WO2021051250A1 - 数据传输方法及装置 - Google Patents

数据传输方法及装置 Download PDF

Info

Publication number
WO2021051250A1
WO2021051250A1 PCT/CN2019/106036 CN2019106036W WO2021051250A1 WO 2021051250 A1 WO2021051250 A1 WO 2021051250A1 CN 2019106036 W CN2019106036 W CN 2019106036W WO 2021051250 A1 WO2021051250 A1 WO 2021051250A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
nas
message
capability information
wireless capability
Prior art date
Application number
PCT/CN2019/106036
Other languages
English (en)
French (fr)
Inventor
郭龙华
胡力
李�赫
吴�荣
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19945845.6A priority Critical patent/EP4024958A4/en
Priority to PCT/CN2019/106036 priority patent/WO2021051250A1/zh
Priority to CN201980096565.5A priority patent/CN113841443B/zh
Publication of WO2021051250A1 publication Critical patent/WO2021051250A1/zh
Priority to US17/695,140 priority patent/US20220210859A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/25—Maintenance of established connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W8/00—Network data management
    • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
    • H04W8/24—Transfer of terminal data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events

Definitions

  • This application relates to the field of communication technology, and in particular to a data transmission method and device.
  • the mobile communication network defined by the 3rd generation partnership project (3GPP) introduces a security protection mechanism to ensure the security of mobile communication (for example, the confidentiality and integrity of communication).
  • the terminal can use the AS security context to perform AS security protection on some private data (such as wireless capability information), and the private data protected by the AS Send to the base station so that the network side knows the private data of the terminal.
  • This application provides a data transmission method and device, which are used to ensure the security of the terminal's private data during the transmission process.
  • a communication system including an access network device and a mobility management network element; wherein, the access network device is used to transfer non-access data from the terminal before the AS context is established between the terminal and the access network device.
  • the private data protected by non-access stratum (NAS) security is sent to the mobile management network element; the private data from the mobile management network element is received.
  • the mobile management network element is used to receive the private data from the terminal that is secured by the NAS; after unsecurely protecting the private data secured by the NAS, the private data is sent to the access network device.
  • NAS non-access stratum
  • the terminal before the terminal establishes the AS security context with the access network device, the terminal sends private data protected by NAS security, so that the network side can learn the private data of the terminal.
  • the private data of the terminal is protected by NAS, so that the security of the private data of the terminal can be ensured during the transmission process.
  • the private data protected by NAS security is carried in the first NAS message sent by the terminal; wherein, the first NAS message is protected by NAS security.
  • the first NAS message is an initial NAS message or a NAS SMP message.
  • the non-plain text information in the initial NAS message includes private data.
  • the mobility management network element is also used to send a second NAS message protected by NAS security to the terminal, and the second NAS message is used to indicate that the mobility management network element has received the first NAS message.
  • the access network device is also used to send a second request message to the mobility management network element when the terminal is determined to be the first type of terminal; the second request message is used to request the mobility management network element Privacy data; mobile management network element, also used to receive the second request message.
  • the access network device is also used to determine that the terminal is the first type of terminal.
  • the access network device is also used to determine that the terminal is the first type terminal, specifically: the access network device determines that the terminal is the first type terminal according to the cell that the terminal accesses; or, the access network The device determines that the terminal is the first type terminal according to the message sent by the terminal; or the access network device determines that the terminal is the first type terminal according to the network capability indication of the terminal.
  • the first type of terminal is a CP-optimized NB-IoT terminal or a CP-optimized CIoT terminal.
  • the access network device is also used to not send a first request message to the terminal when it is determined that the terminal is a terminal of the first type, and the first request message is used to request private data from the terminal.
  • the mobile management network element is also used to send a third NAS message protected by NAS to the terminal without storing valid privacy data.
  • the third NAS message is used to request the terminal to pass through the NAS. Safe protection of private data.
  • the access network device is also used to receive the first RRC message from the terminal.
  • the first RRC message includes a NAS container.
  • the NAS container includes encrypted private data and uplink NAS MAC; to the mobile management network element Sending NAS containers; mobile management network elements, specifically used to receive NAS containers.
  • a data transmission method which includes: before establishing an AS security context, a terminal performs NAS security protection on private data according to a pre-stored NAS security context; and the terminal sends private data protected by NAS security.
  • the terminal before the terminal establishes the AS security context with the access network device, the terminal sends private data protected by NAS security, so that the network side can learn the private data of the terminal.
  • the private data of the terminal is protected by NAS, so that the security of the private data of the terminal can be ensured during the transmission process.
  • the terminal before the terminal establishes the AS security context, it performs NAS security protection on private data according to the pre-stored NAS security context, including: the NAS layer of the terminal obtains the private data from the RRC layer of the terminal; the NAS of the terminal The layer performs NAS security protection on private data according to the pre-stored NAS security context.
  • the terminal sending the private data protected by the NAS security includes: the terminal sends a first RRC message to the access network device, and the first RRC message includes the private data protected by the NAS security.
  • the terminal sending the first RRC message to the access network device includes: the RRC layer of the terminal obtains the private data protected by NAS security from the NAS layer of the terminal; the RRC layer of the terminal sends the first RRC message to the access network device.
  • the first RRC message includes private data protected by NAS security.
  • the first RRC message includes private data protected by NAS security, which is specifically implemented as follows: the first RRC message includes a NAS container, and the NAS container includes encrypted private data and uplink NAS MAC; or, the NAS container includes Unencrypted private data and uplink NAS MAC.
  • the private data protected by NAS security is carried in the first NAS message sent by the terminal; wherein, the first NAS message is protected by NAS security.
  • the first NAS message is an initial NAS message or a NAS SMP message.
  • the non-plain text information element of the initial NAS message includes private data.
  • the method further includes: the terminal receives a second NAS message that is sent by the mobility management network element and protected by NAS security, where the second NAS message is used to indicate that the mobility management network element has received the first NAS message.
  • the method further includes: the terminal receives a third NAS message protected by the NAS from the mobile management network element, and the third NAS message is used to request the terminal for private data protected by the NAS security.
  • the terminal is a first type terminal, and the AS security context is not established between the first type terminal and the access network device.
  • the first type of terminal is a CP-optimized NB-IoT terminal or a CP-optimized CIoT terminal.
  • a data transmission method which includes: a mobile management network element receives private data protected by NAS security; the mobile management network element performs security protection on the private data protected by NAS security according to a pre-stored NAS security context , And store private data.
  • the terminal sends the private data protected by the NAS, so that the network side can learn the private data of the terminal.
  • the private data of the terminal is protected by NAS, so that the security of the private data of the terminal can be ensured during the transmission process.
  • the private data protected by NAS security is carried in the first NAS message sent by the terminal; wherein, the first NAS message is protected by NAS security.
  • the first NAS message is an initial NAS message or a NAS SMP message.
  • the non-plain text information element of the initial NAS message includes private data.
  • the method further includes: the mobility management network element sends a second NAS message protected by NAS security to the terminal, where the second NAS message is used to indicate that the mobility management network element has received the first NAS message.
  • the method further includes: the mobility management network element receives a second request message sent by the access network device, the second request message is used to request the mobility management network element to send private data to the access network device; mobility management The network element sends private data to the access network device.
  • the method further includes: if the mobile management network element does not store valid privacy data, the mobile management network element sends a third NAS to the terminal Message, the third NAS message is used to request private data protected by NAS security from the terminal.
  • the mobile management network element receives the private data protected by NAS security, including: the mobile management network element receives the NAS container sent by the access network device, and the NAS container includes the encrypted private data and the uplink NASMAC; or, The NAS container includes unencrypted private data and uplink NAS MAC.
  • the method further includes: after the mobile management network element unsecurely protects the NAS container, sending private data to the access network device.
  • the method further includes: the mobility management network element performs integrity verification on the uplink NAS MAC; and the uplink NAS MAC passes the integrity After verification, the mobility management network element sends a verification success message to the access network device, and the verification success message is used to indicate that the uplink NAS MAC passes the integrity verification.
  • a data transmission method which includes: when an access network device determines that the terminal is a terminal of the first type, sending a second request message to a mobility management network element, the second request message being used to send a second request message to the mobility management network element Request the privacy data of the terminal; the access network device receives the privacy data sent by the mobile management network element.
  • the access network device when the access network device determines that the terminal is the first type of terminal, it requests the mobile management network element for the privacy data of the terminal, so as to avoid the terminal from sending the privacy data without AS security protection, so as to avoid the privacy data from being compromised. Attackers steal or tamper to ensure the security of the communication network.
  • the method further includes: when the access network device determines that the terminal is a terminal of the first type, not sending a first request message to the terminal, and the first request message is used to request private data from the terminal.
  • the method further includes: when the terminal accesses the first type cell, the access network device determines that the terminal is the first type terminal; the first type cell is the cell accessed by the first type terminal Or, when the message sent by the terminal is a message of the first type, the access network equipment determines that the terminal is a terminal of the first type, and the message of the first type is a message sent by the terminal of the first type; or, the access network equipment is When the network capability of the terminal indicates that the terminal is a terminal of the first type, the terminal is determined to be the terminal of the first type; or, when the access network device receives the second indication information sent by the terminal, the terminal is determined to be the terminal of the first type , The second indication information is used to indicate that the terminal is a terminal of the first type.
  • the first type of terminal is a CP-optimized NB-IoT terminal or a CP-optimized CIoT terminal.
  • a data transmission method including: an access network device receives a first RRC message sent by a terminal, where the first RRC message includes private data protected by NAS; and the access network device sends a message to a mobility management network element. Private data protected by NAS security.
  • the terminal sends the private data protected by the NAS, so that the network side can learn the private data of the terminal.
  • the private data of the terminal is protected by NAS, so that the security of the private data of the terminal can be ensured during the transmission process.
  • the method further includes: the access network device sends a first request message to the terminal, and the first request message is used to request private data from the terminal.
  • the first RRC message includes private data protected by NAS security, which is specifically implemented as follows: the first RRC message includes a first NAS container, and the first NAS container includes encrypted private data and uplink NASMAC; or, The first RRC message includes a second NAS container, and the second NAS container includes unencrypted private data and uplink NAS MAC; or, the first RRC message includes encrypted private data and uplink NAS MAC; or, the first RRC message includes unencrypted private data and uplink NAS MAC; Encrypted private data and uplink NAS MAC.
  • the method further includes: the access network device receives the privacy data sent by the mobility management network element.
  • the method further includes: after the access network device receives the verification success message sent by the mobility management network element, Using private data, the verification success message is used to indicate that the uplink NAS MAC has passed the integrity verification.
  • a communication device including: a processing module and a communication module; the processing module is used to perform NAS security protection on private data according to the pre-stored NAS security context before the AS security context is established; the communication module uses To send private data protected by NAS security.
  • the processing module is used to perform NAS security protection on private data according to the pre-stored NAS security context before establishing the AS security context, including: the NAS layer obtains the private data from the RRC layer; the NAS layer is based on Pre-stored NAS security context, NAS security protection of private data.
  • the communication module is specifically configured to send a first RRC message to the access network device, where the first RRC message includes private data protected by NAS security.
  • the communication module is specifically used to send the first RRC message to the access network device, including: the RRC layer obtains the private data protected by the NAS from the NAS layer; the RRC layer sends the first RRC message to the access network device.
  • RRC message the first RRC message includes private data protected by NAS security.
  • the first RRC message includes private data protected by NAS security, which is specifically implemented as follows: the first RRC message includes a NAS container, and the NAS container includes encrypted private data and uplink NAS MAC; or, the NAS container includes Unencrypted private data and uplink NAS MAC.
  • the private data protected by NAS security is carried in the first NAS message sent by the terminal; wherein, the first NAS message is protected by NAS security.
  • the first NAS message is an initial NAS message or a NAS SMP message.
  • the non-plain text information element of the initial NAS message includes private data.
  • the communication module is further configured to receive a second NAS message sent by the mobility management network element and protected by NAS security, and the second NAS message is used to indicate that the mobility management network element has received the first NAS message.
  • the communication module is also used to receive a third NAS message protected by NAS security sent from a mobile management network element, and the third NAS message is used to request private data protected by NAS security from the terminal.
  • the communication device is a terminal of the first type, and the AS security context is not established between the terminal of the first type and the access network device.
  • the first type of terminal is a CP-optimized NB-IoT terminal or a CP-optimized CIoT terminal.
  • a communication device including: a communication module for receiving private data protected by NAS security; a processing module for decrypting private data protected by NAS security according to a pre-stored NAS security context Protect and store private data.
  • the private data protected by NAS security is carried in the first NAS message sent by the terminal; wherein, the first NAS message is protected by NAS security.
  • the first NAS message is an initial NAS message or a NAS SMP message.
  • the non-plain text information element of the initial NAS message includes private data.
  • the communication module is further configured to send a second NAS message protected by NAS security to the terminal, and the second NAS message is used to indicate that the mobility management network element has received the first NAS message.
  • the communication module is also used to receive a second request message sent by the access network device, and the second request message is used to request the mobility management network element to send private data to the access network device; Send private data.
  • the communication module is also used to send a third NAS message to the terminal if the mobile management network element does not store valid private data, and the third NAS message is used to request the terminal for private data protected by NAS security .
  • the communication module is specifically used to receive the NAS container sent by the access network device.
  • the NAS container includes encrypted private data and uplink NASMAC; or, the NAS container includes unencrypted private data and uplink NAS MAC.
  • the processing module is used to unsecure the NAS container; the communication module is also used to send private data to the access network device after the NAS container is unsecured.
  • the processing module is also used to check the integrity of the upstream NAS MAC when the NAS container includes unencrypted private data and the upstream NAS MAC; the communication module is also used to perform the integrity check on the upstream NAS MAC. After passing the integrity check, a check success message is sent to the access network device, and the check success message is used to indicate that the uplink NAS MAC passes the integrity check.
  • a communication device including: a processing module, configured to determine whether the terminal is a first-type terminal; and a communication module, configured to move to a mobile management network element when the processing module determines that the terminal is a first-type terminal Send a second request message, the second request message is used to request the privacy data of the terminal from the mobility management network element; and receive the privacy data sent by the mobility management network element.
  • the communication module is configured to not send a first request message to the terminal when the processing module determines that the terminal is a terminal of the first type, and the first request message is used to request private data from the terminal.
  • the processing module is used to determine that the terminal is the first type of terminal when the terminal accesses the first type of cell; the first type of cell is the cell accessed by the first type of terminal; or When the message sent by the terminal is the first type of message, it is determined that the terminal is the first type of terminal, and the first type of message is the message sent by the first type of terminal; or, the network capability of the terminal indicates that the terminal is the first type of terminal. In this case, it is determined that the terminal is a terminal of the first type; or, in the case of receiving the second indication information sent by the terminal, it is determined that the terminal is a terminal of the first type, and the second indication information is used to indicate that the terminal is a terminal of the first type.
  • the first type of terminal is a CP-optimized NB-IoT terminal or a CP-optimized CIoT terminal.
  • a communication device including: a receiving module configured to receive a first RRC message sent by a terminal, where the first RRC message includes privacy data protected by NAS security.
  • the sending module is used to send private data protected by NAS security to the mobile management network element.
  • the sending module is also used to send a first request message to the terminal, and the first request message is used to request private data from the terminal.
  • the first RRC message includes private data protected by NAS security, which is specifically implemented as follows: the first RRC message includes a first NAS container, and the first NAS container includes encrypted private data and uplink NASMAC; or, The first RRC message includes a second NAS container, and the second NAS container includes unencrypted private data and uplink NAS MAC; or, the first RRC message includes encrypted private data and uplink NAS MAC; or, the first RRC message includes unencrypted private data and uplink NAS MAC; Encrypted private data and uplink NAS MAC.
  • the receiving module is also used to receive private data sent by the mobile management network element.
  • the communication device further includes a processing module.
  • the processing module is also used to use the private data after receiving the verification success message sent by the mobility management network element when the first RRC message includes unencrypted private data and the uplink NAS MAC, and the verification success message is used for Instruct the uplink NAS MAC to pass the integrity check.
  • a communication device including a processor and a communication interface, and the processor is used to execute computer program instructions so that the communication device implements any possible design involved in any one of the second aspect to the fifth aspect Data transmission method.
  • a computer-readable storage medium stores instructions. When the instructions are executed on a computer, the computer realizes any one of the second to fifth aspects. The data transmission method involved in the design.
  • a computer program product includes instructions, when the computer program product runs on a computer, the computer can realize any of the possible designs involved in any one of the second to fifth aspects Data transfer method.
  • a chip includes a processor, and when the processor executes computer program instructions, the chip realizes the data transmission method involved in any one of the possible designs of the second aspect to the fifth aspect .
  • a communication system including: a mobility management network element and an access network device; a mobility management network element for receiving a tracking area update TAU request message, the TAU request message is used for requesting to update the tracking area; In the case of storing valid privacy data, the TAU response message and AS security protection parameters are sent to the access network device.
  • the TAU response message is used to respond to the TAU request message, and the AS security protection parameter is used to establish the connection between the terminal and the access network device.
  • AS security context access network equipment, used to receive TAU response messages and AS security protection parameters; establish AS security context with the terminal according to the AS security protection parameters; send the first request message to the terminal, the first request message is used to request the terminal Send private data to the access network device; receive a first response message sent by the terminal, where the first response message includes the private data protected by AS security.
  • the mobility management network element sends AS security protection parameters to the access network device, so that the AS security context can be established between the access network device and the terminal, thereby ensuring that the terminal’s private data passes through
  • the AS is transmitted after security protection, so as to prevent the privacy data of the terminal from being stolen or tampered with by an attacker, thereby ensuring the security of the communication network.
  • the access network device is used to unsecurely protect the private data protected by the AS according to the AS security context; after successfully unsecuring the private data protected by the AS, the private data is used .
  • the access network equipment is also used to send fourth indication information to the mobility management network element, and the fourth indication information is used to indicate that the access network equipment requires private data of the terminal.
  • the mobility management network element is also used to receive fourth indication information.
  • a data transmission method including: a mobile management network element receives a tracking area update TAU request message, the TAU request message is used to request to update the tracking area; the mobile management network element does not store the privacy data of the terminal , Send a TAU response message and AS security protection parameters to the access network device, the TAU response message is used to respond to the TAU request message, and the AS security protection parameter is used to establish the AS security context between the terminal and the access network device.
  • the mobility management network element sends AS security protection parameters to the access network device, so that the AS security context can be established between the access network device and the terminal, thereby ensuring that the terminal’s private data passes through
  • the AS is transmitted after security protection, so as to prevent the privacy data of the terminal from being stolen or tampered with by an attacker, thereby ensuring the security of the communication network.
  • the method further includes: the mobility management network element receives fourth indication information, where the fourth indication information is used to indicate that the access network device needs private data of the terminal.
  • a data transmission method including: the access network device sends a tracking area update TAU request message from the terminal to the mobility management network element, the TAU request message is used to request to update the tracking area; the access network device receives The TAU response message and AS security protection parameters sent by the mobility management network element, the TAU response message is used to respond to the TAU request message, and the AS security protection parameter is used to establish the AS security context between the terminal and the access network device; the access network device is based on AS security protection parameters, establish the AS security context with the terminal; the access network device sends a first request message to the terminal, the first request message is used to request the terminal to send private data to the access network device; the access network device receives the data sent by the terminal The first response message, the first response message includes the privacy data protected by the AS security.
  • the mobility management network element sends AS security protection parameters to the access network device, so that the AS security context can be established between the access network device and the terminal, thereby ensuring that the terminal’s private data passes through
  • the AS is transmitted after security protection, so as to prevent the privacy data of the terminal from being stolen or tampered with by an attacker, thereby ensuring the security of the communication network.
  • the method further includes: the access network device sends fourth indication information to the mobility management network element, where the fourth indication information is used to indicate that the access network device needs private data of the terminal.
  • a communication device including: a receiving module for receiving a tracking area update TAU request message, the TAU request message for requesting to update the tracking area; a sending module, for when valid privacy data is not stored Next, send a TAU response message and AS security protection parameters to the access network device, the TAU response message is used to respond to the TAU request message, and the AS security protection parameter is used to establish the AS security context between the terminal and the access network device.
  • the receiving module is further configured to receive fourth indication information, and the fourth indication information is used to indicate that the access network device needs private data of the terminal.
  • a communication device including: a sending module, configured to send a tracking area update TAU request message from a terminal to a mobility management network element, the TAU request message is used to request to update the tracking area; and a receiving module is configured to Receive the TAU response message and AS security protection parameters sent by the mobility management network element, the TAU response message is used to respond to the TAU request message, and the AS security protection parameter is used to establish the AS security context between the terminal and the access network device; the establishment module is used In accordance with the AS security protection parameters, the AS security context with the terminal is established; the sending module is also used to send a first request message to the terminal, the first request message is used to request the terminal to send private data to the access network device; the receiving module also It is used to receive a first response message sent by the terminal, where the first response message includes privacy data protected by AS security.
  • the sending module is also used to send fourth indication information to the mobility management network element, and the fourth indication information is used to indicate that the access network device needs private data of the terminal.
  • a communication device includes a processor and a communication interface, and the processor is used to execute computer program instructions to enable the communication device to implement the data transmission method involved in any design of the fifteenth aspect or the sixteenth aspect.
  • the twentieth aspect a computer-readable storage medium
  • the computer-readable storage medium stores instructions, and when the instructions run on a computer, the computer realizes the design involved in the fifteenth aspect or the sixteenth aspect Data transmission method.
  • a computer program product includes instructions that, when the computer program product runs on a computer, enable the computer to realize the data transmission involved in any one of the fifteenth or sixteenth aspects of the design method.
  • a chip in a twenty-second aspect, includes a processor, and when the processor executes computer program instructions, the chip realizes the data transmission method involved in any one of the fifteenth aspect or the sixteenth aspect.
  • Figure 1 is a schematic diagram of the encryption/decryption process
  • Figure 2 is a schematic diagram of the sender calculating MAC
  • Figure 3 is a schematic diagram of the receiver calculating MAC
  • FIG. 4 is a schematic diagram of a TAU process in the prior art
  • Fig. 5(a) is a schematic structural diagram of an LTE network provided by an embodiment of this application.
  • FIG. 5(b) is a schematic diagram of a 5G network architecture provided by an embodiment of this application.
  • FIG. 6 is a schematic diagram of a protocol stack provided by an embodiment of the application.
  • FIG. 7 is a schematic structural diagram of a communication device provided by an embodiment of this application.
  • FIG. 8 is a schematic diagram of a transmission process of wireless capability information in the prior art
  • FIG. 9 is a flowchart of a data transmission method provided by an embodiment of this application.
  • FIG. 10 is a flowchart of another data transmission method provided by an embodiment of the application.
  • FIG. 11 is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 12 is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 13(a) is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 13(b) is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 14 is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 16 is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 17 is a flowchart of another data transmission method provided by an embodiment of the application.
  • FIG. 18 is a flowchart of another data transmission method provided by an embodiment of this application.
  • FIG. 19 is a schematic structural diagram of a terminal provided by an embodiment of this application.
  • FIG. 20 is a schematic structural diagram of a mobility management network element provided by an embodiment of this application.
  • FIG. 21 is a schematic structural diagram of an access network device provided by an embodiment of this application.
  • A/B can mean A or B.
  • “And/or” in this article is only an association relationship describing the associated objects, which means that there can be three kinds of relationships.
  • a and/or B can mean: A alone exists, A and B exist at the same time, and B exists alone. These three situations.
  • “at least one” means one or more, and “plurality” means two or more.
  • the words “first” and “second” do not limit the quantity and order of execution, and the words “first” and “second” do not limit the difference.
  • indication may include direct indication and indirect indication, as well as explicit indication and implicit indication.
  • the information indicated by a certain piece of information (the first indication information described below) is called the information to be indicated, and there are many ways to indicate the information to be indicated in the specific implementation process.
  • the information to be indicated may be directly indicated, wherein the information to be indicated itself or the index of the information to be indicated, etc.
  • the information to be indicated may also be indicated indirectly by indicating other information, where there is an association relationship between the other information and the information to be indicated.
  • it is also possible to realize the indication of specific information by means of the pre-arranged order (for example, stipulated by the agreement) of the various information, thereby reducing the indication overhead to a certain extent.
  • Encryption/decryption protect the confidentiality of data during transmission (so it can also be called confidentiality protection). Confidentiality means that the true content cannot be seen directly. Encryption protection can generally be achieved by using keys and encryption algorithms to encrypt data. For the specific method of encryption protection, please refer to 3GPP TS 33.401 f50 section 8.2 or 33.501 f50 section 6.4.4 standard related descriptions, which will not be repeated here.
  • the encryption process at the sender can be: the sender can input parameters such as count, length, bearer, and direction into the NEA to determine the encryption.
  • Keystream keystream
  • the sender determines the ciphertext (ciphertext) based on the keystream and plaintext (plaintext).
  • the decryption process at the receiving end may be: the receiving end can input parameters such as count, length, bearer, and direction into the NEA to determine the key stream; Text, confirm the plain text.
  • Integrity protection/verification is used to determine whether the content of a message has been changed during the delivery process, and can also be used as identity verification to confirm the source of the message. Integrity check and protection requires the use of message authentication code (MAC).
  • MAC message authentication code
  • MAC can be used to check whether the content of the message has been changed during the delivery process; and the message authentication code can be used as identity verification to confirm the source of the message.
  • the sender inputs parameters such as key, count, length, bearer, message, and direction into the evolution packet system integrity algorithm ( Evolved packet system integrity algorithm, EIA), can obtain message authentication code (message authentication code integrity, MAC-I) or NAS-MAC.
  • Evolved packet system integrity algorithm Evolved packet system integrity algorithm, EIA
  • the receiver enters the integrity protection key, count, length, bearer, message, direction and other parameters into the EIA, and the expected message authentication code (excepted message authentication code integrity, XMAC-I) can be obtained. Or the expected non-access stratum message authentication code (excepted non-access stratum message authentication code, XNAS-MAC).
  • the receiving end can compare the received MAC-I with the XMAC-I generated by itself to verify whether the message is complete. If MAC-I and XMAC-I are the same, the receiving end determines that the received MAC-I is verified, so that the receiving end can determine that the message sent by the sending end is complete; if MAC-I and XMAC-I are not the same, then The receiving end can determine that the received MAC-I has not passed verification, so that the receiving end can determine that the message sent by the sending end is incomplete.
  • the security context refers to information that can be used to implement data security protection (for example, encryption/decryption, and/or integrity protection/verification).
  • data security protection for example, encryption/decryption, and/or integrity protection/verification.
  • the security context can include one or more of the following: root key, encryption key, integrity protection key, specific parameters (such as NAS Count), key set identifier (KSI), security algorithm, and security indication (For example, an indication of whether to enable encryption, an indication of whether to enable integrity protection, an indication of key usage period, key length), etc.
  • the encryption key is a parameter input when the sender encrypts the plaintext according to the encryption algorithm to generate the ciphertext. If symmetric encryption is used, the encryption key and decryption key are the same.
  • the receiving end can decrypt the ciphertext according to the same encryption algorithm and encryption key. In other words, the sender and receiver can encrypt and decrypt based on the same key.
  • the integrity protection key is a parameter input when the sender performs integrity protection on the plaintext or ciphertext according to the integrity protection algorithm.
  • the receiving end can perform integrity verification on the integrity-protected data according to the same integrity protection algorithm and integrity protection key.
  • the specific parameter (such as NAS Count) is a parameter input when the sender performs anti-replay protection on the plaintext or ciphertext according to the anti-replay protection algorithm.
  • the receiving end can perform anti-replay verification on the anti-replay protected data according to the same anti-replay protection algorithm.
  • the security algorithm is the algorithm used when the data is secured. For example, encryption algorithm, decryption algorithm, integrity protection algorithm, etc.
  • the security context can be divided into NAS security context and AS security context. It is understandable that the NAS security context is used to protect the information transmitted between the terminal and the core network. The AS security context is used to protect the information transmitted between the terminal and the base station.
  • the initial NAS message is the first NAS message sent by the terminal from the idle (IDLE) state to the connected (CONNECTED) state. It should be noted that when the terminal is in the IDLE state, the terminal does not establish a radio resource control (RRC) connection with the network side; when the terminal is in the CONNECTED state, the terminal establishes an RRC connection with the network side.
  • RRC radio resource control
  • the initial NAS message may be a registration request message, a service request message, or a de-registration request message, etc., which is not limited in the embodiment of the present application.
  • the initial NAS message when a partial encryption mechanism is introduced, the initial NAS message includes cleartext information and non-cleartext information.
  • plain text information is information that does not need to be encrypted
  • non-plain text information is information that needs to be encrypted. It should be noted that non-plain text information may also be referred to as encrypted information or cipher text information.
  • the plaintext information includes at least one of the following information elements: extended protocol discriminator, security header type, spare half octet, registration request message identifier ( registration request message identity), 5G system registration type (5G system registration type), next generation key set identifier (ngKSI), 5G system mobile identity (5G system mobile identity, 5GS mobile identity), UE security Capability (UE security capability), additional globally unique temporary UE identity (additional GUTI), UE status (UE status), and evolved packet system (EPS) NAS message container (NAS message container) container).
  • extended protocol discriminator registration request message identity
  • 5G system registration type 5G system registration type
  • next generation key set identifier ngKSI
  • 5G system mobile identity 5G system mobile identity, 5GS mobile identity
  • UE security Capability UE security capability
  • additional globally unique temporary UE identity additional globally unique temporary UE identity
  • UE status UE status
  • EPS evolved packet system
  • the non-plain text information includes at least one of the following information elements: 5G mobility management capability (5GMM capability), payload container (payload container), user plane data, and so on.
  • 5GMM capability 5G mobility management capability
  • payload container payload container
  • user plane data and so on.
  • the non-plaintext information may be other information elements in the initial NAS message except for the plaintext information.
  • the terminal stores the NAS security context
  • the information in the initial NAS message is encrypted and integrity protected.
  • the plaintext information in the initial NAS message is used to establish the NAS security context.
  • the terminal After establishing the NAS security context, the terminal sends a NAS security-protected NAS security mode complete (SMP) message.
  • SMP NAS security-protected NAS security mode complete
  • the NAS SMP message carries the plaintext information and non-plaintext information that should have been sent in the initial NAS message. .
  • the NAS count includes an overflow counter and a sequence number.
  • the NAS count consists of 24 bits (bits)
  • the flipped bits include 16 bits
  • the serial number includes 8 bits.
  • the NAS count can be filled with 32 bits, that is, 8 bits are filled before the original 24 bits of the NAS count, and the filled 8 bits can be all 0s.
  • NAS count is used to count the NAS messages transmitted between the network side and the terminal.
  • NAS count can be divided into uplink NAS count and downlink NAS count.
  • the uplink NAS count is used to count the NAS messages sent by the terminal to the network side. For example, each time the terminal sends a NAS message to the core network device, the uplink NAS count is increased by 1.
  • Downlink NAS count is used to count the NAS messages sent from the network side to the terminal. For example, every time the core network device sends a NAS message to the terminal, the downlink NAS count is incremented by 1.
  • the privacy data of the terminal refers to data that needs to be transmitted through AS signaling in the prior art, and the data is generated by the terminal for reference and use by the base station and core network equipment.
  • the private data of the terminal needs to be protected by AS to ensure the security of the private data in the transmission process.
  • the private data of the terminal may be radio capability (radio capability) information, network slice selection assistance information (NSSAI), private access group identifier (closed access group identifier, CAG-ID), etc.
  • radio capability radio capability
  • NSSAI network slice selection assistance information
  • CAG-ID private access group identifier
  • the embodiments of the present application are not limited to this.
  • the wireless capability information may be used to indicate information about the wireless access technology supported by the terminal.
  • the wireless capability information may include one or more of the following parameters: power level, frequency band, network version supported by the terminal, and so on.
  • power level please refer to 3GPP TS36.306 or TS23.401, which will not be repeated here.
  • the radio capability information may have other names, such as UE radio access capability (UE radio access capability), and the embodiment of the present application is not limited to this.
  • NSSAI includes multiple single NSSAI (single NSSAI, S-NSSAI).
  • the S-NSSAI is composed of a service type (slice/service type, SST) and a slice differentiator (SD).
  • SST includes standardized and operator-defined types.
  • SD is optional information that supplements SST to distinguish multiple network slices of the same SST.
  • CAG-ID is used to indicate the private access group supported by the terminal.
  • TAU process When a terminal moves from one tracking area (TA) to another TA, the terminal needs to re-register its location on the new TA to notify the core network to change its stored terminal location information. This process is TAU process.
  • TA is the basic unit of location update and paging in the communication system.
  • the TAU process in the prior art includes the following steps:
  • the terminal sends a TAU request message to the access network device.
  • the access network device sends a TAU request message to the mobility management network element.
  • the mobility management network element updates the context of the terminal.
  • the mobility management network element sends a TAU response message to the access network device.
  • the access network device sends a TAU response message to the terminal.
  • AS security context is established between the terminal of the first type and the access network device.
  • the AS security context is established between the second type terminal and the access network device.
  • the first type terminal does not have the AS security protection capability; or, although the first type terminal has the AS security protection capability, the AS security protection capability is not activated. Therefore, the first-type terminal does not establish the AS security context, so the first-type terminal does not apply the AS security context for AS signaling security protection.
  • the first type of terminal may be a CP-optimized narrowband internet of things (NB-IoT) terminal or a cellular internet of things (cellular internet of things, CIoT) terminal, and the embodiment of the application is not limited to this.
  • NB-IoT narrowband internet of things
  • CIoT cellular internet of things
  • the second type terminal may be an ordinary mobile phone, etc., and the embodiment of the present application is not limited thereto.
  • the technical solutions provided by the embodiments of the present application can be applied to various communication systems, for example, a 4G communication system, a 5G communication system, a future evolution system, or multiple communication convergence systems, and so on.
  • the technical solution provided by this application can be applied to a variety of application scenarios, such as machine to machine (M2M), macro and micro communications, enhanced mobile broadband (eMBB), ultra-high reliability and ultra-low latency Scenarios such as communication (ultra-reliable&low latency communication, uRLLC) and massive machine type communication (mMTC).
  • M2M machine to machine
  • eMBB enhanced mobile broadband
  • uRLLC ultra-high reliability and ultra-low latency Scenarios
  • mMTC massive machine type communication
  • These scenarios may include, but are not limited to: a communication scenario between a communication device and a communication device, a communication scenario between a network device and a network device, a communication scenario between a network device and a communication device, and so on.
  • the following descriptions are all based on the application in a communication scenario between a network device and a terminal as an example.
  • LTE network includes: one or more terminals, evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (evolved UMTS terrestrial radio access network, E-Utran), and packet evolution core (evolved packet core) , EPC).
  • UMTS evolved universal mobile telecommunications system
  • E-Utran evolved universal mobile telecommunications system
  • EPC packet evolution core
  • E-Utran includes one or more evolved base stations (Evolved Node B, eNB or eNodeB).
  • the eNB is used for radio resource management, user data stream encryption, scheduling and sending of call information initiated from the MME, and routing of user plane data to the S-GW.
  • EPC includes MME and SGW.
  • the EPC may also include other functional network elements not shown in FIG. 5(a), and the embodiment of the present application is not limited thereto.
  • MME is used to send paging messages to related eNBs, encryption and integrity protection of NAS signaling, etc.
  • SGW is the end point of user plane data packets in the wireless access network, and supports the exchange of user plane data for terminal mobility.
  • the interface between the terminal and the eNB may be called the UU interface
  • the interface between the two eNBs may be called the X2 interface
  • the interface between the eNB and the EPC may be called the S1 interface.
  • the names of the UU interface, the X2 interface, and the S1 interface are only examples, and the embodiments of the present application are not limited thereto.
  • 5G networks may include: terminals, radio access networks (RAN) or access networks (AN) (hereinafter RAN and AN are collectively referred to as (R)AN), core network , CN), and data network (DN).
  • RAN radio access networks
  • AN access networks
  • R radio access networks
  • CN core network
  • DN data network
  • the terminal may be a device with a wireless transceiver function.
  • the terminal may have different names, such as user equipment (UE), access terminal, terminal unit, terminal station, mobile station, mobile station, remote station, remote terminal, mobile equipment, wireless communication equipment, terminal agent Or terminal devices, etc.
  • UE user equipment
  • the terminal can be deployed on land, including indoor or outdoor, handheld or vehicle-mounted; it can also be deployed on the water (such as ships, etc.); it can also be deployed in the air (such as airplanes, balloons, and satellites, etc.).
  • Terminals include handheld devices, vehicle-mounted devices, wearable devices, or computing devices with wireless communication capabilities.
  • the terminal may be a mobile phone, a tablet computer, or a computer with wireless transceiver function.
  • Terminal equipment can also be virtual reality (VR) terminal equipment, augmented reality (AR) terminal equipment, wireless terminals in industrial control, wireless terminals in unmanned driving, wireless terminals in telemedicine, and smart Wireless terminals in power grids, wireless terminals in smart cities, wireless terminals in smart homes, and so on.
  • the device used to implement the function of the terminal may be a terminal, or a device capable of supporting the terminal to implement the function, such as a chip system.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the device used to implement the functions of the terminal is a terminal as an example to describe the technical solutions provided by the embodiments of the present application.
  • the access network equipment may also be called a base station.
  • the base station may include various forms of base stations, such as: macro base stations, micro base stations (also referred to as small stations), relay stations, access points, and so on. Specifically, it can be: access point (AP) in wireless local area network (WLAN), Global System for Mobile Communications (GSM) or Code Division Multiple Access (Code Division)
  • the base station (Base Transceiver Station, BTS) in Multiple Access, CDMA can also be the base station (NodeB, NB) in Wideband Code Division Multiple Access (WCDMA), or the eNB in LTE, Or relay stations or access points, or vehicle-mounted devices, wearable devices, and the next generation node B (gNB) in the future 5G network or the public land mobile network (PLMN) network that will evolve in the future The base station in the etc.
  • AP access point
  • GSM Global System for Mobile Communications
  • BTS Code Division Multiple Access
  • BTS Code Division Multiple Access
  • CDMA Code Division Multiple Access
  • a base station usually includes a baseband unit (BBU), a remote radio unit (RRU), an antenna, and a feeder for connecting the RRU and the antenna.
  • BBU baseband unit
  • RRU remote radio unit
  • the antenna is responsible for the conversion between the guided wave on the cable and the space wave in the air.
  • the distributed base station greatly shortens the length of the feeder between the RRU and the antenna, which can reduce signal loss and reduce the cost of the feeder.
  • RRU plus antenna is relatively small and can be installed anywhere, making network planning more flexible.
  • all the BBUs can also be centralized and placed in the central office (CO).
  • decentralized BBUs are centralized and turned into a BBU baseband pool, they can be managed and scheduled uniformly, and resource allocation is more flexible. In this mode, all physical base stations have evolved into virtual base stations. All virtual base stations share the user's data transmission and reception, channel quality and other information in the BBU baseband pool, and cooperate with each other to realize joint scheduling.
  • the base station may include a centralized unit (CU) and a distributed unit (DU).
  • the base station may also include an active antenna unit (AAU).
  • the CU implements part of the base station's functions, and the DU implements some of the base station's functions.
  • the CU is responsible for processing non-real-time protocols and services, and implements radio resource control (radio resource control, RRC) and packet data convergence protocol (packet data convergence protocol, PDCP) layer functions.
  • RRC radio resource control
  • PDCP packet data convergence protocol
  • the DU is responsible for processing physical layer protocols and real-time services, and realizes the functions of radio link control (radio link control, RLC), media access control (MAC), and physical (physical, PHY) layers.
  • the access network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into network devices in the RAN, or the CU can be divided into network devices in the core network (core network, CN), which is not limited here.
  • the control plane (CP) and the user plane (UP) of the CU can also be separated and implemented by different entities. That is, CU can be divided into CU-CP and CU-UP.
  • the core network includes multiple core network network elements (or called network function network elements), such as: access and mobility management function (AMF) network elements, session management function (session management function, SMF) Network element, policy control function (PCF) network element, user plane function (UPF) network element, application layer function (application function) network element, authentication server function (AUSF) ) Network elements, and unified data management (UDM) network elements.
  • AMF access and mobility management function
  • SMF session management function
  • PCF policy control function
  • UPF user plane function
  • application function application function
  • AUSF authentication server function
  • UDM unified data management
  • the core network may also include some network elements not shown in Figure 5(b), such as: security anchor function (SEAF) network elements, authentication credential repository and processing function, ARPF), the embodiments of this application will not be repeated here.
  • SEAF security anchor function
  • ARPF authentication credential repository and processing function
  • the AMF network element is mainly responsible for the mobility management processing part, such as: access control, mobility management, attach and detach, and SMF selection functions.
  • the AMF network element When the AMF network element provides services for the session in the terminal, it will provide storage resources of the control plane for the session to store the session identifier, the SMF identifier associated with the session identifier, and so on.
  • the terminal communicates with the AMF through the Next Generation Network (Next Generation, N) 1 interface (N1 for short), the RAN device communicates with the AMF through the N2 interface (N2 for short), and the RAN device communicates with the UPF through the N3 interface (N3 for short).
  • N1 Next Generation Network
  • N2 Next Generation 1 interface
  • N2 Next Generation 2 interface
  • N3 N3 for short
  • UPF Communicate with the DN through the N6 interface (N6 for short).
  • Control plane network elements such as AMF, SMF, UDM, AUSF, or PCF can also interact with service-oriented interfaces.
  • the servicing interface provided by AMF can be Namf
  • the servicing interface provided by SMF can be Nsmf
  • the servicing interface provided by UDM can be Nudm
  • the servicing interface provided by PCF can be
  • the interface can be Npcf
  • the servicing interface provided by AUSF can be Nausf; it will not be described here.
  • the terminal’s protocol stack includes at least: non-access layer, RRC layer, packet data convergence protocol (PDCP) layer, radio link control (RLC) layer, media interface Access control (media access control, MAC) layer, physical layer (PHY layer).
  • PDCP packet data convergence protocol
  • RLC radio link control
  • MAC media interface Access control
  • PHY layer physical layer
  • the RRC layer, PDCP layer, RLC layer, MAC layer, and PHY layer all belong to the access layer.
  • the non-access layer is a functional layer between the terminal and the core network, and is used to support signaling and data transmission between the terminal and the network elements of the core network (for example, mobility management network elements).
  • the RRC layer is used to support functions such as radio resource management and RRC connection control.
  • the device 100 includes at least one processor 101, a communication line 102, a memory 103 and at least one communication interface 104.
  • the processor 101 can be a general-purpose central processing unit (central processing unit, CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more programs for controlling the execution of the program of this application. integrated circuit.
  • CPU central processing unit
  • ASIC application-specific integrated circuit
  • the communication line 102 may include a path to transmit information between the aforementioned components.
  • the communication interface 104 uses any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc. .
  • RAN radio access network
  • WLAN wireless local area networks
  • the memory 103 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions
  • the dynamic storage device can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disc storage (Including compact discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store program codes in the form of instructions or data structures and can be accessed by a computer Any other media, but not limited to this.
  • the memory can exist independently and is connected to the processor through the communication line 102.
  • the memory can also be integrated with the processor.
  • the memory 103 is used to store computer-executable instructions for executing the solution of the present application, and the processor 101 controls the execution.
  • the processor 101 is configured to execute computer-executable instructions stored in the memory 103, so as to implement the technical solutions provided in the embodiments of the present application.
  • the computer-executable instructions in the embodiments of the present application may also be referred to as application program codes, which are not specifically limited in the embodiments of the present application.
  • the processor 101 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 7.
  • the apparatus 100 may include multiple processors, such as the processor 101 and the processor 107 in FIG. 7. Each of these processors can be a single-CPU (single-CPU) processor or a multi-core (multi-CPU) processor.
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (for example, computer program instructions).
  • the apparatus 100 may further include an output device 105 and an input device 106.
  • the output device 105 communicates with the processor 101 and can display information in a variety of ways.
  • the output device 105 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector (projector) Wait.
  • the input device 106 communicates with the processor 101 and can receive user input in a variety of ways.
  • the input device 106 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the transmission process of wireless capability information can refer to FIG. 8.
  • the transmission process of wireless capability information includes the following steps:
  • the access network device sends a wireless capability request message to the terminal, where the wireless capability request message is used to request wireless capability information of the terminal.
  • the terminal performs AS security protection on the wireless capability information according to the AS security context.
  • the terminal sends the wireless capability information protected by AS security to the access network device.
  • the access network device After the access network device receives the wireless capability information protected by the AS security, the access network device performs unsecure protection on the wireless capability information protected by the AS security. Therefore, the access network device can use the wireless capability information.
  • the access network device sends wireless capability information to the mobility management network element.
  • the mobility management network element stores the wireless capability information of the terminal.
  • the privacy data of the terminal is protected by AS security to ensure the security in the transmission process.
  • the terminal does not have the AS security protection capability, or the access network device does not have the AS security protection parameters in the TAU process, so the AS security context cannot be established between the terminal and the access network device.
  • AS security the private data of the terminal is not protected by AS security, which causes the private data of the terminal to be easily tampered with by an attacker, which affects the security of the communication network.
  • an embodiment of the present application provides a data transmission method. As shown in Figure 9, the method includes the following steps:
  • the terminal performs NAS security protection on the private data of the terminal according to the pre-stored NAS security context.
  • the privacy data of the terminal may be wireless capability information
  • the wireless capability information may be wireless capability parameters and/or wireless capability identifiers.
  • NAS security protection is integrity protection.
  • NAS security protection is integrity protection and encryption protection.
  • the terminal's integrity protection of private data can be specifically implemented as follows: the terminal calculates the first NAS MAC according to the private data, NAS integrity protection parameters, and NAS integrity protection algorithm.
  • the first NAS MAC can be divided into a first uplink NAS MAC and a first downlink NAS MAC.
  • the first uplink NAS MAC is a part of the first NAS MAC
  • the first downlink NAS MAC is another part of the first NAS MAC.
  • the first NAS MAC may include 32 bits
  • the first uplink NAS MAC is the first 16 bits of the first NAS MAC
  • the first downlink NAS MAC is the last 16 bits of the first NAS MAC.
  • NAS integrity protection parameters include uplink NAS count and NAS integrity protection key (Knas-int).
  • the NAS integrity protection parameter also includes the target cell ID.
  • the terminal can set the key to the NAS integrity protection key, set the count to the uplink NAS count, set the message to the target cell ID and privacy data, and set the direction to the bit value corresponding to the uplink direction. , Set the bearer to a preset constant; after that, the terminal enters these parameters into the EIA to determine the first NAS MAC.
  • the uplink NAS count is the NAS count corresponding to the next NAS message sent by the terminal.
  • the target cell ID is used to indicate the target cell to which the terminal is connected.
  • the target cell ID may be a physical cell identifier (PCI) or a cell global identification (CGI) of the target cell, and the application is not limited to this.
  • PCI physical cell identifier
  • CGI cell global identification
  • the target cell ID is used in the calculation of the NAS MAC, and its purpose is to bind the NAS MAC with the target cell to prevent the message carrying the NAS MAC from being replayed to other cells.
  • direction is used to indicate the direction of data transmission.
  • the direction can be indicated by 1 or more bits. For example, suppose that the direction is represented by a bit, the direction is set to 0, which means the upstream direction; the direction is set to 1, which means the downstream direction.
  • bearer When bearer is set to 0, it is used to instruct the terminal to use the 3GPP access technology to access the network. When bearer is set to 1, it is used to instruct the terminal to use non-3GPP access technology to access the network. In this embodiment of the application, beraer can be set to 0.
  • the terminal encrypts and protects private data, which may be specifically implemented as: the terminal generates a key stream according to the NAS encryption parameter and the NAS encryption algorithm. After that, the terminal generates encrypted private data according to the key stream and the private data.
  • the NAS encryption parameter includes the NAS encryption key (Knas-enc).
  • the NAS encryption parameter also includes uplink NAS count.
  • the terminal can set the key to the NAS encryption key, the count to the upstream NAS count, the direction to the bit value corresponding to the upstream direction, the bearer to the preset constant, and the length to For the length of the key stream, generate the key stream; then, the terminal combines the plaintext (that is, the unencrypted private data) and the key stream to generate the ciphertext (that is, the encrypted private data).
  • the RRC layer of the terminal sends the private data to the NAS layer of the terminal; after that, the NAS layer of the terminal performs NAS security protection on the private data according to the pre-stored NAS security context.
  • the terminal sends the privacy data protected by the NAS security to the mobility management network element, so that the mobility management network element receives the privacy data protected by the NAS security from the terminal.
  • the mobility management network element in the 4G network, can be a mobility management entity (MME); in the 5G network, the mobility management network element can be AMF; in the future evolution system, the mobility management network element can be NAS security termination point similar to MME/AMF. This is a unified description, and will not be repeated below.
  • MME mobility management entity
  • AMF Access Management Function
  • the private data protected by the NAS security includes: unencrypted private data and the first uplink NAS MAC.
  • the private data protected by the NAS security includes: encrypted private data and the first upstream NAS MAC.
  • the mobile management network element stores the private data after unsecure protection of the private data protected by the NAS.
  • the unsecured protection operation includes integrity verification.
  • the unsecured protection operation includes decryption.
  • the mobile management network element performs integrity verification on the private data protected by NAS security, which can be specifically implemented as follows: the mobile management network element performs integrity verification according to the NAS integrity protection key, NAS integrity protection parameters, private data, and integrity
  • the protection algorithm generates the second NAS MAC.
  • the mobility management network element determines the second uplink NAS MAC according to the second NAS MAC.
  • the mobility management network element compares whether the MAC of the first uplink NAS and the MAC of the second uplink NAS are the same. If the first uplink NAS MAC and the second uplink NAS MAC are the same, the mobility management network element determines that the privacy data reported by the terminal is complete. Otherwise, the mobile management network element determines that the private data reported by the terminal is incomplete.
  • the second NAS MAC can be divided into a second uplink NAS MAC and a second downlink NAS MAC.
  • the second uplink NAS MAC is a part of the second NAS MAC
  • the second downlink NAS MAC is another part of the second NAS MAC.
  • the second NAS MAC may include 32 bits
  • the second uplink NAS MAC is the first 16 bits of the second NAS MAC
  • the second downlink NAS MAC is the last 16 bits of the second NAS MAC.
  • the mobile management network element decrypts the private data protected by the NAS security, which can be specifically implemented as follows: the mobile management network element generates a key stream according to the NAS encryption parameter and the NAS encryption algorithm. After that, the mobility management network element obtains the plaintext (that is, the decrypted private data) according to the key stream and the ciphertext.
  • the mobile management network element may also generate corresponding identification information for the private data, and the identification information is used to uniquely identify the private data. For example, taking private data as a wireless capability parameter as an example, the mobility management network element may generate a wireless capability identifier corresponding to the wireless capability parameter. In this way, the mobile management network element establishes and stores the correspondence between the privacy data and the identification information.
  • the mobility management network element After the mobility management network element generates corresponding identification information for the private data, the mobility management network element sends the identification information to the terminal. Therefore, when the terminal next reports the private data to the network side, the terminal may not send the private data, but send the identification information of the private data.
  • Other network elements for example, access network equipment
  • the mobile management network element cannot successfully unsecure the private data protected by the NAS, that is, the mobile management network element determines that the private data protected by the NAS fails the integrity check, or the mobile management If the network element cannot decrypt the private data protected by the NAS security, the mobile management network element discards the private data protected by the NAS security.
  • the mobile management network element can also notify the terminal to resend the private data protected by NAS security.
  • the terminal sends private data protected by NAS security to the mobile management network element without establishing an AS security context with the access network device to ensure the security of the private data during transmission Sex.
  • step S102 The technical solution shown in FIG. 9 will be described in detail below in conjunction with different implementation manners of step S102.
  • step S102 can be specifically implemented as step S201.
  • the terminal sends a first NAS message protected by NAS security to a mobility management network element, so that the mobility management network element receives the first NAS message protected by NAS security.
  • the first NAS message includes private data.
  • the private data included in the first NAS message is also protected by NAS security.
  • the first NAS message may reuse an existing NAS message, such as an initial NAS message or a NAS SMP message.
  • existing NAS messages can add protected cells for carrying private data.
  • the existing NAS message may also include indication information, which is used to indicate that the existing NAS message carries private data protected by the NAS security.
  • the private data may be protected by an initial NAS security mechanism, for example, the non-plain text information of the initial NAS message includes private data.
  • the first NAS message may also be a newly added NAS message for carrying private data.
  • the first NAS message can be transmitted as a complete NAS message, or can be divided into multiple NAS messages for transmission, which is not limited in the embodiment of the present application.
  • the NAS layer of the terminal after the NAS layer of the terminal performs NAS security protection on the private data, the NAS layer of the terminal sends the first NAS message to the mobility management network element.
  • the data transmission method may further include step S202.
  • the mobility management network element sends a second NAS message to the terminal, so that the terminal receives the second NAS message from the mobility management network element.
  • the second NAS message is used to indicate that the mobility management network element has successfully received the first NAS message.
  • step S102 can be specifically implemented as steps S301-S302.
  • the terminal sends a first RRC message to the access network device, so that the access network device receives the first RRC message from the terminal.
  • the first RRC message includes private data protected by NAS security.
  • the first RRC message includes private data protected by NAS security, including one of the following situations:
  • the first RRC message includes: the first uplink NAS MAC and encrypted private data
  • the first RRC message includes: the first uplink NAS MAC and unencrypted private data
  • the first RRC message includes: a first NAS container, and the first NAS container includes a first uplink NAS MAC and encrypted private data;
  • the first RRC message includes: unencrypted private data and a second NAS container, and the second NAS container includes the first uplink NAS MAC.
  • the first RRC message may also include a part of bits of the uplink NAS count, for example, the lowest 5 bits of the uplink NAS count.
  • the NAS layer of the terminal after the NAS layer of the terminal performs NAS security protection on the private data, the NAS layer of the terminal sends the private data protected by the NAS security to the RRC layer of the terminal. After that, the RRC layer of the terminal encapsulates the private data protected by the NAS security into a first RRC message, and sends the first RRC message to the access network device.
  • the access network device sends the privacy data protected by the NAS to the mobility management network element, so that the mobility management network element receives the privacy data protected by the NAS security.
  • the mobility management network element is AMF
  • the private data protected by NAS security is carried in the N2 message
  • the mobility management network element is MME
  • the private data protected by NAS security is carried in the S1 message in.
  • the access network device sends the first uplink NAS MAC and encrypted private data to the mobility management network element. If the first RRC message includes the first uplink NAS MAC and unencrypted private data, the access network device sends the first uplink NAS MAC and unencrypted private data to the mobility management network element. If the first RRC message includes the first NAS container, the access network device sends the first NAS container to the mobility management network element. If the first RRC message includes unencrypted private data and the second NAS container, the access network device sends the unencrypted private data and the second NAS container to the mobility management network element.
  • the access network device does not parse the first NAS container or the second NAS container, but directly uploads it to the mobility management network element , Reducing the processing time of the access network device for the content included in the first RRC message.
  • the access network device may also send target cell information to the mobility management network element.
  • the following describes the specific implementation process of transmitting private data between the first type terminal and the network side in combination with specific application scenarios.
  • a data transmission method provided by an embodiment of this application includes the following steps:
  • a NAS security context has been established between the terminal and the core network.
  • the terminal performs NAS security protection on the private data according to the NAS security context.
  • S403 The terminal sends a first NAS message protected by NAS security to the mobility management network element, so that the mobility management network element receives the first NAS message protected by NAS security.
  • the terminal determines that it is a terminal of the first type, after the NAS security context is established between the terminal and the core network, the terminal can actively perform the above steps S402 and S403, To ensure that the network side can obtain the private data that has been secured by the NAS, so that the network side can use the private data normally.
  • the mobile management network element performs security protection on the first NAS message that has been secured by the NAS, and acquires and stores the private data of the terminal.
  • the access network device may perform the following step S405.
  • Trigger condition 1 The access network device receives a specific message issued by the mobility management network element, and the specific message does not carry the privacy data of the terminal.
  • the access network device receives the S1 message issued by the MME, and the S1 message does not carry the wireless capability information.
  • the S1 message may be an initial context establishment request (INITIAL CONTEXT SETUP REQUEST), a connection establishment indication (CONNETION ESTABLISHMENT INDICATION), a UE radio capability matching request (UE RADIO CAPABILITY MATCH REQUEST), etc.
  • Trigger condition 2 The access network device is ready to configure the privacy data of the terminal.
  • the access network equipment is ready to perform the process of switching from E-UTRAN to UTRAN, dual link selection, and so on.
  • Trigger condition 3 The access network device receives a trigger message from the mobility management network element, and the trigger message is used to instruct the access network device to acquire the private data of the terminal.
  • the second type of terminal is performing an attach process, or the second type of terminal is performing the first TAU process after attaching GERAN/UTRAN, or the second type of terminal is performing a wireless connection for the terminal.
  • the MME deletes the wireless capability information of the terminal and sends an S1 message to the access network device to trigger the access network device to obtain the wireless capability information of the terminal.
  • the MME sends a DOWNLINK NAS TRANSPORT message to the access network equipment.
  • the DOWNLINK NAS TRANSPORT message carries indication information to trigger the access network equipment to obtain the terminal’s wireless capability information.
  • the MME when the MME is based on a single radio voice call continuity (single radio voice call continuity, SRVCC) capability, terminal use case type, or local strategy, more terminal wireless capability information is needed to configure and support the IP multimedia subsystem (IP multimedia subsystem,
  • IP multimedia subsystem IP multimedia subsystem
  • IMS voice packet switch (PS) session indication IMS voice over PS Session Supported Indication
  • PS IMS voice packet switch
  • IMS voice over PS Session Supported Indication the MME requests the wireless capability information of the terminal from the access network equipment.
  • S405 The access network device judges whether the terminal is a terminal of the first type.
  • step S405 can be expressed as: the access network device judges whether the terminal has the AS security protection capability.
  • the terminal is the first type of terminal, which is equivalent to that the terminal does not have the AS security protection capability.
  • the terminal is not the first type terminal, which is equivalent to the terminal having AS security protection capabilities.
  • the access network device determines whether the terminal is a terminal of the first type, and any one of the following implementation manners may be adopted:
  • Implementation manner 1 The access network equipment determines whether the terminal is a terminal of the first type according to the cell type that the terminal accesses. Specifically, when a terminal accesses a cell of the first type, the access network device may determine that the terminal is a terminal of the first type. In the case that the terminal does not access the first type cell, the access network device may determine that the terminal is not the first type terminal.
  • the first type of cell is a cell accessed by the first type of terminal, such as an NB-Iot cell.
  • Implementation manner 2 The access network device determines whether the terminal is a terminal of the first type according to the type of message sent by the terminal. Specifically, when the terminal sends a message of the first type, the access network device may determine that the terminal is a terminal of the first type; when the terminal does not send a message of the first type, the access network device may determine that the terminal is not the first type of message. Type terminal.
  • the first type of message is a message sent by the first type of terminal.
  • the first type of message may be RRCSetupRequest-NB, or Connection Establishment Indication.
  • Implementation manner 3 The access network device determines whether the terminal is a terminal of the first type according to the network capability information of the terminal. Specifically, when the network capability information of the terminal indicates that the terminal is a terminal of the first type, the access network device may determine that the terminal is a terminal of the first type. In a case where the network capability indication information of the terminal does not indicate that the terminal is a terminal of the first type, the access network device may determine that the terminal is not a terminal of the first type.
  • Implementation manner 4 The access network device determines whether the terminal is a terminal of the first type according to whether the second indication information is received. For example, when the access network device receives the second instruction information sent by the terminal, the access network device determines that the terminal is a first type terminal; when the access network device does not receive the second instruction information, the access network device does not receive the second instruction information. The network access device determines that the terminal is not a terminal of the first type.
  • implementation manner 1 to implementation manner 4 are only examples, and the embodiment of the present application does not specifically limit the implementation manner for the access network device to determine whether the terminal is a terminal of the first type.
  • the first terminal is a CP-optimized NB-IoT terminal/CIoT terminal as an example to specifically describe the implementation of step S405.
  • the access network device may first determine whether the terminal is an IoT terminal, and then further determine whether the terminal is a CP-optimized NB-IoT terminal/CIoT terminal. If the terminal is not an IoT terminal, the access network device can determine that the terminal is not a CP-optimized NB-IoT terminal/CIoT terminal.
  • the access network device can determine whether the terminal is an Internet of Things terminal according to the cell type that the terminal accesses. Specifically, when the terminal accesses the Internet of Things cell, the access network device may determine that the terminal is an Internet of Things terminal. When the terminal does not access the IoT cell, the access network device can determine that the terminal is not an IoT terminal.
  • the access network device determines whether the terminal is an Internet of Things terminal according to the type of the RRC message sent by the terminal. Specifically, when the RRC message sent by the terminal is the same in type as the RRC message of the Internet of Things terminal, the terminal is an Internet of Things terminal; otherwise, the terminal is not an Internet of Things terminal. For example, when the terminal sends the RRCSetupRequest-NB message, the access network device may determine that the terminal is an Internet of Things terminal.
  • the access network device may further determine whether the terminal is a CP optimized terminal after determining that the current terminal is an Internet of Things terminal.
  • the access network device may determine that the terminal is a CP optimized terminal.
  • the specific type of message may be Connection Establishment Indication.
  • the access network device can determine that the terminal is a CP-optimized terminal; when the network capability information of the terminal indicates that the terminal is not a CP-optimized terminal, access The network equipment determines that the terminal is not a CP optimized terminal.
  • the access network device can first determine whether the terminal is an IoT terminal, and then further determine whether the terminal supports CP optimization, so as to accurately determine whether the terminal is a CP-optimized NB-IoT terminal/CIoT terminal.
  • the access network device may first determine whether the terminal supports CP optimization, and then further determine whether the terminal is an IoT terminal, so as to accurately determine whether the terminal is a CP-optimized NB-IoT terminal/CIoT terminal.
  • the access network device obtains the private data of the terminal according to the existing process, which will not be repeated here.
  • the terminal when the terminal is a terminal of the first type, since the AS security context cannot be established between the access network device and the terminal of the first type, it is not appropriate for the access network device to directly report to the first type according to the existing process.
  • the terminal requests private data to avoid transmission of private data that does not have AS security protection between the first type terminal and the access network device, thereby giving an attacker the opportunity to tamper with the private data of the first type terminal. Based on this, the access network device does not send the first request message to the terminal, but executes the following step S406.
  • the first request message is used to request the terminal to send the privacy data of the terminal to the access network device.
  • the private data is wireless capability information
  • the first request message may be a wireless capability request message.
  • the access network device sends a second request message to the mobility management network element, so that the mobility management network element receives the second request message sent by the access network device.
  • the second request message is used to request the mobility management network element to send the private data of the terminal to the access network device.
  • the second request message is an N2 message.
  • the second request message is an S1 message.
  • the second request message is an N2 message/S1 message specifically used to obtain private data of the terminal.
  • the second request message reuses the existing N2 message/S1 message.
  • the second request message includes first indication information, and the first indication information is used to instruct the mobility management network element to send the private data of the terminal to the access network device.
  • the second request message may be to retrieve UE information (Retrive UE Information), UE capability information indication (UE Capability Info Indication), and the like.
  • UE information Retrive UE Information
  • UE capability information indication UE Capability Info Indication
  • the second request message includes terminal information or identification information corresponding to the privacy data.
  • the terminal information may be an international mobile station equipment identity (IMEI), which is not limited in the embodiment of the present application.
  • IMEI international mobile station equipment identity
  • the second request message may further include second indication information.
  • the second indication information is used to indicate that the terminal is a terminal of the first type.
  • the second indication information is used to indicate that the terminal does not have the AS security protection capability.
  • the mobility management network element sends the privacy data of the terminal to the access network device, so that the access network device receives the privacy data of the terminal.
  • step S404 the mobile management network element has acquired and stored the private data of the terminal. Therefore, the mobility management network element can find the private data of the terminal according to the second request message, so that the mobility management network element directly sends the private data of the terminal to the access network device.
  • the mobility management network element finds the private data of the terminal according to the second request message, which may be specifically implemented as follows: the mobility management network element finds the private data of the terminal according to the terminal information or identification information included in the second request message .
  • the mobility management network element sends a second response message to the access network device, so that the access network device receives the second response message from the mobility management network element.
  • the second response message is used to respond to the second request message.
  • the second response message includes the privacy data of the terminal.
  • the second response message is an N2 message.
  • the second response message is an S1 message.
  • the second response message may be a newly added N2 message/S1 message; or, the second response message may reuse an existing N2 message/S1 message.
  • the second response message may be an initial context establishment request (INITIAL CONTEXT SETUP REQUEST), connection establishment indication (CONNETION ESTABLISHMENT INDICATION), downlink NAS transmission (DOWNLINK NAS TRANSPROT), UE information transmission (UE INFORMATION TRANSFER), UE wireless Capability matching request (UE RADIO CAPABILITY MATCH REQUEST), etc.
  • the embodiment of the present application is not limited to this.
  • the access network device uses the private data of the terminal.
  • the first type terminal actively sends the NAS-protected private data to the mobile management network element, so that when the access network device needs to obtain the private data of the first type terminal, the mobile management network The meta can send private data to the access network device. Therefore, in the process that the access network device obtains the privacy data of the first type terminal, the privacy data of the first type terminal will not be transmitted without security protection, thereby preventing the privacy data of the first type terminal from being attacked. Tampering ensures the security of the private data of the first type of terminal during the transmission process.
  • a data transmission method provided in an embodiment of this application includes the following steps:
  • S501 Establish a NAS security context between the terminal and the core network.
  • S502 The mobility management network element judges whether to store valid privacy data.
  • the effective privacy data refers to the privacy data that has not been marked for deletion.
  • the mobile management network element stores the private data of the terminal, the private data will be marked as deleted.
  • the private data marked as deleted will be deleted by the mobile management network element.
  • the mobile management network element searches for the private data of the terminal in the database according to the terminal information or identification information.
  • the mobile management network element does not find the private data of the terminal, or the private data of the terminal found by the mobile management network element is marked for deletion, the mobile management network element can determine that no effective private data is stored.
  • the mobile management network element can find the privacy data of the terminal, and the privacy data is not marked for deletion, the mobile management network element can determine that valid privacy data has been stored.
  • the mobility management network element pre-stores effective privacy data
  • the mobility management network element sends the privacy data of the terminal to the access network device.
  • the specific implementation process can refer to the relevant description of step S407 above, which will not be repeated here.
  • the mobility management network element executes the following step S503; alternatively, the mobility management network element may skip step S503 and directly execute step S504.
  • S503 The mobility management network element judges whether the terminal is a terminal of the first type.
  • the mobility management network element determines whether the terminal is a terminal of the first type, and any one of the following implementation manners may be adopted:
  • the mobile management network element determines whether the terminal is a terminal of the first type according to the network capability information of the terminal. Specifically, when the network capability information of the terminal indicates that the terminal is a terminal of the first type, the mobility management network element may determine that the terminal is a terminal of the first type. In a case where the network capability indication information of the terminal does not indicate that the terminal is a terminal of the first type, the access network device may determine that the terminal is not a terminal of the first type.
  • CP optimization specifically refers to: CP optimization (control Plane CIoT EPS Optimisation) of the CIoT evolved packet system (evolved packet system, EPS).
  • CP optimization control Plane CIoT EPS Optimisation
  • CIoT evolved packet system evolved packet system, EPS.
  • This first cell may be referred to as a “preferred network behavior” cell.
  • the mobility management network element can determine that the terminal is a first type terminal; when the first information element is used to indicate that the terminal does not support CP optimization, the mobility management network element It can be determined that the terminal is not the first type of terminal.
  • Implementation manner 2 The mobility management network element determines whether the terminal is a terminal of the first type according to whether the second indication information is received. For example, in the case that the mobility management network element receives the second indication information sent by the access network device, the mobility management network element determines that the terminal is a terminal of the first type; in the case that the mobility management network element does not receive the second indication information Next, the mobility management network element determines that the terminal is not a terminal of the first type.
  • the mobility management network element can send a third request message to the access network device according to the procedure in the prior art, and the third request message is used to trigger the access network device from The terminal obtains private data.
  • the mobility management network element does not send a third request message to the access network device, but executes the following step S504.
  • the mobility management network element sends a third NAS message to the terminal, so that the terminal receives the third NAS message from the mobility management network element.
  • the third NAS message is used to request the terminal to send private data protected by NAS security to the mobility management network element.
  • the third NAS message is a NAS message specifically used to request to obtain private data of the terminal.
  • the third NAS message reuses the existing NAS message.
  • the third NAS message includes third indication information, and the third indication information is used to instruct the terminal to send private data protected by NAS security to the mobility management network element.
  • the NAS layer of the terminal After receiving the third NAS message, the NAS layer of the terminal will request the RRC layer of the terminal for the private data of the terminal, so that the NAS layer of the terminal can perform NAS security protection on the private data of the terminal.
  • the terminal performs NAS security protection on the private data according to the NAS security context.
  • S506 The terminal sends a first NAS message protected by NAS security to the mobility management network element, so that the mobility management network element receives the first NAS message protected by NAS security.
  • the mobility management network element performs security protection on the first NAS message that has been secured by the NAS according to the NAS security context, and obtains the private data of the terminal.
  • the mobile management network element stores the private data of the terminal.
  • the mobile management network element sends the privacy data of the terminal to the access network device, so that the access network device receives the privacy data of the terminal.
  • the access network device uses the private data of the terminal.
  • the mobility management network element sends a third NAS message to the first-type terminal to trigger the first-type terminal to report Private data. In this way, the network side can learn the private data of the first type of terminal.
  • the data transmission method further includes steps S510 and S511 before step S503.
  • S510 The access network device judges whether the terminal is a terminal of the first type.
  • the access network device sends a second request message to the mobility management network element, so that the mobility management network element receives the second request message sent by the access network device.
  • S510-S511 are the same as steps S405-S406, and the specific description can be referred to the above, which will not be repeated here.
  • the access network device can obtain the private data of the terminal by sending the first request message to the mobility management network element .
  • a data transmission method provided by an embodiment of this application includes the following steps:
  • S602 When the access network device needs to obtain the private data of the terminal, the access network device sends a first request message to the terminal, so that the terminal receives the first request message from the access network device.
  • the terminal performs NAS security protection on the private data of the terminal according to the NAS security context.
  • the terminal sends the first RRC message to the access network device, so that the access network device receives the first RRC message.
  • the first RRC message includes private data protected by NAS security.
  • the first RRC message may carry second indication information, and the second indication information is used to indicate that the terminal is a terminal of the first type.
  • the access network device sends the privacy data protected by the NAS security to the mobility management network element.
  • the access network device sends the privacy data protected by the NAS to the mobility management network element when it is determined that the terminal is the first type terminal.
  • the mobile management network element performs security protection on the private data protected by the NAS security.
  • the mobility management network element sends the privacy data of the terminal to the access network device, so that the access network device receives the privacy data of the terminal.
  • the access network device uses the private data of the terminal.
  • step S607 can be replaced with step S609.
  • the mobility management network element sends a verification success message to the access network device, so that the access network device receives the verification success message.
  • the verification success message is used to indicate that the first uplink NAS MAC has passed the verification.
  • the process of transmitting private data between the access network device and the first type terminal reuses the process in the prior art, and has better compatibility.
  • the privacy data of the terminal is accepted and protected by NAS, so as to ensure the security of the privacy data of the terminal during the transmission process.
  • a data transmission method provided by an embodiment of this application includes the following steps:
  • the terminal sends a first response message to the access network device, so that the access network device receives the first response message.
  • the first response message is used to respond to the first request message.
  • the first response message includes private data that is not protected by AS security.
  • the first response message includes the privacy data protected by AS security.
  • the data transmission method includes the following step S703.
  • the access network device temporarily uses the private data of the terminal.
  • the access network device only temporarily uses the privacy of the terminal. Data without storing the terminal’s private data, thereby ensuring the security of the communication network.
  • the access network device when there is a security risk of tampering with private data, if the access network device sends the private data to the mobile management network element, the mobile management network element stores the private data that may be tampered with. As a result, in the subsequent process, the privacy data of the terminal obtained by other access network devices from the mobility management network element has been tampered with, resulting in a greater security risk in the communication network. In order to avoid this situation, when the first response message includes private data that is not protected by AS security, the access network device does not send the terminal's private data to the mobile management network element to avoid the possibility of storage of the mobile management network element. Private data that has been tampered with.
  • the data transmission method includes the following steps S704-S705.
  • the access network device performs security protection on the private data protected by the AS security, and stores and uses the private data.
  • the access network device After the security protection of the privacy data protected by the AS security is performed, the access network device sends the privacy data of the terminal to the mobile management network element, so that the mobile management network element receives the privacy data of the terminal.
  • the mobile management network element stores the privacy data of the terminal.
  • the access network device follows the procedure in the prior art to obtain the private data of the terminal. Moreover, when the first response message sent by the terminal carries private data that is not protected by AS security, the access network device only temporarily uses the private data, and the access network device does not send the terminal’s data to the mobility management network element. Privacy data to reduce the security risks of communication networks.
  • the access network device if the access network device needs to obtain the privacy data of the terminal, and the mobile management network does not store the privacy data of the terminal, the access network device will request the privacy data from the terminal.
  • the access network device does not have AS security protection parameters, so the access network device cannot establish an AS security context with the terminal. Therefore, the terminal can only send private data without AS security protection to the access network device. Since private data does not have AS security protection, there is a risk of tampering with private data during transmission.
  • the data transmission method includes the following steps:
  • S801 The terminal sends a TAU request message to the mobility management network element, so that the mobility management network element receives the TAU request message from the terminal.
  • the TAU request message is used to request to update the tracking area.
  • the access network device is responsible for receiving the TAU request message sent by the terminal and transparently transmitting the TAU request message to the mobility management network element.
  • the mobility management network element sends a TAU response message and AS security protection parameters to the access network device, so that the access network device receives the TAU response message and AS security protection parameters.
  • the AS security protection parameter is used to establish the AS security context between the access network device and the terminal.
  • the AS security protection parameter may be KeNB.
  • the mobile management network element when the access network device needs to obtain the privacy data of the terminal, and the mobile management network element does not store the privacy data of the terminal, the mobile management network element sends a TAU response message and AS to the access network device. Safety protection parameters.
  • the TAU response message and the AS security protection parameter may be located in the same N2 message/S1 message; or, the TAU response message and the AS security protection parameter may be located in different N2 messages/S1 messages.
  • the access network device After receiving the AS security protection parameters, the access network device establishes an AS security context with the terminal according to the AS security protection parameters.
  • S803 An AS security mode command (security mode command, SMC) process is executed between the access network device and the terminal.
  • SMC security mode command
  • the AS SMC process is used to establish the AS security context between the access network device and the terminal. Specifically, the AS SMC process is used to negotiate the keys and algorithms used for integrity protection and encryption protection between the terminal and the access network device.
  • the AS SMC process includes: the access network device sends an AS SMC message to the terminal; after that, the terminal sends an AS SMP message to the access network device.
  • the access network device sends a first request message to the terminal, so that the terminal receives the first request message.
  • the terminal performs AS security protection on the private data of the terminal according to the AS security context.
  • S806 The terminal sends a first response message to the access network device, so that the access network device receives the first response message.
  • the first response message includes privacy data protected by AS security.
  • the access network device performs security protection on the private data protected by the AS security, and stores and uses the private data.
  • the access network device transparently transmits the TAU response message from the mobility management network element to the terminal.
  • step S808 may be executed first, and then steps S803-S807; or, steps S803-S807 may be executed first, and then step S808 may be executed; or, steps S803-S807 and step S808 may be executed simultaneously.
  • the mobility management network element sends AS security protection parameters to the access network equipment, so that when the access network equipment needs to obtain the privacy data of the terminal, the access network equipment
  • the AS security context can be established with the terminal, so that the terminal can perform AS security protection on the private data, thereby ensuring the security of the private data in the transmission process.
  • a data transmission method provided by an embodiment of this application includes the following steps:
  • S901 The terminal sends an uplink RRC message to the access network device, so that the access network device receives the uplink RRC message.
  • the uplink RRC message includes terminal information and TAU request message.
  • the fourth indication information is used to indicate that the access network device needs to obtain the private data of the terminal.
  • the fourth indication information may be equivalent to the first request message in the foregoing.
  • the TAU request message and the fourth indication information may be carried in the same N2 message/S1 message. Or, the TAU request message and the fourth indication information are carried in different N2 messages/S1 messages.
  • the access network device needs to obtain the private data of the terminal, including: the access network device wants to know whether the terminal supports NAS DC.
  • the mobility management network element determines whether to store valid privacy data.
  • the mobility management network element In the case that the mobility management network element stores effective privacy data, the mobility management network element sends the privacy data of the terminal and a TAU response message to the access network device.
  • the mobility management network element executes the following step S904.
  • the mobility management network element judges whether the terminal is a terminal of the first type.
  • the mobility management network element may send a third NAS message to the terminal to trigger the terminal to report the first NAS message, so that the mobility management network element may obtain the private data of the terminal. After the mobile management network element obtains the private data of the terminal, the mobile management network element sends the private data of the terminal and a TAU response message to the access network device.
  • the data transmission method may include the following steps S905-S911.
  • S905-S911 are the same as steps S802-S808, and the specific description can be referred to the above, which will not be repeated here.
  • each network element such as a terminal, an access network device, and a mobility management network element
  • each network element includes a hardware structure or software module corresponding to each function, or a combination of the two, in order to realize the above-mentioned functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application and design constraint conditions of the technical solution. Professionals and technicians can use different methods for each specific application to implement the described functions, but such implementation should not be considered beyond the scope of this application.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software function modules. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation. The following is an example of dividing each function module corresponding to each function:
  • FIG. 19 it is a schematic structural diagram of a terminal provided by an embodiment of this application.
  • the terminal includes a communication module 201 and a processing module 202.
  • the communication module 201 is used to support the terminal to perform step S102 in FIG. 9, steps S201 and S202 in FIG. 10, step S301 in FIG. 11, step S403 in FIG. 12, step S504 and step S504 in FIG. 13(a) S506, steps S602 and S604 in Fig. 14, steps SS701 and S702 in Fig. 16, steps S803, S804 and S806 in Fig. 17, steps S901, S906, S907, S909 and S911 in Fig.
  • the processing module 202 is used to support the terminal to perform step S101 in FIG. 9, step S402 in FIG. 12, step S505 in FIG. 13(a), step S603 in FIG. 14, step S805 in FIG. 17, and step S805 in FIG. Step S908, and/or other processing operations that need to be performed by the terminal in the embodiment of the present application.
  • the processing module 202 in FIG. 19 may be implemented by the processor 101 in FIG. 7, and the communication module 201 in FIG. 19 may be implemented by the communication interface 104 in FIG.
  • the embodiment of this application does not impose any restriction on this.
  • FIG. 20 it is a schematic structural diagram of a mobility management network element provided by an embodiment of this application.
  • the mobility management network element includes a communication module 301 and a processing module 302.
  • the communication module 301 is used to support the mobility management network element to perform step S102 in Figure 9, steps S201 and S202 in Figure 10, step S302 in Figure 11, steps S403, S406 and S407 in Figure 12, Figure 13(a) Steps S504, S506, and S508 in Figure 13(b), Step S511 in Figure 13(b), Steps S605 and S607 in Figure 14, Step S609 in Figure 15, Step S705 in Figure 16, Step S801 and S802 in Figure 17 , Steps S902 and S905 in FIG.
  • the processing module 302 is used to support the mobility management network element to perform step S103 in FIG. 9, step S404 in FIG. 12, steps S502, S503, and S507 in FIG. 13(a), step S606 in FIG. 14, and step S606 in FIG. Step S706, steps S903 and S904 in FIG. 9, and/or other processing operations required by the mobility management network element in the embodiment of the present application.
  • the processing module 302 in FIG. 20 may be implemented by the processor 101 in FIG. 7, and the communication module 301 in FIG. 20 may be implemented by the communication interface 104 in FIG.
  • the embodiment of this application does not impose any restriction on this.
  • the access network device includes a communication module 401 and a processing module 402.
  • the communication module 401 is used to support the access network equipment to perform steps S301 and S302 in FIG. 11, steps S406 and S407 in FIG. 12, step S508 in FIG. 13(a), step S511 in FIG. 13(b), and Steps S602, S604, S605, and S607 in 14, step S609 in Fig. 15, steps S701, S702, and S705 in Fig. 16, steps S802, S803, S804, S806, and S808 in Fig. 17, steps in Fig. 18 S901, S905, S905, S906, S907, S909, and S911, and/or other communication operations that need to be performed by the access network device in the embodiment of the present application.
  • the processing module 402 is used to support the access network device to execute steps S405 and S408 in FIG. 12, step S509 in FIG. 13(a), step S510 in FIG. 13(b), step S608 in FIG. 14, and step S608 in FIG. Steps S703 and S704 in FIG. 17, step S807 in FIG. 17, step S910 in FIG. 18, and/or other processing operations that need to be performed by the access network device in the embodiment of the present application.
  • the processing module 402 in FIG. 21 may be implemented by the processor 101 in FIG. 7, and the communication module 401 in FIG. 21 may be implemented by the communication interface 104 in FIG.
  • the embodiment of this application does not impose any restriction on this.
  • the embodiment of the present application also provides a computer-readable storage medium in which computer instructions are stored; when the computer-readable storage medium runs on a computer, the computer is caused to execute the method described in the embodiment of the present application.
  • the data transmission method provided.
  • the embodiments of the present application also provide a computer program product containing computer instructions, which when running on a computer, enable the computer to execute the data transmission method provided in the embodiments of the present application.
  • An embodiment of the present application provides a chip including a processor, and when the processor executes an instruction, the chip can execute the data transmission method provided in the embodiment of the present application.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, a computer, or a server.
  • the data center transmits to another website site, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or may include one or more data storage devices such as servers and data centers that can be integrated with the medium.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium, or a semiconductor medium (for example, a solid state hard disk).
  • the devices and methods disclosed in the several embodiments provided in this application can be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, for example, multiple units or components may be divided. It can be combined or integrated into another device, or some features can be omitted or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate parts may or may not be physically separate.
  • the parts displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed to multiple different places. . Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product, and the software product is stored in a storage medium. It includes several instructions to make a device (may be a single-chip microcomputer, a chip, etc.) or a processor (processor) execute all or part of the steps of the methods described in the various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种数据传输方法及装置，涉及通信技术领域，用于保证终端的无线能力信息在传输过程中的安全性。该方法包括：终端在建立AS安全上下文之前，根据NAS安全上下文对无线能力信息进行NAS安全保护；之后，终端向移动管理网元发送经过NAS安全保护的无线能力信息；移动管理网元接收到经过NAS安全保护的无线能力信息之后，对经过NAS安全保护的无线能力信息进行解安全保护，从而获取并且存储终端的无线能力信息。这样一来，在接入网设备需要终端的无线能力信息的场景下，移动管理网元可以向接入网设备发送无线能力信息。本申请适用于无线能力信息的传输过程中。

Description

数据传输方法及装置 技术领域
本申请涉及通信技术领域，尤其涉及一种数据传输方法及装置。
背景技术
第三代合作伙伴计划项目(3rd generation partnership project，3GPP)定义的移动通信网络引入了安全保护机制来保证移动通信的安全(例如：通信的保密性、完整性)。在终端与基站之间建立接入层(access stratum，AS)安全上下文之后，终端可以通过AS安全上下文，对一些隐私数据(例如无线能力信息)进行AS安全保护，并将AS安全保护的隐私数据发送给基站，以使得网络侧获知该终端的隐私数据。
当前，在一些场景下，终端与基站之间未建立安全上下文，从而终端不能对隐私数据进行AS安全保护，终端只能向基站传输无AS安全保护的隐私数据。这种情况下，隐私数据存在被攻击者窃取或者篡改的风险，导致通信网络存在安全风险。
发明内容
本申请提供一种数据传输方法及装置，用于保证终端的隐私数据在传输过程中的安全性。
第一方面，提供一种通信系统，包括接入网设备和移动管理网元；其中，接入网设备，用于在终端与接入网设备建立AS上下文之前，将来自终端的经过非接入层(non-access stratum，NAS)安全保护的隐私数据发送给移动管理网元；接收来自移动管理网元的隐私数据。移动管理网元，用于接收来自终端的且经过NAS安全保护的隐私数据；在对经过NAS安全保护的隐私数据进行解安全保护之后，向接入网设备发送隐私数据。
基于上述技术方案，在终端与接入网设备建立AS安全上下文之前，终端通过发送经过NAS安全保护的隐私数据，以使得网络侧可以获知终端的隐私数据。并且，终端的隐私数据经过NAS安全保护，从而可以保证终端的隐私数据在传输过程中的安全性。
一种可能的设计中，经过NAS安全保护的隐私数据携带在终端发送的第一NAS消息中；其中，第一NAS消息经过NAS安全保护。
一种可能的设计中，第一NAS消息为初始NAS消息，或者NAS SMP消息。
一种可能的设计中，在第一NAS消息为初始NAS消息的情况下，初始NAS消息中的非明文信息包括隐私数据。
一种可能的设计中，移动管理网元，还用于向终端发送经过NAS安全保护的第二NAS消息，第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
一种可能的设计中，接入网设备，还用于在确定终端为第一类型终端的情况下，向移动管理网元发送第二请求消息；第二请求消息用于向移动管理网元请求隐私数据；移动管理网元，还用于接收第二请求消息。
一种可能的设计中，接入网设备，还用于确定终端为第一类型终端。
一种可能的设计中，接入网设备，还用于确定终端为第一类型终端，具体为：接 入网设备根据终端接入的小区，确定终端为第一类型终端；或者，接入网设备根据终端发送的消息，确定终端为第一类型终端；或者，接入网设备根据终端的网络能力指示，确定终端为第一类型终端。
一种可能的设计中，第一类型终端为CP优化的NB-IoT终端或者CP优化的CIoT终端。
一种可能的设计中，接入网设备，还用于在确定终端为第一类型终端的情况下，不向终端发送第一请求消息，第一请求消息用于向终端请求隐私数据。
一种可能的设计中，移动管理网元，还用于在未存储有效的隐私数据的情况下，向终端发送经过NAS安全保护的第三NAS消息，第三NAS消息用于向终端请求经过NAS安全保护的隐私数据。
一种可能的设计中，接入网设备，还用于接收来自终端的第一RRC消息，第一RRC消息包括NAS容器，NAS容器包括加密后的隐私数据以及上行NAS MAC；向移动管理网元发送NAS容器；移动管理网元，具体用于接收NAS容器。
第二方面，提供一种数据传输方法，包括：终端在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护；终端发送经过NAS安全保护的隐私数据。
基于上述技术方案，在终端与接入网设备建立AS安全上下文之前，终端通过发送经过NAS安全保护的隐私数据，以使得网络侧可以获知终端的隐私数据。并且，终端的隐私数据经过NAS安全保护，从而可以保证终端的隐私数据在传输过程中的安全性。
一种可能的设计中，终端在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护，包括：终端的NAS层从终端的RRC层获取到隐私数据；终端的NAS层根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护。
一种可能的设计中，终端发送经过NAS安全保护的隐私数据，包括：终端向接入网设备发送第一RRC消息，第一RRC消息包括经过NAS安全保护的隐私数据。
一种可能的设计中，终端向接入网设备发送第一RRC消息，包括：终端的RRC层从终端的NAS层获取经过NAS安全保护的隐私数据；终端的RRC层向接入网设备发送第一RRC消息，第一RRC消息包括经过NAS安全保护的隐私数据。
一种可能的设计中，第一RRC消息包括经过NAS安全保护的隐私数据，具体实现为：第一RRC消息包括NAS容器，NAS容器包括加密后的隐私数据以及上行NAS MAC；或者，NAS容器包括未加密的隐私数据以及上行NAS MAC。
一种可能的设计中，经过NAS安全保护的隐私数据携带在终端发送的第一NAS消息中；其中，第一NAS消息经过NAS安全保护。
一种可能的设计中，第一NAS消息为初始NAS消息或者NAS SMP消息。
一种可能的设计中，在第一NAS消息为初始NAS消息的情况下，初始NAS消息的非明文信元包括隐私数据。
一种可能的设计中，该方法还包括：终端接收移动管理网元发送的经过NAS安全保护的第二NAS消息，第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
一种可能的设计中，该方法还包括：终端接收来自移动管理网元发送的经过NAS安全保护的第三NAS消息，第三NAS消息用于向终端请求经过NAS安全保护的隐私数据。
一种可能的设计中，终端为第一类型终端，第一类型终端与接入网设备之间不建立AS安全上下文。
一种可能的设计中，第一类型终端为CP优化的NB-IoT终端或者CP优化的CIoT终端。
第三方面，提供一种数据传输方法，包括：移动管理网元接收经过NAS安全保护的隐私数据；移动管理网元根据预先存储的NAS安全上下文，对经过NAS安全保护的隐私数据进行解安全保护，并存储隐私数据。
基于上述技术方案，终端通过发送经过NAS安全保护的隐私数据，以使得网络侧可以获知终端的隐私数据。并且，终端的隐私数据经过NAS安全保护，从而可以保证终端的隐私数据在传输过程中的安全性。
一种可能的设计中，经过NAS安全保护的隐私数据携带在终端发送的第一NAS消息中；其中，第一NAS消息经过NAS安全保护。
一种可能的设计中，第一NAS消息为初始NAS消息，或者NAS SMP消息。
一种可能的设计中，在第一NAS消息为初始NAS消息的情况下，初始NAS消息的非明文信元包括隐私数据。
一种可能的设计中，该方法还包括：移动管理网元向终端发送经过NAS安全保护的第二NAS消息，第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
一种可能的设计中，该方法还包括：移动管理网元接收接入网设备发送的第二请求消息，第二请求消息用于请求移动管理网元向接入网设备发送隐私数据；移动管理网元向接入网设备发送隐私数据。
一种可能的设计中，在移动管理网元向接入网设备发送隐私数据之前，该方法还包括：若移动管理网元未存储有效的隐私数据，则移动管理网元向终端发送第三NAS消息，第三NAS消息用于向终端请求经过NAS安全保护的隐私数据。
一种可能的设计中，移动管理网元接收经过NAS安全保护的隐私数据，包括：移动管理网元接收接入网设备发送的NAS容器，NAS容器包括加密后的隐私数据以及上行NASMAC；或者，NAS容器包括未加密的隐私数据以及上行NAS MAC。
一种可能的设计中，该方法还包括：移动管理网元在对NAS容器进行解安全保护之后，向接入网设备发送隐私数据。
一种可能的设计中，在NAS容器包括未加密的隐私数据以及上行NAS MAC的情况下，该方法还包括：移动管理网元对上行NAS MAC进行完整性校验；在上行NAS MAC通过完整性校验之后，移动管理网元向接入网设备发送校验成功消息，校验成功消息用于指示上行NAS MAC通过完整性校验。
第四方面，提供一种数据传输方法，包括：接入网设备确定终端为第一类型终端的情况下，向移动管理网元发送第二请求消息，第二请求消息用于向移动管理网元请求终端的隐私数据；接入网设备接收移动管理网元发送的隐私数据。
基于上述技术方案，接入网设备在确定终端为第一类型终端的情况下，通过向移 动管理网元请求终端的隐私数据，从而避免终端发送无AS安全保护的隐私数据，以避免隐私数据被攻击者窃取或者篡改，保证通信网络的安全性。
一种可能的设计中，该方法还包括：接入网设备在确定终端为第一类型终端的情况下，不向终端发送第一请求消息，第一请求消息用于向终端请求隐私数据。
一种可能的设计中，该方法还包括：接入网设备在终端接入第一类型小区的情况下，确定终端为第一类型终端；第一类型小区为第一类型终端所接入的小区；或者，接入网设备在终端发送的消息为第一类型消息的情况下，确定终端为第一类型终端，第一类型消息为第一类型终端所发送的消息；或者，接入网设备在终端的网络能力指示终端为第一类型终端的情况下，确定终端为第一类型终端；或者，接入网设备在接收到终端发送的第二指示信息的情况下，确定终端为第一类型终端，第二指示信息用于指示终端为第一类型终端。
一种可能的设计中，第一类型终端为CP优化的NB-IoT终端或者CP优化的CIoT终端。
第五方面，提供一种数据传输方法，包括：接入网设备接收终端发送的第一RRC消息，第一RRC消息包括经过NAS安全保护的隐私数据；接入网设备向移动管理网元发送经过NAS安全保护的隐私数据。
基于上述技术方案，终端通过发送经过NAS安全保护的隐私数据，以使得网络侧可以获知终端的隐私数据。并且，终端的隐私数据经过NAS安全保护，从而可以保证终端的隐私数据在传输过程中的安全性。
一种可能的设计中，该方法还包括：接入网设备向终端发送第一请求消息，第一请求消息用于向终端请求隐私数据。
一种可能的设计中，第一RRC消息包括经过NAS安全保护的隐私数据，具体实现为：第一RRC消息包括第一NAS容器，第一NAS容器包括加密后的隐私数据以及上行NASMAC；或者，第一RRC消息包括第二NAS容器，第二NAS容器包括未加密的隐私数据以及上行NAS MAC；或者，第一RRC消息包括加密后的隐私数据以及上行NAS MAC；或者，第一RRC消息包括未加密的隐私数据以及上行NAS MAC。
一种可能的设计中，该方法还包括：接入网设备接收移动管理网元发送的隐私数据。
一种可能的设计中，在第一RRC消息包括未加密的隐私数据以及上行NAS MAC的情况下，该方法还包括：接入网设备在接收到移动管理网元发送的校验成功消息之后，使用隐私数据，校验成功消息用于指示上行NAS MAC通过完整性校验。
第六方面，提供一种通信装置，包括：处理模块和通信模块；处理模块，用于在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护；通信模块，用于发送经过NAS安全保护的隐私数据。
一种可能的设计中，处理模块，用于在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护，包括：NAS层从RRC层获取到隐私数据；NAS层根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护。
一种可能的设计中，通信模块，具体用于向接入网设备发送第一RRC消息，第一 RRC消息包括经过NAS安全保护的隐私数据。
一种可能的设计中，通信模块，具体用于向接入网设备发送第一RRC消息，包括：RRC层从NAS层获取经过NAS安全保护的隐私数据；RRC层向接入网设备发送第一RRC消息，第一RRC消息包括经过NAS安全保护的隐私数据。
一种可能的设计中，第一RRC消息包括经过NAS安全保护的隐私数据，具体实现为：第一RRC消息包括NAS容器，NAS容器包括加密后的隐私数据以及上行NAS MAC；或者，NAS容器包括未加密的隐私数据以及上行NAS MAC。
一种可能的设计中，经过NAS安全保护的隐私数据携带在终端发送的第一NAS消息中；其中，第一NAS消息经过NAS安全保护。
一种可能的设计中，第一NAS消息为初始NAS消息或者NAS SMP消息。
一种可能的设计中，在第一NAS消息为初始NAS消息的情况下，初始NAS消息的非明文信元包括隐私数据。
一种可能的设计中，通信模块，还用于接收移动管理网元发送的经过NAS安全保护的第二NAS消息，第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
一种可能的设计中，通信模块，还用于接收来自移动管理网元发送的经过NAS安全保护的第三NAS消息，第三NAS消息用于向终端请求经过NAS安全保护的隐私数据。
一种可能的设计中，通信装置为第一类型终端，第一类型终端与接入网设备之间不建立AS安全上下文。
一种可能的设计中，第一类型终端为CP优化的NB-IoT终端或者CP优化的CIoT终端。
第七方面，提供一种通信装置，包括：通信模块，用于接收经过NAS安全保护的隐私数据；处理模块，用于根据预先存储的NAS安全上下文，对经过NAS安全保护的隐私数据进行解安全保护，并存储隐私数据。
一种可能的设计中，经过NAS安全保护的隐私数据携带在终端发送的第一NAS消息中；其中，第一NAS消息经过NAS安全保护。
一种可能的设计中，第一NAS消息为初始NAS消息，或者NAS SMP消息。
一种可能的设计中，在第一NAS消息为初始NAS消息的情况下，初始NAS消息的非明文信元包括隐私数据。
一种可能的设计中，通信模块，还用于向终端发送经过NAS安全保护的第二NAS消息，第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
一种可能的设计中，通信模块，还用于接收接入网设备发送的第二请求消息，第二请求消息用于请求移动管理网元向接入网设备发送隐私数据；向接入网设备发送隐私数据。
一种可能的设计中，通信模块，还用于若移动管理网元未存储有效的隐私数据，则向终端发送第三NAS消息，第三NAS消息用于向终端请求经过NAS安全保护的隐私数据。
一种可能的设计中，通信模块，具体用于接收接入网设备发送的NAS容器，NAS容器包括加密后的隐私数据以及上行NASMAC；或者，NAS容器包括未加密的隐私 数据以及上行NAS MAC。
一种可能的设计中，处理模块，用于对NAS容器进行解安全保护；通信模块，还用于在对NAS容器进行解安全保护之后，向接入网设备发送隐私数据。
一种可能的设计中，处理模块，还用于在NAS容器包括未加密的隐私数据以及上行NAS MAC的情况下，对上行NAS MAC进行完整性校验；通信模块，还用于在上行NAS MAC通过完整性校验之后，向接入网设备发送校验成功消息，校验成功消息用于指示上行NAS MAC通过完整性校验。
第八方面，提供一种通信装置，包括：处理模块，用于判断终端是否为第一类型终端；通信模块，用于在处理模块确定终端为第一类型终端的情况下，向移动管理网元发送第二请求消息，第二请求消息用于向移动管理网元请求终端的隐私数据；接收移动管理网元发送的隐私数据。
一种可能的设计中，通信模块，用于在处理模块确定终端为第一类型终端的情况下，不向终端发送第一请求消息，第一请求消息用于向终端请求隐私数据。
一种可能的设计中，处理模块，用于在终端接入第一类型小区的情况下，确定终端为第一类型终端；第一类型小区为第一类型终端所接入的小区；或者，在终端发送的消息为第一类型消息的情况下，确定终端为第一类型终端，第一类型消息为第一类型终端所发送的消息；或者，在终端的网络能力指示终端为第一类型终端的情况下，确定终端为第一类型终端；或者，在接收到终端发送的第二指示信息的情况下，确定终端为第一类型终端，第二指示信息用于指示终端为第一类型终端。
一种可能的设计中，第一类型终端为CP优化的NB-IoT终端或者CP优化的CIoT终端。
第九方面，提供一种通信装置，包括：接收模块，用于接收终端发送的第一RRC消息，第一RRC消息包括经过NAS安全保护的隐私数据。发送模块，用于向移动管理网元发送经过NAS安全保护的隐私数据。
一种可能的设计中，发送模块，还用于向终端发送第一请求消息，第一请求消息用于向终端请求隐私数据。
一种可能的设计中，第一RRC消息包括经过NAS安全保护的隐私数据，具体实现为：第一RRC消息包括第一NAS容器，第一NAS容器包括加密后的隐私数据以及上行NASMAC；或者，第一RRC消息包括第二NAS容器，第二NAS容器包括未加密的隐私数据以及上行NAS MAC；或者，第一RRC消息包括加密后的隐私数据以及上行NAS MAC；或者，第一RRC消息包括未加密的隐私数据以及上行NAS MAC。
一种可能的设计中，接收模块，还用于接收移动管理网元发送的隐私数据。
一种可能的设计中，所述通信装置还包括处理模块。处理模块，还用于在第一RRC消息包括未加密的隐私数据以及上行NAS MAC的情况下，在接收到移动管理网元发送的校验成功消息之后，使用隐私数据，校验成功消息用于指示上行NAS MAC通过完整性校验。
第十方面，提供一种通信装置，包括处理器和通信接口，处理器用于执行计算机程序指令，使得通信装置实现第二方面至第五方面中任一方面的任一种可能的设计所涉及的数据传输方法。
第十一方面，提供一种计算机可读存储介质，计算机可读存储介质存储有指令，当指令在计算机上运行时，使得计算机实现第二方面至第五方面中任一方面的任一种可能的设计所涉及的数据传输方法。
第十二方面，一种计算机程序产品，计算机程序产品包括指令，当计算机程序产品在计算机上运行时，使得计算机实现第二方面至第五方面中任一方面的任一种可能的设计所涉及的数据传输方法。
第十三方面，一种芯片，芯片包括处理器，当处理器执行计算机程序指令时，使得芯片实现第二方面至第五方面中任一方面的任一种可能的设计所涉及的数据传输方法。
第十四方面，提供一种通信系统，包括：移动管理网元和接入网设备；移动管理网元，用于接收跟踪区更新TAU请求消息，TAU请求消息用于请求更新跟踪区；在未存储有效的隐私数据的情况下，向接入网设备发送TAU响应消息和AS安全保护参数，TAU响应消息用于响应TAU请求消息，AS安全保护参数用于建立终端与接入网设备之间的AS安全上下文；接入网设备，用于接收TAU响应消息和AS安全保护参数；根据AS安全保护参数，与终端建立AS安全上下文；向终端发送第一请求消息，第一请求消息用于请求终端向接入网设备发送隐私数据；接收终端发送的第一响应消息，第一响应消息包括AS安全保护的隐私数据。
基于上述技术方案，在TAU流程中，移动管理网元通过向接入网设备发送AS安全保护参数，以使得接入网设备与终端之间能够建立AS安全上下文，从而保证终端的隐私数据在经过AS安全保护之后才传输，从而避免终端的隐私数据被攻击者窃取或者篡改，从而保证通信网络的安全性。
一种可能的设计中，接入网设备，用于根据述AS安全上下文，对AS安全保护的隐私数据进行解安全保护；在成功对AS安全保护的隐私数据进行解安全保护之后，使用隐私数据。
一种可能的设计中，接入网设备，还用于向移动管理网元发送第四指示信息，第四指示信息用于指示接入网设备需要终端的隐私数据。移动管理网元，还用于接收第四指示信息。
第十五方面，提供一种数据传输方法，包括：移动管理网元接收跟踪区更新TAU请求消息，TAU请求消息用于请求更新跟踪区；移动管理网元在未存储终端的隐私数据的情况下，向接入网设备发送TAU响应消息和AS安全保护参数，TAU响应消息用于响应TAU请求消息，AS安全保护参数用于建立终端与接入网设备之间的AS安全上下文。
基于上述技术方案，在TAU流程中，移动管理网元通过向接入网设备发送AS安全保护参数，以使得接入网设备与终端之间能够建立AS安全上下文，从而保证终端的隐私数据在经过AS安全保护之后才传输，从而避免终端的隐私数据被攻击者窃取或者篡改，从而保证通信网络的安全性。
一种可能的设计中，该方法还包括：移动管理网元接收第四指示信息，第四指示信息用于指示接入网设备需要终端的隐私数据。
第十六方面，提供一种数据传输方法，包括：接入网设备将来自终端的跟踪区更 新TAU请求消息发送给移动管理网元，TAU请求消息用于请求更新跟踪区；接入网设备接收移动管理网元发送的TAU响应消息和AS安全保护参数，TAU响应消息用于响应TAU请求消息，AS安全保护参数用于建立终端与接入网设备之间的AS安全上下文；接入网设备根据AS安全保护参数，建立与终端的AS安全上下文；接入网设备向终端发送第一请求消息，第一请求消息用于请求终端向接入网设备发送隐私数据；接入网设备接收终端发送的第一响应消息，第一响应消息包括AS安全保护的隐私数据。
基于上述技术方案，在TAU流程中，移动管理网元通过向接入网设备发送AS安全保护参数，以使得接入网设备与终端之间能够建立AS安全上下文，从而保证终端的隐私数据在经过AS安全保护之后才传输，从而避免终端的隐私数据被攻击者窃取或者篡改，从而保证通信网络的安全性。
一种可能的设计中，该方法还包括：接入网设备向移动管理网元发送第四指示信息，第四指示信息用于指示接入网设备需要终端的隐私数据。
第十七方面，提供一种通信装置，包括：接收模块，用于接收跟踪区更新TAU请求消息，TAU请求消息用于请求更新跟踪区；发送模块，用于在未存储有效的隐私数据的情况下，向接入网设备发送TAU响应消息和AS安全保护参数，TAU响应消息用于响应TAU请求消息，AS安全保护参数用于建立终端与接入网设备之间的AS安全上下文。
一种可能的设计中，接收模块，还用于接收第四指示信息，第四指示信息用于指示接入网设备需要终端的隐私数据。
第十八方面，提供一种通信装置，包括：发送模块，用于将来自终端的跟踪区更新TAU请求消息发送给移动管理网元，TAU请求消息用于请求更新跟踪区；接收模块，用于接收移动管理网元发送的TAU响应消息和AS安全保护参数，TAU响应消息用于响应TAU请求消息，AS安全保护参数用于建立终端与接入网设备之间的AS安全上下文；建立模块，用于根据AS安全保护参数，建立与终端的AS安全上下文；发送模块，还用于向终端发送第一请求消息，第一请求消息用于请求终端向接入网设备发送隐私数据；接收模块，还用于接收终端发送的第一响应消息，第一响应消息包括AS安全保护的隐私数据。
一种可能的设计中，发送模块，还用于向移动管理网元发送第四指示信息，第四指示信息用于指示接入网设备需要终端的隐私数据。
第十九方面，一种通信装置，包括处理器和通信接口，处理器用于执行计算机程序指令，使得通信装置实现第十五方面或第十六方面中任一种设计所涉及的数据传输方法。
第二十方面，一种计算机可读存储介质，计算机可读存储介质存储有指令，当指令在计算机上运行时，使得计算机实现第十五方面或第十六方面中任一种设计所涉及的数据传输方法。
第二十一方面，一种计算机程序产品，计算机程序产品包括指令，当计算机程序产品在计算机上运行时，使得计算机实现第十五方面或第十六方面中任一种设计所涉及的数据传输方法。
第二十二方面，一种芯片，芯片包括处理器，当处理器执行计算机程序指令时，使得芯片实现第十五方面或第十六方面中任一种设计所涉及的数据传输方法。
附图说明
图1为加密/解密的过程示意图；
图2为发送方计算MAC的示意图；
图3为接收方计算MAC的示意图；
图4为现有技术中TAU流程的示意图；
图5(a)为本申请实施例提供的一种LTE网络的结构示意图；
图5(b)为本申请实施例提供的一种5G网络的架构示意图；
图6为本申请实施例提供的一种协议栈的示意图；
图7为本申请实施例提供的一种通信装置的结构示意图；
图8为现有技术中无线能力信息的传输流程的示意图；
图9为本申请实施例提供的一种数据传输方法的流程图；
图10为本申请实施例提供的另一种数据传输方法的流程图；
图11为本申请实施例提供的另一种数据传输方法的流程图；
图12为本申请实施例提供的另一种数据传输方法的流程图；
图13(a)为本申请实施例提供的另一种数据传输方法的流程图；
图13(b)为本申请实施例提供的另一种数据传输方法的流程图；
图14为本申请实施例提供的另一种数据传输方法的流程图；
图15为本申请实施例提供的另一种数据传输方法的流程图；
图16为本申请实施例提供的另一种数据传输方法的流程图；
图17为本申请实施例提供的另一种数据传输方法的流程图；
图18为本申请实施例提供的另一种数据传输方法的流程图；
图19为本申请实施例提供的一种终端的结构示意图；
图20为本申请实施例提供的一种移动管理网元的结构示意图；
图21为本申请实施例提供的一种接入网设备的的结构示意图。
具体实施方式
在本申请的描述中，除非另有说明，“/”表示“或”的意思，例如，A/B可以表示A或B。本文中的“和/或”仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。此外，“至少一个”是指一个或多个，“多个”是指两个或两个以上。“第一”、“第二”等字样并不对数量和执行次序进行限定，并且“第一”、“第二”等字样也并不限定一定不同。
需要说明的是，本申请中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
在本申请的描述中，“指示”可以包括直接指示和间接指示，也可以包括显式指示和隐式指示。将某一信息(如下文所述的第一指示信息)所指示的信息称为待指示 信息，则具体实现过程中，对所述待指示信息进行指示的方式有很多种。例如，可以直接指示所述待指示信息，其中所述待指示信息本身或者所述待指示信息的索引等。又例如，也可以通过指示其他信息来间接指示所述待指示信息，其中该其他信息与所述待指示信息之间存在关联关系。又例如，还可以仅仅指示所述待指示信息的一部分，而所述待指示信息的其他部分则是已知的或者提前约定的。另外，还可以借助预先约定(例如协议规定)的各个信息的排列顺序来实现对特定信息的指示，从而在一定程度上降低指示开销。
为了便于理解本申请的技术方案，下面先对本申请所涉及的术语进行简单介绍。
1、加密/解密
加密/解密：保护数据在传输过程中的机密性(因此又可以被称作机密性保护)，机密性是指无法被直接看出真实内容。加密保护一般可以使用密钥和加密算法对数据进行加密来实现。加密保护的具体方法可以参考3GPP TS 33.401 f50中8.2节或33.501 f50中6.4.4节标准相关描述，这里不再赘述。
示例性的，如图1所示，发送端的加密过程可以为：发送端可以将计数值(count)、长度(length)、承载(bearer)、以及方向(direction)等参数输入NEA中，确定密钥流(keystream)；之后，发送端根据密钥流和明文(plaintext)，确定密文(ciphertext)。
示例性的，如图1所示，接收端的解密过程可以为：接收端可以将count、length、bearer、以及direction等参数输入NEA中，确定密钥流；之后，接收端根据密钥流和密文，确定明文。
2、完整性保护/校验
完整性保护/校验：完整性保护/校验用于判断消息在传递过程中，其内容是否被更改，也可以用于作为身份验证，以确认消息的来源。完整性校验和保护需要使用消息认证码(message authentication code，MAC)。完整性校验和保护的具体方法可以参考第三代合作伙伴计划(3rd generation partnership project，3GPP)TS 33.401 f50中8.1节或33.501 f50中6.4.3节标准相关描述，这里不再赘述。
MAC可以用于检查消息在传递过程中，其内容是否被更改；以及，消息认证码可以用于作为身份验证，以确认消息的来源。
如图2所示，发送端将密钥(key)、计数值(count)、长度(length)、承载(bearer)、消息(message)、方向(direction)等参数输入演进分组系统完整性算法(evolved packet system integrity algorithm，EIA)，可以得到完整性的消息认证码(message authentication code integrity，MAC-I)或者NAS-MAC。
如图3所示，接收端将完整性保护密钥、count、length、bearer、message、direction等参数输入EIA，可以得到期望的完整性的消息认证码(excepted message authentication code integrity，XMAC-I)或者期望的非接入层消息认证码(excepted non-access stratum message authentication code，XNAS-MAC)。
对于接收端来说，接收端可以将接收到的MAC-I与自身生成的XMAC-I进行比对，以验证消息是否完整。若MAC-I与XMAC-I相同，则接收端确定接收到的MAC-I通过验证，从而接收端能够确定发送端所发送的消息是完整的；若MAC-I与XMAC-I不相同，则接收端能够确定接收到的MAC-I未通过验证，从而接收端能够确定发送端 所发送的消息是不完整的。
3、安全上下文
安全上下文是指可以用于实现数据的安全保护(例如，加密/解密，和/或完整性保护/校验)的信息。
安全上下文可以包括以下一项或者多项：根密钥、加密密钥、完整性保护密钥、特定参数(比如NAS Count)、密钥集标识(key set identifier，KSI)、安全算法、安全指示(例如，是否开启加密的指示，是否开启完整性保护的指示、密钥使用期限的指示，密钥长度)等。
其中，加密密钥为发送端根据加密算法对明文进行加密以生成密文时输入的参数。若使用对称加密的方法，加密密钥和解密密钥是相同的。接收端可以根据相同的加密算法和加密密钥对密文进行解密。换句话说，发送端和接收端可以基于同一个密钥去加密和解密。
完整性保护密钥为发送端根据完整性保护算法对明文或密文进行完整性保护时输入的参数。接收端可以根据相同的完整性保护算法和完整性保护密钥对进行了完整性保护的数据进行完整性验证。
特定参数(比如NAS Count)为发送端根据防重放保护算法对明文或密文进行防重放保护时输入的参数。接收端可以根据相同的防重放保护算法对进行了防重放保护的数据进行防重放验证。
安全算法即对数据进行安全保护时使用的算法。例如，加密算法、解密算法、完整性保护算法等。
在本申请实施例中，安全上下文可以分为NAS安全上下文和AS安全上下文。可以理解的是，NAS安全上下文用于保护终端与核心网之间传输的信息。AS安全上下文用于保护终端与基站之间传输的信息。
4、初始NAS消息
初始NAS消息是终端从空闲(IDLE)态转变为连接(CONNECTED)态发送的第一条NAS消息。需要说明的是，当终端处于IDLE态时，终端未与网络侧建立无线资源控制(radio resource control，RRC)连接；当终端处于CONNECTED态时，终端与网络侧建立了RRC连接。
在实际应用场景中，初始NAS消息可以是注册请求消息，服务请求消息，或者去注册请求消息等，本申请实施例对此不作限定。
5G网络中，在引入了部分加密机制的情况下，初始NAS消息包括明文(cleartext)信息以及非明文(non-cleartext)信息。其中，明文信息为不需要加密的信息，非明文信息为需要加密的信息。需要说明的是，非明文信息也可以称之为加密信息或者密文信息。
可选的，明文信息包括以下信元中的至少一项：扩展协议识别(Extended protocol discriminator)，安全头类型(security header type)，预留的半字(spare half octet)、注册请求消息标识(registration request message identity)，5G系统注册类型(5G system registration type)，下一代密钥集标识(next generation key set identifier，ngKSI)，5G系统移动身份(5G system mobile identity，5GS mobile identity)，UE安全能力(UE  security capability)，附加的全球唯一临时UE标识(additional globally unique temporary UE identity，additional GUTI)，UE状态(UE status)，以及演进分组系统(evolved packet system，EPS)NAS消息容器(NAS message container)。
可选的，非明文信息包括以下信元中的至少一项：5G移动管理能力(5GMM capability)，负载容器(payload container)，用户面数据等。非明文信息可以是初始NAS消息中除了明文信息的其他信元。
需要说明的是，在终端存储有NAS安全上下文的情况下，初始NAS消息中的信息被加密和完整性保护。
需要说明的是，当终端与核心网之间未建立NAS安全上下文时，初始NAS消息中的明文信息用于建立NAS安全上下文。在建立NAS安全上下文之后，终端再发送经过NAS安全保护的NAS安全模式完成(security mode complete，SMP)消息，该NAS SMP消息中承载有原本应该在初始NAS消息中发送的明文信息和非明文信息。
5、NAS count
NAS count包括翻转比特位(overflow counter)和序列号(sequence number)。
可选的，若NAS count由24比特(bit)组成，则翻转比特位包括16bit，序列号包括8bit。在以NAS count进行安全保护时，NAS count可以被填充为32bit，即在NAS count原有的24bit之前填充8bit，填充的8bit可以全为0。
NAS count用于对网络侧和终端之间传输的NAS消息进行计数。NAS count可以分为上行NAS count和下行NAS count。
上行NAS count用于对终端发送给网络侧的NAS消息进行计数。例如，终端每向核心网设备发送一条NAS消息，上行NAS count加1。
下行NAS count用于对网络侧发送给终端的NAS消息进行计数。例如，核心网设备每向终端发送一条NAS消息，下行NAS count加1。
6、终端的隐私数据
在本申请实施例中，终端的隐私数据是指：现有技术中需要通过AS信令来传输的数据，并且该数据是由终端生成的，用于供基站和核心网设备参考和使用。并且，终端的隐私数据需要进行AS安全保护，以保证隐私数据在传输过程中的安全性。
示例性的，终端的隐私数据可以为无线能力(radio capability)信息、网络切片选择辅助信息(Network Slice Selection Assistance Information，NSSAI)、私有接入组标识(closed access group identifier，CAG-ID)等，本申请实施例不限于此。
其中，无线能力信息可以用于指示终端支持的无线接入技术的信息。示例性的，无线能力信息可以包括以下参数中的一个或多个：功率等级、频带、终端支持的网络版本等。无线能力信息可以参考3GPP TS36.306或者TS23.401，此处不再赘述。无线能力信息可以有其他名称，例如UE无线接入能力(UE radio access capability)，本申请实施例不限于此。
NSSAI包括多个单NSSAI(single NSSAI，S-NSSAI)。S-NSSAI由服务类型(slice/service type，SST)和切片区分器(slice differentiator，SD)组成。其中，SST包括标准化和运营商自定义的类型。SD是补充SST的可选信息，以区分相同SST的多个网络切片。
CAG-ID用于指示终端所支持的私有接入组。
7、跟踪区更新(tracking area update，TAU)
当终端从一个跟踪区(tracking area，TA)移动到另一种TA时，终端需要在新的TA上重新进行位置登记，以通知核心网更改其存储的终端的位置信息，这一过程即为TAU流程。
需要说明的是，通信系统的覆盖区域可以被划分为多个TA。TA是通信系统中位置更新和寻呼的基本单位。
示例性的，如图4所示，现有技术中的TAU流程包括以下步骤：
S11、终端向接入网设备发送TAU请求消息。
S12、接入网设备向移动管理网元发送TAU请求消息。
S13、移动管理网元更新终端的上下文。
S14、移动管理网元向接入网设备发送TAU响应消息。
S15、接入网设备向终端发送TAU响应消息。
8、第一类型终端、第二类型终端
第一类型终端与接入网设备之间不建立AS安全上下文。第二类型终端与接入网设备之间建立AS安全上下文。
在实际应用中，第一类型终端不具备AS安全保护能力；或者，第一类型终端虽然具备AS安全保护能力，但是未激活AS安全保护能力。从而，第一类型终端不建立AS安全上下文，从而第一类型终端不会应用AS安全上下文进行AS信令的安全保护。
示例性的，第一类型终端可以为CP优化的窄带物联网(narrowband internet of things，NB-IoT)终端或者蜂窝物联网(cellular internet of things，CIoT)终端，本申请实施例不限于此。
示例性的，第二类型终端可以为普通的手机等，本申请实施例不限于此。
以上是对本申请实施例所涉及的术语的介绍，以下不再赘述。
本申请实施例提供的技术方案可以应用于各种通信系统，例如，4G通信系统，5G通信系统，未来演进系统或者多种通信融合系统等等。本申请提供的技术方案可以应用于多种应用场景，例如，机器对机器(machine to machine，M2M)、宏微通信、增强型移动互联网(enhanced mobile broadband，eMBB)、超高可靠超低时延通信(ultra-reliable&low latency communication，uRLLC)以及海量物联网通信(massive machine type communication，mMTC)等场景。这些场景可以包括但不限于：通信设备与通信设备之间的通信场景，网络设备与网络设备之间的通信场景，网络设备与通信设备之间的通信场景等。下文中均是以应用于网络设备和终端之间的通信场景中为例进行说明的。
此外，本申请实施例描述的网络架构以及业务场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
如图5(a)所示，为本申请实施例所提供的技术方案所适用的LTE网络的架构。LTE网络包括：一个或多个终端、演进的通用移动通信系统(universal mobile  telecommunications system，UMTS)陆地无线接入网(evolved UMTS terrestrial radio access network，E-Utran)、以及分组演进核心(evolved packet core，EPC)。
其中，E-Utran包括一个或多个演进型基站(Evolved Node B，eNB或eNodeB)。eNB用于负责无线资源管理、用户数据流加密、从MME发起的呼叫信息的调度和发送、用户面数据向S-GW的路由等。
EPC包括MME和SGW。EPC还可以包括图5(a)未示出的其他功能网元，本申请实施例不限于此。
MME用于将寻呼消息发送到相关的eNB、NAS信令的加密和完整性保护等。
SGW是用户面数据包在无线接入网的终结点，支持终端移动性的用户平面数据的交换。
在LTE网络中，终端与eNB之间的接口可以称为UU接口，两个eNB之间的接口可以称为X2接口，eNB与EPC之间的接口可以称为S1接口。可以理解的是，UU接口、X2接口、S1接口的名称仅是示例，本申请实施例不限于此。
如图5(b)所示，为本申请实施例提供的技术方案所适用的5G网络的架构。5G网络可以包括：终端、无线接入通信网络(radio access network，RAN)或者接入通信网络(access network，AN)(下文中将RAN和AN统称为(R)AN)、核心网(core network，CN)、以及数据网(data network，DN)。
其中，终端可以是一种具有无线收发功能的设备。所述终端可以有不同的名称，例如用户设备(user equipment，UE)、接入终端、终端单元、终端站、移动站、移动台、远方站、远程终端、移动设备、无线通信设备、终端代理或终端装置等。终端可以被部署在陆地上，包括室内或室外、手持或车载；也可以被部署在水面上(如轮船等)；还可以被部署在空中(例如飞机、气球和卫星上等)。终端包括具有无线通信功能的手持式设备、车载设备、可穿戴设备或计算设备。示例性地，终端可以是手机(mobile phone)、平板电脑或带无线收发功能的电脑。终端设备还可以是虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程医疗中的无线终端、智能电网中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等等。本申请实施例中，用于实现终端的功能的装置可以是终端，也可以是能够支持终端实现该功能的装置，例如芯片系统。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例中，以用于实现终端的功能的装置是终端为例，描述本申请实施例提供的技术方案。
接入网设备也可以称为基站。基站可以包括各种形式的基站，例如：宏基站，微基站(也称为小站)，中继站，接入点等。具体可以为：是无线局域网(wireless local area network，WLAN)中的接入点(access point，AP)，全球移动通信系统(Global System for Mobile Communications，GSM)或码分多址接入(Code Division Multiple Access，CDMA)中的基站(Base Transceiver Station，BTS)，也可以是宽带码分多址(Wideband Code Division Multiple Access，WCDMA)中的基站(NodeB，NB)，还可以是LTE中的eNB，或者中继站或接入点，或者车载设备、可穿戴设备以及未来5G网络中的下一代节点B(the next generation node B，gNB)或者未来演进的公用陆地移动网(public  land mobile network，PLMN)网络中的基站等。
基站，通常包括基带单元(baseband unit，BBU)、射频拉远单元(remote radio unit，RRU)、天线、以及用于连接RRU和天线的馈线。其中，BBU用于负责信号调制。RRU用于负责射频处理。天线用于负责线缆上导行波和空气中空间波之间的转换。一方面，分布式基站大大缩短了RRU和天线之间馈线的长度，可以减少信号损耗，也可以降低馈线的成本。另一方面，RRU加天线比较小，可以随地安装，让网络规划更加灵活。除了RRU拉远之外，还可以把BBU全部都集中起来放置在中心机房(central office，CO)，通过这种集中化的方式，可以极大减少基站机房数量，减少配套设备，特别是空调的能耗，可以减少大量的碳排放。此外，分散的BBU集中起来变成BBU基带池之后，可以统一管理和调度，资源调配更加灵活。这种模式下，所有的实体基站演变成了虚拟基站。所有的虚拟基站在BBU基带池中共享用户的数据收发、信道质量等信息，相互协作，使得联合调度得以实现。
在一些部署中，基站可以包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)。基站还可以包括有源天线单元(active antenna unit，AAU)。CU实现基站的部分功能，DU实现基站的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，简称RLC)、媒体接入控制(media access control，MAC)和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令或PDCP层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，在本申请实施例中，接入网设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，CU可以划分为RAN中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，在此不做限制。
一种可能的设计中，对于基站来说，还可以将CU的控制面(control plane，CP)和用户面(user plane，UP)分离，以不同实体来实现。也即，CU可以分为CU-CP和CU-UP。
核心网包括多个核心网网元(或者称为网络功能网元)，例如：接入和移动性管理功能(access and mobility management function，AMF)网元、会话管理功能(session management function，SMF)网元、策略控制功能(policy control function，PCF)网元网元、用户面功能(user plane function，UPF)网元、应用层功能(application function)网元、鉴权功能(authentication server function，AUSF)网元、以及统一数据管理(unified data management，UDM)网元。
此外，核心网还可以包括一些图5(b)中未示出的网元，例如：安全锚功能(security anchor function，SEAF)网元、认证凭证库以及处理功能(authentication credential repository and processing function，ARPF)，本申请实施例在此不予赘述。
AMF网元主要负责移动性管理处理部分，例如：接入控制、移动性管理、附着与去附着以及SMF选择等功能。AMF网元为终端中的会话提供服务的情况下，会为该 会话提供控制面的存储资源，以存储会话标识、与会话标识关联的SMF标识等。
其中，终端通过下一代网络(Next generation，N)1接口(简称N1)与AMF通信，RAN设备通过N2接口(简称N2)与AMF通信，RAN设备通过N3接口(简称N3)与UPF通信，UPF通过N6接口(简称N6)与DN通信。
AMF、SMF、UDM、AUSF、或者PCF等控制面网元也可以采用服务化接口进行交互。比如，如图5(b)所示，AMF对外提供的服务化接口可以为Namf；SMF对外提供的服务化接口可以为Nsmf；UDM对外提供的服务化接口可以为Nudm；PCF对外提供的服务化接口可以为Npcf，AUSF对外提供的服务化接口可以为Nausf；在此不再一一描述。
如图6所示，为本申请实施例提供的一种协议栈的示意图。如图6所示，终端的协议栈至少包括：非接入层、RRC层、分组数据汇聚协议(packet data convergence protocol，PDCP)层、无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层、物理层(PHY layer)。其中，RRC层、PDCP层、RLC层、MAC层、PHY层均属于接入层。
其中，非接入层是终端与核心网之间的功能层，用于支持终端与核心网的网元(例如移动管理网元)之间的信令和数据传输。
RRC层用于支持无线资源的管理、RRC连接控制等功能。
对于其他的协议层，例如PDCP层、RLC层等，其定义与功能可以参见现有技术的说明，在此不再赘述。
如图7所示，该装置100包括至少一个处理器101，通信线路102，存储器103以及至少一个通信接口104。
处理器101可以是一个通用中央处理器(central processing unit，CPU)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
通信线路102可包括一通路，在上述组件之间传送信息。
通信接口104，使用任何收发器一类的装置，用于与其他设备或通信网络通信，如以太网，无线接入网(radio access network，RAN)，无线局域网(wireless local area networks，WLAN)等。
存储器103可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可以是独立存在，通过通信线路102与处理器相连接。存储器也可以和处理器集成在一起。
其中，存储器103用于存储执行本申请方案的计算机执行指令，并由处理器101来控制执行。处理器101用于执行存储器103中存储的计算机执行指令，从而实现本 申请实施例所提供的技术方案。
可选的，本申请实施例中的计算机执行指令也可以称之为应用程序代码，本申请实施例对此不作具体限定。
在具体实现中，作为一种实施例，处理器101可以包括一个或多个CPU，例如图7中的CPU0和CPU1。
在具体实现中，作为一种实施例，装置100可以包括多个处理器，例如图7中的处理器101和处理器107。这些处理器中的每一个可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，装置100还可以包括输出设备105和输入设备106。输出设备105和处理器101通信，可以以多种方式来显示信息。例如，输出设备105可以是液晶显示器(liquid crystal display，LCD)，发光二级管(light emitting diode，LED)显示设备，阴极射线管(cathode ray tube，CRT)显示设备，或投影仪(projector)等。输入设备106和处理器101通信，可以以多种方式接收用户的输入。例如，输入设备106可以是鼠标、键盘、触摸屏设备或传感设备等。
示例性的，在现有技术中，无线能力信息的传输流程可以参考图8。如图8所示，无线能力信息的传输流程包括以下步骤：
S21、终端与接入网设备之间建立AS安全上下文。
S22、接入网设备向终端发送无线能力请求消息，该无线能力请求消息用于请求终端的无线能力信息。
S23、终端根据AS安全上下文，对无线能力信息进行AS安全保护。
S24、终端向接入网设备发送AS安全保护的无线能力信息。
可以理解的是，接入网设备在接收到AS安全保护的无线能力信息之后，接入网设备对AS安全保护的无线能力信息进行解安全保护。从而，接入网设备可以使用该无线能力信息。
S25、接入网设备向移动管理网元发送无线能力信息。
S26、移动管理网元存储终端的无线能力信息。
从图8所示的例子可以看出，现有技术中，终端的隐私数据是通过AS安全保护来保证传输过程中的安全性。但是，在一些场景下，例如终端不具备AS安全保护能力，或者接入网设备在TAU流程中不具备AS安全保护参数，因此终端与接入网设备之间不能建立AS安全上下文。这样一来，网络侧在获知终端的隐私数据的过程中，终端的隐私数据未进行AS安全保护，导致终端的隐私数据容易被攻击者篡改，影响通信网络的安全性。
为了解决这一技术问题，本申请实施例提供一种数据传输方法。如图9所示，该方法包括以下步骤：
S101、终端根据预先存储的NAS安全上下文，对终端的隐私数据进行NAS安全保护。
示例性的，终端的隐私数据可以为无线能力信息，无线能力信息可以为无线能力参数和/或无线能力标识。
可选的，NAS安全保护为完整性保护。或者，NAS安全保护为完整性保护和加密保护。
示例性的，终端对隐私数据进行完整性保护，可以具体实现为：终端根据隐私数据、NAS完整性保护参数以及NAS完整性保护算法，计算出第一NAS MAC。
在本申请实施例中，第一NAS MAC可以划分为第一上行NAS MAC和第一下行NAS MAC。第一上行NAS MAC是第一NAS MAC的一部分比特，第一下行NAS MAC是第一NAS MAC的另一部分比特。例如，第一NAS MAC可以包括32个比特，第一上行NAS MAC为第一NAS MAC的前16个比特，第一下行NAS MAC为第一NAS MAC的后16个比特。
其中，NAS完整性保护参数包括上行NAS count和NAS完整性保护密钥(Knas-int)。可选的，NAS完整性保护参数还包括目标小区ID。
结合图2进行举例说明，终端可以将key设置为NAS完整性保护密钥，将count设置为上行NAS count，将message设置为目标小区ID以及隐私数据，将direction设置为上行方向所对应的比特值，将bearer设置为预设常数；之后，终端将这些参数输入EIA，确定第一NAS MAC。
上行NAS count为终端发送的下一条NAS消息所对应的NAS count。
目标小区ID用于指示终端连接的目标小区。示例性的，目标小区ID可以是目标小区的物理标识(physical cell Identifier，PCI)或小区全球标识(cell global identification，CGI)，本申请不限于此。需要说明的是，NAS MAC的计算过程中使用到目标小区ID，其目的在于将NAS MAC和目标小区进行绑定，以避免承载该NAS MAC的消息被重放到其他小区。
direction用于表示数据传输的方向。direction可以以1个或多个比特来指示。例如，假设direction以一个比特来表示，direction置为0，表示上行方向；direction置为1，表示下行方向。
bearer置为0时，用于指示终端采用3GPP接入技术接入网络。bearer置为1时，用于指示终端采用非3GPP接入技术接入网络。在本申请实施例中，beraer可以设置为0。
示例性的，终端对隐私数据进行加密保护，可以具体实现为：终端根据NAS加密参数以及NAS加密算法，生成密钥流。之后，终端根据密钥流和隐私数据，生成加密后的隐私数据。其中，NAS加密参数包括NAS加密密钥(Knas-enc)。可选的，NAS加密参数还包括上行NAS count。
结合图1进行举例说明，终端可以将key设置为NAS加密密钥，将count设置为上行NAS count，将将direction设置为上行方向所对应的比特值，将bearer设置为预设常数，将length设置为密钥流的长度，生成密钥流；之后，终端结合明文(也即未加密的隐私数据)和密钥流，生成密文(也即加密后的隐私数据)。
作为一种实现方式，终端的RRC层将隐私数据发送给终端的NAS层；之后，终端的NAS层根据预先存储的NAS安全上下文，对隐私数据进行NAS安全保护。
S102、终端向移动管理网元发送经过NAS安全保护的隐私数据，以使得移动管理网元接收来自终端的经过NAS安全保护的隐私数据。
其中，在4G网络中，移动管理网元可以为移动管理实体(mobility management entity，MME)；在5G网络中，移动管理网元可以为AMF；在未来的演进系统中，移动管理网元可以为类似MME/AMF的NAS安全终结点。在此统一说明，以下不再赘述。
示例性的，在隐私数据仅接受完整性保护的情况下，经过NAS安全保护的隐私数据包括：未加密的隐私数据和第一上行NAS MAC。在隐私数据接受完整性保护和加密保护的情况下，经过NAS安全保护的隐私数据包括：加密后的隐私数据和第一上行NAS MAC。
S103、移动管理网元在对经过NAS安全保护的隐私数据进行解安全保护之后，存储所述隐私数据。
可以理解的是，在隐私数据接受完整性保护的情况下，解安全保护操作包括完整性校验。在隐私数据接受完整性保护的情况下，解安全保护操作包括解密。
示例性的，移动管理网元对经过NAS安全保护的隐私数据进行完整性校验，可以具体实现为：移动管理网元根据NAS完整性保护密钥、NAS完整性保护参数、隐私数据、以及完整性保护算法，生成第二NAS MAC。之后，移动管理网元根据第二NAS MAC，确定第二上行NAS MAC。移动管理网元比对第一上行NAS MAC和第二上行NAS MAC是否相同。若第一上行NAS MAC和第二上行NAS MAC相同，则移动管理网元确定终端上报的隐私数据是完整的。否则，移动管理网元确定终端上报的隐私数据是不完整的。
在本申请实施例中，第二NAS MAC可以划分为第二上行NAS MAC和第二下行NAS MAC。第二上行NAS MAC是第二NAS MAC的一部分比特，第二下行NAS MAC是第二NAS MAC的另一部分比特。例如，第二NAS MAC可以包括32个比特，第二上行NAS MAC为第二NAS MAC的前16个比特，第二下行NAS MAC为第二NAS MAC的后16个比特。
示例性的，移动管理网元对经过NAS安全保护的隐私数据进行解密操作，可以具体实现为：移动管理网元根据NAS加密参数以及NAS加密算法，生成密钥流。之后，移动管理网元根据密钥流和密文，获得明文(也即解密后的隐私数据)。
可选的，在成功对隐私数据解安全保护之后，移动管理网元还可以为该隐私数据生成对应的标识信息，该标识信息用于唯一标识该隐私数据。例如，以隐私数据为无线能力参数为例，移动管理网元可以生成无线能力参数所对应的无线能力标识。这样一来，移动管理网元建立并存储了隐私数据与标识信息之间的对应关系。
在移动管理网元为隐私数据生成对应的标识信息之后，移动管理网元将该标识信息发送给终端。从而，终端在下一次向网络侧上报隐私数据的时候，终端可以不发送隐私数据，而是发送隐私数据的标识信息。其他网元(例如接入网设备)可以根据该标识信息，从移动管理网元获取到隐私数据。
需要说明的是，若移动管理网元不能成功对经过NAS安全保护的隐私数据进行解安全保护，也即移动管理网元确定经过NAS安全保护的隐私数据未通过完整性校验，或者，移动管理网元不能对经过NAS安全保护的隐私数据进行解密，则移动管理网元丢弃该经过NAS安全保护的隐私数据。可选的，移动管理网元还可以通知终端重新发 送经过NAS安全保护的隐私数据。
基于图9所示的技术方案，终端在未与接入网设备建立AS安全上下文的情况下，终端向移动管理网元发送经过NAS安全保护的隐私数据，以保证隐私数据在传输过程中的安全性。
下面结合步骤S102的不同实现方式，对图9所示的技术方案进行具体说明。
(1)如图10所示，步骤S102可以具体实现为步骤S201。
S201、终端向移动管理网元发送经过NAS安全保护的第一NAS消息，以使得移动管理网元接收到经过NAS安全保护的第一NAS消息。其中，第一NAS消息包括隐私数据。
可以理解的是，由于第一NAS消息经过NAS安全保护，因此第一NAS消息所包括的隐私数据同样经过NAS安全保护。
一种可能的设计中，第一NAS消息可以复用已有的NAS消息，例如初始NAS消息或者NAS SMP消息。已有的NAS消息可以增加受保护的用于承载隐私数据的信元。已有的NAS消息中还可以包括指示信息，该指示信息用于指示该已有的NAS消息携带了经过NAS安全保护的隐私数据。
可选的，在第一NAS消息为初始NAS消息的情况下，隐私数据可以采用初始NAS安全机制进行保护，例如初始NAS消息的非明文信息包括隐私数据。
另一种可能的设计中，第一NAS消息也可以为新增的用于承载隐私数据的NAS消息。
可以理解的是，第一NAS消息可以作为一条完整的NAS消息来传输，也可以分为多条NAS消息来传输，本申请实施例对此不作限定。
作为一种可能的实现方式，终端的NAS层在对隐私数据进行NAS安全保护之后，终端的NAS层向移动管理网元发送第一NAS消息。
可选的，如图10所示，数据传输方法在步骤S201之后，还可以包括步骤S202。
S202、移动管理网元向终端发送第二NAS消息，以使得终端接收来自移动管理网元的第二NAS消息。其中，第二NAS消息用于指示移动管理网元成功接收到第一NAS消息。
(2)如图11所示，步骤S102可以具体实现为步骤S301-S302。
S301、终端向接入网设备发送第一RRC消息，以使得接入网设备接收来自终端的第一RRC消息。其中，第一RRC消息包括经过NAS安全保护的隐私数据。
可选的，第一RRC消息包括经过NAS安全保护的隐私数据，包括以下情形之一：
情形一、第一RRC消息包括：第一上行NAS MAC和加密后的隐私数据；
情形二、第一RRC消息包括：第一上行NAS MAC和未加密的隐私数据；
情形三、第一RRC消息包括：第一NAS容器，该第一NAS容器包括第一上行NAS MAC和加密后的隐私数据；
情形四、第一RRC消息包括：未加密的隐私数据和第二NAS容器，该第二NAS容器包括第一上行NAS MAC。
可选的，第一RRC消息还可以包括上行NAS count的一部分比特，例如上行NAS count的最低5比特。
作为一种可能的实现方式，终端的NAS层在对隐私数据进行NAS安全保护之后，终端的NAS层向终端的RRC层发送经过NAS安全保护的隐私数据。之后，终端的RRC层将经过NAS安全保护的隐私数据封装为第一RRC消息，并将第一RRC消息发送给接入网设备。
S302、接入网设备向移动管理网元发送经过NAS安全保护的隐私数据，以使得移动管理网元接收到来自经过NAS安全保护的隐私数据。
可选的，在移动管理网元为AMF的情况下，经过NAS安全保护的隐私数据承载于N2消息中；在移动管理网元为MME的情况下，经过NAS安全保护的隐私数据承载于S1消息中。
可以理解的是，若第一RRC消息包括第一上行NAS MAC和加密后的隐私数据，则接入网设备向移动管理网元发送第一上行NAS MAC和加密后的隐私数据。若第一RRC消息包括第一上行NAS MAC和未加密的隐私数据，则接入网设备向移动管理网元发送第一上行NAS MAC和未加密的隐私数据。若第一RRC消息包括第一NAS容器，则接入网设备向移动管理网元发送第一NAS容器。若第一RRC消息包括未加密的隐私数据和第二NAS容器，则接入网设备向移动管理网元发送未加密的隐私数据和第二NAS容器。
需要说明的是，在第一RRC消息包括第一NAS容器或者第二NAS容器的情况下，接入网设备不对第一NAS容器或者第二NAS容器进行解析，而是直接上传给移动管理网元，减少接入网设备对于第一RRC消息所包括的内容的处理时间。
可选的，除了经过NAS安全保护的隐私数据之外，接入网设备还可以向移动管理网元发送目标小区信息。
下面结合具体应用场景，来介绍第一类型终端与网络侧之间传输隐私数据的具体实现过程。
如图12所示，为本申请实施例提供的一种数据传输方法，该方法包括以下步骤：
S401、终端与核心网之间已建立NAS安全上下文。
S402、终端根据NAS安全上下文，对隐私数据进行NAS安全保护。
S403、终端向移动管理网元发送经过NAS安全保护的第一NAS消息，以使得移动管理网元接收经过NAS安全保护的第一NAS消息。
可选的，在注册流程、小区切换流程或者其他流程中，若终端确定自身为第一类型终端，则在终端与核心网之间建立NAS安全上下文之后，终端可以主动执行上述步骤S402和S403，以保证网络侧可以获取到具有经过NAS安全保护的隐私数据，从而网络侧可以正常地使用该隐私数据。
S404、移动管理网元对经过NAS安全保护的第一NAS消息进行解安全保护，获取并存储终端的隐私数据。
在接入网设备需要获取终端的隐私数据的情况下，接入网设备可以执行下述步骤S405。
下面具体说明接入网设备执行步骤S405的触发条件。
触发条件1、接入网设备接收到移动管理网元下发的特定消息，该特定消息中未携带终端的隐私数据。
例如，以终端的隐私数据为无线能力信息为例，接入网设备接收到MME下发的S1消息，该S1消息未携带无线能力信息。该S1消息可以为初始上下文建立请求(INITIAL CONTEXT SETUP REQUEST)、连接建立指示(CONNETION ESTABLISHMENT INDICATION)、UE无线能力匹配请求(UE RADIO CAPABILITY MATCH REQUEST)等。
触发条件2、接入网设备准备进行需要使用终端的隐私数据的配置。
例如，接入网设备准备进行从E-UTRAN切换到UTRAN的流程、双链接选择等。
触发条件3、接入网设备接收到来自移动管理网元的触发消息，该触发消息用于指示接入网设备获取终端的隐私数据。
例如，对于第二类型终端来说，第二类型终端在执行附着(attach)流程，或者第二类型终端在附着GERAN/UTRAN之后的第一次TAU流程，或者第二类型终端执行用于终端无线能力上报的TAU流程，MME会删除终端的无线能力信息，并且向接入网设备发送S1消息，以触发接入网设备获取终端的无线能力信息。
又例如，对于第一类型终端来说，第一类型终端在执行附着(attach)流程，或者第一类型终端在GERAN/UTRAN附着网络之后的第一次TAU流程，或者第一类型终端执行用于终端无线能力上报的TAU流程，MME向接入网设备下发DOWNLINK NAS TRANSPORT消息，该DOWNLINK NAS TRANSPORT消息携带指示信息，以触发接入网设备获取终端的无线能力信息。
又例如，当MME根据单一无线语音呼叫连续性(single radio voice call continuity，SRVCC)能力、终端用例类型或者本地策略，需要更多的终端无线能力信息以配置支持IP多媒体子系统(IP multimedia subsystem，IMS)语音的分组交换(packet switch，PS)会话指示(IMS voice over PS Session Supported Indication)时，MME向接入网设备请求终端的无线能力信息。
S405、接入网设备判断终端是否为第一类型终端。
其中，步骤S405可以表述为：接入网设备判断终端是否具备AS安全保护能力。
可以理解的是，终端为第一类型终端，相当于终端不具备AS安全保护能力。终端不为第一类型终端，相当于终端具备AS安全保护能力。
可选的，接入网设备判断终端是否为第一类型终端，可以采用以下实现方式中的任意一种：
实现方式一、接入网设备根据终端所接入的小区类型，判断终端是否为第一类型终端。具体的，在终端接入第一类型小区的情况下，接入网设备可以确定终端为第一类型终端。在终端未接入第一类型小区的情况下，接入网设备可以确定终端不为第一类型终端。
其中，第一类型小区为第一类型终端所接入的小区，例如NB-Iot小区。
实现方式二、接入网设备根据终端所发送的消息类型，判断终端是否为第一类型终端。具体的，在终端发送第一类型消息的情况下，接入网设备可以确定终端为第一类型终端；在终端不发送第一类型消息的情况下，接入网设备可以确定终端不为第一类型终端。
其中，第一类型消息为第一类型终端所发送的消息。例如，第一类型消息可以为 RRCSetupRequest-NB，或者Connection Establishment Indication。
实现方式三、接入网设备根据终端的网络能力信息，确定终端是否为第一类型终端。具体的，在终端的网络能力信息指示终端为第一类型终端的情况下，接入网设备可以确定终端为第一类型终端。在终端的网络能力指示信息未指示终端为第一类型终端的情况下，接入网设备可以确定终端不为第一类型终端。
实现方式四、接入网设备根据是否接收到第二指示信息，确定终端是否为第一类型终端。例如，在接入网设备接收到终端所发送的第二指示信息的情况下，接入网设备确定终端为第一类型终端；在接入网设备未接收到第二指示信息的情况下，接入网设备确定终端不为第一类型终端。
可以理解的是，上述实现方式一至实现方式四仅为示例，本申请实施例对于接入网设备判断终端是否为第一类型终端的实现方式不作具体限定。
下面以第一终端为CP优化的NB-IoT终端/CIoT终端为例，具体说明步骤S405的实现方式。
可选的，接入网设备可以先通过判断终端是否为物联网终端，再进一步判断终端是否为CP优化的NB-IoT终端/CIoT终端。若终端不为物联网终端，则接入网设备可以确定该终端不为CP优化的NB-IoT终端/CIoT终端。
例如，接入网设备可以根据终端所接入的小区类型，判断终端是否为物联网终端。具体的，在终端接入物联网小区时，接入网设备可以确定终端为物联网终端。在终端未接入物联网小区时，接入网设备可以确定终端不为物联网终端。
又例如，接入网设备根据终端所发送的RRC消息类型，判断终端是否为物联网终端。具体的，终端所发送的RRC消息与物联网终端的RRC消息在类型上相同时，该终端即为物联网终端；反之，该终端不为物联网终端。举例来说，在终端发送RRCSetupRequest-NB消息时，接入网设备可以确定终端为物联网终端。
可选的，接入网设备可以在判断当前终端为物联网终端后，进一步判断终端是否为CP优化终端。
例如，若接入网设备接收到特定类型的消息，则接入网设备可以确定终端为CP优化终端。该特定类型的消息可以为Connection Establishment Indication。
又例如，在终端的网络能力信息指示终端为CP优化终端的情况下，接入网设备可以确定终端为CP优化终端；在终端的网络能力信息指示终端不为CP优化终端的情况下，接入网设备确定终端不为CP优化终端。
在实际应用中，接入网设备可以先判断终端是否物联网终端，再进一步判断该终端是否支持CP优化，从而准确确定该终端是否为CP优化的NB-IoT终端/CIoT终端。或者，接入网设备可以先判断终端是否支持CP优化，再进一步判断终端是否为物联网终端，从而准确确定该终端是否为CP优化的NB-IoT终端/CIoT终端。
需要说明的是，在终端不为第一类型终端的情况下，接入网设备按照现有流程来获取终端的隐私数据，此处不再赘述。
需要说明的是，在终端为第一类型终端的情况下，由于接入网设备与第一类型终端之间不能建立AS安全上下文，因此接入网设备不宜按照现有流程，直接向第一类型终端请求隐私数据，以避免不具备AS安全保护的隐私数据在第一类型终端与接入 网设备之间传输，从而给予攻击者篡改第一类型终端的隐私数据的机会。基于此，接入网设备不向终端发送第一请求消息，而是执行下述步骤S406。
其中，第一请求消息用于请求终端向接入网设备发送终端的隐私数据。具体的，在隐私数据为无线能力信息的情况下，第一请求消息可以为无线能力请求消息。
S406、接入网设备向移动管理网元发送第二请求消息，以使得移动管理网元接收接入网设备发送的第二请求消息。
其中，第二请求消息用于请求移动管理网元向接入网设备发送终端的隐私数据。
需要说明的是，在移动管理网元为AMF的情况下，第二请求消息为N2消息。在移动管理网元为MME的情况下，第二请求消息为S1消息。
一种可能的设计中，第二请求消息是专门用于获取终端的隐私数据的N2消息/S1消息。
另一种可能的设计中，第二请求消息复用现有的N2消息/S1消息。并且，第二请求消息包括第一指示信息，该第一指示信息用于指示移动管理网元向接入网设备发送终端的隐私数据。
示例性的，第二请求消息可以为检索UE信息(Retrive UE Information)，UE能力信息指示(UE Capability Info Indication)等。
可选的，第二请求消息包括终端信息或者隐私数据对应的标识信息。示例性的，终端信息可以为国际移动台设备标识(international mobile station equipment identity，IMEI)，本申请实施例对此不作限定。
可选的，第二请求消息还可以包括第二指示信息。第二指示信息用于指示终端为第一类型终端。或者说，第二指示信息用于指示终端不具备AS安全保护能力。
S407、移动管理网元向接入网设备发送终端的隐私数据，以使得接入网设备接收到终端的隐私数据。
可以理解的是，由于在步骤S404中，移动管理网元已获取并存储了终端的隐私数据。因此，移动管理网元可以根据第二请求消息，查找到终端的隐私数据，从而移动管理网元直接向接入网设备发送终端的隐私数据。
可选的，移动管理网元根据第二请求消息，查找到终端的隐私数据，可以具体实现为：移动管理网元根据第二请求消息所包括的终端信息或者标识信息，查找到终端的隐私数据。
作为一种可能的实现方式，移动管理网元向接入网设备发送第二响应消息，以使得接入网设备接收来自移动管理网元的第二响应消息。其中，第二响应消息用于响应第二请求消息。第二响应消息包括终端的隐私数据。
需要说明的是，在移动管理网元为AMF的情况下，第二响应消息为N2消息。在移动管理网元为MME的情况下，第二响应消息为S1消息。
可选的，第二响应消息可以为新增的N2消息/S1消息；或者，第二响应消息可以复用现有的N2消息/S1消息。
示例性的，第二响应消息可以为初始上下文建立请求(INITIAL CONTEXT SETUP REQUEST)、连接建立指示(CONNETION ESTABLISHMENT INDICATION)、下行NAS传输(DOWNLINK NAS TRANSPROT)、UE信息传输(UE INFORMATION  TRANSFER)、UE无线能力匹配请求(UE RADIO CAPABILITY MATCH REQUEST)等，本申请实施例不限于此。
S408、接入网设备使用终端的隐私数据。
基于图12所示的技术方案，第一类型终端主动向移动管理网元发送经过NAS安全保护的隐私数据，从而在接入网设备需要获取第一类型终端的隐私数据的情况下，移动管理网元可以向接入网设备发送隐私数据。从而，接入网设备获取第一类型终端的隐私数据的流程中，第一类型终端的隐私数据不会由于在不具备安全保护的情况下传输，从而避免第一类型终端的隐私数据被攻击者篡改，保证第一类型终端的隐私数据在传输过程中的安全性。
如图13(a)所示，为本申请实施例提供的一种数据传输方法，该方法包括以下步骤：
S501、终端与核心网之间建立NAS安全上下文。
S502、移动管理网元判断是否存储有效的隐私数据。
其中，有效的隐私数据是指未被标记删除的隐私数据。
可以理解的是，在一些场景下，例如终端上报无线能力信息流程中，或者终端的附着流程中，移动管理网元虽然存储着终端的隐私数据，但该隐私数据会被标记为删除。标记为删除的隐私数据会被移动管理网元删除。
作为一种可能的实现方式，移动管理网元根据终端信息或者标识信息，在数据库中查找终端的隐私数据。当移动管理网元未查找到终端的隐私数据，或者移动管理网元查找到的终端的隐私数据被标记删除时，移动管理网元可以确定未存储有效的隐私数据。当移动管理网元可以查找到终端的隐私数据，且该隐私数据未被标记删除时，移动管理网元可以确定已存储有效的隐私数据。
在移动管理网元预先存储有效的隐私数据的情况下，移动管理网元向接入网设备发送终端的隐私数据，其具体实现过程可以参考上述步骤S407的相关描述，在此不再赘述。
在移动管理网元未存储有效的隐私数据的情况下，移动管理网元执行下述步骤S503；或者，移动管理网元可以跳过步骤S503，直接执行步骤S504。
S503、移动管理网元判断终端是否是第一类型终端。
可选的，移动管理网元判断终端是否为第一类型终端，可以采用以下实现方式中的任意一种：
实现方式一、移动管理网元根据终端的网络能力信息，确定终端是否为第一类型终端。具体的，在终端的网络能力信息指示终端为第一类型终端的情况下，移动管理网元可以确定终端为第一类型终端。在终端的网络能力指示信息未指示终端为第一类型终端的情况下，接入网设备可以确定终端不为第一类型终端。
示例性的，网络能力信息中存在第一信元，该第一信元用于指示终端是否支持CP优化。这里CP优化具体是指：CIoT演进的分组系统(evolved packet system，EPS)的CP优化(control Plane CIoT EPS Optimisation)。该第一信元可以称为“偏好的网络行为”信元。
在第一信元用于指示终端支持CP优化的情况下，移动管理网元可以确定终端为 第一类型终端；在第一信元用于指示终端不支持CP优化的情况下，移动管理网元可以确定终端不为第一类型终端。
实现方式二、移动管理网元根据是否接收到第二指示信息，确定终端是否为第一类型终端。例如，在移动管理网元接收到接入网设备所发送的第二指示信息的情况下，移动管理网元确定终端为第一类型终端；在移动管理网元未接收到第二指示信息的情况下，移动管理网元确定终端不为第一类型终端。
可以理解的是，上述实现方式仅为示例，本申请实施例对于移动管理网元判断终端是否为第一类型终端的实现方式不作具体限定。
在终端不为第一类型终端的情况下，移动管理网元可以按照现有技术中的流程，向接入网设备发送第三请求消息，所述第三请求消息用于触发接入网设备从终端获取到隐私数据。
在终端为第一类型终端的情况下，移动管理网元不向接入网设备发送第三请求消息，而是执行下述步骤S504。
S504、移动管理网元向终端发送第三NAS消息，以使得终端接收来自移动管理网元的第三NAS消息。其中，第三NAS消息用于请求终端向移动管理网元发送经过NAS安全保护的隐私数据。
一种可能的设计中，第三NAS消息是专门用于请求获取终端的隐私数据的NAS消息。
另一种可能的设计中，第三NAS消息复用现有的NAS消息。并且，第三NAS消息包括第三指示信息，第三指示信息用于指示终端向移动管理网元发送经过NAS安全保护的隐私数据。
对于终端来说，终端的NAS层在接收到第三NAS消息之后，会向终端的RRC层请求终端的隐私数据，以便于终端的NAS层对终端的隐私数据进行NAS安全保护。
S505、终端根据NAS安全上下文，对隐私数据进行NAS安全保护。
S506、终端向移动管理网元发送经过NAS安全保护的第一NAS消息，以使得移动管理网元接收经过NAS安全保护的第一NAS消息。
S507、移动管理网元根据NAS安全上下文，对经过NAS安全保护的第一NAS消息进行解安全保护，获取到终端的隐私数据。
可选的，在移动管理网元获取到终端的隐私数据之后，移动管理网元存储该终端的隐私数据。
S508、移动管理网元向接入网设备发送终端的隐私数据，以使得接入网设备接收到终端的隐私数据。
S509、接入网设备使用终端的隐私数据。
基于图13(a)所示的技术方案，在第一类型终端与核心网之间建立安全上下文之后，移动管理网元通过向第一类型终端发送第三NAS消息，以触发第一类型终端上报隐私数据。这样一来，网络侧可以获知第一类型终端的隐私数据。
基于图13(a)所示的技术方案，如图13(b)所示，该数据传输方法在步骤S503之前还包括步骤S510和S511。
S510、接入网设备判断终端是否为第一类型终端。
S511、接入网设备向移动管理网元发送第二请求消息，以使得移动管理网元接收接入网设备发送的第二请求消息。
其中，S510-S511、与步骤S405-S406相同，具体描述可参考上文，在此不再赘述。
基于图13(b)所示的技术方案，在接入网设备需要获取终端的隐私数据的情况下，接入网设备可以通过向移动管理网元发送第一请求消息，以获取终端的隐私数据。
如图14所示，为本申请实施例提供的一种数据传输方法，该方法包括以下步骤：
S601、终端与核心网之间已建立NAS安全上下文。
S602、在接入网设备需要获取终端的隐私数据的情况下，接入网设备向终端发送第一请求消息，以使得终端接收来自接入网设备的第一请求消息。
S603、在终端为第一类型终端的情况下，终端根据NAS安全上下文，对终端的隐私数据进行NAS安全保护。
S604、终端向接入网设备发送第一RRC消息，以使得接入网设备接收第一RRC消息。其中，第一RRC消息包括经过NAS安全保护的隐私数据。
可选的，第一RRC消息可以携带第二指示信息，第二指示信息用于指示终端为第一类型终端。
S605、接入网设备向移动管理网元发送经过NAS安全保护的隐私数据。
作为一种可能的实现方式，接入网设备在确定终端为第一类型终端的情况下，向移动管理网元发送经过NAS安全保护的隐私数据。
S606、移动管理网元对经过NAS安全保护的隐私数据进行解安全保护。
S607、移动管理网元向接入网设备发送终端的隐私数据，以使得接入网设备接收终端的隐私数据。
S608、接入网设备使用终端的隐私数据。
如图15所示，在第一RRC消息包括未加密的隐私数据的情况下，步骤S607可以替换为步骤S609。
S609、移动管理网元向接入网设备发送校验成功消息，以使得接入网设备接收校验成功消息。
其中，校验成功消息用于指示第一上行NAS MAC通过校验。
基于图14或者图15所示的技术方案，接入网设备与第一类型终端之间传输隐私数据的流程复用现有技术中的流程，具有较好的兼容性。同时，第一类型终端所发送的第一RRC消息中，终端的隐私数据接受了经过NAS安全保护，从而保证终端的隐私数据在传输过程中的安全性。
如图16所示，为本申请实施例提供的一种数据传输方法，该方法包括以下步骤：
S701、在接入网设备需要获取终端的隐私数据的情况下，接入网设备向终端发送第一请求消息，以使得终端接收来自接入网设备的第一请求消息。
S702、终端向接入网设备发送第一响应消息，以使得接入网设备接收到第一响应消息。
其中，第一响应消息用于响应第一请求消息。
可选的，在终端为第一类型终端的情况下，第一响应消息包括未进行AS安全保护的隐私数据。在终端不为第一类型终端的情况下，第一响应消息包括AS安全保护 的隐私数据。
在第一响应消息包括未进行AS安全保护的隐私数据的情况下，该数据传输方法包括以下步骤S703。
S703、接入网设备临时使用终端的隐私数据。
可以理解的是，若第一响应消息包括未进行AS安全保护的隐私数据，则第一响应消息所包括的隐私数据存在被篡改的安全风险，因此接入网设备仅是临时使用该终端的隐私数据，而不会存储该终端的隐私数据，从而保证通信网络的安全性。
另外，在隐私数据存在被篡改的安全风险的情况下，若接入网设备向移动管理网元发送隐私数据，使得移动管理网元存储的是可能被篡改的隐私数据。这样一来，在后续流程中，其他接入网设备从移动管理网元获取到的终端的隐私数据均是被篡改的，导致通信网络存在较大的安全风险。为了避免这种情况的发生，在第一响应消息包括未进行AS安全保护的隐私数据的情况下，接入网设备不向移动管理网元发送终端的隐私数据，以避免移动管理网元存储可能被篡改的隐私数据。
在第一响应消息包括AS安全保护的隐私数据的情况下，该数据传输方法包括以下步骤S704-S705。
S704、接入网设备对AS安全保护的隐私数据进行解安全保护，存储并使用隐私数据。
S705、在对AS安全保护的隐私数据进行解安全保护之后，接入网设备向移动管理网元发送终端的隐私数据，以使得移动管理网元接收终端的隐私数据。
S706、移动管理网元存储终端的隐私数据。
基于图16所示的技术方案，无论终端是否是第一类型终端，接入网设备沿用现有技术中的流程来获取终端的隐私数据。并且，在终端所发送的第一响应消息携带未进行AS安全保护的隐私数据的情况下，接入网设备仅是临时使用该隐私数据，并且接入网设备不向移动管理网元发送终端的隐私数据，以降低通信网络的安全风险。
当前，在TAU场景下，若接入网设备需要获取终端的隐私数据，而移动管理网未存储终端的隐私数据，则接入网设备会向终端请求隐私数据。但是，在TAU场景下，接入网设备不具备AS安全保护参数，因此接入网设备不能与终端建立AS安全上下文。从而，终端仅能向接入网设备发送无AS安全保护的隐私数据。由于隐私数据不具备AS安全保护，导致隐私数据在传输过程中存在被篡改的风险。
为了解决这一技术问题，本申请实施例提供一种数据传输方法。如图17所示，该数据传输方法包括以下步骤：
S801、终端向移动管理网元发送TAU请求消息，以使得移动管理网元接收来自终端的TAU请求消息。
其中，TAU请求消息用于请求更新跟踪区。
可以理解的是，在终端发送TAU请求消息的过程中，接入网设备负责接收终端所发送的TAU请求消息，并将TAU请求消息透传给移动管理网元。
S802、移动管理网元向接入网设备发送TAU响应消息和AS安全保护参数，以使得接入网设备接收到TAU响应消息和AS安全保护参数。
其中，AS安全保护参数用于建立接入网设备与终端之间的AS安全上下文。示例 性的，AS安全保护参数可以为KeNB。
作为一种可能的实现方式，在接入网设备需要获取终端的隐私数据，并且移动管理网元未存储终端的隐私数据的情况下，移动管理网元向接入网设备发送TAU响应消息和AS安全保护参数。
可以理解的是，TAU响应消息和AS安全保护参数可以位于同一N2消息/S1消息中；或者，TAU响应消息和AS安全保护参数可以位于不同的N2消息/S1消息中。
这样一来，在接收到AS安全保护参数之后，接入网设备根据AS安全保护参数，与终端之间建立AS安全上下文。
S803、接入网设备与终端之间执行AS安全模式命令(security mode command，SMC)流程。
其中，AS SMC流程用于建立接入网设备与终端之间的AS安全上下文。具体的，AS SMC流程用于协商终端与接入网设备之间的完整性保护和加密保护所使用的密钥和算法。
示例性的，AS SMC流程包括：接入网设备向终端发送AS SMC消息；之后，终端向接入网设备发送AS SMP消息。
S804、接入网设备向终端发送第一请求消息，以使得终端接收到第一请求消息。
S805、终端根据AS安全上下文，对终端的隐私数据进行AS安全保护。
S806、终端向接入网设备发送第一响应消息，以使得接入网设备接收到第一响应消息。其中，第一响应消息包括AS安全保护的隐私数据。
S807、接入网设备对AS安全保护的隐私数据进行解安全保护，存储并使用隐私数据。
S808、接入网设备将来自移动管理网元的TAU响应消息透传给终端。
需要说明的是，本申请实施例不限制步骤S808与步骤S803-S807之间的执行顺序。例如，可以先执行步骤S808，再执行步骤S803-S807；或者，先执行步骤S803-S807，再执行步骤S808；或者，同时执行步骤S803-S807，与步骤S808。
基于图17所示的技术方案，在TAU流程中，移动管理网元向接入网设备发送AS安全保护参数，以便于在接入网设备需要获取终端的隐私数据的情况下，接入网设备可以与终端之间建立AS安全上下文，从而终端可以对隐私数据进行AS安全保护，从而保证隐私数据在传输过程中的安全性。
下面结合具体应用场景对图18所示的技术方案进行具体介绍。
如图18所示，为本申请实施例提供的一种数据传输方法，该方法包括以下步骤：
S901、终端向接入网设备发送上行RRC消息，以使得接入网设备接收到上行RRC消息。
其中，上行RRC消息包括终端信息以及TAU请求消息。
S902、接入网设备在需要获取终端的隐私数据的情况下，向移动管理网元发送TAU请求消息以及第四指示信息。
其中，第四指示信息用于指示接入网设备需要获取终端的隐私数据。
可选的，第四指示信息可以相当于前文中的第一请求消息。
可以理解的是，TAU请求消息和第四指示信息可以承载于同一N2消息/S1消息中。 或者，TAU请求消息和第四指示信息承载于不同的N2消息/S1消息中。
示例性的，在TAU场景下，接入网设备需要获取终端的隐私数据，包括：接入网设备希望获知终端是否支持NAS DC。
S903、在移动管理网元接收到第四指示信息的情况下，移动管理网元判断是否存储有效的隐私数据。
在移动管理网元存储有效的隐私数据的情况下，移动管理网元向接入网设备发送终端的隐私数据和TAU响应消息。
在移动管理网元未存储有效的隐私数据的情况下，移动管理网元执行下述步骤S904。
S904、移动管理网元判断终端是否为第一类型终端。
在终端为第一类型终端的情况下，移动管理网元可以向终端发送第三NAS消息，以触发终端上报第一NAS消息，从而移动管理网元可以获取到终端的隐私数据。在移动管理网元获取到终端的隐私数据之后，移动管理网元向接入网设备发送终端的隐私数据和TAU响应消息。
在终端不为第一类型终端的情况下，数据传输方法可以包括以下步骤S905-S911。
S905-S911、与步骤S802-S808相同，具体描述可以参考上文，在此不再赘述。
上述主要从每一个网元之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，每一个网元，例如终端、接入网设备、以及移动管理网元，为了实现上述功能，其包含了执行每一个功能相应的硬件结构或软件模块，或两者结合。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对网络设备和终端进行功能模块的划分，例如，可以对应每一个功能划分每一个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应每一个功能划分每一个功能模块为例进行说明：
如图19所示，为本申请实施例提供的一种终端的结构示意图。所述终端包括通信模块201和处理模块202。其中，通信模块201用于支持终端执行图9中的步骤S102，图10中的步骤S201和S202，图11中的步骤S301，图12中的步骤S403，图13(a)中的步骤S504和S506，图14中的步骤S602和S604，图16中的步骤SS701和S702，图17中的步骤S803、S804和S806，图18中的步骤S901、S906、S907、S909和S911，和/或本申请实施例中终端需要执行的其他通信操作。处理模块202用于支持终端执行图9中的步骤S101，图12中的步骤S402，图13(a)中的步骤S505，图14中的步骤S603，图17中的步骤S805，图18中的步骤S908，和/或本申请实施例中终端需要执行的其他处理操作。
作为一个示例，结合图7所示的通信装置，图19中的处理模块202可以由图7中的处理器101来实现，图19中的通信模块201可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
如图20所示，为本申请实施例提供的一种移动管理网元的结构示意图。所述移动管理网元包括通信模块301和处理模块302。通信模块301用于支持移动管理网元执行图9中的步骤S102，图10中的步骤S201和S202，图11中的步骤S302，图12中的步骤S403、S406和S407，图13(a)中的步骤S504、S506和S508，图13(b)中的步骤S511，图14中的步骤S605和S607，图15中的步骤S609，图16中的步骤S705，图17中的步骤S801和S802，图18中的步骤S902和S905，和/或本申请实施例中的移动管理网元需要进行的其他通信操作。处理模块302用于支持移动管理网元执行图9中的步骤S103，图12中的步骤S404，图13(a)中的步骤S502、S503和S507，图14中的步骤S606，图16中的步骤S706，图9中的步骤S903和S904，和/或本申请实施例中的移动管理网元需要进行的其他处理操作。
作为一个示例，结合图7所示的通信装置，图20中的处理模块302可以由图7中的处理器101来实现，图20中的通信模块301可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
如图21所示，为本申请实施例提供的一种接入网设备的结构示意图。所述接入网设备包括通信模块401和处理模块402。
通信模块401用于支持接入网设备执行图11中的步骤S301和S302，图12中的步骤S406和S407，图13(a)中的步骤S508，图13(b)中的步骤S511，图14中的步骤S602、S604、S605和S607，图15中的步骤S609，图16中的步骤S701、S702和S705，图17中的步骤S802、S803、S804、S806和S808，图18中的步骤S901、S905、S905、S906、S907、S909和S911，和/或本申请实施例中接入网设备需要执行的其他通信操作。处理模块402用于支持接入网设备执行图12中的步骤S405和S408，图13(a)中的步骤S509，图13(b)中的步骤S510，图14中的步骤S608，图16中的步骤S703和S704，图17中的步骤S807，图18中的步骤S910，和/或本申请实施例中接入网设备需要执行的其他处理操作。
作为一个示例，结合图7所示的通信装置，图21中的处理模块402可以由图7中的处理器101来实现，图21中的通信模块401可以由图7中的通信接口104来实现，本申请实施例对此不作任何限制。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机指令；当所述计算机可读存储介质在计算机上运行时，使得该计算机执行本申请实施例所提供的数据传输方法。
本申请实施例还提供了一种包含计算机指令的计算机程序产品，当其在计算机上运行时，使得计算机可以执行本申请实施例提供的数据传输方法。
本申请实施例提供一种芯片，该芯片包括处理器，该处理器执行指令时，使得该芯片可以执行本申请实施例提供的数据传输方法。
应理解，所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个 网站站点、计算机、服务器或者数据中心通过有线(例如同轴电缆、光纤、数字用户线)或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可以用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)，光介质、或者半导体介质(例如固态硬盘)等。
通过以上的实施方式的描述，所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
应该理解到，在本申请所提供的几个实施例中所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何在本申请揭露的技术范围内的变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (93)

  1. 一种通信系统，其特征在于，包括接入网设备和移动管理网元；其中，
    所述接入网设备，用于在终端与所述接入网设备建立接入层AS上下文之前，将来自所述终端的经过非接入层NAS安全保护的无线能力信息发送给所述移动管理网元；接收来自所述移动管理网元的所述无线能力信息；其中，所述无线能力信息用于指示所述终端所支持的无线接入技术；
    所述移动管理网元，用于接收来自所述终端的且经过NAS安全保护的无线能力信息；在对经过NAS安全保护的无线能力信息进行解安全保护之后，向所述接入网设备发送所述无线能力信息。
  2. 根据权利要求1所述的通信系统，其特征在于，所述经过NAS安全保护的无线能力信息携带在所述终端发送的第一NAS消息中；其中，所述第一NAS消息经过NAS安全保护。
  3. 根据权利要求2所述的通信系统，其特征在于，所述第一NAS消息为初始NAS消息，或者NAS安全模式完成SMP消息。
  4. 根据权利要求3所述的通信系统，其特征在于，在所述第一NAS消息为所述初始NAS消息的情况下，所述初始NAS消息中的非明文信息包括所述无线能力信息。
  5. 根据权利要求2至4任一项所述的通信系统，其特征在于，
    所述移动管理网元，还用于向所述终端发送经过NAS安全保护的第二NAS消息，所述第二NAS消息用于指示所述移动管理网元已接收到所述第一NAS消息。
  6. 根据权利要求2至5任一项所述的通信系统，其特征在于，
    所述接入网设备，还用于在确定所述终端为第一类型终端的情况下，向所述移动管理网元发送第二请求消息；所述第二请求消息用于向所述移动管理网元请求所述无线能力信息；
    所述移动管理网元，还用于接收所述第二请求消息。
  7. 根据权利要求6所述的通信系统，其特征在于，
    所述接入网设备，还用于确定所述终端为第一类型终端。
  8. 根据权利要求7所述的通信系统，其特征在于，所述接入网设备，还用于确定所述终端为第一类型终端，具体为：
    所述接入网设备根据所述终端接入的小区，确定所述终端为所述第一类型终端；或者，
    所述接入网设备根据所述终端发送的消息，确定所述终端为所述第一类型终端；或者，
    所述接入网设备根据所述终端的网络能力指示，确定所述终端为第一类型终端。
  9. 根据权利要求6至8任一项所述的通信系统，其特征在于，所述第一类型终端为控制面CP优化的窄带物联网NB-IoT终端或者CP优化的蜂窝物联网CIoT终端。
  10. 根据权利要求6至8任一项所述的通信系统，其特征在于，
    所述接入网设备，还用于在确定所述终端为第一类型终端的情况下，不向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求所述无线能力信息。
  11. 根据权利要求1至10任一项所述的通信系统，其特征在于，
    所述移动管理网元，还用于在未存储有效的无线能力信息的情况下，向所述终端发送经过NAS安全保护的第三NAS消息，所述第三NAS消息用于向所述终端请求经过NAS安全保护的无线能力信息。
  12. 根据权利要求1所述的通信系统，其特征在于，
    所述接入网设备，还用于接收来自所述终端的第一RRC消息，所述第一RRC消息包括NAS容器，所述NAS容器包括加密后的无线能力信息以及上行NAS MAC；向所述移动管理网元发送所述NAS容器；
    所述移动管理网元，具体用于接收所述NAS容器。
  13. 一种数据传输方法，其特征在于，所述方法包括：
    终端在建立接入层AS安全上下文之前，根据预先存储的非接入层NAS安全上下文，对无线能力信息进行NAS安全保护，所述无线能力信息用于指示所述终端支持的无线接入技术；
    所述终端发送经过NAS安全保护的无线能力信息。
  14. 根据权利要求13所述的数据传输方法，其特征在于，所述终端在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对无线能力信息进行NAS安全保护，包括：
    所述终端的NAS层从所述终端的无线资源控制RRC层获取到所述无线能力信息；
    所述终端的NAS层根据预先存储的NAS安全上下文，对无线能力信息进行NAS安全保护。
  15. 根据权利要求14所述的数据传输方法，其特征在于，所述终端发送经过NAS安全保护的无线能力信息，包括：
    所述终端向接入网设备发送第一RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息。
  16. 根据权利要求15所述的数据传输方法，其特征在于，所述终端向接入网设备发送第一RRC消息，包括：
    所述终端的RRC层从所述终端的NAS层获取经过NAS安全保护的无线能力信息；
    所述终端的RRC层向所述接入网设备发送第一RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息。
  17. 根据权利要求15或16所述的数据传输方法，其特征在于，所述第一RRC消息包括经过NAS安全保护的无线能力信息，具体实现为：
    所述第一RRC消息包括NAS容器，所述NAS容器包括加密后的无线能力信息以及上行NAS MAC；或者，所述NAS容器包括未加密的无线能力信息以及上行NAS消息认证码MAC。
  18. 根据权利要求14所述的数据传输方法，其特征在于，所述经过NAS安全保护的无线能力信息携带在所述终端发送的第一NAS消息中；其中，所述第一NAS消息经过NAS安全保护。
  19. 根据权利要求18所述的数据传输方法，其特征在于，所述第一NAS消息为初始NAS消息或者NAS安全模式完成SMP消息。
  20. 根据权利要求19所述的数据传输方法，其特征在于，在所述第一NAS消息 为所述初始NAS消息的情况下，所述初始NAS消息的非明文信元包括所述无线能力信息。
  21. 根据权利要求18至20任一项所述的数据传输方法，其特征在于，所述方法还包括：
    所述终端接收移动管理网元发送的经过NAS安全保护的第二NAS消息，所述第二NAS消息用于指示所述移动管理网元已接收到所述第一NAS消息。
  22. 根据权利要求18至21任一项所述的数据传输方法，其特征在于，所述方法还包括：
    所述终端接收来自移动管理网元发送的经过NAS安全保护的第三NAS消息，所述第三NAS消息用于请求所述终端向所述移动管理网元发送经过NAS安全保护的无线能力信息。
  23. 根据权利要求13至22任一项所述的数据传输方法，其特征在于，所述终端为第一类型终端，所述第一类型终端与接入网设备之间不建立AS安全上下文。
  24. 根据权利要求23所述的数据传输方法，其特征在于，所述第一类型终端为控制面CP优化的窄带物联网NB-IoT终端或者CP优化的蜂窝物联网CIoT终端。
  25. 一种数据传输方法，其特征在于，所述方法包括：
    移动管理网元接收经过非接入层NAS安全保护的无线能力信息，所述无线能力信息用于指示终端支持的无线接入技术；
    所述移动管理网元根据预先存储的NAS安全上下文，对经过NAS安全保护的无线能力信息进行解安全保护，并存储所述无线能力信息。
  26. 根据权利要求25所述的数据传输方法，其特征在于，所述经过NAS安全保护的无线能力信息携带在所述终端发送的第一NAS消息中；其中，所述第一NAS消息经过NAS安全保护。
  27. 根据权利要求26所述的数据传输方法，其特征在于，所述第一NAS消息为初始NAS消息，或者NAS安全模式完成SMP消息。
  28. 根据权利要求27所述的数据传输方法，其特征在于，在所述第一NAS消息为初始NAS消息的情况下，所述初始NAS消息的非明文信元包括所述无线能力信息。
  29. 根据权利要求26至28任一项所述的数据传输方法，其特征在于，所述方法还包括：
    所述移动管理网元向所述终端发送经过NAS安全保护的第二NAS消息，所述第二NAS消息用于指示所述移动管理网元已接收到所述第一NAS消息。
  30. 根据权利要求26至29任一项所述的数据传输方法，其特征在于，所述方法还包括：
    所述移动管理网元接收接入网设备发送的第二请求消息，所述第二请求消息用于请求所述移动管理网元向所述接入网设备发送所述无线能力信息；
    所述移动管理网元向所述接入网设备发送所述无线能力信息。
  31. 根据权利要求30所述的数据传输方法，其特征在于，在所述移动管理网元向所述接入网设备发送所述无线能力信息之前，所述方法还包括：
    若所述移动管理网元未存储有效的无线能力信息，则所述移动管理网元向所述终 端发送第三NAS消息，所述第三NAS消息用于向所述终端请求经过NAS安全保护的无线能力信息。
  32. 根据权利要求25所述的数据传输方法，其特征在于，所述移动管理网元接收经过NAS安全保护的无线能力信息，包括：
    所述移动管理网元接收接入网设备发送的NAS容器，所述NAS容器包括加密后的无线能力信息以及上行NAS消息认证码MAC；或者，所述NAS容器包括未加密的无线能力信息以及上行NAS MAC。
  33. 根据权利要求32所述的数据传输方法，其特征在于，所述方法还包括：
    所述移动管理网元在对所述NAS容器进行解安全保护之后，向所述接入网设备发送所述无线能力信息。
  34. 根据权利要求32所述的数据传输方法，其特征在于，在所述NAS容器包括未加密的无线能力信息以及上行NAS MAC的情况下，所述方法还包括：
    所述移动管理网元对所述上行NAS MAC进行完整性校验；
    在所述上行NAS MAC通过完整性校验之后，所述移动管理网元向所述接入网设备发送校验成功消息，所述校验成功消息用于指示所述上行NAS MAC通过完整性校验。
  35. 一种数据传输方法，其特征在于，所述方法还包括：
    接入网设备确定终端为第一类型终端的情况下，向移动管理网元发送第二请求消息，所述第二请求消息用于向所述移动管理网元请求所述终端的无线能力信息，所述无线能力信息用于指示所述终端支持的无线接入技术；
    所述接入网设备接收所述移动管理网元发送的所述无线能力信息。
  36. 根据权利要求35所述的数据传输方法，其特征在于，所述方法还包括：
    所述接入网设备在确定所述终端为第一类型终端的情况下，不向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求所述无线能力信息。
  37. 根据权利要求35或36所述的数据传输方法，其特征在于，所述方法还包括：
    所述接入网设备在所述终端接入第一类型小区的情况下，确定所述终端为所述第一类型终端；所述第一类型小区为所述第一类型终端所接入的小区；或者，
    所述接入网设备在所述终端发送的消息为第一类型消息的情况下，确定所述终端为所述第一类型终端，所述第一类型消息为所述第一类型终端所发送的消息；或者，
    所述接入网设备在所述终端的网络能力指示所述终端为所述第一类型终端的情况下，确定所述终端为第一类型终端；或者，
    所述接入网设备在接收到所述终端发送的第二指示信息的情况下，确定所述终端为第一类型终端，所述第二指示信息用于指示所述终端为第一类型终端。
  38. 根据权利要求35至37任一项所述的数据传输方法，其特征在于，所述第一类型终端为控制面CP优化的窄带物联网NB-IoT终端或者CP优化的蜂窝物联网CIoT终端。
  39. 一种数据传输方法，其特征在于，所述方法包括：
    接入网设备接收终端发送的第一无线资源控制RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息，所述无线能力信息用于指示所述终端支持的无 线接入技术；
    所述接入网设备向移动管理网元发送所述经过NAS安全保护的无线能力信息。
  40. 根据权利要求39所述的数据传输方法，其特征在于，所述方法还包括：
    所述接入网设备向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求所述无线能力信息。
  41. 根据权利要求39或40所述的数据传输方法，其特征在于，所述第一RRC消息包括经过NAS安全保护的无线能力信息，具体实现为：
    所述第一RRC消息包括第一NAS容器，所述第一NAS容器包括加密后的无线能力信息以及上行NAS消息认证码MAC；或者，
    所述第一RRC消息包括第二NAS容器，所述第二NAS容器包括未加密的无线能力信息以及所述上行NAS MAC；或者，
    所述第一RRC消息包括加密后的无线能力信息以及所述上行NAS MAC；或者，
    所述第一RRC消息包括未加密的无线能力信息以及所述上行NAS MAC。
  42. 根据权利要求41所述的数据传输方法，其特征在于，所述方法还包括：
    所述接入网设备接收所述移动管理网元发送的所述无线能力信息。
  43. 根据权利要求41所述的数据传输方法，其特征在于，在所述第一RRC消息包括未加密的无线能力信息以及所述上行NAS MAC的情况下，所述方法还包括：
    所述接入网设备在接收到所述移动管理网元发送的校验成功消息之后，使用所述无线能力信息，所述校验成功消息用于指示所述上行NAS MAC通过完整性校验。
  44. 一种通信装置，其特征在于，包括：处理模块和通信模块；
    所述处理模块，用于在建立接入层AS安全上下文之前，根据预先存储的非接入层NAS安全上下文，对无线能力信息进行NAS安全保护，所述无线能力信息用于指示终端支持的无线接入技术；
    所述通信模块，用于发送经过NAS安全保护的无线能力信息。
  45. 根据权利要求44所述的通信装置，其特征在于，所述处理模块，用于在建立AS安全上下文之前，根据预先存储的NAS安全上下文，对无线能力信息进行NAS安全保护，包括：
    NAS层从无线资源控制RRC层获取到所述无线能力信息；
    NAS层根据预先存储的NAS安全上下文，对无线能力信息进行NAS安全保护。
  46. 根据权利要求45所述的通信装置，其特征在于，
    所述通信模块，具体用于向接入网设备发送第一RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息。
  47. 根据权利要求46所述的通信装置，其特征在于，所述通信模块，具体用于向接入网设备发送第一RRC消息，包括：
    RRC层从NAS层获取经过NAS安全保护的无线能力信息；
    RRC层向所述接入网设备发送第一RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息。
  48. 根据权利要求46或47所述的通信装置，其特征在于，所述第一RRC消息包括经过NAS安全保护的无线能力信息，具体实现为：
    所述第一RRC消息包括NAS容器，所述NAS容器包括加密后的无线能力信息以及上行NAS MAC；或者，所述NAS容器包括未加密的无线能力信息以及上行NAS消息认证码MAC。
  49. 根据权利要求45所述的通信装置，其特征在于，所述经过NAS安全保护的无线能力信息携带在所述终端发送的第一NAS消息中；其中，所述第一NAS消息经过NAS安全保护。
  50. 根据权利要求49所述的通信装置，其特征在于，所述第一NAS消息为初始NAS消息或者NAS安全模式完成SMP消息。
  51. 根据权利要求50所述的通信装置，其特征在于，在所述第一NAS消息为所述初始NAS消息的情况下，所述初始NAS消息的非明文信元包括所述无线能力信息。
  52. 根据权利要求49至51任一项所述的通信装置，其特征在于，
    所述通信模块，还用于接收移动管理网元发送的经过NAS安全保护的第二NAS消息，所述第二NAS消息用于指示所述移动管理网元已接收到所述第一NAS消息。
  53. 根据权利要求48至52任一项所述的通信装置，其特征在于，
    所述通信模块，还用于接收来自移动管理网元发送的经过NAS安全保护的第三NAS消息，所述第三NAS消息用于请求所述终端向所述移动管理网元发送经过NAS安全保护的无线能力信息。
  54. 根据权利要求44至53任一项所述的通信装置，其特征在于，所述通信装置为第一类型终端，所述第一类型终端与接入网设备之间不建立接入层AS安全上下文。
  55. 根据权利要求54所述的通信装置，其特征在于，所述第一类型终端为控制面CP优化的窄带物联网NB-IoT终端或者CP优化的蜂窝物联网CIoT终端。
  56. 一种通信装置，其特征在于，包括：
    通信模块，用于接收经过非接入层NAS安全保护的无线能力信息，所述无线能力信息用于指示终端支持的无线接入技术；
    处理模块，用于根据预先存储的NAS安全上下文，对经过NAS安全保护的无线能力信息进行解安全保护，并存储所述无线能力信息。
  57. 根据权利要求56所述的通信装置，其特征在于，所述经过NAS安全保护的无线能力信息携带在所述终端发送的第一NAS消息中；其中，所述第一NAS消息经过NAS安全保护。
  58. 根据权利要求57所述的通信装置，其特征在于，所述第一NAS消息为初始NAS消息，或者NAS安全模式完成SMP消息。
  59. 根据权利要求58所述的通信装置，其特征在于，在所述第一NAS消息为初始NAS消息的情况下，所述初始NAS消息的非明文信元包括所述无线能力信息。
  60. 根据权利要求56至59任一项所述的通信装置，其特征在于，
    所述通信模块，还用于向所述终端发送经过NAS安全保护的第二NAS消息，所述第二NAS消息用于指示移动管理网元已接收到第一NAS消息。
  61. 根据权利要求56至60任一项所述的通信装置，其特征在于，
    所述通信模块，还用于接收接入网设备发送的第二请求消息，所述第二请求消息用于请求移动管理网元向所述接入网设备发送所述无线能力信息；向所述接入网设备 发送所述无线能力信息。
  62. 根据权利要求61所述的通信装置，其特征在于，
    所述通信模块，还用于若所述移动管理网元未存储有效的无线能力信息，则向所述终端发送第三NAS消息，所述第三NAS消息用于向所述终端请求经过NAS安全保护的无线能力信息。
  63. 根据权利要求56所述的通信装置，其特征在于，
    所述通信模块，具体用于接收接入网设备发送的NAS容器，所述NAS容器包括加密后的无线能力信息以及上行NAS消息认证码MAC；或者，所述NAS容器包括未加密的无线能力信息以及上行NAS MAC。
  64. 根据权利要求63所述的通信装置，其特征在于，
    所述处理模块，用于对所述NAS容器进行解安全保护；
    所述通信模块，还用于在对所述NAS容器进行解安全保护之后，向所述接入网设备发送所述无线能力信息。
  65. 根据权利要求63所述的通信装置，其特征在于，
    所述处理模块，还用于在所述NAS容器包括未加密的无线能力信息以及上行NAS MAC的情况下，对所述上行NAS MAC进行完整性校验；
    所述通信模块，还用于在所述上行NAS MAC通过完整性校验之后，向所述接入网设备发送校验成功消息，所述校验成功消息用于指示所述上行NAS MAC通过完整性校验。
  66. 一种通信装置，其特征在于，包括：
    处理模块，用于判断终端是否为第一类型终端；
    通信模块，用于在所述处理模块确定终端为第一类型终端的情况下，向移动管理网元发送第二请求消息，所述第二请求消息用于向所述移动管理网元请求所述终端的无线能力信息，所述无线能力信息用于指示所述终端支持的无线接入技术；接收所述移动管理网元发送的所述无线能力信息。
  67. 根据权利要求66所述的通信装置，其特征在于，
    所述通信模块，用于在所述处理模块确定所述终端为第一类型终端的情况下，不向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求所述无线能力信息。
  68. 根据权利要求66或67所述的通信装置，其特征在于，
    所述处理模块，用于在所述终端接入第一类型小区的情况下，确定所述终端为所述第一类型终端；所述第一类型小区为所述第一类型终端所接入的小区；或者，在所述终端发送的消息为第一类型消息的情况下，确定所述终端为所述第一类型终端，所述第一类型消息为所述第一类型终端所发送的消息；或者，在所述终端的网络能力指示所述终端为所述第一类型终端的情况下，确定所述终端为第一类型终端；或者，在接收到所述终端发送的第二指示信息的情况下，确定所述终端为第一类型终端，所述第二指示信息用于指示所述终端为第一类型终端。
  69. 根据权利要求66至68任一项所述的通信装置，其特征在于，所述第一类型终端为控制面CP优化的窄带物联网NB-IoT终端或者CP优化的蜂窝物联网CIoT终 端。
  70. 一种通信装置，其特征在于，包括：
    接收模块，用于接收终端发送的第一无线资源控制RRC消息，所述第一RRC消息包括经过NAS安全保护的无线能力信息，所述无线能力信息用于指示所述终端支持的无线接入技术；
    发送模块，用于向移动管理网元发送所述经过NAS安全保护的无线能力信息。
  71. 根据权利要求70所述的通信装置，其特征在于，
    所述发送模块，还用于向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求所述无线能力信息。
  72. 根据权利要求70或71所述的通信装置，其特征在于，所述第一RRC消息包括经过NAS安全保护的无线能力信息，具体实现为：
    所述第一RRC消息包括第一NAS容器，所述第一NAS容器包括加密后的无线能力信息以及上行NAS消息认证码MAC；或者，
    所述第一RRC消息包括第二NAS容器，所述第二NAS容器包括未加密的无线能力信息以及所述上行NAS MAC；或者，
    所述第一RRC消息包括加密后的无线能力信息以及所述上行NAS MAC；或者，
    所述第一RRC消息包括未加密的无线能力信息以及所述上行NAS MAC。
  73. 根据权利要求72所述的通信装置，其特征在于，
    所述接收模块，还用于接收所述移动管理网元发送的所述无线能力信息。
  74. 根据权利要求72所述的通信装置，其特征在于，所述通信装置还包括处理模块；
    所述处理模块，还用于在所述第一RRC消息包括未加密的无线能力信息以及所述上行NAS MAC的情况下，在接收到所述移动管理网元发送的校验成功消息之后，使用所述无线能力信息，所述校验成功消息用于指示所述上行NAS MAC通过完整性校验。
  75. 一种通信装置，其特征在于，包括处理器和通信接口，所述处理器用于执行计算机程序指令，使得所述通信装置实现权利要求13至43任一项所述的数据传输方法。
  76. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求13至43任一项所述的数据传输方法。
  77. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述计算机程序产品在计算机上运行时，使得所述计算机执行权利要求13至43任一项所述的数据传输方法。
  78. 一种芯片，其特征在于，所述芯片包括处理器，当所述处理器执行计算机程序指令时，使得所述芯片执行权利要求13至43任一项所述的数据传输方法。
  79. 一种通信系统，其特征在于，包括：移动管理网元和接入网设备；
    所述移动管理网元，用于接收跟踪区更新TAU请求消息，所述TAU请求消息用于请求更新跟踪区；在未存储有效的无线能力信息的情况下，向所述接入网设备发送 TAU响应消息和接入层AS安全保护参数，所述无线能力信息用于指示终端支持的无线接入技术，所述TAU响应消息用于响应所述TAU请求消息，所述AS安全保护参数用于建立所述终端与所述接入网设备之间的AS安全上下文；
    所述接入网设备，用于接收所述TAU响应消息和所述AS安全保护参数；根据所述AS安全保护参数，与所述终端建立AS安全上下文；向所述终端发送第一请求消息，所述第一请求消息用于请求所述终端向所述接入网设备发送所述无线能力信息；接收所述终端发送的第一响应消息，所述第一响应消息包括AS安全保护的无线能力信息。
  80. 根据权利要求79所述的通信系统，其特征在于，
    所述接入网设备，还用于根据述AS安全上下文，对AS安全保护的无线能力信息进行解安全保护；在成功对AS安全保护的无线能力信息进行解安全保护之后，使用所述无线能力信息。
  81. 根据权利要求79或80所述的通信系统，其特征在于，
    所述接入网设备，还用于向所述移动管理网元发送第四指示信息，所述第四指示信息用于指示所述接入网设备需要所述终端的无线能力信息；
    所述移动管理网元，还用于接收所述第四指示信息。
  82. 一种数据传输方法，其特征在于，包括：
    移动管理网元接收跟踪区更新TAU请求消息，所述TAU请求消息用于请求更新跟踪区；
    所述移动管理网元在未存储终端的无线能力信息的情况下，向接入网设备发送TAU响应消息和接入层AS安全保护参数，所述无线能力信息用于指示所述终端支持的无线接入技术，所述TAU响应消息用于响应所述TAU请求消息，所述AS安全保护参数用于建立所述终端与所述接入网设备之间的AS安全上下文。
  83. 根据权利要求82所述的数据传输方法，其特征在于，所述方法还包括：
    所述移动管理网元接收第四指示信息，所述第四指示信息用于指示所述接入网设备需要所述终端的无线能力信息。
  84. 一种数据传输方法，其特征在于，包括：
    接入网设备将来自终端的跟踪区更新TAU请求消息发送给移动管理网元，所述TAU请求消息用于请求更新跟踪区；
    所述接入网设备接收所述移动管理网元发送的TAU响应消息和接入层AS安全保护参数，所述TAU响应消息用于响应所述TAU请求消息，所述AS安全保护参数用于建立所述终端与所述接入网设备之间的AS安全上下文；
    所述接入网设备根据所述AS安全保护参数，建立与终端的AS安全上下文；
    所述接入网设备向所述终端发送第一请求消息，所述第一请求消息用于向终端请求无线能力信息，所述无线能力信息用于指示所述终端支持的无线接入技术；
    所述接入网设备接收所述终端发送的第一响应消息，所述第一响应消息包括AS安全保护的无线能力信息。
  85. 根据权利要求84所述的数据传输方法，其特征在于，所述方法还包括：
    所述接入网设备向所述移动管理网元发送第四指示信息，所述第四指示信息用于指示所述接入网设备需要所述终端的无线能力信息。
  86. 一种通信装置，其特征在于，包括：
    接收模块，用于接收跟踪区更新TAU请求消息，所述TAU请求消息用于请求更新跟踪区；
    发送模块，用于在未存储终端的无线能力信息的情况下，向接入网设备发送TAU响应消息和接入层AS安全保护参数，所述无线能力信息用于指示所述终端支持的无线接入技术，所述TAU响应消息用于响应所述TAU请求消息，所述AS安全保护参数用于建立所述终端与所述接入网设备之间的AS安全上下文。
  87. 根据权利要求86所述的通信装置，其特征在于，
    所述接收模块，还用于接收第四指示信息，所述第四指示信息用于指示所述接入网设备需要所述终端的无线能力信息。
  88. 一种通信装置，其特征在于，包括：
    发送模块，用于将来自终端的跟踪区更新TAU请求消息发送给移动管理网元，所述TAU请求消息用于请求更新跟踪区；
    接收模块，用于接收所述移动管理网元发送的TAU响应消息和接入层AS安全保护参数，所述TAU响应消息用于响应所述TAU请求消息，所述AS安全保护参数用于建立所述终端与接入网设备之间的AS安全上下文；
    建立模块，用于根据所述AS安全保护参数，建立与终端的AS安全上下文；
    所述发送模块，还用于向所述终端发送第一请求消息，所述第一请求消息用于向所述终端请求无线能力信息，所述无线能力信息用于指示所述终端支持的无线接入技术；
    所述接收模块，还用于接收所述终端发送的第一响应消息，所述第一响应消息包括AS安全保护的无线能力信息。
  89. 根据权利要求88所述的通信装置，其特征在于，
    所述发送模块，还用于向所述移动管理网元发送第四指示信息，所述第四指示信息用于指示所述接入网设备需要所述终端的无线能力信息。
  90. 一种通信装置，其特征在于，包括处理器和通信接口，所述处理器用于执行计算机程序指令，使得所述通信装置实现权利要求82至85任一项所述的数据传输方法。
  91. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有指令，当所述指令在计算机上运行时，使得所述计算机执行权利要求82至85任一项所述的数据传输方法。
  92. 一种计算机程序产品，其特征在于，所述计算机程序产品包括指令，当所述计算机程序产品在计算机上运行时，使得所述计算机执行权利要求82至85任一项所述的数据传输方法。
  93. 一种芯片，其特征在于，所述芯片包括处理器，当所述处理器执行计算机程序指令时，使得所述芯片执行权利要求82至85任一项所述的数据传输方法。
PCT/CN2019/106036 2019-09-16 2019-09-16 数据传输方法及装置 WO2021051250A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP19945845.6A EP4024958A4 (en) 2019-09-16 2019-09-16 DATA TRANSMISSION METHOD AND DEVICE
PCT/CN2019/106036 WO2021051250A1 (zh) 2019-09-16 2019-09-16 数据传输方法及装置
CN201980096565.5A CN113841443B (zh) 2019-09-16 2019-09-16 数据传输方法及装置
US17/695,140 US20220210859A1 (en) 2019-09-16 2022-03-15 Data transmission method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/106036 WO2021051250A1 (zh) 2019-09-16 2019-09-16 数据传输方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/695,140 Continuation US20220210859A1 (en) 2019-09-16 2022-03-15 Data transmission method and apparatus

Publications (1)

Publication Number Publication Date
WO2021051250A1 true WO2021051250A1 (zh) 2021-03-25

Family

ID=74882937

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/106036 WO2021051250A1 (zh) 2019-09-16 2019-09-16 数据传输方法及装置

Country Status (4)

Country Link
US (1) US20220210859A1 (zh)
EP (1) EP4024958A4 (zh)
CN (1) CN113841443B (zh)
WO (1) WO2021051250A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023208472A1 (en) * 2022-04-29 2023-11-02 Nokia Technologies Oy Devices, methods, apparatus and computer readable medium for communications

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114710789B (zh) * 2022-06-06 2022-09-16 浪潮通信技术有限公司 网络切片确定方法、装置及电子设备
CN115623483B (zh) * 2022-12-16 2023-04-18 深圳中宝新材科技有限公司 键合丝设备的工作信息的完整性保护方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101888684A (zh) * 2009-05-14 2010-11-17 中兴通讯股份有限公司 无线资源控制连接重建失败后快速连接建立的方法及系统
CN103686695A (zh) * 2013-12-30 2014-03-26 大唐移动通信设备有限公司 一种终端类型判断方法和系统
WO2018174995A1 (en) * 2017-03-20 2018-09-27 Intel IP Corporation Handling of user equipment coverage enhancement mode b radio capability mismatch due to change in user equipment usage setting

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101309500B (zh) * 2007-05-15 2011-07-20 华为技术有限公司 不同无线接入技术间切换时安全协商的方法和装置
KR101700448B1 (ko) * 2009-10-27 2017-01-26 삼성전자주식회사 이동 통신 시스템에서 보안 관리 시스템 및 방법
WO2016195177A1 (ko) * 2015-05-29 2016-12-08 엘지전자(주) 무선 통신 시스템에서 데이터 송수신 방법 및 이를 위한 장치
JP2019009480A (ja) * 2015-11-10 2019-01-17 シャープ株式会社 端末装置、ｃ−ｓｇｎおよび通信制御方法
CN106961703B (zh) * 2016-01-11 2021-07-23 中兴通讯股份有限公司 一种信息传输方法、装置和系统
CN108476444B (zh) * 2016-06-17 2020-12-01 华为技术有限公司 获取终端无线能力信息的方法、核心网实体、基站和终端
CN109791590A (zh) * 2016-08-22 2019-05-21 诺基亚技术有限公司 安全性过程
CN109246684B (zh) * 2017-05-19 2020-11-27 大唐移动通信设备有限公司 一种无线能力的获取方法及装置
CA3021658A1 (en) * 2017-10-20 2019-04-20 Comcast Cable Communications, Llc Non-access stratum capability information
US11330478B2 (en) * 2018-08-10 2022-05-10 Qualcomm Incorporated Idle cell reselection and user equipment capability signaling

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101888684A (zh) * 2009-05-14 2010-11-17 中兴通讯股份有限公司 无线资源控制连接重建失败后快速连接建立的方法及系统
CN103686695A (zh) * 2013-12-30 2014-03-26 大唐移动通信设备有限公司 一种终端类型判断方法和系统
WO2018174995A1 (en) * 2017-03-20 2018-09-27 Intel IP Corporation Handling of user equipment coverage enhancement mode b radio capability mismatch due to change in user equipment usage setting

Non-Patent Citations (5)

* Cited by examiner, † Cited by third party
Title
3GPP TS 33.401
3GPP TS 36.306
ANONYMOUS: "3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Procedures for the 5G System; Stage 2 (Release 16)", 3GPP STANDARD; TECHNICAL SPECIFICATION; 3GPP TS 23.502, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. V16.0.2, 1 April 2019 (2019-04-01), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, pages 1 - 419, XP051723248 *
QUALCOMM INCORPORATED: "Assignment of UE Radio Capability ID using NAS", 3GPP DRAFT; S2-1906388-23502-UERCID ASSIGNMENT-R6, 3RD GENERATION PARTNERSHIP PROJECT (3GPP), MOBILE COMPETENCE CENTRE ; 650, ROUTE DES LUCIOLES ; F-06921 SOPHIA-ANTIPOLIS CEDEX ; FRANCE, vol. SA WG2, no. Reno, NV, USA; 20190513 - 20190517, 17 May 2019 (2019-05-17), Mobile Competence Centre ; 650, route des Lucioles ; F-06921 Sophia-Antipolis Cedex ; France, XP051743998 *
See also references of EP4024958A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2023208472A1 (en) * 2022-04-29 2023-11-02 Nokia Technologies Oy Devices, methods, apparatus and computer readable medium for communications

Also Published As

Publication number Publication date
US20220210859A1 (en) 2022-06-30
EP4024958A1 (en) 2022-07-06
CN113841443A (zh) 2021-12-24
EP4024958A4 (en) 2022-08-17
CN113841443B (zh) 2024-03-26

Similar Documents

Publication Publication Date Title
US11695742B2 (en) Security implementation method, device, and system
CN110830991B (zh) 安全会话方法和装置
EP3917187A1 (en) Security implementation method and related apparatus
US10798082B2 (en) Network authentication triggering method and related device
JP7101775B2 (ja) セキュリティ保護方法および装置
WO2020221218A1 (zh) 信息获取方法及装置
US20220210859A1 (en) Data transmission method and apparatus
US20220174761A1 (en) Communications method and apparatus
US20210168614A1 (en) Data Transmission Method and Device
WO2020249126A1 (zh) 安全校验方法及装置
WO2022134089A1 (zh) 一种安全上下文生成方法、装置及计算机可读存储介质
CN114223231B (zh) 通信方法及装置
CN106797560B (zh) 用于配置安全参数的方法、服务器、基站和通信系统
US20220264305A1 (en) Method for Protecting Truncated Parameter and Apparatus
WO2022174802A1 (zh) 密钥更新的方法和装置
WO2021073382A1 (zh) 注册方法及装置
WO2021147053A1 (zh) 数据传输方法、装置及系统
KR20100092353A (ko) 트래픽 암호화 키 관리방법 및 장치
RU2805219C1 (ru) Способ защиты усеченного параметра, устройство, считываемый компьютером носитель данных и микросхема
WO2023011263A1 (zh) 消息传输方法及通信装置
WO2021238280A1 (zh) 一种通信方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19945845

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019945845

Country of ref document: EP

Effective date: 20220330