 根据权利要求23或24所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所 述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  28. 一种通信方法，其特征在于，所述通信方法应用于第二节点，所述第二节点与第一节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述方法包括：
    所述第二节点接收来自于用户面网元的下行数据包；
    所述第二节点确定所述下行数据包的分组数据汇聚协议PDCP层安全状态；
    所述第二节点根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道；
    所述第二节点通过所述目标安全隧道向所述第一节点发送所述下行数据包。
  29. 根据权利要求28所述的通信方法，其特征在于，所述第二节点根据所述下行数据包的PDCP层安全状态和多个安全隧道的安全状态，确定目标安全隧道，包括：
    所述第二节点根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
  30. 根据权利要求28或29所述的通信方法，其特征在于，所述第二节点确定所述下行数据包的PDCP层安全状态，包括：
    所述第二节点根据所述下行数据包是否携带完整性的消息认证码MAC-I，确定所述下行数据包的PDCP层安全状态。
  31. 根据权利要求30所述的通信方法，其特征在于，所述第二节点根据所述下行数据包是否携带MAC-I，确定所述下行数据包的PDCP层安全状态，包括：
    若所述下行数据包未携带MAC-I，则所述第二节点确定所述下行数据包的PDCP层安全状态为完整性保护关闭；
    若所述下行数据包携带MAC-I，则所述第二节点确定所述下行数据包的PDCP层安全状态为完整性保护开启。
  32. 根据权利要求28或29所述的通信方法，其特征在于，所述第二节点确定所述下行数据包的PDCP层安全状态，包括：
    所述第二节点根据用于传输所述下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定所述下行数据包的PDCP层安全状态；其中，所述第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，所述第二传输隧道为所述第二节点与所述用户面网元之间的传输隧道。
  33. 根据权利要求32所述的通信方法，其特征在于，所述方法还包括：
    所述第二节点获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；
    所述第二节点获取PDU会话与第二传输隧道的标识之间的对应关系；
    所述第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成所述第二对应关系。
  34. 根据权利要求32或33所述的通信方法，其特征在于，所述方法还包括：
    所述第二节点获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；
    所述第二节点获取PDU会话的标识与第一传输隧道的标识之间的对应关系；
    所述第二节点根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系；
    所述第二节点向所述第一节点发送所述第一对应关系。
  35. 根据权利要求30至34任一项所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  36. 根据权利要求32至34任一项所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述下行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  37. 根据权利要求32至34任一项所述的通信方法，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  38. 一种通信装置，其特征在于，所述通信装置与第二节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述通信装置包括：
    通信模块，用于接收来自终端的上行数据包；
    处理模块，用于确定所述上行数据包的分组数据汇聚协议PDCP层安全状态；根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标互联网协议安全隧道；
    所述通信模块，还用于通过所述目标安全隧道向所述第二节点发送所述上行数据包。
  39. 根据权利要求38所述的通信装置，其特征在于，
    所述处理模块，具体用于根据所述上行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与上行数据包的PDCP层 安全状态是互补的安全隧道作为所述目标安全隧道。
  40. 根据权利要求38或39所述的通信装置，其特征在于，
    所述处理模块，具体用于根据所述上行数据包是否携带完整性的消息认证码MAC-I，确定所述上行数据包的PDCP层安全状态。
  41. 根据权利要求40所述的通信装置，其特征在于，
    所述处理模块，具体用于若所述上行数据包未携带MAC-I，则确定所述上行数据包的PDCP层安全状态为完整性保护关闭；若所述上行数据包携带MAC-I，则确定所述上行数据包的PDCP层安全状态为完整性保护开启。
  42. 根据权利要求38或39所述的通信装置，其特征在于，
    所述处理模块，具体用于根据用于传输所述上行数据包的第一传输隧道的标识、以及预先存储的第一对应关系，确定所述上行数据包的PDCP层安全状态；其中，所述第一对应关系为第一传输隧道的标识与PDCP层安全状态之间的对应关系，所述第一传输隧道为所述通信装置与所述第二节点之间的传输隧道。
  43. 根据权利要求41所述的通信装置，其特征在于，
    所述通信模块，还用于接收所述第二节点发送的第一对应关系。
  44. 根据权利要求39至42任一项所述的通信装置，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  45. 根据权利要求42或43所述的通信装置，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述上行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  46. 根据权利要求42或43所述的通信装置，其特征在于，所述目标安全隧道的安全状态与所述上行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述上行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述上行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述上行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  47. 一种通信装置，其特征在于，所述通信装置与第一节点之间建立有多个安全隧道，所述多个安全隧道对应不同的安全状态，所述通信装置包括：
    通信模块，用于接收来自于用户面网元的下行数据包；
    处理模块，用于确定所述下行数据包的分组数据汇聚协议PDCP层安全状态；根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，确定目标安全隧道；
    所述通信模块，用于通过所述目标安全隧道向所述第一节点发送所述下行数据包。
  48. 根据权利要求47所述的通信装置，其特征在于，
    所述处理模块，具体用于根据所述下行数据包的PDCP层安全状态和所述多个安全隧道的安全状态，从所述多个安全隧道中，选择安全状态与所述下行数据包的PDCP层安全状态是互补的安全隧道作为所述目标安全隧道。
  49. 根据权利要求47或48所述的通信装置，其特征在于，
    所述处理模块，具体用于根据所述下行数据包是否携带完整性的消息认证码MAC-I，确定所述下行数据包的PDCP层安全状态。
  50. 根据权利要求49所述的通信装置，其特征在于，
    所述处理模块，具体用于若所述下行数据包未携带MAC-I，则确定所述下行数据包的PDCP层安全状态为完整性保护关闭；若所述下行数据包携带MAC-I，则确定所述下行数据包的PDCP层安全状态为完整性保护开启。
  51. 根据权利要求47或48所述的通信装置，其特征在于，
    所述处理模块，用于根据用于传输所述下行数据包的第二传输隧道的标识、以及预先存储的第二对应关系，确定所述下行数据包的PDCP层安全状态；其中，所述第二对应关系为第二传输隧道的标识和PDCP层安全状态之间的对应关系，所述第二传输隧道为所述通信装置与所述用户面网元之间的传输隧道。
  52. 根据权利要求51所述的通信装置，其特征在于，
    所述处理模块，还用于获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话与第二传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话与第二传输隧道的标识之间的对应关系，生成所述第二对应关系。
  53. 根据权利要求51或52所述的通信装置，其特征在于，
    所述处理模块，还用于获取协议数据单元PDU会话的标识与PDCP层安全状态之间的对应关系；获取PDU会话的标识与第一传输隧道的标识之间的对应关系；根据PDU会话的标识与PDCP层安全状态之间的对应关系、以及PDU会话的标识与第一传输隧道的标识之间的对应关系，生成第一对应关系；
    所述通信模块，还用于向所述第一节点发送所述第一对应关系。
  54. 根据权利要求49至53任一项所述的通信装置，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护开启，则所述目标安全隧道的安全状态应为完整性保护关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭，则所述目标安全隧道的安全状态应为完整性保护开启。
  55. 根据权利要求51至53任一项所述的通信装置，其特征在于，所述目标安全 隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为加密保护开启，则所述目标安全隧道的安全状态应为加密保护关闭；
    若所述下行数据包的PDCP层安全状态为加密保护关闭，则所述目标安全隧道的安全状态应为加密保护开启。
  56. 根据权利要求51至53任一项所述的通信装置，其特征在于，所述目标安全隧道的安全状态与所述下行数据包的PDCP层安全状态是互补的，包括以下情形之一：
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均关闭，则所述目标安全隧道的安全状态为完整性保护和加密保护均开启；
    若所述下行数据包的PDCP层安全状态为完整性保护和加密保护均开启，则所述目标安全隧道的安全状态为完整性保护和加密保护均关闭；
    若所述下行数据包的PDCP层安全状态为完整性保护开启且加密保护关闭，则所述目标安全隧道的安全状态为完整性保护关闭且加密保护开启；
    若所述下行数据包的PDCP层安全状态为完整性保护关闭且加密保护开启，则所述目标安全隧道的安全状态为完整性保护开启且加密保护关闭。
  57. 一种通信装置，其特征在于，包括处理器和通信接口，当所述处理器执行计算机程序指令时，使得所述通信装置执行权利要求19至27任一项所述的通信方法；或者，使得所述计算机执行权利要求28至37任一项所述的通信方法。
  58. 一种计算机可读存储介质，其特征在于，所述计算机存储介质存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求19至27任一项所述的通信方法；或者，使得所述计算机执行权利要求28至37任一项所述的通信方法。
  59. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述计算机程序产品在计算机上运行时，使得所述计算机执行权利要求19至27任一项所述的通信方法；或者，使得所述计算机执行权利要求28至37任一项所述的通信方法。
  60. 一种芯片，其特征在于，包括处理器，当所述处理器执行计算机程序指令时，使得所述计算机执行权利要求19至27任一项所述的通信方法；或者，使得所述计算机执行权利要求28至37任一项所述的通信方法。
  61. 一种通信系统，其特征在于，包括：移动管理网元、认证服务网元、以及数据管理网元；
    所述移动管理网元，用于接收来自于通信设备的注册请求消息；向认证服务网元发送第一认证请求消息；在所述注册请求消息包括第一指示信息的情况下，所述第一认证请求消息包括所述第一指示信息；
    所述认证服务网元，用于接收所述第一认证请求消息；向所述数据管理网元发送第二认证请求消息；在所述第一认证请求消息包括第一指示信息的情况下，所述第二认证请求消息包括所述第一指示信息；
    所述数据管理网元，用于在所述第二认证请求消息包括第一指示信息的情况下，查询所述通信设备的标识是否在预设名单中；若所述通信设备的标识在预设名单中，则确定所述通信设备为接入回传一体化节点IAB node；若所述通信设备的标识不在预设名单中，则确定所述通信设备为终端。
  62. 根据权利要求61所述的通信系统，其特征在于，
    所述数据管理网元，还用于在所述第二认证请求消息不包括第一指示信息的情况下，确定所述通信设备为终端。
  63. 一种通信方法，其特征在于，所述方法包括：
    数据管理网元接收第二认证请求消息，所述第二认证请求消息包括通信设备的用户标识；
    所述数据管理网元在所述第二认证请求消息包括第一指示信息的情况下，查询所述通信设备的标识是否在预设名单中；
    若所述通信设备的标识在预设名单中，则所述数据管理网元确定所述通信设备为接入回传一体化节点IAB node；
    若所述通信设备的标识不在预设名单中，则所述数据管理网元确定所述通信设备为终端。
  64. 根据权利要求63所述的通信方法，其特征在于，所述方法还包括：
    所述数据管理网元在所述第二认证请求消息不包括第一指示信息的情况下，确定所述通信设备为终端。
  65. 一种通信装置，其特征在于，包括：
    通信模块，用于接收第二认证请求消息，所述第二认证请求消息包括通信设备的用户标识；
    处理模块，用于在所述第二认证请求消息包括第一指示信息的情况下，查询所述通信设备的标识是否在预设名单中；若所述通信设备的标识在预设名单中，则确定所述通信设备为接入回传一体化节点IAB node；若所述通信设备的标识不在预设名单中，则确定所述通信设备为终端。
  66. 根据权利要求65所述的通信装置，其特征在于，
    所述处理模块，还用于在所述第二认证请求消息不包括第一指示信息的情况下，确定所述通信设备为终端。
  67. 一种通信装置，其特征在于，包括处理器和通信接口，当所述处理器执行计算机程序指令时，使得所述通信装置执行权利要求63或64所述的通信方法。
  68. 一种计算机可读存储介质，其特征在于，所述计算机存储介质存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求63或64所述的通信方法。
  69. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述计算机程序产品在计算机上运行时，使得所述计算机执行权利要求63或64所述的通信方法。
  70. 一种芯片，其特征在于，包括处理器，当所述处理器执行计算机程序指令时，使得所述计算机执行权利要求63或64所述的通信方法。
  71. 一种通信方法，其特征在于，所述方法包括：
    数据管理网元确定通信设备为接入回程一体化节点IAB node；
    数据管理网元在主鉴权流程中向移动管理网元发送第二指示信息，第二指示信息用于确定通信设备为IAB node。
  72. 根据权利要求71所述的通信方法，其特征在于，所述第二指示信息承载于第二认证响应消息或者鉴权信息回答命令消息中。
  73. 一种通信装置，其特征在于，包括：
    处理模块，用于确定通信设备为接入回程一体化节点IAB node；
    通信模块，用于在主鉴权流程中向移动管理网元发送第二指示信息，第二指示信息用于确定通信设备为IAB node。
  74. 根据权利要求73所述的通信装置，其特征在于，所述第二指示信息承载于第二认证响应消息或者鉴权信息回答命令消息中。
  75. 一种通信装置，其特征在于，包括处理器和通信接口，当所述处理器执行计算机程序指令时，使得所述通信装置执行权利要求71或72所述的通信方法。
  76. 一种计算机可读存储介质，其特征在于，所述计算机存储介质存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求71或72所述的通信方法。
  77. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述计算机程序产品在计算机上运行时，使得所述计算机执行权利要求71或72所述的通信方法。
  78. 一种芯片，其特征在于，包括处理器，当所述处理器执行计算机程序指令时，使得所述计算机执行权利要求71或72所述的通信方法。
PCT/CN2019/101250 2019-08-18 2019-08-18 通信方法及装置 WO2021031055A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201980096530.1A CN113841366B (zh) 2019-08-18 2019-08-18 通信方法及装置
EP19941841.9A EP4016949A4 (en) 2019-08-18 2019-08-18 COMMUNICATION METHOD AND DEVICE
PCT/CN2019/101250 WO2021031055A1 (zh) 2019-08-18 2019-08-18 通信方法及装置
US17/674,590 US20220174761A1 (en) 2019-08-18 2022-02-17 Communications method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/101250 WO2021031055A1 (zh) 2019-08-18 2019-08-18 通信方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/674,590 Continuation US20220174761A1 (en) 2019-08-18 2022-02-17 Communications method and apparatus

Publications (1)

Publication Number Publication Date
WO2021031055A1 true WO2021031055A1 (zh) 2021-02-25

Family

ID=74659471

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/101250 WO2021031055A1 (zh) 2019-08-18 2019-08-18 通信方法及装置

Country Status (4)

Country Link
US (1) US20220174761A1 (zh)
EP (1) EP4016949A4 (zh)
CN (1) CN113841366B (zh)
WO (1) WO2021031055A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024060932A1 (zh) * 2022-09-23 2024-03-28 大唐移动通信设备有限公司 网络注册、信息传输方法、装置及通信设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11856489B2 (en) * 2019-08-08 2023-12-26 Qualcomm Incorporated Uplink broadcast/multicast packet processing
CN116319105B (zh) * 2023-05-22 2023-08-15 北京中鼎昊硕科技有限责任公司 一种基于多路安全隧道的高可靠数据传输管理系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080076392A1 (en) * 2006-09-22 2008-03-27 Amit Khetawat Method and apparatus for securing a wireless air interface
CN102098676A (zh) * 2010-01-04 2011-06-15 大唐移动通信设备有限公司 一种实现完整性保护的方法、装置和系统
CN103188681A (zh) * 2009-09-28 2013-07-03 华为技术有限公司 数据传输方法、装置及系统
CN107079023A (zh) * 2014-10-29 2017-08-18 高通股份有限公司 用于下一代蜂窝网络的用户面安全
CN109257212A (zh) * 2018-09-10 2019-01-22 武汉虹信通信技术有限责任公司 一种iab基站接入的方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8867428B2 (en) * 2009-04-13 2014-10-21 Qualcomm Incorporated Split-cell relay application protocol
US20110305339A1 (en) * 2010-06-11 2011-12-15 Karl Norrman Key Establishment for Relay Node in a Wireless Communication System
CN104506406B (zh) * 2011-11-03 2018-10-30 华为技术有限公司 一种鉴权认证设备
US9491575B2 (en) * 2014-06-13 2016-11-08 Qualcomm Incorporated Positioning beacons with wireless backhaul
US10367677B2 (en) * 2016-05-13 2019-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Network architecture, methods, and devices for a wireless communications network
CN105873038A (zh) * 2016-06-07 2016-08-17 武汉邮电科学研究院 一种lte基站用户面数据安全处理方法
CN109586900B (zh) * 2017-09-29 2020-08-07 华为技术有限公司 数据安全处理方法及装置
CN110072297B (zh) * 2018-01-23 2021-01-05 上海华为技术有限公司 一种信息交互方法、装置及计算机可读存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080076392A1 (en) * 2006-09-22 2008-03-27 Amit Khetawat Method and apparatus for securing a wireless air interface
CN103188681A (zh) * 2009-09-28 2013-07-03 华为技术有限公司 数据传输方法、装置及系统
CN102098676A (zh) * 2010-01-04 2011-06-15 大唐移动通信设备有限公司 一种实现完整性保护的方法、装置和系统
CN107079023A (zh) * 2014-10-29 2017-08-18 高通股份有限公司 用于下一代蜂窝网络的用户面安全
CN109257212A (zh) * 2018-09-10 2019-01-22 武汉虹信通信技术有限责任公司 一种iab基站接入的方法

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
3GPP TS 33.401
See also references of EP4016949A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024060932A1 (zh) * 2022-09-23 2024-03-28 大唐移动通信设备有限公司 网络注册、信息传输方法、装置及通信设备

Also Published As

Publication number Publication date
US20220174761A1 (en) 2022-06-02
CN113841366A (zh) 2021-12-24
CN113841366B (zh) 2023-01-13
EP4016949A1 (en) 2022-06-22
EP4016949A4 (en) 2022-08-10

Similar Documents

Publication Publication Date Title
US11805409B2 (en) System and method for deriving a profile for a target endpoint device
US20220174761A1 (en) Communications method and apparatus
WO2020221218A1 (zh) 信息获取方法及装置
WO2021136211A1 (zh) 授权结果的确定方法及装置
EP4142328A1 (en) Network authentication method and apparatus, and system
WO2022028259A1 (zh) 用户签约数据的获取方法及装置
WO2023125293A1 (zh) 通信方法及通信装置
US20230337002A1 (en) Security context generation method and apparatus, and computer-readable storage medium
KR20200013053A (ko) 통신 방법 및 장치
US20220303763A1 (en) Communication method, apparatus, and system
WO2022253083A1 (zh) 一种公私网业务的隔离方法、装置及系统
US20220174497A1 (en) Communication Method And Apparatus
WO2021051250A1 (zh) 数据传输方法及装置
WO2021180209A1 (zh) 传输寻呼信息的方法和通信装置
WO2023246942A1 (zh) 通信方法及装置
WO2023246457A1 (zh) 安全决策协商方法及网元
WO2023213209A1 (zh) 密钥管理方法及通信装置
EP4274310A1 (en) Network intercommunication method and apparatus
WO2021147053A1 (zh) 数据传输方法、装置及系统
WO2024065483A1 (en) Authentication procedures for edge computing in roaming deployment scenarios
WO2023071885A1 (zh) 一种通信方法及通信装置
US20230308868A1 (en) Method, devices and system for performing key management
Fernandez et al. Patterns for WiMax security.
WO2020215272A1 (zh) 通信方法、通信装置和通信系统
CN116782224A (zh) 通信方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19941841

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019941841

Country of ref document: EP

Effective date: 20220317