WO2021031746A1

WO2021031746A1 - Security algorithm configuration method, center unit-control plane, and terminal

Info

Publication number: WO2021031746A1
Application number: PCT/CN2020/102061
Authority: WO
Inventors: 毕晓宇; 刘爱娟
Original assignee: 大唐移动通信设备有限公司
Priority date: 2019-08-16
Filing date: 2020-07-15
Publication date: 2021-02-25
Also published as: CN112399422A; CN112399422B

Abstract

Embodiments of the present application provide a security algorithm configuration method, a center unit-control plane (CU-CP), and a terminal. The security algorithm configuration method comprises: sending security algorithm information corresponding to a center unit-user plane (CU-UP) to the terminal to complete a negotiation process of the security algorithm information corresponding to the CU-UP, so that the CU-UP can correspond to its own security algorithm information. Therefore, the security of the CU-UP service is improved.

Description

Security algorithm configuration method, control plane central node and terminal

Cross references to related applications

This application claims the priority of the Chinese patent application filed on August 16, 2019 with the application number 201910760051.7 and the invention title of "a security algorithm configuration method, control plane central node and terminal", which is fully incorporated by reference This article.

Technical field

This application relates to the field of communication technology, and in particular to a security algorithm configuration method, a control plane central node and a terminal.

Background technique

In the New Radio (NR) system, a logical radio access network (Radio Access Network, RAN) node can be further divided into a Central Unit-Control Plane (CU-CP) and one Or multiple user plane central nodes (Central Unit-User Plane, CU-UP) and one or more distributed nodes (Distributed Unit, DU), this structure is called CU-CP/UP separation structure, these nodes can be located in different Within the physical entity. In addition, one CU-CP can be connected to multiple CU-UPs.

In addition, in the prior art, the security algorithm used by all user bearers between a user and a 5g base station (gNB) is the same (including encryption algorithms and integrity protection algorithms). In this scenario, if user data of different Quality of Service (QoS) is carried on the CU-UP inside the gNB (for example, some CU-UPs carry online entertainment videos that are not related to user privacy, some CU-UP UP carries a small amount of data but contains data related to user privacy, such as location and user’s home device information, etc.), and all CU-UPs use the same security algorithm, which will lead to security risks, such as The null algorithm is selected in the public land mobile network (Public Land Mobile Network, PLMN), but the data of some users is not allowed to use the null algorithm to protect. In addition, due to the different locations of different CU-UPs, some CU-UPs are deployed in relatively core internal locations, and security algorithms with a higher security level need to be configured. At this time, if the security algorithms of all CU-UPs are unified, it is also Will cause some safety hazards.

Summary of the invention

The embodiments of the present application provide a security algorithm configuration method, a control plane central node, and a terminal, so as to implement a security algorithm that can be adapted to different CU-UP configurations.

In the first aspect, an embodiment of the present application provides a security algorithm configuration method, including:

Send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.

In the second aspect, an embodiment of the present application provides a security algorithm configuration method, including:

Receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.

In the third aspect, an embodiment of the present application provides a security algorithm configuration method, including:

Receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.

In the fourth aspect, an embodiment of the present application provides a security algorithm configuration device, including:

The sending module is used to send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.

In the fifth aspect, an embodiment of the present application provides a security algorithm configuration device, including:

The receiving module is used to receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.

In the sixth aspect, an embodiment of the present application provides a security algorithm configuration device, including:

The receiving module is configured to receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.

In the seventh aspect, an embodiment of the present application provides a control plane central node CU-CP, including a memory, a processor, and a program stored in the memory and capable of running on the processor. The processor executes the program when the program is executed. The following steps:

In an eighth aspect, an embodiment of the present application provides a terminal including a memory, a processor, and a program stored in the memory and capable of running on the processor, and the processor implements the following steps when the program is executed:

In the ninth aspect, an embodiment of the present application provides a user plane central node CU-UP, including a memory, a processor, and a program stored in the memory and capable of running on the processor. The processor executes the program when the program is executed. The following steps:

In a tenth aspect, an embodiment of the present application provides a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program implements the steps of the security algorithm configuration method when executed by a processor.

The security algorithm configuration method, control plane central node, and terminal provided by the embodiments of the application implement the security algorithm information corresponding to each CU-UP between the terminal by sending the security algorithm information corresponding to the CU-UP to the terminal. The negotiation process enables CU-UP to correspond to its own security algorithm information, avoids the problem of potential security risks when each CU-UP corresponds to the same security algorithm information, and improves the security of CU-UP services.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description These are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

FIG. 1 is one of the steps of a flow chart of a security algorithm configuration method in an embodiment of this application;

Figure 2 is the second flow chart of the steps of the security algorithm configuration method in the embodiment of the application;

FIG. 3 is the third step flow chart of the security algorithm configuration method in the embodiment of this application;

FIG. 4 is one of the schematic diagrams of the interaction process when the CU-CP configures the security algorithm for the CU-UP in the embodiment of the application;

FIG. 5 is the second schematic diagram of the interaction process when the CU-CP configures the security algorithm for the CU-UP in the embodiment of this application;

6 is a schematic diagram of the interaction process when the CU-UP itself configures a security algorithm in an embodiment of the application;

FIG. 7 is one of the module block diagrams of the security algorithm configuration device in an embodiment of the application;

Fig. 8 is the second block diagram of the security algorithm configuration device in the embodiment of the application;

FIG. 9 is the third block diagram of the security algorithm configuration device in the embodiment of the application;

FIG. 10 is a schematic structural diagram of CU-CP in an embodiment of the application;

FIG. 11 is a schematic structural diagram of a terminal in an embodiment of the application;

FIG. 12 is a schematic diagram of the structure of CU-UP in an embodiment of the application.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of this application.

In NR and similar systems, a logical RAN node can be further divided into a CU-CP, one or more CU-UPs, and one or more distributed node DUs. This structure is called a CU-CP/UP separation structure . In this structure, CU-CP and DU are connected by F1-C or similar interface, and CU-CP and CU-UP are connected by E1 or similar interface; the control plane connection between RAN node and core network ends at In CU-CP, the user plane connection ends at CU-UP, and the air interface connection between the RAN node and the terminal ends at DU.

A common scenario of the CU-CP/UP separation structure is as follows: CU-UP is implemented as a central control node, and CU-UP is implemented as a data service node, and different CU-UPs support different types of data streams. For example, CU-UP1 supports low-latency data streams and is deployed outdoors near the base station together with DU; while CU-UP2 supports high-bandwidth data streams and is deployed in the central computer room.

The encryption algorithms used in the current NR/5G system include NEA0, NEA1, NEA2, and NEA3, and the integrity algorithms include NIA0, NIA1, NIA2, and NIA3. Under normal circumstances, gNB will support the above-mentioned security algorithm, and the description of the UP security algorithm in the prior art is: Session Management Function (SMF) entity shall establish a session in Protocol Data Unit (PDU) In the process, the user plane security algorithm of the PDU session is provided to ng-Enb/gNB, and the UP security algorithm should indicate whether to activate UP confidentiality and/or UP for all data radio bearers (Data Radio Bearer, DRB) belonging to the PDU session Complete inclusion.

In addition, in the prior art, the access layer (Access Stratum, AS) algorithm negotiation is for each gNB, specifically: each gNB should configure a list of allowed algorithms through network management, including an integrity algorithm list and a secret A list of performance algorithms, which should be arranged in the order of priority determined by the operator. When the AS security context is to be established in the gNB, the Access and Mobility Management Function (AMF) entity should send the terminal 5G security function to the gNB. The gNB should select the highest priority confidentiality security algorithm according to the list sort, and save it in the terminal's 5G security capability, and the selected security algorithm is sent to the terminal through the AS Security Mode Command (SMC) message. In addition, the selected encryption algorithm is used to encrypt the activated user plane and radio resource control (Radio Resource Control, RRC) services, and the selected integrity algorithm is used to protect the integrity of the user plane and RRC traffic.

However, when the CU-CP/UP are separated, according to the existing technology, all CU-UPs in the base station use the same security algorithm, which may cause the same key to be calculated on different CU-UPs, leading to security risks, and It is impossible to realize CU-CP/UP to meet the security requirements of multiple services.

In view of the above-mentioned problem that all CU-UPs in the base station adopt the same security algorithm, it is prone to security risks. As shown in FIG. 1, an embodiment of the present application provides a security algorithm configuration method, including the following steps:

Step 101: Send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.

In this step, specifically, the CU-CP sends the security algorithm information corresponding to the CU-UP to the terminal.

It should be noted that the number of CU-UPs is one or more, and each CU-UP corresponds to one security algorithm information. In this step, the security algorithm information corresponding to the CU-UP can be sent to the terminal, so as to realize the communication with the terminal. Negotiation of security algorithms between them, thereby improving the security of each CU-UP service.

In addition, specifically, the security algorithm may include an encryption algorithm and an integrity protection algorithm.

In addition, further, in this embodiment, when the CU-CP sends the security algorithm information corresponding to the CU-UP to the terminal, any of the following methods may be adopted:

The first way is to send N access layer AS security mode command SMC messages to the terminal.

In this way, the CU-CP sends an AS SMC message to the terminal to realize the transmission of the security algorithm information corresponding to the CU-UP.

Among them, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to each CU-UP in all CU-UPs; when N is taken When the value is the same as the number of CU-UPs, each SMC message carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to a single CU-UP.

Specifically, the scenarios where the aforementioned N values are different are described here. For example, when the CU-CP can determine the security algorithm information corresponding to the CU-UP, it can send the security algorithm information corresponding to the CU-UP by sending one or N SMC messages to the terminal; for example, when the CU-UP -When the number of UPs is n, and the CU-CP determines the security algorithm information corresponding to each CU-UP, it can send an SMC message to the terminal once. At this time, the SMC message needs to carry each of the n CU-UPs. The security algorithm information corresponding to each CU-UP can also be sent to the terminal N times of SMC messages. At this time, the SMC message only needs to carry the security algorithm information corresponding to one CU-UP. For another example, when the CU-UP itself determines the corresponding security algorithm information, one CU-UP needs to correspond to one SMC message. At this time, the CU-CP needs to pass the security algorithm information determined by each CU-UP itself through a The SMC message is sent to the terminal.

Of course, what needs to be explained here is that the security algorithm information may carry a corresponding CU-UP identifier, so that different security algorithm information can be distinguished through the CU-UP identifier.

In addition, it should be noted here that the SMC message may also carry a message authentication code (Message Authentication Code, MAC) value.

At this time, after sending N access layer AS security mode command SMC messages to the terminal, the CU-CP can receive the security mode completion message sent by the terminal when the MAC value verification is successful; The CU-UP corresponding to the SMC message sends a negotiation acceptance message, and the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.

Of course, it needs to be explained here that the SMC message can be integrity protected by the NIA algorithm in the RRC security algorithm to calculate the MAC value.

In this way, by carrying the MAC value in the SMC message, the terminal can verify the integrity of the SMC message, so that the terminal can report to the CU-CP after successfully verifying the MAC value, that is, verifying the integrity of the SMC message. Send a security mode complete message to complete the negotiation process of the security algorithm; at this time, the CU-CP can send a negotiation acceptance message to the CU-UP corresponding to the SMC message through the E1 interface, so that the CU-UP can determine its corresponding Security algorithm.

The second way: sending an RRC connection reconfiguration message to the terminal.

Specifically, the RRC connection reconfiguration message carries security algorithm information corresponding to each DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.

Specifically, there is a pre-configured correspondence between DRB and CU-UP, for example, DRB1 and DRB2 correspond to CU-UP1, and DRB3 and DRB4 correspond to CU-UP2. This enables the CU-CP to carry the security algorithm information corresponding to each DRB in the RRC connection reconfiguration message sent to the terminal, the terminal can determine the security algorithm corresponding to the CU-UP through the correspondence between DRB and CU-UP Information, so as to realize the negotiation between the security algorithm corresponding to the CU-UP and the terminal.

In addition, further, in this embodiment, before sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal, it also needs to obtain the security algorithm information corresponding to the CU-UP. The specific obtaining method may include the following two methods:

First, configure the corresponding security algorithm for CU-UP.

Specifically, in this manner, the CU-CP configures the security algorithm corresponding to the CU-UP.

Among them, when configuring the corresponding security algorithm for CU-UP, the following two methods can be used:

The first method is to configure a corresponding security algorithm for the CU-UP according to the quality of service QoS data flow allocated for the CU-UP.

Specifically, the CU-CP can allocate a QoS data flow for each CU-UP according to the user's service requirements, and then configure the corresponding security algorithm for the CU-UP according to the QoS data flow allocated for the CU-UP.

In this way, by configuring the corresponding security algorithm for the CU-UP according to the QoS data flow of each CU-UP, the adaptability of the security algorithm configured for the CU-UP is ensured, thereby ensuring the CU-UP service time safety.

In the second type, when receiving the first bearer context setting request message for the CU-UP sent by the core network, according to the QoS corresponding to the data flow in the first bearer context setting request message, the CU-UP UP configure the corresponding security algorithm.

Specifically, when the CU-CP receives the first bearer context setting request message (BEARER CONTEXT SETUP REQUEST) for the CU-CP from the core network, it may set the QoS corresponding to the data flow in the request message according to the first bearer context, Configure the corresponding security algorithm for CU-UP. Ensure the adaptability of the security algorithm configured for CU-UP.

In addition, it should be noted here that after setting the corresponding security algorithm for the CU-UP according to the QoS corresponding to the data flow in the first bearer context setting request message, the CU-CP may also send the first to the CU-UP 2. A bearer context setting request message, where the second bearer context setting request message carries security algorithm information corresponding to the CU-UP; and then receiving feedback from the CU-UP according to the second bearer context setting request message A context setting response message (BEARER CONTEXT SETUP RESPONSE), the context setting response message carries the security algorithm information corresponding to the CU-UP.

In this way, the interaction and determination of the security algorithm information corresponding to the CU-UP between the CU-CP and the CU-UP are realized through the above-mentioned method.

Of course, it should be noted here that in this embodiment, after the CU-CP receives the context setting response message, the RRC connection reconfiguration message may be used to send the security algorithm information corresponding to the CU-UP to the terminal.

In addition, it should be noted that, after receiving the context setting response message fed back by the CU-UP according to the second bearer context setting request message, it may also send a bearer context modification request message to the CU-UP, the bearer context modification request The message (BEARER CONTEXT MODIFICATION REQUEST) carries or does not carry the security algorithm information of the CU-UP; and then receives the bearer context modification response message (BEARER CONTEXT MODIFICATION RESPONSE) fed back by the CU-UP, the bearer context modification response message It carries or does not carry the security algorithm information of the CU-UP.

In this way, through the above method, the process of modifying the security algorithm information corresponding to the CU-UP by the CU-CP can be realized, and the flexibility of configuring the security algorithm for the CU-UP can be realized.

Second, receiving a notification message sent by the CU-UP, where the notification message carries security algorithm information corresponding to the CU-UP.

Specifically, the CU-UP may select a security algorithm corresponding to its own bearer service according to the user service requirements allocated by the CU-CP, and send a notification message carrying the corresponding security algorithm information to the CU-CP. At this time, the CU-UP can obtain the security algorithm information corresponding to each CU-UP by receiving the notification message carrying the security algorithm information corresponding to the CU-UP.

In this way, the CU-CP realizes the acquisition of the security algorithm information corresponding to the CU-UP through the above two methods, and realizes the flexibility of the CU-CP's acquisition process of the security algorithm information corresponding to the CU-UP.

In this embodiment, by sending the security algorithm information corresponding to the CU-UP to the terminal, the negotiation process of the security algorithm information corresponding to each CU-UP with the terminal is realized, so that the CU-UP can correspond to its own security algorithm information. This avoids the problem of potential safety hazards when each CU-UP corresponds to the same security algorithm information, and improves the security of CU-UP services.

In addition, as shown in FIG. 2, the second step flow chart of the security algorithm configuration method in the embodiment of this application, the method includes the following steps:

Step 201: Receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.

In this step, specifically, the terminal receives the security algorithm information corresponding to the CU-UP sent by the CU-CP.

Of course, it should be noted that the number of CU-UPs is one or more, and the number of CU-UPs is not limited here.

By receiving the security algorithm information corresponding to the CU-UP sent by the CU-CP, the terminal realizes the negotiation process of the security algorithm information corresponding to the CU-UP, realizes that the CU-UP can correspond to its own security algorithm information, and improves the CU -UP service security.

Further, in this embodiment, when receiving the security algorithm information corresponding to the CU-UP sent by the CU-CP, the following two methods may be included:

First, receiving N access layer AS security mode command SMC messages sent by the CU-CP.

Specifically, when N is 1, the SMC message carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to each CU-UP in all CU-UPs; when the value of N is equal to When the number of CU-UPs is the same, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to a single CU-UP.

It should be noted here that the foregoing N SMC messages are the same as the N SMC messages in the embodiment on the CU-CP side. For the introduction of the N SMC messages, please refer to the foregoing embodiment, which will not be repeated here.

The CU-CP sends the security algorithm information corresponding to the CU-UP to the terminal by sending N SMC messages. At this time, the terminal realizes the reception of the security algorithm information corresponding to the CU-UP through the N SMC messages, thereby realizing CU- Negotiation process of security algorithm information corresponding to UP.

In addition, specifically, the SMC message also carries the MAC value of the message authentication code. At this time, after receiving the N SMC messages sent by the CU-CP, the terminal can check the MAC value; specifically, when the terminal successfully checks the MAC value, it can send a security message to the CU-CP The mode completion message completes the negotiation process of the security algorithm information corresponding to the CU-UP.

Second: receiving the RRC connection reconfiguration message sent by the CU-CP.

Specifically, the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.

It should be noted here that the foregoing RRC connection reconfiguration message is the same as the RRC connection reconfiguration message in the embodiment on the CU-CP side. For the introduction of the RRC connection reconfiguration message, please refer to the foregoing embodiment, and will not be described in detail here.

In this way, by receiving the security algorithm information corresponding to the CU-UP in the above two ways, the flexibility of the interaction process of the security algorithm information corresponding to the CU-UP is realized.

In this embodiment, the terminal realizes the negotiation process of the security algorithm information corresponding to the CU-UP by receiving the security algorithm information corresponding to the CU-UP sent by the CU-CP, and realizes that the CU-UP can correspond to its own security algorithm information , Improve the security of CU-UP service.

In addition, as shown in FIG. 3, the third step flow chart of the security algorithm configuration method in the embodiment of this application, the method includes the following steps:

Step 301: Receive a negotiation acceptance message sent by the control plane central node CU-CP.

Specifically, the negotiation acceptance message carries security algorithm information corresponding to CU-UP.

In this step, specifically, when the CU-CP receives the security mode completion message sent by the terminal, the CU-CP sends a negotiation acceptance message to the CU-UP. At this time, the CU-UP receives the negotiation sent by the CU-CP through the E1 interface Accept the message to complete the entire negotiation and determination process of the security algorithm information corresponding to the CU-UP, so that the CU-UP can correspond to its own security algorithm, avoiding the hidden security problem when all CU-UPs correspond to the same security algorithm , Improve the security of CU-UP service.

In addition, further, before receiving the negotiation acceptance message sent by the CU-CP, the CU-UP may also send a notification message to the CU-CP, and the notification message carries the security algorithm information corresponding to the CU-UP .

Specifically, CU-CP can allocate user service requirements (corresponding to QoS) to CU-UP. At this time, CU-UP can select the security algorithm corresponding to its own bearer service according to the user service requirements allocated by CU-CP, and send it to CU The CP sends a notification message carrying corresponding security algorithm information, so that the CU-CP can obtain the security algorithm information corresponding to the CU-UP from the notification message, and then can negotiate the security algorithm with the terminal.

Of course, it should be noted here that the security algorithm information corresponding to the CU-UP may carry the CU-UP identifier, so that the CU-CP can distinguish different security algorithm information through the CU-UP identifier.

In addition, further, the CU-UP may also receive a bearer context setting request message sent by the CU-CP, and the bearer context setting request message carries the security algorithm information corresponding to the CU-UP; and then according to the A context setting request message is carried, and a context setting response message is sent to the CU-CP, and the context setting response message carries the security algorithm information corresponding to the CU-UP.

Specifically, when the CU-CP sends a bearer context setting request message carrying the security algorithm information corresponding to the CU-UP to the CU-UP, the CU-UP can receive the context setting request message, and feed back that the CU-UP location The context setting response message of the corresponding security algorithm information is used to implement the interactive confirmation process of the security algorithm with the CU-CP, and enable the CU-CP to perform subsequent operation procedures according to the context setting response information.

Of course, it should be noted here that after the CU-UP sends the context setting response message to the CU-CP, it can also receive the bearer context modification request message sent by the CU-CP, and the bearer context modification request message carries Or not carrying the security algorithm information of the CU-UP; then sending a bearer context modification response message to the CU-CP, the bearer context modification response message carrying or not carrying the security algorithm information of the CU-UP.

In this way, through the above method, the process of modifying the security algorithm information corresponding to the CU-UP can be realized, and the flexibility of configuring the security algorithm for the CU-UP can be realized.

In this embodiment, by receiving the negotiation acceptance information sent by the CU-CP that carries the security algorithm information corresponding to the CU-UP, the CU-UP can correspond to its own security algorithm, and it is avoided that all CU-UPs correspond to the same security algorithm. There are hidden security problems, which improves the security of CU-UP services.

Regarding the foregoing embodiment, the interaction process between the CU-CP, CU-UP and the terminal in the foregoing embodiment will be described below through specific examples.

One: Refer to Figure 4, which is one of the schematic diagrams of the interaction process when the CU-CP configures the security algorithm for the CU-UP.

Assuming that there are multiple CU-UPs in the base station, the nth CU-UP is used as an example for description. At this time, the CU-CP can allocate a corresponding security algorithm to each CU-UP according to the QoS data flow allocated for the CU-UP.

Then, CU-CP initiates AS security algorithm negotiation to the terminal, that is, sends an SMC message to the terminal, which carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to CU-UP; Optionally, in order to distinguish different security algorithm information, the corresponding CU-UP identifier can be added to each security algorithm information; the SMC message uses the NIA in the RRC security algorithm for integrity protection and calculates the MAC value.

Then, after receiving the SMC message, the terminal verifies the MAC value, and if the verification is successful, it sends a security mode complete message to the CU-CP.

At this time, after the CU-CP receives the security mode completion message, it sends the negotiation acceptance information carrying the security algorithm information corresponding to the CU-UP to the CU-UP through each E1 interface.

It should be noted that one or more SMC messages can be sent between the terminal and the CU-CP. When an SMC message is sent once, the security algorithm information corresponding to the CU-UP carried in the SMC message is for multiple CU-UPs. Security algorithm information; when multiple SMC messages are sent, the security algorithm information corresponding to the CU-UP carried in each SMC message is the security algorithm information of a single CU-UP.

Second: Refer to Figure 5, which is the second schematic diagram of the interaction process when the CU-CP configures the security algorithm for the CU-UP.

Assuming that there are multiple CU-UPs in the base station, the nth CU-UP is used as an example for description. At this time, the CU-CP receives the first bearer context setting request message (BEARER CONTEXT SETUP REQUEST) for each CU-UP from the core network, and sets the QoS of the data flow in the request message according to each first bearer context, Configure the corresponding security algorithm for each CU-UP.

Then, the CU-CP sends a second bearer context setting request message to the CU-UP, and the second bearer context setting request message carries the security algorithm information corresponding to the CU-UP.

Then, the CU-CP receives the context setting response message (BEARER CONTEXT SETUP RESPONSE) fed back by the CU-UP according to the second bearer context setting request message, and the context setting response message carries the security algorithm corresponding to the CU-UP information. At this time, the CU-CP may send an RRC connection reconfiguration message to the terminal. The RRC connection reconfiguration message carries the security algorithm information corresponding to each DRB. Of course, there is a correspondence between the DRB and the CU-UP pre-configuration.

It should be noted that CU-CP can send a bearer context modification request message (BEARER CONTEXT MODIFICATION REQUEST) to CU-UP, and then receive a bearer context modification response message (BEARER CONTEXT MODIFICATION RESPONSE) fed back by CU-UP; of course, bearer context modification Both the request message and the bearer context modification response message may or may not carry CU-UP security algorithm information.

Third: Refer to Figure 6, a schematic diagram of the interaction process when configuring the security algorithm for CU-UP itself.

Assuming that there are multiple CU-UPs in the base station, the nth CU-UP is used as an example for description. CU-CP allocates user service requirements (corresponding to QoS) to CU-UP. At this time, CU-UP selects the security algorithm corresponding to its own bearer service according to the user service requirements allocated by CU-CP.

Then, the CU-UP sends a notification message carrying corresponding security algorithm information to the CU-CP; at this time, in order to distinguish different E1 connections, the security algorithm information of each CU-CP can be attached with a CU-CP identifier.

Then, after receiving the notification message, the CU-CP sends N SMC messages to the terminal, and the SMC message can only carry information about the security algorithm selected by the CU-UP itself, RRC message encryption algorithm information, and RRC message integrity algorithm information ; Of course, you can also carry the MAC value. In addition, the security algorithm information can be attached with the corresponding CU-UP identification; in addition, it should be noted that for each CU-UP, an SMC message needs to be sent once, and each SMC message corresponds to a CU-UP, that is, the terminal and The negotiation process of the security algorithm between CU-UPs is one-to-one. If there are N CU-UPs, N SMC messages need to be sent.

In this way, through the above-mentioned multiple interaction processes, the negotiation process of the security algorithm corresponding to the CU-CP, CU-UP and the CU-UP between the terminals is realized, so that each CU-UP can correspond to its own security algorithm. It avoids the hidden security problem when all CU-UPs correspond to the same security algorithm, and improves the security of the CU-UP service.

In addition, as shown in FIG. 7, it is one of the module block diagrams of the security algorithm configuration device in the embodiment of this application, and the device includes:

The sending module 701 is configured to send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.

Optionally, the sending module 701 includes:

The first sending unit is configured to send N access layer AS security mode command SMC messages to the terminal; wherein, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information and RRC message integrity Algorithm information and the security algorithm information corresponding to each CU-UP in all CU-UPs; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information and security algorithm information corresponding to a single CU-UP;

or,

The second sending unit is configured to send an RRC connection reconfiguration message to the terminal, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB and CU-UP are pre-configured with Correspondence.

Optionally, it also includes:

The configuration module is configured to configure the security algorithm corresponding to the CU-UP configuration; or,

The receiving module is configured to receive a notification message sent by the CU-UP, where the notification message carries the security algorithm information corresponding to the CU-UP.

It should be noted here that the device in this embodiment can implement all the method steps of the CU-CP side method embodiment, and can achieve the same technical effect. The implementation of the method in this embodiment and the CU-CP side method will not be repeated here. The same parts and technical effects in the example will be repeated.

In addition, as shown in FIG. 8, the second module block diagram of the security algorithm configuration device in this embodiment of the application, the device includes:

The receiving module 801 is configured to receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.

Optionally, the receiving module 801 includes:

The first receiving unit is configured to receive N access layer AS security mode command SMC messages sent by the CU-CP; wherein, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information and RRC Message integrity algorithm information and security algorithm information corresponding to each CU-UP in all CU-UPs; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption Algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to a single CU-UP;

or,

The second receiving unit is configured to receive an RRC connection reconfiguration message sent by the CU-CP, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB and CU-UP The pre-configuration has a corresponding relationship.

It should be noted here that the device in this embodiment can implement all the method steps of the terminal-side method embodiment, and can achieve the same technical effect. The same technical effect as in the terminal-side method embodiment in this embodiment will not be described here. Part and technical effects will be repeated.

In addition, as shown in FIG. 9, the third module block diagram of the security algorithm configuration device in the embodiment of this application, the device includes:

The receiving module 901 is configured to receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.

Optionally, it also includes:

The sending module is configured to send a notification message to the CU-CP, and the notification message carries security algorithm information corresponding to the CU-UP.

It should be noted here that the device in this embodiment can implement all the method steps of the terminal-side method embodiment, and can achieve the same technical effect. The difference between the method in this embodiment and the CU-UP-side method embodiment The same parts and technical effects will be repeated.

In addition, as shown in FIG. 10, it is a schematic diagram of the physical structure of the CU-CP provided by this embodiment of the application. The CU-CP may include: a processor (processor) 1010, a communication interface (Communications Interface) 1020, and a memory (memory) 1030 And the communication bus 1040, in which the processor 1010, the communication interface 1020, and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 can call a computer program stored on the memory 1030 and run on the processor 1010 to perform the following steps:

Optionally, the sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal includes: sending N access layer AS security mode command SMC messages to the terminal; wherein, when N is 1, The SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to each CU-UP in all CU-UPs; when the value of N and the number of CU-UPs When the same, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to a single CU-UP; or, sends an RRC connection reconfiguration message to the terminal, so The RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.

Optionally, the SMC message also carries a message authentication code MAC value.

Optionally, after the N access layer AS security mode command SMC messages are sent to the terminal, the processor further implements the following step when executing the program: receiving that the terminal is calibrating the MAC value When the verification is successful, a security mode completion message is sent; a negotiation acceptance message is sent to the CU-UP corresponding to the SMC message, and the negotiation acceptance message carries the security algorithm information corresponding to the CU-UP.

Optionally, before sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal, the processor further implements the following step when executing the program: configuring the corresponding security algorithm for the CU-UP; or To receive the notification message sent by the CU-UP, where the notification message carries the security algorithm information corresponding to the CU-UP.

Optionally, the configuration of the corresponding security algorithm for the CU-UP includes: configuring the corresponding security algorithm for the CU-UP according to the quality of service QoS data flow allocated for the CU-UP; or, when received When the core network sends the first bearer context setting request message for the CU-UP, according to the QoS corresponding to the data flow in the first bearer context setting request message, configure the corresponding security algorithm for the CU-UP .

Optionally, after the corresponding security algorithm is configured on the CU-UP according to the QoS corresponding to the data flow in the first bearer context setting request message, the processor further implements the following when executing the program The step: sending a second bearer context setting request message to the CU-UP, where the second bearer context setting request message carries the security algorithm information corresponding to the CU-UP; receiving the CU-UP according to the In the context setting response message fed back by the second bearer context setting request message, the context setting response message carries the security algorithm information corresponding to the CU-UP.

Optionally, after receiving the context setting response message fed back by the CU-UP according to the second bearer context setting request message, the processor further implements the following step when executing the program: UP sends a bearer context modification request message, the bearer context modification request message carries or does not carry the security algorithm information of the CU-UP; receives a bearer context modification response message fed back by the CU-UP, the bearer context modification response The message carries or does not carry the security algorithm information of the CU-UP.

In addition, the aforementioned logic instructions in the memory 1030 can be implemented in the form of computer executable instructions and when sold or used as an independent product, they can be stored in a computer readable storage medium. Thus, an embodiment of the present application provides a software product, the computer software product is stored in a storage medium, and includes a number of instructions to make a computer device (for example, a personal computer, a server, or a network device, etc.) execute All or part of the steps of the method described in each embodiment of this application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code .

In addition, as shown in FIG. 11, a schematic diagram of the physical structure of the terminal provided in this embodiment of the application. The terminal may include: a processor 1110, a communication interface 1120, a memory 1130, and a communication bus 1140 Among them, the processor 1110, the communication interface 1120, and the memory 1130 communicate with each other through the communication bus 1140. The processor 1110 can call a computer program stored on the memory 1130 and run on the processor 1110 to perform the following steps:

Optionally, the receiving the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP includes: receiving N access layer AS security mode commands SMC sent by the CU-CP Message; among them, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to each CU-UP in all CU-UPs; when N When the value of is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information, and security algorithm information corresponding to a single CU-UP; or In the RRC connection reconfiguration message sent by the CU-CP, the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP preconfiguration.

Optionally, after receiving the N access layer AS security mode command SMC messages sent by the CU-CP, the processor further implements the following step when executing the program: when checking the MAC value When successful, a safety mode complete message is sent to the CU-CP.

In addition, as shown in FIG. 12, a schematic diagram of the physical structure of the CU-UP provided by this embodiment of the application. The CU-UP may include: a processor (processor) 1210, a communications interface (Communications Interface) 1220, and a memory (memory) 1230 And the communication bus 1240, in which the processor 1210, the communication interface 1220, and the memory 1230 communicate with each other through the communication bus 1240. The processor 1210 can call a computer program stored on the memory 1230 and run on the processor 1210 to execute the following steps:

Optionally, before the receiving the negotiation acceptance message sent by the control plane central node CU-CP, the processor further implements the following step when executing the program: sending a notification message to the CU-CP, the notification message It carries the security algorithm information corresponding to the CU-UP.

Optionally, the processor further implements the following steps when executing the program:

Receiving a bearer context setting request message sent by the CU-CP, the bearer context setting request message carrying the security algorithm information corresponding to the CU-UP; according to the bearer context setting request message, to the CU- The CP sends a context setting response message, and the context setting response message carries security algorithm information corresponding to the CU-UP.

Optionally, after the context setting response message is sent to the CU-CP, the processor further implements the following step when executing the program: receiving a bearer context modification request message sent by the CU-CP, so The bearer context modification request message carries or does not carry the security algorithm information of the CU-UP; a bearer context modification response message is sent to the CU-CP, and the bearer context modification response message carries or does not carry the CU- UP security algorithm information.

The embodiments of the present application also provide a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program is implemented when executed by a processor to perform the methods provided in the foregoing embodiments.

The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One location, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solutions of the embodiments. Based on the content disclosed in this application, those of ordinary skill in the art can understand and implement the technical solutions disclosed in this application without creative work.

Through the description of the above implementation manners, those skilled in the art can clearly understand that each implementation manner can be implemented by software in combination with a required general hardware platform, and of course, it can also be implemented by hardware. Therefore, an embodiment of the present application provides a computer software product, which can be stored in a computer-readable storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer A device (for example, a personal computer, a server, or a network device, etc.) executes the method described in each embodiment or some parts of the embodiment.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application, not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: The technical solutions recorded in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

A security algorithm configuration method, characterized in that it includes:

Send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.
The security algorithm configuration method according to claim 1, wherein the sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal comprises:

Send N access layer AS security mode command SMC messages to the terminal; where, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and all CU-UPs The security algorithm information corresponding to each CU-UP in each CU-UP; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information, and Security algorithm information corresponding to a single CU-UP;

or,

Send an RRC connection reconfiguration message to the terminal, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.
The security algorithm configuration method according to claim 2, wherein the SMC message also carries a message authentication code MAC value.
The security algorithm configuration method according to claim 3, characterized in that, after sending N access layer AS security mode command SMC messages to the terminal, the method further comprises:

Receiving a security mode completion message sent by the terminal when the MAC value verification is successful;

A negotiation acceptance message is sent to the CU-UP corresponding to the SMC message, and the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.
The security algorithm configuration method according to claim 1, characterized in that, before said sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal, the method further comprises:

Configure the corresponding security algorithm for CU-UP; or,

Receive a notification message sent by the CU-UP, where the notification message carries the security algorithm information corresponding to the CU-UP.
The security algorithm configuration method according to claim 5, wherein the configuration of the security algorithm corresponding to the CU-UP comprises:

Configure a corresponding security algorithm for the CU-UP according to the quality of service QoS data flow allocated for the CU-UP; or,

When receiving the first bearer context setting request message for the CU-UP sent by the core network, the CU-UP configuration corresponding to the QoS corresponding to the data flow in the first bearer context setting request message Security algorithm.
The security algorithm configuration method according to claim 6, wherein after the QoS corresponding to the data flow in the request message is set according to the first bearer context, the corresponding security algorithm is configured on the CU-UP, Also includes:

Sending a second bearer context setting request message to the CU-UP, where the second bearer context setting request message carries security algorithm information corresponding to the CU-UP;

Receiving a context setting response message fed back by the CU-UP according to the second bearer context setting request message, where the context setting response message carries security algorithm information corresponding to the CU-UP.
The security algorithm configuration method according to claim 7, wherein after receiving the context setting response message fed back by the CU-UP according to the second bearer context setting request message, the method further comprises:

Sending a bearer context modification request message to the CU-UP, where the bearer context modification request message carries or does not carry the security algorithm information of the CU-UP;

Receiving a bearer context modification response message fed back by the CU-UP, where the bearer context modification response message carries or does not carry the security algorithm information of the CU-UP.
A security algorithm configuration method, characterized in that it includes:

Receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.
The security algorithm configuration method according to claim 9, wherein the receiving security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP comprises:

Receive N access layer AS security mode command SMC messages sent by the CU-CP; where, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and all The security algorithm information corresponding to each CU-UP in the CU-UP; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information and RRC message integrity Algorithm information and security algorithm information corresponding to a single CU-UP;

or,

Receive an RRC connection reconfiguration message sent by the CU-CP, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.
The security algorithm configuration method according to claim 10, wherein the SMC message also carries a message authentication code MAC value.
The security algorithm configuration method according to claim 11, wherein after receiving the N access layer AS security mode command SMC messages sent by the CU-CP, the method further comprises:

When the verification of the MAC value is successful, a security mode complete message is sent to the CU-CP.
A security algorithm configuration method, characterized in that it includes:

Receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.
The security algorithm configuration method according to claim 13, wherein before the receiving the negotiation acceptance message sent by the control plane central node CU-CP, the method further comprises:

Send a notification message to the CU-CP, where the notification message carries the security algorithm information corresponding to the CU-UP.
The method for configuring a security algorithm according to claim 13, further comprising:

Receiving a bearer context setting request message sent by the CU-CP, where the bearer context setting request message carries security algorithm information corresponding to the CU-UP;

According to the bearer context setting request message, a context setting response message is sent to the CU-CP, and the context setting response message carries the security algorithm information corresponding to the CU-UP.
The method for configuring a security algorithm according to claim 15, wherein after the sending a context setting response message to the CU-CP, the method further comprises:

Receiving a bearer context modification request message sent by the CU-CP, where the bearer context modification request message carries or does not carry the security algorithm information of the CU-UP;

Sending a bearer context modification response message to the CU-CP, where the bearer context modification response message carries or does not carry the security algorithm information of the CU-UP.
A security algorithm configuration device, characterized in that it comprises:

The sending module is configured to send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.
A security algorithm configuration device, characterized in that it comprises:

The receiving module is configured to receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.
A security algorithm configuration device, characterized in that it comprises:

The receiving module is configured to receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.
A control plane central node CU-CP includes a memory, a processor, and a program that is stored on the memory and can run on the processor, and is characterized in that the processor implements the following steps when executing the program:

Send the security algorithm information corresponding to the user plane central node CU-UP to the terminal.
The CU-CP according to claim 20, wherein the sending the security algorithm information corresponding to the user plane central node CU-UP to the terminal comprises:

Send N access layer AS security mode command SMC messages to the terminal; where, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and all CU-UPs The security algorithm information corresponding to each CU-UP in each CU-UP; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information, RRC message integrity algorithm information, and Security algorithm information corresponding to a single CU-UP;

or,

Send an RRC connection reconfiguration message to the terminal, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.
The CU-CP according to claim 21, wherein the SMC message also carries a message authentication code (MAC) value.
The CU-CP according to claim 22, wherein after the N access layer AS security mode command SMC messages are sent to the terminal, the processor further implements the following steps when executing the program:

Receiving a security mode completion message sent by the terminal when the MAC value verification is successful;

A negotiation acceptance message is sent to the CU-UP corresponding to the SMC message, and the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.
The CU-CP according to claim 20, characterized in that, before the security algorithm information corresponding to the user plane central node CU-UP is sent to the terminal, the processor further implements the following steps when executing the program:

Configure the corresponding security algorithm for CU-UP; or,

Receive a notification message sent by the CU-UP, where the notification message carries the security algorithm information corresponding to the CU-UP.
The CU-CP according to claim 24, wherein the configuration of the corresponding security algorithm for the CU-UP comprises:

Configure a corresponding security algorithm for the CU-UP according to the quality of service QoS data flow allocated for the CU-UP; or,

When receiving the first bearer context setting request message for the CU-UP sent by the core network, the CU-UP configuration corresponding to the QoS corresponding to the data flow in the first bearer context setting request message Security algorithm.
The CU-CP according to claim 25, wherein the QoS corresponding to the data flow in the request message is set according to the first bearer context, and after the corresponding security algorithm is configured for the CU-UP, The processor also implements the following steps when executing the program:

Sending a second bearer context setting request message to the CU-UP, where the second bearer context setting request message carries security algorithm information corresponding to the CU-UP;

Receiving a context setting response message fed back by the CU-UP according to the second bearer context setting request message, where the context setting response message carries security algorithm information corresponding to the CU-UP.
The CU-CP according to claim 26, wherein after receiving the context setting response message fed back by the CU-UP according to the second bearer context setting request message, when the processor executes the program Also implement the following steps:

Sending a bearer context modification request message to the CU-UP, where the bearer context modification request message carries or does not carry the security algorithm information of the CU-UP;

Receiving a bearer context modification response message fed back by the CU-UP, where the bearer context modification response message carries or does not carry the security algorithm information of the CU-UP.
A terminal includes a memory, a processor, and a program stored on the memory and capable of running on the processor, wherein the processor implements the following steps when executing the program:

Receive the security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP.
The terminal according to claim 28, wherein the receiving security algorithm information corresponding to the user plane central node CU-UP sent by the control plane central node CU-CP comprises:

Receive N access layer AS security mode command SMC messages sent by the CU-CP; where, when N is 1, the SMC message carries radio resource control RRC message encryption algorithm information, RRC message integrity algorithm information, and all The security algorithm information corresponding to each CU-UP in the CU-UP; when the value of N is the same as the number of CU-UPs, each of the SMC messages carries RRC message encryption algorithm information and RRC message integrity Algorithm information and security algorithm information corresponding to a single CU-UP;

or,

Receive an RRC connection reconfiguration message sent by the CU-CP, where the RRC connection reconfiguration message carries security algorithm information corresponding to each data radio bearer DRB, and the DRB has a corresponding relationship with the CU-UP pre-configuration.
The terminal according to claim 29, wherein the SMC message also carries a message authentication code (MAC) value.
The terminal according to claim 30, wherein after receiving the N access layer AS security mode command SMC messages sent by the CU-CP, the processor further implements the following steps when executing the program :

When the verification of the MAC value is successful, a security mode complete message is sent to the CU-CP.
A user plane central node CU-UP includes a memory, a processor, and a program stored on the memory and capable of running on the processor, and is characterized in that the processor implements the following steps when executing the program:

Receive a negotiation acceptance message sent by the control plane central node CU-CP, where the negotiation acceptance message carries security algorithm information corresponding to the CU-UP.
The CU-UP according to claim 32, wherein before the receiving the negotiation acceptance message sent by the control plane central node CU-CP, the processor further implements the following steps when executing the program:

Send a notification message to the CU-CP, where the notification message carries the security algorithm information corresponding to the CU-UP.
The CU-UP according to claim 32, wherein the processor further implements the following steps when executing the program:

Receiving a bearer context setting request message sent by the CU-CP, where the bearer context setting request message carries security algorithm information corresponding to the CU-UP;

According to the bearer context setting request message, a context setting response message is sent to the CU-CP, and the context setting response message carries the security algorithm information corresponding to the CU-UP.
The CU-UP according to claim 34, wherein after the context setting response message is sent to the CU-CP, the processor further implements the following steps when executing the program:

Receiving a bearer context modification request message sent by the CU-CP, where the bearer context modification request message carries or does not carry the security algorithm information of the CU-UP;

Sending a bearer context modification response message to the CU-CP, where the bearer context modification response message carries or does not carry the security algorithm information of the CU-UP.
A non-transitory computer-readable storage medium with a computer program stored thereon, wherein the computer program implements the steps of the security algorithm configuration method according to any one of claims 1 to 16 when the computer program is executed by a processor.