WO2021212413A1 - 一种密钥的传输方法及装置 - Google Patents

一种密钥的传输方法及装置 Download PDF

Info

Publication number
WO2021212413A1
WO2021212413A1 PCT/CN2020/086416 CN2020086416W WO2021212413A1 WO 2021212413 A1 WO2021212413 A1 WO 2021212413A1 CN 2020086416 W CN2020086416 W CN 2020086416W WO 2021212413 A1 WO2021212413 A1 WO 2021212413A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
configuration
terminal device
message
multicast
Prior art date
Application number
PCT/CN2020/086416
Other languages
English (en)
French (fr)
Inventor
于海凤
李秉肇
许斌
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2020/086416 priority Critical patent/WO2021212413A1/zh
Publication of WO2021212413A1 publication Critical patent/WO2021212413A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]

Definitions

  • This application relates to the field of communications, and in particular to a method and device for transmitting a key.
  • Multicast is a network technology that allows one to send a data packet to multiple receivers.
  • the data source can send the data packet once so that the receivers in the multicast group who need the data packet receive the data packet.
  • LTE Long Term Evolution
  • MBMS Multimedia Broadcast Multicast Service
  • the network side device as a data source can send multicast data packets to multiple terminal devices.
  • the access network device on the network side needs to send the configuration information of the multicast data packets one by one to Terminal equipment, and a new network element is added to the core network side in the network side to perform key management of the multicast data.
  • the embodiments of the present application provide a method and device for transmitting a key, which are used to implement the transmission of the key in the multicast process, ensure the security of multicast service transmission, and reduce the signaling overhead of the communication system.
  • the first aspect of the embodiments of the present application provides a method for transmitting a key, which is applied to an access network device.
  • the access network device sends a first message to the terminal device, and the first message includes a first message.
  • the first key is used to encrypt the multicast data packet, that is, the terminal device can process the received multicast data packet from the access network device according to the first key; after that, the first key
  • the access network device may send the first configuration to the terminal device in a multicast manner, and the first configuration is used to update the first key, so that the terminal device can update the first configuration according to the first configuration.
  • the received multicast data packet from the access network device is further processed according to the updated key.
  • the access network device sends the first configuration for updating the first key to the terminal device in a multicast manner.
  • the keys in multiple terminal devices can be realized through one sending process.
  • the update saves the signaling overhead caused by the access network equipment unicast sending update messages to each terminal device, thereby ensuring the security of multicast service transmission and reducing the signaling overhead of the communication system.
  • the multicast manner may be through a multicast control channel (Multicast Control Channel).
  • MCCH multicast Control Channel
  • DCI downlink control information
  • the broadcast mode is not limited here; in addition, the first configuration can also be flexibly configured.
  • the first configuration can be configured to directly replace the data of the first key, or it can be configured to update the first key.
  • the key update strategy can also be in other ways, which is not limited here.
  • the first message in the first message sent by the access network device to the terminal device, the first message further includes a first timer, and/or first time information , wherein the first timer is used to indicate the effective duration of the first key, and the first time information is used to indicate the effective start time of the first key.
  • the access network device may carry the time indication information of the first key in the first message, specifically, it may carry the first timer indicating the effective duration of the first key, and/ Or, it may carry the first time information indicating the effective start time of the first key, so that the terminal device can receive the multicast data packet from the access network device according to the first timer and/or the first time information , So that the subsequent terminal device's use timeliness of the first key can be aligned with the access network device, and the use timeliness of the first key can more flexibly control the encryption strategy of the multicast transmission, and improve the communication security.
  • the first message further includes a first configuration information set associated with the first key, and the first configuration information set includes at least one multicast configuration Information
  • the multicast configuration information includes at least one of the following: multicast service identifier, group radio network temporary identifier (G-RNTI), bandwidth part (BWP) indication information, physical downlink shared channel (Physical downlink share channel, PDSCH) scrambling sequence, discontinuous reception (discontinuous reception, DRX) parameters, demodulation reference signal, rate matching reference signal, search space indicator, control resource set indicator.
  • the access network device can carry the first configuration information set associated with the first key in the first message, so that the terminal device can obtain the first set of configuration information used to process the multicast data packet through the first message.
  • a key and the corresponding first set of configuration information can further save the signaling overhead of the access network device.
  • the method further includes: the access network device sends a first instruction to the terminal device, where the first instruction is used to instruct the terminal device to enter radio resource control ( radio resource control, RRC) idle state or RRC inactive state, do not release the first configuration information set and the first key, and continue to use the first configuration information set and the first key to receive the multicast data packet .
  • RRC radio resource control
  • the access network device since the access network device sends multicast data packets to the terminal device without relying on the RRC connection between the two, in order to further save the signaling consumption between the access network device and the terminal device, the access network device The device can use the first instruction to cause the terminal device to enter the radio resource control RRC idle state or the RRC inactive state according to the first instruction, without releasing the first configuration information set and the first key, that is, continue to use the first configuration information set and the first key.
  • the configuration information set and the first key receive the multicast data packet, that is, the terminal device can use the first key pair in the RRC idle state or the RRC inactive state to receive the multicast data packet through the first configuration information set
  • the multicast data packet is decrypted to obtain the multicast data, so that the terminal equipment in the RRC idle state or the RRC inactive state can also realize the transmission of the multicast service.
  • the first configuration is used to update the first key to the second key, and the first configuration further includes a second configuration information set.
  • a second configuration information set is associated with the second key, and the second configuration information set is a subset of the first configuration information set.
  • the second configuration information set is a subset of the first configuration information set
  • the first configuration sent by the access network device to the terminal device may instruct to update the first key corresponding to the second configuration information set to the first configuration information set.
  • Two keys so that the terminal device can update part of the first key or update all of the first keys, so as to realize the selective update of the multicast key.
  • the access network device may determine The first key needs to be updated, including:
  • the access network device can be further flexibly processed to determine that the first key needs to be updated in a variety of ways.
  • the determination basis for the determination process can be the first timer corresponding to the first key.
  • the first request message of the terminal device and the first configuration sent by the core network make the key transmission method suitable for multiple application scenarios.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the access network device may encrypt the sending process of the first configuration in a variety of ways.
  • the encryption method may be through the first configuration.
  • Key encryption, a third key set in the first message, or the use of the fourth key associated with the terminal device, encrypted transmission of the first configuration used to update the first key can improve transmission Data security in the process.
  • the first configuration is carried in first downlink control information, and the first downlink control information is scrambled by the group radio network temporary identifier G-RNTI, or Scrambling is performed by a preset radio network temporary identifier (RNTI).
  • G-RNTI group radio network temporary identifier
  • RNTI radio network temporary identifier
  • the access network device when the access network device sends the first downlink control information to the terminal device in a multicast manner, the first downlink control information may be scrambled by the G-RNTI associated with the first key , It can also be scrambled by the preset RNTI in the terminal device, and the first configuration can be carried on the first downlink control information, without the need to set up a message dedicated to sending the first configuration, further saving access The signaling consumption of network equipment.
  • the first message is an RRC message, a media access control control element (MAC CE) message, or a physical downlink control channel PDCCH message .
  • MAC CE media access control control element
  • the first message sent by the access network device to the terminal device may specifically be an RRC message, a MAC CE message, or a PDCCH message, which provides a specific implementation method in the process of sending the first message, and improves the feasibility of the solution. .
  • the first message is sent in unicast mode; or, the first message is encrypted by a fourth key associated with the terminal device and Sent by broadcast.
  • the first message may be sent in unicast mode, where sending in unicast mode refers to sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection
  • the first message can be encrypted by the fourth key associated with the terminal device and sent in a broadcast mode.
  • the broadcast mode refers to the communication mode of the sender of the data "one-to-all" the receiver, That is, all terminal devices within the coverage of the access network device can receive the broadcast information
  • the fourth key is a key pre-stored in the terminal device.
  • the access network device communicates with the terminal device in advance and is The fourth key distributed by the terminal device or the fourth key preset in the terminal device by the operator service provider.
  • the method before the access network device sends the first configuration to the terminal device in a multicast manner, the method further includes:
  • the access network device sends the paging message to the terminal device, and the paging message includes a second indication, and the second indication is used to indicate that the first key is updated; after that, the access network device and the terminal device After the RRC connection is established, the access network device sends the first configuration to the terminal device in a multicast manner.
  • the access network device can use a paging message to make the terminal device in the RRC connection state after establishing an RRC connection with the terminal device, and then send the first configuration to the terminal device in a multicast manner, In this way, the update of the first key in the terminal device in the RRC inactive state or the RRC idle state is realized.
  • the second aspect of the embodiments of the present application provides a method for transmitting a key, which is applied to a terminal device.
  • the terminal device receives a first message from an access network device, and the first message includes a first key.
  • the first key is used to encrypt the multicast data packet.
  • the terminal device can process the received multicast data packet from the access network device according to the first key; the first key exists
  • the terminal device receives the first configuration from the access network device in a multicast manner, where the first configuration is used to update the first key; after that, the terminal device changes the configuration according to the first configuration.
  • the first key is updated to the second key.
  • the terminal device can receive the multicast data packet from the access network device according to the second key.
  • the terminal device receives the first configuration for updating the first key from the access network device in a multicast manner.
  • the encryption of multiple terminal devices can be realized through one sending process.
  • the update of the key saves the signaling overhead caused by the access network equipment sending the update message one by one to each terminal device, thereby realizing the transmission of the key in the multicast process, ensuring the security of the multicast service transmission, and reducing The signaling overhead of the communication system.
  • the multicast manner may be to carry the first configuration through the MCCH. It can also be implemented by the access network device using a preset identifier to scramble the downlink control information sent in the first configuration, or other multicast methods, which are not limited here; in addition, the first configuration is also It can be flexibly configured.
  • the first configuration can be configured to directly replace the data of the first key, or it can be configured as an update strategy for updating the first key, or in other ways. Make a limit.
  • the first message further includes a first timer, and/or first time information , wherein the first timer is used to indicate the effective duration of the first key, and the first time information is used to indicate the effective start time of the first key.
  • the access network device may carry the time indication information of the first key in the first message, specifically, it may carry the first timer indicating the effective duration of the first key, and/ Or, it may carry the first time information indicating the effective start time of the first key, so that the terminal device can receive the multicast data packet from the access network device according to the first timer and/or the first time information Therefore, the use time limit of the first key by the terminal device is aligned with the access network device, and the use time limit of the first key can more flexibly control the encryption strategy of the multicast transmission and improve the communication security.
  • the first message further includes a first configuration information set associated with the first key, and the first configuration information set includes at least one multicast configuration Information, the multicast configuration information includes at least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, partial bandwidth BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the access network device can carry the first configuration information set associated with the first key in the first message, so that the terminal device can obtain the first set of configuration information used to process the multicast data packet through the first message.
  • a key and the corresponding first set of configuration information can correspondingly save the signaling overhead of the terminal device for the terminal device.
  • the method further includes: receiving a first instruction from the access network device, the first instruction being used to instruct the terminal device to enter the radio resource control RRC idle state Or the RRC is in an inactive state, and continues to use the first configuration information set and the first key to receive the multicast data packet.
  • the terminal device can enter the wireless network according to the first instruction.
  • Resource control RRC idle state or RRC inactive state and does not release the first configuration information set and the first key, that is, continue to use the first configuration information set and the first key to receive the multicast data packet, also
  • the terminal device can use the first key in the RRC idle state or the RRC inactive state to decrypt the multicast data packet received through the first configuration information set to obtain the multicast data, so that the terminal device is in the RRC Idle state or RRC inactive state can also realize the reception of multicast data packets.
  • the first configuration further includes a second configuration information set indication, the second configuration information set is associated with the second key, and the second configuration information The set is a subset of the first configuration information set.
  • the second configuration information set is a subset of the first configuration information set
  • the first configuration sent by the access network device to the terminal device may instruct to update the first key corresponding to the second configuration information set to the first configuration information set.
  • the second key for the terminal device, it is possible to update part of the first key or update all of the first keys, so as to realize the selective update of the multicast key.
  • the method before the terminal device receives the first configuration from the access network device in a multicast manner, the method further includes: sending the first configuration to the access network device A request message, where the first request message is used to request update information of the first key.
  • the terminal device may send a first request message to the access network device when it is determined that the update information of the first key is required, and thereafter, the access network device sends the first request message to the terminal device in response to the first request message.
  • the way in which the terminal device actively queries the update information of the first key can ensure that the latest key configuration is maintained in the terminal device, and avoid the situation that the multicast data packet cannot be processed due to the failure of the key to be updated in time.
  • the access network device can subsequently trigger the execution of the process of obtaining the update information of the first key according to the first request message, and there is no need to separately configure the update strategy of the first key, which can save further Signaling consumption of access network equipment.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the access network device may encrypt the sending process of the first configuration in a variety of ways.
  • the encryption method may be through the first configuration.
  • Key encryption, a third key set in the first message, or the use of the fourth key associated with the terminal device, encrypted transmission of the first configuration used to update the first key can improve transmission Data security in the process.
  • the first configuration is carried by the first downlink control information from the access network device, and the first downlink control information passes through the group radio network temporary identification RNTI is scrambled, or the first downlink control information is scrambled by using a preset radio network temporary identifier RNTI.
  • the first downlink control information when the terminal device receives the first downlink control information from the access network device in a multicast manner, the first downlink control information may be added by the G-RNTI associated with the first key. It can also be scrambled by the RNTI preset in the terminal equipment, and the first configuration can be carried on the first downlink control information, and there is no need to set up a special message for sending the first configuration, further saving Signaling consumption of access network equipment.
  • the first message is an RRC message, a MAC CE message for a media access control control unit, or a physical downlink control channel PDCCH message.
  • the first message sent by the access network device to the terminal device may specifically be an RRC message, a MAC CE message, or a PDCCH message, which provides a specific implementation method in the process of sending the first message, and improves the feasibility of the solution. .
  • the method further includes:
  • the terminal device When the terminal device determines that multicast configuration is needed, the terminal device initiates an RRC connection establishment process or an RRC connection recovery process to receive the first message from the access network device.
  • the terminal device if the terminal device is not in the connected state before receiving the first message from the access network device, that is, when the terminal device is in an inactive state or an idle state, only when the terminal device determines When multicast configuration is required, the terminal device will initiate the RRC connection establishment process or the RRC connection recovery process to receive the first message from the access network device, so that the terminal device in the inactive state or the idle state is also The acquisition of the first key corresponding to the multicast data packet can be achieved.
  • the terminal device determining that a multicast configuration is required includes: the terminal device determines that no multicast configuration is available, or
  • the terminal device determines that it is interested in the multicast service and has no corresponding multicast configuration.
  • the terminal device may determine that a multicast configuration is needed.
  • the terminal device may determine that no multicast configuration is available, or the terminal device may determine that it is interested in a multicast service and has no corresponding multicast configuration.
  • the terminal device may determine that it is interested in a multicast service and has no corresponding multicast configuration.
  • the method further includes:
  • the terminal device When the terminal device determines that the update information of the first key is required, the terminal device initiates an RRC connection establishment process or an RRC connection recovery process to receive the first configuration from the access network device.
  • the terminal device determines that a multicast configuration is needed, the terminal device initiates the RRC connection establishment process or the RRC connection recovery process to receive the first configuration from the access network device, thereby being in an inactive state or an idle state
  • the acquisition corresponding to the first configuration can also be implemented in the terminal device.
  • the terminal device determining that the update information of the first key is required includes: determining that the multicast configuration needs to be acquired according to the paging message from the access network device, the The paging message is used to indicate that the first key has been updated; or, the terminal device determines that the first timer expires.
  • the terminal device determines that it needs the update information of the first key.
  • it can be determined that the multicast configuration needs to be acquired according to the paging message from the access network device, and the paging message uses To indicate that the first key has been updated; or, to determine that the first timer has expired, thereby providing a specific implementation mode for the terminal device to be configured for multicast, so that the key transmission method is suitable for a variety of application scenarios, And improve the feasibility of the scheme.
  • the first message is sent in unicast mode; or, the first message is encrypted by a fourth key associated with the terminal device and Sent by broadcast.
  • the first message may be sent in unicast mode, where sending in unicast mode refers to sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection
  • the first message can be encrypted by the fourth key associated with the terminal device and sent in a broadcast mode.
  • the broadcast mode refers to the communication mode of the sender of the data "one-to-all" the receiver, That is, all terminal devices within the coverage of the access network device can receive the broadcast information
  • the fourth key is a key pre-stored in the terminal device.
  • the access network device communicates with the terminal device in advance and is The fourth key distributed by the terminal device or the fourth key preset in the terminal device by the operator service provider.
  • the third aspect of the embodiments of the present application provides a method for transmitting a key, which is applied to an access network device.
  • the access network device sends a first message to the terminal device, and the first message includes the first key.
  • the access network device may unicast the first configuration to the terminal device, and the first configuration is used to update the first key, This allows the terminal device to further process the received multicast data packet from the access network device according to the updated key after the first key is updated according to the first configuration.
  • the access network device can carry the first key and the first configuration information set associated with the first key in the first message, so that the terminal device can obtain the multicast data packet through the first message.
  • the first key and the corresponding first configuration information set thereby saving the signaling overhead of the access network device.
  • sending in unicast mode refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection.
  • the first configuration can also be flexibly configured, for example, the first configuration can be configured to directly replace the data of the first key, or it can be configured as an update strategy for updating the first key, or It is another method, which is not limited here.
  • the first message in the first message sent by the access network device to the terminal device, the first message further includes a first timer, and/or first time information , wherein the first timer is used to indicate the effective duration of the first key, and the first time information is used to indicate the effective start time of the first key.
  • the access network device may carry the time indication information of the first key in the first message, specifically, it may carry the first timer indicating the effective duration of the first key, and/ Or, it may carry the first time information indicating the effective start time of the first key, so that the terminal device can receive the multicast data packet from the access network device according to the first timer and/or the first time information , So that the use time of the first key by the terminal device can be aligned with that of the access network device, and the use time of the first key can more flexibly control the encryption strategy of the multicast transmission, and improve the communication security.
  • the first configuration information set includes at least one piece of multicast configuration information, wherein the multiple Broadcast configuration information includes at least one of the following: multicast service identifier, group radio network temporary identifier G-RNTI, bandwidth part BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate Matching reference signal, search space indication, control resource set indication.
  • the multiple Broadcast configuration information includes at least one of the following: multicast service identifier, group radio network temporary identifier G-RNTI, bandwidth part BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate Matching reference signal, search space indication, control resource set indication.
  • the access network device may configure at least one piece of multicast configuration information in the first configuration information set, and specifically provide relevant parameters included in the implementation of the multicast configuration information, thereby improving the achievability of the solution. sex.
  • the method further includes: the access network device sends a first instruction to the terminal device, where the first instruction is used to instruct the terminal device to enter radio resource control RRC Idle state or RRC inactive state, and continue to use the first configuration information set and the first key to receive the multicast data packet.
  • the access network device since the access network device sends multicast data packets to the terminal device without relying on the RRC connection between the two, in order to further save the signaling consumption between the access network device and the terminal device, the access network device The device can use the first instruction to cause the terminal device to enter the radio resource control RRC idle state or the RRC inactive state according to the first instruction, without releasing the first configuration information set and the first key, that is, continue to use the first configuration information set and the first key.
  • the configuration information set and the first key receive the multicast data packet, that is, the terminal device can use the first key pair in the RRC idle state or the RRC inactive state to receive the multicast data packet through the first configuration information set
  • the multicast data packet is decrypted to obtain the multicast data, so that the terminal device in the inactive state or the idle state can also realize the acquisition of the multicast data packet.
  • the first configuration is used to update the first key to the second key
  • the first configuration further includes a second configuration information set
  • the first configuration A second configuration information set is associated with the second key
  • the second configuration information set is a subset of the first configuration information set
  • the second configuration information set is a subset of the first configuration information set
  • the first configuration sent by the access network device to the terminal device may instruct to update the first key corresponding to the second configuration information set to the first configuration information set.
  • Two keys so that the terminal device can update part of the first key or update all of the first keys, so as to realize the selective update of the multicast key.
  • the access network device may determine that it needs to be updated according to one of the following conditions
  • the first key includes:
  • the access network device can be further flexibly processed to determine that the first key needs to be updated in a variety of ways.
  • the determination basis for the determination process can be the first timer corresponding to the first key.
  • the first request message of the terminal device and the first configuration sent by the core network make the key transmission method suitable for multiple application scenarios.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the access network device may encrypt the sending process of the first configuration in a variety of ways.
  • the encryption method may be through the first configuration.
  • Key encryption, a third key set in the first message, or the use of the fourth key associated with the terminal device, encrypted transmission of the first configuration used to update the first key can improve transmission Data security in the process.
  • the first message is an RRC message, a media access control control unit MAC CE message, or a physical downlink control channel PDCCH message.
  • the first message sent by the access network device to the terminal device may specifically be an RRC message, a MAC CE message, or a PDCCH message, which provides a specific implementation method in the process of sending the first message, and improves the feasibility of the solution. .
  • the first message is sent in unicast mode; or
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • the first message may be sent in unicast mode, where sending in unicast mode refers to sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection
  • the first message can be encrypted by the fourth key associated with the terminal device and sent in a broadcast mode.
  • the broadcast mode refers to the communication mode of the sender of the data "one-to-all" the receiver, That is, all terminal devices within the coverage of the access network device can receive the broadcast information
  • the fourth key is a key pre-stored in the terminal device.
  • the access network device communicates with the terminal device in advance and is The fourth key distributed by the terminal device or the fourth key preset in the terminal device by the operator service provider.
  • the method before the access network device sends the first configuration to the terminal device in a unicast manner, the method further includes: the access network device sends to the terminal device The paging message, the paging message includes a second indication, the second indication is used to indicate that the first key is updated; after the access network device establishes an RRC connection with the terminal device, the access network device uses unicast Mode to send the first configuration to the terminal device.
  • the access network device can use a paging message to make the terminal device in a connected state after establishing an RRC connection with the terminal device, and then send the first configuration to the terminal device in a multicast manner, so as to realize the connection Update of the first key in a terminal device in an inactive state or an idle state.
  • the fourth aspect of the embodiments of the present application provides a method for transmitting a key, which is applied to a terminal device.
  • the terminal device receives a first message from an access network device, and the first message includes a first key and A first set of configuration information associated with the first key, the first key is used to encrypt the multicast data packet, and the first configuration information set is used to receive the multicast data packet; at this time, the terminal device may The first key processes the received multicast data packets from the access network device; when the first key is updated, the terminal device unicasts the first configuration from the access network device , Wherein, the first configuration is used to update the first key; after that, the terminal device updates the first key to the second key according to the first configuration.
  • the terminal device can update the first key according to the second key.
  • the key receives the multicast data packet from the access network device.
  • the terminal device may obtain the first key used to process the multicast data packet and the corresponding first configuration information set through the first message, thereby saving the signaling overhead of the access network device.
  • sending in unicast mode refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection.
  • the first configuration can also be flexibly configured, for example, the first configuration can be configured to directly replace the data of the first key, or it can be configured as an update strategy for updating the first key, or It is another method, which is not limited here.
  • the first message in the first message received from the access network device by the terminal device, the first message further includes a first timer and/or first time information,
  • the first timer is used to indicate the effective duration of the first key
  • the first time information is used to indicate the effective start time of the first key.
  • the access network device may carry the time indication information of the first key in the first message, specifically, it may carry the first timer indicating the effective duration of the first key, and/ Or, it may carry the first time information indicating the effective start time of the first key, so that the terminal device can receive the multicast data packet from the access network device according to the first timer and/or the first time information , So that the terminal device's use time of the first key is aligned with the access network device, and the use of the first key can more flexibly control the encryption strategy of the multicast transmission, and improve the communication security.
  • the first configuration information set includes at least one piece of multicast configuration information
  • the multicast configuration information includes at least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, partial bandwidth BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the access network device may configure at least one piece of multicast configuration information in the first configuration information set, and specifically provide relevant parameters included in the implementation of the multicast configuration information, thereby improving the achievability of the solution. sex.
  • the method further includes: the terminal device receives a first instruction from the access network device, and the first instruction is used to instruct the terminal device to enter the radio resource control RRC The idle state or the RRC inactive state, and the first configuration information set and the first key are not released, that is, the terminal device continues to use the first configuration information set and the first key to receive the multicast data packet.
  • the terminal device receives a first instruction from the access network device, and the first instruction is used to instruct the terminal device to enter the radio resource control RRC The idle state or the RRC inactive state, and the first configuration information set and the first key are not released, that is, the terminal device continues to use the first configuration information set and the first key to receive the multicast data packet.
  • the access network device since the access network device sends multicast data packets to the terminal device without relying on the RRC connection between the two, in order to further save the signaling consumption between the access network device and the terminal device, the access network device The device can use the first instruction to cause the terminal device to enter the radio resource control RRC idle state or the RRC inactive state according to the first instruction, while not releasing the first configuration information set and the first key, that is, continue to use the first configuration information set and the first key.
  • the configuration information set and the first key receive the multicast data packet, that is, the terminal device can use the first key pair in the RRC idle state or the RRC inactive state to receive the multicast data packet through the first configuration information set
  • the multicast data packet is decrypted to obtain the multicast data, so that the terminal device can receive the multicast data packet even in the RRC idle state or the RRC inactive state.
  • the first configuration further includes a second configuration information set, the second configuration information set is associated with the second key, and the second configuration information set It is a subset of the first configuration information set.
  • the second configuration information set is a subset of the first configuration information set
  • the first configuration sent by the access network device to the terminal device may instruct to update the first key corresponding to the second configuration information set to the first configuration information set.
  • Two keys so that the terminal device can update part of the first key or update all of the first keys, so as to realize the selective update of the multicast key.
  • the method before the terminal device receives the first configuration from the access network device in a unicast manner, the method further includes: The device sends a first request message, where the first request message is used to request update information of the first key.
  • the terminal device may send a first request message to the access network device when it is determined that the update information of the first key is required, and thereafter, the access network device sends the first request message to the terminal device in response to the first request message.
  • the way in which the terminal device actively queries the update information of the first key can ensure that the latest key configuration is maintained in the terminal device, and avoid the situation that the multicast data packet cannot be processed due to the failure of the key to be updated in time.
  • the access network device can subsequently trigger the execution of the process of obtaining the update information of the first key according to the first request message, and there is no need to separately configure the update strategy of the first key, which can save further Signaling consumption of access network equipment.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the access network device may encrypt the sending process of the first configuration in a variety of ways.
  • the encryption method may be through the first configuration.
  • Key encryption, a third key set in the first message, or the use of the fourth key associated with the terminal device, encrypted transmission of the first configuration used to update the first key can improve transmission Data security in the process.
  • the first message is an RRC message, a MAC CE message for a media access control control unit, or a physical downlink control channel PDCCH message.
  • the first message sent by the access network device to the terminal device may specifically be an RRC message, a MAC CE message, or a PDCCH message, which provides a specific implementation method in the process of sending the first message, and improves the feasibility of the solution. .
  • the method further includes:
  • the terminal device When the terminal device determines that multicast configuration is needed, the terminal device initiates an RRC connection establishment process or an RRC connection recovery process to receive the first message from the access network device.
  • the terminal device if the terminal device is not in the connected state before receiving the first message from the access network device, that is, when the terminal device is in an inactive state or an idle state, only when the terminal device determines When multicast configuration is required, the terminal device will initiate the RRC connection establishment process or the RRC connection recovery process to receive the first message from the access network device, so that the terminal device in the inactive state or the idle state is also The acquisition of the first key corresponding to the multicast data packet can be achieved.
  • the terminal device determining that a multicast configuration is required includes: the terminal device determines that no multicast configuration is available, or
  • the terminal device determines that it is interested in the multicast service and has no corresponding multicast configuration.
  • the terminal device may determine that a multicast configuration is needed.
  • the terminal device may determine that no multicast configuration is available, or the terminal device may determine that it is interested in a multicast service and has no corresponding multicast configuration. , Thereby providing a specific implementation method for the terminal device to be configured for multicast, and improving the feasibility of the solution.
  • the method further includes:
  • the terminal device When the terminal device determines that the update information of the first key is required, the terminal device initiates an RRC connection establishment process or an RRC connection recovery process to receive the first configuration from the access network device.
  • the terminal device determines that a multicast configuration is needed, the terminal device initiates the RRC connection establishment process or the RRC connection recovery process to receive the first configuration from the access network device, thereby being in an inactive state or an idle state
  • the acquisition corresponding to the first configuration can also be implemented in the terminal device.
  • the terminal device determining that the update information of the first key is required includes: determining that the multicast configuration needs to be acquired according to the paging message from the access network device, the The paging message is used to indicate that the first key has been updated;
  • the terminal device determines that the update information of the first key is required. Among them, it may be determined that the multicast configuration needs to be acquired according to a paging message from the access network device, and the paging message is used for Indicate that there is an update of the first key; or, determine that the first timer expires, thereby providing a specific implementation manner in which the terminal device requires a multicast configuration, and improving the feasibility of the solution.
  • the first message is sent in unicast mode; or
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • the first message may be sent in unicast mode, where sending in unicast mode refers to sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection
  • the first message can be encrypted by the fourth key associated with the terminal device and sent in a broadcast mode.
  • the broadcast mode refers to the communication mode of the sender of the data "one-to-all" the receiver, That is, all terminal devices within the coverage of the access network device can receive the broadcast information
  • the fourth key is a key pre-stored in the terminal device.
  • the access network device communicates with the terminal device in advance and is The fourth key distributed by the terminal device or the fourth key preset in the terminal device by the operator service provider.
  • the fifth aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a transceiver unit and a processing unit; wherein, the processing unit is used to communicate to The terminal device sends a first message, the first message includes a first key, and the first key is used to encrypt a multicast data packet; the processing unit is also used to send the first message to the terminal device in a multicast manner through the transceiver unit A configuration, the first configuration is used to update the first key. Wherein, the processing unit is used to send the first configuration for updating the first key to the terminal device in a multicast manner through the transceiver unit. When the number of terminal devices is multiple, multiple devices can be realized through one sending process.
  • the update of the key in the terminal device saves the signaling overhead caused by the communication device for unicast sending update messages to each terminal device one by one, thereby ensuring the security of multicast service transmission and reducing the signaling overhead of the communication system.
  • the component modules of the communication device may also be used to execute the steps performed in each possible implementation manner of the first aspect.
  • the first aspect please refer to the first aspect, which will not be repeated here.
  • a sixth aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a transceiver unit and a processing unit; wherein, the transceiver unit is configured to receive data from access The first message of the network device, the first message includes a first key, and the first key is used to encrypt a multicast data packet; the transceiver unit is also used to receive the first message from the access network device in a multicast manner A configuration, the first configuration is used to update the first key; the processing unit is used to update the first key to a second key according to the first configuration; the transceiver unit is also used to update the first key according to the The second key receives the multicast data packet from the access network device.
  • the transceiver unit in the communication device receives the first configuration for updating the first key from the access network device in a multicast manner.
  • the number of the communication device is multiple, multiple transmissions can be achieved through a single transmission process.
  • the update of the key in each terminal device saves the signaling overhead caused by the access network equipment sending the update message one by one to each communication device, so as to realize the transmission of the key in the multicast process and ensure the security of the multicast service transmission At the same time, it reduces the signaling overhead of the communication system.
  • the component modules of the communication device may also be used to execute the steps executed in each possible implementation manner of the second aspect.
  • the second aspect please refer to the second aspect, and details are not repeated here.
  • the seventh aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a transceiving unit and a processing unit; wherein the processing unit is used to communicate with the transceiving unit through the transceiving unit.
  • the terminal device sends a first message.
  • the first message includes a first key and a first set of configuration information associated with the first key.
  • the first key is used to encrypt the multicast data packet; the processing unit also uses The first configuration is sent to the terminal device in a unicast manner through the transceiver unit, and the first configuration is used to update the first key.
  • the processing unit in the communication device can carry the first key and the first configuration information set associated with the first key in the first message through the transceiver unit, so that the terminal device can obtain the The first key of the multicast data packet and the corresponding first configuration information set are processed, thereby saving the signaling overhead of the communication device.
  • the component modules of the communication device may also be used to execute the steps executed in each possible implementation manner of the third aspect.
  • the third aspect please refer to the third aspect, which will not be repeated here.
  • the eighth aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a transceiver unit and a processing unit; wherein, the transceiver unit is configured to receive data from access A first message of a network device, the first message includes a first key and a first set of configuration information associated with the first key, the first key is used to encrypt a multicast data packet, and the first configuration information The set is used to receive the multicast data packet; the transceiver unit is also used to receive the first configuration from the access network device in a unicast manner, and the first configuration is used to update the first key; the processing unit, It is configured to update the first key to a second key according to the first configuration update; the transceiver unit is further configured to receive the multicast data packet from the access network device according to the second key. Wherein, the transceiver unit in the communication device can obtain the first key used to process the multicast data packet and the corresponding first configuration information set through the first message
  • the component modules of the communication device may also be used to execute the steps executed in each possible implementation manner of the fourth aspect.
  • the fourth aspect please refer to the fourth aspect, and details are not repeated here.
  • a ninth aspect of the embodiments of the present application provides a communication device, the communication device may specifically be a key transmission device, wherein the communication device includes a processor, the processor is coupled with a memory, and the memory is used to store a computer program or instruction The processor is configured to execute the computer program or instruction in the memory, so that the method described in the first aspect or any one of the possible implementation manners of the first aspect is executed, or the third aspect or the third aspect is executed The method described in any one of the possible implementations is executed.
  • a tenth aspect of the embodiments of the present application provides a communication device, the communication device may specifically be a key transmission device, wherein the communication device includes a processor, the processor is coupled with a memory, and the memory is used to store a computer program or instruction The processor is configured to execute the computer program or instruction in the memory, so that the method described in the foregoing second aspect or any one of the possible implementation manners of the second aspect is executed, or, the foregoing fourth aspect or the fourth aspect is executed The method described in any one of the possible implementations is executed.
  • the eleventh aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor uses To run a computer program or instruction to execute the method described in the aforementioned first aspect or any one of the possible implementations of the first aspect, or to make the aforementioned third aspect or any one of the possible implementations of the third aspect The method is executed.
  • a twelfth aspect of the embodiments of the present application provides a communication device, which may specifically be a key transmission device, wherein the communication device includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor uses To run a computer program or instruction to execute the method described in the foregoing second aspect or any one of the possible implementations of the second aspect, or to make the foregoing fourth aspect or any one of the possible implementations of the fourth aspect The method is executed.
  • a thirteenth aspect of the embodiments of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes any of the above-mentioned first aspect or first aspect.
  • a fourteenth aspect of the embodiments of the present application provides a computer-readable storage medium that stores one or more computer-executable instructions.
  • the processor executes any of the above-mentioned second aspect or the second aspect.
  • the method described in one possible implementation manner, or the processor executes the method described in the foregoing fourth aspect or any one of the possible implementation manners of the fourth aspect.
  • the fifteenth aspect of the embodiments of the present application provides a computer program product (or computer program) storing one or more computers.
  • the processor executes the first aspect or the first aspect. Any one of the possible implementation manners of the aspect, the foregoing third aspect, or any one of the possible implementation manners of the third aspect.
  • the sixteenth aspect of the embodiments of the present application provides a computer program product storing one or more computers.
  • the processor executes the second aspect or any possible implementation of the second aspect.
  • the processor executes the foregoing fourth aspect or any one of the possible implementation methods of the fourth aspect.
  • the seventeenth aspect of the embodiments of the present application provides a chip system
  • the chip system includes a processor, and is configured to support the access network device to implement the foregoing first aspect or any one of the possible implementation manners of the first aspect, and the foregoing third aspect. Or a function involved in any possible implementation of the third aspect.
  • the chip system may also include a memory, and the memory is used to store the necessary program instructions and data of the access network device.
  • the chip system can be composed of chips, or include chips and other discrete devices.
  • the eighteenth aspect of the embodiments of the present application provides a chip system, the chip system includes a processor, and is configured to support a terminal device to implement any one of the foregoing second aspect or any possible implementation manner of the second aspect, the foregoing fourth aspect or the first aspect.
  • the functions involved in any one of the four possible implementations may also include a memory, and the memory is used to store the necessary program instructions and data of the terminal device.
  • the chip system can be composed of chips, or include chips and other discrete devices.
  • a nineteenth aspect of the embodiments of the present application provides a communication system.
  • the communication system includes the communication device of the fifth aspect and the communication device of the sixth aspect, or the communication system includes the communication device of the fifth aspect and the sixth aspect.
  • the communication system includes the communication device of the seventh aspect and the communication device of the eighth aspect, or the communication system includes the communication device of the ninth aspect and the communication device of the tenth aspect, or, the The communication system includes the communication device of the eleventh aspect and the communication device of the twelfth aspect.
  • the fifth, seventh, ninth, eleventh, thirteenth, fifteenth, seventeenth and nineteenth aspects or the technical effects brought by any one of the possible implementation methods can be found in the first aspect Or the technical effects brought about by the different possible implementation manners of the first aspect, or refer to the third aspect or the technical effects brought about by the different possible implementation manners of the third aspect, which will not be repeated here.
  • the technical effects of the sixth, eighth, tenth, twelfth, fourteenth, sixteenth, eighteenth and nineteenth aspects or any one of the possible implementation methods can be found in the second aspect Or the technical effects brought about by the different possible implementation manners of the second aspect, or, refer to the technical effects brought about by the fourth aspect or the different possible implementation manners of the fourth aspect, which will not be repeated here.
  • the access network device sends a first message to the terminal device, the first message includes a first key, and the first key is used to encrypt multicast Data packet; sending a first configuration to the terminal device in a multicast manner, where the first configuration is used to update the first key.
  • the first configuration used to update the first key is sent to the terminal device in a multicast manner, and the key update in multiple terminal devices can be realized through a single sending process, saving the access network device to perform one for each terminal device.
  • the signaling overhead caused by the unicast sending of the update message, so as to realize the transmission of the key in the multicast process ensure the security of the multicast service transmission, and reduce the signaling overhead of the communication system.
  • Figure 1-1 is a schematic diagram of the system architecture of the multicast process in the prior art
  • Figure 1-2 is another schematic diagram of the system architecture of the multicast process in the prior art
  • Figure 1-3 is a schematic diagram of data interaction in the multicast process in the prior art
  • Figure 1-4 is another schematic diagram of data interaction in the multicast process in the prior art
  • Figure 1-5 is another schematic diagram of data interaction in the multicast process in the prior art
  • Figure 1-6 is another schematic diagram of data interaction in the multicast process in the prior art
  • FIG. 2 is a schematic diagram of the realization process of the multicast process in the embodiment of the application.
  • FIG. 3 is another schematic diagram of the realization process of the multicast process in the embodiment of the application.
  • FIG. 4 is a schematic diagram of the system architecture of the multicast process in an embodiment of the application.
  • FIG. 5 is a schematic diagram of a method for transmitting a key in an embodiment of the application
  • FIG. 6 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 7 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 8 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 9 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 10 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 11 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 12 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 13 is another schematic diagram of a key transmission method in an embodiment of this application.
  • FIG. 14 is a schematic diagram of an access network device in an embodiment of this application.
  • FIG. 15 is a schematic diagram of a terminal device in an embodiment of this application.
  • FIG. 16 is another schematic diagram of an access network device in an embodiment of this application.
  • FIG. 17 is another schematic diagram of a terminal device in an embodiment of this application.
  • FIG. 18 is another schematic diagram of an access network device in an embodiment of this application.
  • FIG. 19 is another schematic diagram of a terminal device in an embodiment of this application.
  • Terminal device It can be a wireless terminal device that can receive network device scheduling and instruction information.
  • a wireless terminal device can be a device that provides voice and/or data connectivity to users, or a handheld device with wireless connection function, or Other processing equipment connected to the wireless modem.
  • a terminal device can communicate with one or more core networks or the Internet via a radio access network (RAN).
  • the terminal device can be a mobile terminal device, such as a mobile phone (or called a "cellular" phone, mobile phone). phone)), computers and data cards, for example, can be portable, pocket-sized, handheld, built-in computer or vehicle-mounted mobile devices, which exchange language and/or data with the wireless access network.
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDAs personal digital assistants
  • Pad tablets Computers
  • Wireless terminal equipment can also be called system, subscriber unit, subscriber station, mobile station, mobile station (MS), remote station (remote station), access point ( access point (AP), remote terminal equipment (remote terminal), access terminal equipment (access terminal), user terminal equipment (user terminal), user agent (user agent), subscriber station (subscriber station, SS), user terminal equipment (customer premises equipment, CPE), terminal (terminal), user equipment (user equipment, UE), mobile terminal (mobile terminal, MT), etc.
  • the terminal device may also be a wearable device and a next-generation communication system, for example, a terminal device in a 5G communication system or a terminal device in a public land mobile network (PLMN) that will evolve in the future.
  • PLMN public land mobile network
  • Network equipment It can be a device in a wireless network.
  • a network device can be a radio access network (RAN) node (or device) that connects terminal equipment to the wireless network, and it can also be called a base station.
  • RAN equipment are: new generation Node B (gNodeB), transmission reception point (TRP), evolved Node B (evolved Node B, eNB), wireless network in 5G communication system Controller (radio network controller, RNC), node B (Node B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved Node B) , Or home Node B, HNB, baseband unit (BBU), or wireless fidelity (Wi-Fi) access point (AP), etc.
  • the network device may include a centralized unit (CU) node, or a distributed unit (DU) node, or a RAN device including a CU
  • the network device can send configuration information (for example, carried in a scheduling message and/or an instruction message) to the terminal device, and the terminal device further performs network configuration according to the configuration information, so that the network configuration between the network device and the terminal device is aligned; or , Through the network configuration preset in the network device and the network configuration preset in the terminal device, the network configuration between the network device and the terminal device is aligned.
  • “alignment” refers to the determination of the carrier frequency of the interactive message sending and receiving, the type of interactive message, the meaning of the field information carried in the interactive message, or the meaning of the interactive message between the network device and the terminal device when there is an interactive message. The understanding of the other configurations of the interactive message is the same.
  • the network device may be another device that provides wireless communication functions for the terminal device.
  • the embodiment of the present application does not limit the specific technology and specific device form adopted by the network device. For ease of description, the embodiments of the present application are not limited.
  • the network equipment may also include core network equipment.
  • the core network equipment includes, for example, access and mobility management function (AMF), user plane function (UPF), or session management function (session management function, SMF). Wait.
  • AMF access and mobility management function
  • UPF user plane function
  • SMF session management function
  • the device used to implement the function of the network device may be a network device, or a device capable of supporting the network device to implement the function, such as a chip system, and the device may be installed in the network device.
  • the device used to implement the functions of the network equipment is a network device as an example to describe the technical solutions provided in the embodiments of the present application.
  • Radio resource control (RRC) state terminal equipment has three RRC states: RRC connected state (connected state), RRC idle state (idle state) and inactive state (inactive state).
  • RRC connected state connected state
  • RRC idle state idle state
  • inactive state inactive state
  • RRC connected state (or, can also be referred to as connected state for short.
  • connected state and “RRC connected state” are the same concept, and the two terms can be interchanged): the terminal device establishes an RRC connection with the network, and it can Perform data transfer.
  • RRC idle state (or, can also be referred to as idle state for short.
  • idle state and “RRC idle state” are the same concept, and the two terms can be interchanged): the terminal device does not establish an RRC connection with the network, and the base station The context of the terminal device is not stored. If the terminal device needs to enter the RRC connected state from the RRC idle state, it needs to initiate an RRC connection establishment process.
  • RRC inactive state (or, can also be referred to as inactive state for short.
  • inactive state “inactive state”, “deactivated state”, “inactive state”, “RRC inactive state” and “RRC deactivated state” , Is the same concept, these terms can be interchanged):
  • the terminal device entered the RRC connection state before, and then the base station released the RRC connection, but the base station saved the context of the terminal device. If the terminal device needs to enter the RRC connected state again from the RRC inactive state, it needs to initiate the RRC recovery process (or called the RRC connection recovery process). Compared with the RRC establishment process, the RRC recovery process has shorter time delay and lower signaling overhead. However, the base station needs to save the context of the terminal device, which will occupy the storage overhead of the base station.
  • At least one of A, B, and C includes A, B, C, AB, AC, BC, or ABC.
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the order, timing, priority, or importance of multiple objects. degree.
  • Multicast is a network technology that allows one or more senders to send a single data packet to multiple receivers.
  • the data source can send the data packet once, so that the receivers in the multicast group who need the data packet can receive the data packet.
  • unicast refers to the communication between a sender and a receiver over the network.
  • the data multicast process can be realized through MBMS technology.
  • Figure 1-1 and Figure 1-2 are schematic diagrams of the existing multicast network architecture
  • FIG. 1-1 is a schematic diagram of the network architecture implemented by the terminal equipment (UE) in the unicast process.
  • the UE connects to the core network equipment through the evolutional base station (evolutional Node B, eNB) to achieve single network data.
  • the core network equipment includes a mobility management entity (Mobility Management Entity, MME), a packet data network gateway (Packet Data Network Gateway, PDN GW/P-GW), and a content service unit (content service).
  • MME Mobility Management Entity
  • PDN GW/P-GW Packet Data Network Gateway
  • content service content service
  • FIG. 1-2 a schematic diagram of the system architecture for MBMS to implement the multicast process.
  • the MBMS network element in the 4G LTE MBMS network architecture shown in Figure 1-2 is introduced.
  • multiple interface protocols including broadcast/multicast service center (BM-SC), MBMS gateway (MBMS Gateway, MBMS-GW) and multi-cell/multicast coordination entity (multi-cell/multicast coordination) entity, MCE), where:
  • BM-SC broadcast/multicast service center
  • MBMS gateway MBMS Gateway, MBMS-GW
  • MCE multi-cell/multicast coordination entity
  • BM-SC mainly realizes the distribution and control functions of enhanced MBMS (enhanced-MBMS, eMBMS) services.
  • BM-SC as the transmission portal of the eMBMS service of the content provider, is the initiator of the eMBMS session, and provides functions such as scheduling and delivery of eMBMS services, and security key (key) management;
  • MCE is a logical entity introduced by LTE eMBMS to realize multi-cell transmission, and is responsible for allocating radio resources of eNBs in the multimedia broadcast single frequency network (MBSFN) area to which it is connected and eMBMS session management;
  • MMSFN multimedia broadcast single frequency network
  • MBMS-GW is responsible for delivering MBMS session control messages to MME and forwarding MBMS service data to eNB.
  • MBMS-GW can be deployed together with P-GW.
  • multicast transmission of data can be realized.
  • the following is an example of the process of multicast-related 4G single-cell multicast (SC-PTM, single cell point to multi-point) implementation. illustrate.
  • SC-PTM is a technology that uses shared data information to transmit the same service to multiple UEs at the same time.
  • a group of UEs receiving the same service use the same downlink configuration for service reception, and it is not necessary to establish its own communication for each UE. link.
  • SC-PTM has a single cell multicast control channel (SC-MCCH, single cell multicast control channel) and a single cell multicast transmission channel (SC-MTCH, single cell multicast transport channel). ), these two logical channels are mapped to the downlink shared channel (DL-SCH, downlink shared channel).
  • SC-MCCH single cell multicast control channel
  • SC-MTCH single cell multicast transmission channel
  • the control channel SC-MCCH contains service identification and time information for receiving the broadcast service logical channel (MTCH, multicast traffic channel), and the SC-MTCH is used to transmit service data.
  • the SC-MCCH is sent periodically.
  • the SC-MCCH cycle has a repetition period (Repetition Period, RP) and a modification period (Modification Period, MP). Each repetition period sends one SC-MCCH, and a modification period contains several repetition periods. And the content of SC-MCCH remains unchanged during the modification period.
  • the cell uses G-RNTI to schedule service data to multiple UEs at the same time, and each G-RNTI can be associated with one MBMS service.
  • G-RNTI uses a specific example to illustrate the general process of the terminal receiving the SC-PTM service:
  • the terminal obtains the system information block 20 (SIB) from the base station.
  • the system message contains the control information for transmitting the SC-PTM service, that is, the configuration information of the SC-MCCH.
  • the terminal can know how to use the system message To receive the SC-MCCH, specifically, the system message includes the repetition period (RepetitionPeriod, RP) and offset (sc-mcch-Offset) of the SC-MCCH, that is, the boundary of the SC-MCCH period, which meets SFN every time
  • the SC-MCCH transmission time represents the SC-MCCH transmission duration
  • the configuration information included in the SC-MTCH includes the SC-PTM service identifier MBMSSessionInfo (TMGI, Session ID), which is used to receive the SC-MTCH identifier G-RNTI, and the SC-MTCH time information sc-mtch-schedulingInfo.
  • the terminal can receive the multicast service data in the SC-MTCH according to the control information of the SC-MCCH and the scheduling information of the corresponding PDCCH.
  • the SC-MCCH configuration the MCCH is repeatedly sent in each MP, and the repetition period is RP. In an MP, the content of the SC-MCCH is the same.
  • the PDCCH containing the modification notification will be sent, the modification notification It is the MCCH change Notification.
  • the UE When the UE detects the SC-N-RNTI on the PDCCH, it is considered that the modification notification is detected, and the UE obtains the SC-MCCH again.
  • the UE When obtaining the SC-MCCH, the UE needs to detect the PDCCH scrambled by the SC-RNTI to obtain the scheduling information of the SC-MCCH.
  • BM-SC network elements include: key management function (Key Management Function), and key management function is further divided into: key request function (Key Request Function) and key distribution function (Key Distribution Function).
  • key management function Key Management Function
  • Key Distribution Function key distribution function
  • the BM-SC uses unicast (separate transmission) to send the key to the UE, but the process involved in the key distribution process is realized through the interaction of application layer signaling.
  • the network side device as a data source can send multicast data packets to multiple terminal devices.
  • the access network side in the network side needs to be used to indicate The configuration information of how to receive multicast data packets is sent to the terminal equipment one by one through multicast.
  • a broadcast/multicast service center (BM-SC) network element is added to the core network side in the network side.
  • the BM-SC network element sends the multicast-related keys to the terminal devices in the multicast group in a unicast manner through user plane data transmission.
  • the operator uses MBMS to implement the key management method in the process, it needs to add a server and core network interface, which makes the key management structure and process more complicated: on the one hand, when the number of terminal devices in the multicast group is large, add new
  • the BM-SC network element needs to establish a unicast connection with multiple terminal devices one by one and then send the multicast key, which is too inefficient; on the other hand, the newly-added BM-SC network element sends the multicast key through the connection
  • the access network device is forwarded to the terminal device through application layer signaling, and the access network device sends configuration information indicating how to receive multicast data packets through multicast, and sends the multicast key and multicast configuration information separately For terminal equipment, there is a certain delay, which affects the efficiency of network communication.
  • the embodiments of the present application provide a method and device for transmitting a key, which are used to implement a key transmission mode in a multicast process.
  • FIG 4 is a schematic diagram of a network architecture to which the embodiments of this application are applicable.
  • the network architecture includes multiple UEs, such as UE1, UE2, and UE3; access network equipment, such as NR NodeB , GNB), including gNB-control plane functional entity (gNB-CP) and gNB-user plane functional entity (gNB-UP); core network equipment (CN, core network), examples of which are access and mobility management network elements ( access and mobility management function (AMF) and user plane function (UPF).
  • GNB gNB-control plane functional entity
  • gNB-UP gNB-user plane functional entity
  • CN core network equipment
  • AMF access and mobility management function
  • UPF user plane function
  • the dotted line represents the control plane connection
  • the solid line represents the transmission path of user data.
  • All three terminal devices are connected to the base station.
  • a cell RNTI Cell RNTI, C-RNTI
  • DRB data radio bearer
  • the DRB also Associate a G-RNTI, realize dynamic conversion between unicast and multicast through G-RNTI and C-RNTI scheduling.
  • three terminal devices receive the same service, and each terminal device has a unicast bearer, that is, a channel for receiving data based on C-RNTI.
  • the base station also configures the same G-RNTI for the three terminal devices at the same time.
  • the base station can schedule the same data to three terminal devices respectively. In this case, unicast scheduling is used. In the case of using G-RNTI to schedule data, the base station schedules a copy of data and all three terminal devices can receive it.
  • the embodiment of the present application considers the encryption process of the multicast data and the management network element of the multicast key to solve the above-mentioned problems:
  • Method 1 Realize multicast data encryption through access network equipment.
  • PDCP packet data convergence protocol
  • Method 2 Realize multicast data encryption through new functions or protocol layers of core network equipment.
  • new protocol layers are added to the terminal equipment and core network equipment respectively ( New layer) implementation;
  • Method 3 Add server management, you can use the existing MBMS application layer management method, the air interface is invisible, and the new server and core network interface are relatively simple;
  • Method 4 Through the management of the access network equipment, the access network element can realize the update of the unified multicast key through the multicast mode, and save the signaling overhead under the premise of ensuring security;
  • Mode 5 Through core network device management, the key is for the multicast group, and is uniformly maintained by the core network device, and the key is sent as a multicast context (multicast context).
  • the subsequent embodiments adopt the above-mentioned methods one, four, and five. Described in combination with, that is, the encryption process of the multicast data is realized by the access network device, and the management network element of the multicast key is realized by the access network device/core network device.
  • the encryption process of the multicast data is implemented by the access network device
  • the management network element of the multicast key is implemented by the access network device or the core network device.
  • the connection The method of aligning the network access device and the terminal device can be unicast transmission or multicast transmission.
  • FIG. 5 is a schematic flowchart of a key transmission method provided in an embodiment of the application, as shown in FIG. 5, including:
  • the access network device sends a first message to the terminal device.
  • the access network device sends the first message to the terminal device.
  • the terminal device receives the first message from the access network device in step S101.
  • the first message sent by the access network device to the terminal device includes the first key, where the first key is used to encrypt the multicast data packet, that is, the terminal device can subsequently receive data from the terminal device according to the first key pair.
  • the multicast data packet of the access network device is decrypted.
  • the first message sent by the access network device to the terminal device may also include a first timer and/or first time information, where the first timer is used to indicate the effective duration of the first key, The first time information is used to indicate the effective start time of the first key.
  • the terminal device obtains the first timer and/or the first time information in the process of receiving the first message from the access network device in step S101.
  • the terminal device may also determine the first timer and/or the first time information according to the preset time configuration inside the terminal device, or it may be determined according to other messages exchanged between the access network device and the terminal device
  • the first timer and/or the first moment information are not limited here.
  • the access network equipment may handle a large number of multiple multicast services, and different multicast services may have different timeliness requirements.
  • the multicast service is an advertisement push service
  • the multicast service is a real-time live broadcast service of a sports game, it generally requires multiple times
  • the terminal device needs to maintain the validity of the first key for a long time.
  • the access network device and the terminal device can realize the multicast secret between the access network device and the terminal device. Alignment of the time limit used by the key.
  • the key transmission process can be further optimized, and the effective time information for the first key can be configured to control the multicast transmission more flexibly Encryption strategy to improve communication security.
  • the application methods for using the effective start time of the first key indicated by the first time information are as follows: Many, including:
  • Manner 1 The terminal device can validate the first key immediately after receiving the first message.
  • the access network device carries the effective time indication T (that is, the first time information) in the first message.
  • the terminal device determines the key corresponding to the first key according to the effective time indication The time when the configuration takes effect.
  • the key valid time indication corresponding to the first key may be an absolute time indication.
  • the key valid time indication corresponding to the first key may indicate a certain time, minute, second, and millisecond.
  • the key valid time indication corresponding to the first key can be a radio frame number, or radio frame number + subframe number, or radio frame number + subframe number + time slot number,
  • the radio frame number (System Frame Number, SFN) X correspondingly, the terminal device validates the key configuration corresponding to the first key at the boundary corresponding to SFN X.
  • the terminal device validates the key configuration corresponding to the first key at a relative time after receiving the first message, where the relative time can specifically indicate the time when a specific event occurs, that is, before the specific event occurs.
  • the terminal device validates the key configuration corresponding to the first key.
  • the specific event may be that the terminal device receives a complete wireless frame from the access network device.
  • the terminal device may validate the key configuration at the boundary of the wireless frame where the first message is located;
  • the specific event can be that the terminal device receives the multicast data packet from the access network device.
  • the terminal device can receive the multicast data packet from the access network device after receiving the first message.
  • the specific event may be pre-configured in the terminal device or indicated by the access network device.
  • the access network device may send the bearer to the terminal device through dedicated signaling.
  • the indication of a specific event obviously, the specific event may also be implemented in other ways, which is not limited here.
  • the terminal device can determine the specific event in a variety of ways.
  • the specific event can be carried in the first message, it can also be predefined in the terminal device, or it can be carried by the access network device and sent to the terminal device. In other messages of, there is no limitation here.
  • Method 4 When the first message is an RRC reconfiguration message, the terminal device will validate the password corresponding to the first key after receiving the hybrid automatic repeat request (HARQ) of the RRC reconfiguration complete message.
  • HARQ hybrid automatic repeat request
  • the terminal device After the terminal device receives the reconfiguration message sent by the access network device, it will send the reconfiguration complete message to the access network device, in order to ensure that the access network device successfully receives the reconfiguration complete message (to ensure that the terminal device It is aligned with the two ends of the access network device).
  • the access network device After receiving the reconfiguration complete message, the access network device will reply to the terminal device with HARQ feedback, indicating that the reconfiguration is successfully received, and the terminal device can receive the reconfiguration completion message.
  • the terminal device validates the key configuration corresponding to the first key.
  • the first timer For the first timer corresponding to the first key, the first timer is used to indicate the effective duration of the first key, and the terminal device uses the first timer after receiving the first timer sent by the access network device.
  • a timer There are many ways of a timer, including:
  • the terminal device determines that the first key is invalid.
  • the terminal device can send a query message to the access network device, and the query message is used to query whether the access network device has an update key key at this time; optionally, the terminal device can send a query message to the access network device when the first timer expires.
  • the device sends an inquiry message, or the terminal device may send an inquiry message to the access network device before the first timer expires.
  • the terminal device can maintain a periodic query timer.
  • the duration and start time of the periodic query timer can be obtained from the access network device or the core network device, for example, by the access network device or the core network device. It is specified in the message sent by the device to the terminal device, or pre-configured in the terminal device.
  • the terminal device sends the above-mentioned query message.
  • step S101 Before step S101 is implemented, it also includes step S101A: the terminal device determines that a multicast configuration is required.
  • the terminal device if the terminal device is not in the RRC connected state, such as when the terminal device is in the RRC inactive state or the RRC idle state, when the terminal device determines that multicast configuration is required, the terminal device initiates the RRC connection establishment process or the RRC connection The recovery process enters the RRC connected state, and then receives the first message from the access network device in step S101, so that the terminal device in the inactive state or idle state can also implement the first message corresponding to the multicast data packet. Obtaining the key.
  • the manner in which the terminal device determines that multicast configuration is required includes at least one of the following:
  • the terminal device When a terminal device is interested in a multicast service and does not have a corresponding multicast configuration, it is determined that a multicast configuration is required. At this time, the terminal device stores the configuration of some services, but there is no multicast corresponding to the interested multicast service Configuration, in other words, the stored partial service configuration does not include the multicast configuration corresponding to the multicast service of interest.
  • the first message can be sent in multiple ways: including:
  • the first message may be sent in unicast mode.
  • Sending in unicast mode refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection.
  • a message can be an RRC message, a MAC CE message, a PDCCH message, or another type of unicast message, which is not limited here.
  • the first message can also be sent in a broadcast mode, where the broadcast mode refers to the communication mode in which the sender of the data "one-to-all" the receiver, that is, the terminal equipment within the coverage of the access network equipment can receive it
  • the fourth key associated with the terminal device is encrypted and sent in a broadcast manner, but what this embodiment wants to implement is a multicast process, that is, to make a specific terminal device receive the first message, so ,
  • the broadcast message can be sent by encrypting the broadcast message with the fourth key.
  • the fourth key may be pre-configured in the terminal device.
  • the fourth key may be a key pre-stored in a specific terminal device, so that a specific terminal device equipped with the fourth key can be based on the The fourth key decrypts the broadcast message to obtain the first message, but a terminal device that does not possess the fourth key cannot completely decrypt the broadcast message, and can discard/ignore the broadcast message.
  • the fourth key when the fourth key is implemented, it may specifically be a key that the access network device pre-aligns with the terminal device.
  • the access network device is of a specified type.
  • the fourth key assigned by the terminal device, or the access network device determines the fourth key according to the instruction of the core network device.
  • the operator service provider can preset the fourth key in the storage module of the terminal device, such as preset in the terminal device Subscriber Identity Module (SIM) Universal Subscriber Identity Module (Universal Subscriber Identity Module) , USIM), IP MultiMedia Service Identity Module (ISIM), embedded SIM card (embedded SIM, eSIM) or other such as electronic signature authentication, electronic wallet, etc.
  • SIM Subscriber Identity Module
  • USIM Universal Subscriber Identity Module
  • ISIM IP MultiMedia Service Identity Module
  • embedded SIM card embedded SIM card
  • the terminal device may obtain the fourth key from the access network device or the core network device, and the fourth key used by the access network device and the terminal device are aligned.
  • the terminal device receives the fourth key sent by the access network device, or the terminal device receives the key sent by the core network device.
  • a specific terminal device with the fourth key can decrypt the broadcast message according to the fourth key to obtain the first key, while a terminal device without the fourth key cannot completely decrypt the broadcast message.
  • the terminal device cannot decrypt the broadcast message, it can discard/ignore the broadcast message.
  • the first message can also be sent by multicast.
  • the multicast can be sent by sending the first message on the MCCH channel.
  • the time-frequency configuration related to the MCCH can be sent to the access network device in advance.
  • the broadcast message sent by the terminal device is carried; the multicast transmission can also be achieved by using G-RNTI to scramble the first message, where the G-RNTI can be carried by the access network device and sent to the terminal device in advance (unicast, The multicast configuration information included in the multicast or broadcast) message; the first message may also be sent in other multicast manners, which is not limited here.
  • the access network device may also send a first configuration information set to the terminal device, where the first configuration information set includes at least one multicast configuration information, and the multicast configuration information includes at least one of the following: Multicast service identifier, G-RNTI, BWP indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search space indication, control resource set indication, etc.
  • the multicast data packet sent by the access network device to the terminal device can be configured through the multicast configuration information, and for the terminal device, the multicast data packet from the access network device can be received through the multicast configuration information .
  • the access network device may indicate to the terminal device that the first configuration information set is associated with the first key carried in the first message in step S101, that is, instruct the terminal device to use the first key pair to pass the The multicast data packet received in the first configuration information set is decrypted, where the indication may be an explicit indication or an implicit indication, specifically:
  • the explicit indication may be implemented by including the identification of the first key in the first configuration information set.
  • the identification of the first key may be The type identifier that carries the information where the first key is located may be the verification bit identifier in the field of the first key itself or other identifiers that can indicate the first key.
  • the first configuration information set may carry In the first message different from the first key that carries the first key sent by the access network device to the terminal device, the multicast configuration information and the multicast key are sent separately, and the security of the multicast data packet transmission is further realized;
  • the implicit indication mode can indicate to the terminal device that the key and configuration information set carried in the same message have an association relationship by default.
  • the first configuration information set It is carried in the first message where the first key is located.
  • the terminal device determines that the first message contains the first configuration information set and the first key, it determines that the first configuration information set is associated with the first message.
  • a key so that the terminal device can obtain the first key used to process the multicast data packet and the corresponding first configuration information set through the first message.
  • the signaling overhead of the access network equipment can be further saved.
  • the first configuration information set includes at least one multicast configuration information, that is, the first configuration information set may include multiple multicast configuration information.
  • the multiple multicast configuration information includes multiple multicast service identifiers.
  • multiple multicast configuration information includes multicast service identifier 1, multicast service identifier 2,...multicast service identifier 10, that is, the first configuration information set includes the multicast service identifier 1, multicast service identifier 2.
  • the subsequent terminal device receives the multicast data packet from the access network device, if the multicast data includes the multicast service identifier 1, the multicast service identifier 2...multicast
  • the terminal device can use the first key associated with the first configuration information set to decrypt the multicast data packet to obtain the multicast data; wherein, in the first configuration information set Other parameters can also realize the configuration of multiple multicast configuration information, which will not be repeated here.
  • the access network device may also carry a first indication in the first message sent in step S101.
  • the terminal device may further obtain the first indication through the first message.
  • the first indication is used to instruct the terminal device to enter the RRC idle state or the RRC inactive state without releasing the first configuration information set and the first key (or suspend the first configuration information set and the first key maintenance It is still valid), and continue to use the first configuration information set and the first key to receive the multicast data packet, so that the terminal device can also receive the multicast data packet in the RRC idle state or the RRC inactive state.
  • the storage module may be a SIM, USIM, ISIM, eSIM or others such as electronic signature authentication, electronic wallet, etc.; it may also be the first indication carried in a specific message sent by the access network device, where the specific message may be the first message in step S101 , Or other RRC messages, such as RRC release (RRCRelease) message, RRC connection release (RRCConnectionRelease) message, RRC resumption (RRCResume) message, RRC connection resumption (RRCConnectionResume) message, etc.
  • the specific implementation of the first indication in the specific message may include at least one or more of the following:
  • the first indication may be a 1-bit indication carried in the specific message.
  • the specific message carries a "1bit indication”, that is, the bit is set to 1, which indicates that the terminal device enters the RRC idle state or the RRC inactive state, At the same time, do not release the first configuration information set and the first key (or suspend the first configuration information set and the first key to keep it still valid), and continue to use the first configuration information set and the first secret.
  • the key receives the multicast packet.
  • the bit when the bit is set to another value, it can identify the terminal device to release the first configuration information set and/or the first key, or identify other information, which is not limited here. ;
  • the first indication may be the field information carried in the specific message.
  • the field information When the field information is carried in the specific message, it indicates that the terminal device enters the RRC idle state or the RRC inactive state, and the first configuration information is not released at the same time Set and the first key (or suspend the first configuration information set and the first key to keep it still valid), and continue to use the first configuration information set and the first key to receive the multicast data packet, Conversely, when the field information is not carried in the specific message, it can identify the terminal device to release the first configuration information set and/or the first key, or identify other information, which is not limited here;
  • the first indication information may be the specified cause value Cause carried by the specific message.
  • the specified cause When the specified cause is carried in the specific message, it indicates that the terminal device enters the RRC idle state or the RRC inactive state, and does not release the specified cause at the same time.
  • the first configuration information set and the first key (or suspend the first configuration information set and the first key to keep it still valid), and continue to use the first configuration information set and the first key to receive the multiple
  • the specified cause when the specified cause is not carried in the specific message, it can identify the terminal device to release the first configuration information set and/or the first key, or identify other information, which is not limited here.
  • the terminal device Since the reception of multicast data packets does not depend on the RRC connection between the terminal device and the access network device, it can also be achieved when the terminal device exits the RRC connection state, that is, the terminal device is in the RRC idle state or the RRC inactive state Receiving multicast data, the terminal device enters the radio resource control RRC idle state or the RRC inactive state according to the first instruction, and does not release the first configuration information set and the first key, that is, continues to use the first configuration information Set and the first key to receive the multicast data packet, that is, the terminal device can use the first key pair in the RRC idle state or the RRC inactive state to receive the multicast packet through the first configuration information set
  • the data packet is decrypted to obtain the multicast data, so that the signaling consumption between the access network device and the terminal device can be further saved.
  • the terminal device can also determine to exit the connected state by itself based on its own configuration strategies such as reducing power consumption and/or improving performance, or determine to exit the connected state by other means, which is not limited in the present invention.
  • the terminal device sends a third instruction to the access network device.
  • the third instruction is used to instruct the terminal device to determine to exit the connected state by itself, or the third instruction is used to request the release of the RRC connection, or The third instruction is used to request to suspend the RRC connection, or the third instruction to the access network device that the terminal device requests to exit the connected state.
  • the third indication may be carried in an RRC message, and the RRC message may be an RRC connection request message or an RRC connection suspension message or other RRC messages, which is not limited in the present invention.
  • the third instruction is used to instruct the access network device that the terminal device decides to exit the connected state by itself, so that the access network device and the terminal device can align the state of the terminal device, so that the access network device will exit the connected state after exiting the connected state. In the idle state or the inactive state, the first message can still be used to realize receiving the multicast data packet from the access network device.
  • the access network device sends a multicast data packet encrypted with the first key to the terminal device.
  • the terminal device can use the information obtained in step S101
  • the first key decrypts the multicast data packet to obtain the multicast data in the multicast data packet, so as to realize the encryption of the multicast key during the multicast data transmission process between the access network device and the terminal device Process to improve the security of multicast data communication.
  • the access network device sends the first configuration to the terminal device in a multicast manner.
  • the access network device sends the first configuration to the terminal device in a multicast manner.
  • the terminal device receives the first configuration from the access network device in a multicast manner in step S102.
  • the access network device sends the first configuration for updating the first key to the terminal device in a multicast manner, so that the terminal device can update the first key to the second key according to the first configuration, and then further according to the second key.
  • the key processes the received multicast data packets from the access network equipment.
  • the first configuration is used to update the first key to the second key, and the first configuration can also be flexibly configured.
  • the first configuration can be configured to be directly used to replace the second key.
  • the second key of a key can also be an update strategy configured to update the first key (for example, Next Hop parameter (NH), Next Hop Chaining Counter parameter) , NCC) or other parameters, using related parameters to derive the updated second key), or other methods, which are not limited here.
  • NH Next Hop parameter
  • NCC Next Hop Chaining Counter parameter
  • the first configuration includes the second key as an example for description, where the first key in step S101 is used to encrypt the multicast data packet sent by the access network device to the terminal device, and after step S102, The encryption key of the multicast data packet sent by the access network device to the terminal device is updated from the first key to the second key. Therefore, in the implementation of the solution, the first configuration can be done through explicit or implicit To indicate to update the first key to the second key, specifically:
  • the first configuration display instructs the UE to update the first key to the second key.
  • the first configuration includes the second key and the identification of the first key.
  • the identification of the first key may be The type identifier that carries the information where the first key is located may be the verification bit identifier in the field of the first key itself or other identifiers that can indicate the first key;
  • the first configuration implicitly instructs the UE to update the first key to the second key
  • the first configuration includes the second key and the second configuration associated with the second key An information set, where the second configuration information set is a subset of the first configuration information set.
  • the second configuration information set is a subset of the first configuration information set
  • the first configuration sent by the access network device to the terminal device may instruct to update the first key corresponding to the second configuration information set to the second key , So that the terminal device can update part of the first key or update all of the first keys, so as to achieve further optimization of the key transmission mode.
  • the first configuration information set corresponding to the first key includes the multicast service identifier 1, the multicast service identifier 2,... the multicast service identifier 10 ;
  • the second set of configuration information corresponding to the second key includes the multicast service identifier 1, the multicast service identifier 2...
  • the terminal device sets the multicast service identifier 1
  • the multicast data packet corresponding to the multicast service identifier 2...multicast service identifier 4 is updated with the second key for processing, and other multicast service identifiers (multicast service identifier 5...multicast service identifier 10) correspond to The multicast data packet still corresponds to the first key for processing.
  • the parameter "BWP indication information" in the first configuration information set is used to indicate that the terminal device can use the BWP1: 40 MHz bandwidth and BWP2: 10 MHz bandwidth; among them, the multicast services sent in the BWP1 and BWP2 modes both use the first
  • the second configuration information set in the first configuration may only indicate that the multicast service corresponding to BWP1 is updated to use the second key encryption process, and the key corresponding to BWP2 is not changed. That is to say, the multicast service corresponding to BWP2 still uses the first key for processing.
  • other parameters in the first configuration information set can also implement a similar process, which will not be repeated here.
  • the first configuration further includes effective time information of the second key.
  • the first configuration includes a second timer, and/or second time information, where the second timer is used to indicate the second The effective duration of the key.
  • the first time information is used to indicate the effective start time of the second key.
  • the implementation of the second timer and the second time information can refer to the aforementioned first timer and first time The relevant realization process of the information will not be repeated here.
  • the method further includes step S1021: the access network device determines whether the first key needs to be updated.
  • the determination process can be implemented in multiple ways. For example, the access network device may determine that the first key corresponds to the first key. Or, the access network device determines that the first key needs to be updated according to the first request message from the terminal device, and the first request message is used to request the update information of the first key.
  • the network access further queries and determines that the first key needs to be updated according to the first request message; or, the access network device determines that the first key needs to be updated according to the first configuration from the core network device, or the access network The device determines that a certain terminal device in the multicast group leaves the group, and in order to prevent the key from leaking, the first key is updated uniformly. That is, the access network device can perform flexible processing for different usage scenarios, and determine that the first key needs to be updated in a variety of ways, so as to realize the timely update of the multicast key, thereby improving the security of communication.
  • step S1022 the terminal device determines that the update information of the first key is required. Specifically, if the terminal device is not in the RRC connected state, for example, when the terminal device is in the RRC inactive state or the RRC idle state, when the terminal device determines that the update information of the first key is required, the terminal device establishes an RRC connection by initiating The process or the RRC connection recovery process enters the RRC connected state, and then receives the first configuration from the access network device in step S102, so that the terminal device in the inactive state or idle state can also implement the first key Acquisition of updated information.
  • the terminal device determines that the update information of the first key is required, which may specifically include:
  • the terminal device determines that it needs to obtain the multicast configuration according to the paging message from the access network device, where the paging message is used to indicate that the first key is updated; where, if the key management network element is a core network device If the core network device determines that the first key needs to be updated, it may send a paging message to the access network device, and the access network device forwards the paging message to the terminal device, where the paging message may include the first key Two instructions, the second instruction is used to indicate that the first key has been updated; after that, after the access network device establishes an RRC connection with the terminal device, the access network device sends the first key to the terminal device in a multicast manner. Configuration.
  • the access network device can use a paging message to make the terminal device in a connected state after establishing an RRC connection with the terminal device, and then send the first configuration to the terminal device in a multicast manner, thereby realizing that the pair is in an inactive state.
  • the terminal device determines that the update information of the first key is required when the first timer corresponding to the first key has expired.
  • the multicast mode in the process of the access network device sending the first configuration to the terminal device, can be realized by carrying the first configuration through MCCH, or the access network device can use the preset identifier to carry the first configuration.
  • the configured message (for example, the DCI message) is implemented by scrambling, and it may also be other multicast methods, which is not limited here.
  • the implementation process of the preset identifier scrambling process is taken as an example for description.
  • the first configuration may specifically be carried in the first downlink control information, and the first downlink control information Scrambling through G-RNTI, or scrambling through preset RNTI.
  • the G-RNTI may be carried in the first configuration information set in the implementation process of step S101, and the preset RNTI is a radio network temporary identifier that is different from the G-RNTI and used to scramble and carry the DCI of the first configuration.
  • the preset RNTI is a radio network temporary identifier that is different from the G-RNTI and used to scramble and carry the DCI of the first configuration.
  • it may be a predefined dedicated identifier, or it may be an identifier dynamically configured by a network device, or it may be an identifier preset in the terminal device.
  • the access network device when the access network device communicates with the terminal device in advance, the access network device assigns a preset RNTI to a terminal device of a specified type, or the access network device determines the preset RNTI according to the instruction of the core network device, For example, the operating service provider presets the preset RNTI of the storage module in the terminal device, such as SIM, USIM, ISIM, embedded eSIM, or other such as electronic signature authentication, electronic wallet, etc., and then accesses the network device
  • the preset RNTI can be determined according to an instruction issued by the core network device corresponding to the operator service provider. Therefore, the first configuration can be carried in the first downlink control information sent by the access network device to the terminal device, and there is no need to set a special message for sending the first configuration, which further saves the information of the access network device. ⁇ consuming.
  • the first configuration may be further encrypted.
  • the first configuration may be directly encrypted by the first key; or , The first configuration may be encrypted by a third key, which is carried in the first message in step S101 and is different from the first key; or, the first configuration may also It is encrypted by the fourth key associated with the terminal device, so that the encrypted transmission of the first configuration for updating the first key can improve the data security in the transmission process.
  • the access network device may additionally set up interactive information with the terminal device to implement the process of updating the third key.
  • the access network device sends a multicast data packet encrypted with the second key to the terminal device.
  • the terminal device can use the information obtained in step S102
  • the second key decrypts the multicast data packet to obtain the multicast data in the multicast data packet, so that during the multicast data transmission process between the access network device and the terminal device, the access network device and the terminal device
  • the update and alignment of multicast keys between terminal devices further enhances the security of multicast data communication.
  • the access network device sends a first message to the terminal device, the first message includes a first key, and the first key is used to encrypt the multicast data packet, that is, the terminal device can pair according to the first key
  • the received multicast data packet from the access network device is processed; after that, when the first key is updated, the access network device can send the first configuration to the terminal device in a multicast manner, and the second A configuration is used to update the first key, so that the terminal device can, after updating the first key according to the first configuration, further pair the received multicast data packet from the access network device according to the updated key To process.
  • the access network device sends the first configuration for updating the first key to the terminal device in a multicast manner.
  • the keys in multiple terminal devices can be realized through one sending process.
  • the update of saves the signaling overhead caused by the access network device to unicast the update message to each terminal device one by one, so as to achieve the optimization of the key transmission mode in the multicast process.
  • FIG. 6 is a schematic flowchart of another key transmission method provided in an embodiment of the application, as shown in FIG. 6, including:
  • the access network device sends a first message to the terminal device.
  • the access network device sends the first message to the terminal device.
  • the terminal device receives the first message from the access network device in step S201.
  • the first message includes a first key and a first set of configuration information associated with the first key, where the first key is used to encrypt a multicast data packet, or the terminal device can receive according to the first key pair
  • the received multicast data packet from the access network device is decrypted.
  • the terminal device can further align various configuration parameters used in the multicast configuration with the access network device, where the configuration parameters can be carried in the first message in step S201,
  • the first message further includes a first configuration information set associated with the first key, the first configuration information set includes at least one multicast configuration information, and the multicast configuration information includes at least one of the following: a multicast service identifier , G-RNTI, BWP indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search space indication, control resource set indication, etc. Therefore, the terminal device can obtain the first key used to process the multicast data packet and the corresponding first configuration information set through the first message.
  • step S101 Compared with the need to set up a separate process of sending configuration information in the prior art, it can be further Save the signaling overhead of the access network equipment.
  • step S101 For the specific implementation process of the first configuration information set, reference may be made to the related description in step S101, which will not be repeated here.
  • the terminal device may further determine a first timer indicating the aging information of the first key, and/or first time information, where the first timer is used to indicate the effective duration of the first key, the The first time information is used to indicate the effective start time of the first key, the effective time of the first key, and the effective duration of the first key to realize the process of determining the validity of the first key. For details, see The relevant content in step S101 will not be repeated here.
  • step S201 Before step S201 is implemented, it also includes step S201A: the terminal device determines that a multicast configuration is required.
  • the terminal device determines that multicast configuration is required, the terminal device initiates the RRC connection establishment process or the RRC connection The recovery process enters the RRC connected state, and then receives the first message from the access network device in step S201, so that the terminal device in the inactive state or idle state can also implement the first message corresponding to the multicast data packet. Obtaining the key.
  • the terminal device determines that multicast configuration is required. For the specific implementation process, refer to the relevant implementation process of S101 in the foregoing steps, which will not be repeated here.
  • the first message can be sent in unicast mode or broadcast mode.
  • the specific process of sending the first message refer to the related implementation of S101 in the previous step. The process will not be repeated here.
  • the access network device may also carry a first indication in the first message sent in step S201. Accordingly, the terminal device may further obtain the first indication through the first message, where For the specific process of implementing the first instruction, reference may be made to the related implementation process of the first instruction in step S101, which will not be repeated here.
  • the terminal device can also determine to exit the connected state by itself based on its own configuration strategies such as reducing power consumption and/or improving performance, or determine to exit the connected state by other means. This is not the case in the present invention. Do restrictions.
  • the terminal device determines to exit the connected state, the terminal device sends a third instruction to the access network device.
  • the terminal device sends a third instruction to the access network device.
  • the access network device For the specific process of implementing the third instruction, refer to the related implementation process of the third instruction in step S101, which will not be repeated here. .
  • the access network device sends a multicast data packet encrypted with the first key to the terminal device.
  • the terminal device can use the information obtained in step S201
  • the first key decrypts the multicast data packet to obtain the multicast data in the multicast data packet, so as to realize the encryption of the multicast key during the multicast data transmission process between the access network device and the terminal device Process to improve the security of multicast data communication.
  • the access network device sends the first configuration to the terminal device in a unicast manner, where the first configuration is used to update the first key in step S201.
  • the access network device sends the first configuration to the terminal device in a unicast manner.
  • the terminal device receives the first configuration from the access network device in a unicast manner in step S202.
  • the first configuration is used to update the first key, so that the terminal device can, after updating the first key according to the first configuration, further pair the received multicast from the access network device according to the updated key.
  • the packet is processed.
  • the first configuration is sent in unicast mode, which refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection.
  • the specific implementation of the message in the unicast sending process can be an RRC message, a MAC CE message, a PDCCH message, or other types of unicast messages, which are not limited here.
  • the access network device sends the first configuration in unicast mode.
  • the second embodiment implements the first configuration during the one-to-one communication between the access network device and the terminal device.
  • the transmission of key information can selectively implement multicast key update for some terminal devices, further improving the security of key information transmission.
  • the first configuration may also carry a second timer used to indicate corresponding to the second key, and/or second time information, where the second timer is used to indicate the effective duration of the second key,
  • the first time information is used to indicate the effective start time of the second key.
  • the implementation of the second timer and the second time information can refer to the related implementation of the first timer and the first time information in the foregoing embodiment. The process will not be repeated here.
  • step S2021 the access network device determines whether the first key needs to be updated.
  • the determination process There are multiple implementations of the determination process. For the specific implementation of the determination process, reference may be made to the description in step S102. The relevant implementation process will not be repeated here.
  • the terminal device determines that the update information of the first key is required. Specifically, if the terminal device is not in the RRC connected state, for example, when the terminal device is in the RRC inactive state or the RRC idle state, when the terminal device determines that the update information of the first key is required, the terminal device establishes an RRC connection by initiating The process or the RRC connection recovery process enters the RRC connected state, and then receives the first configuration from the access network device in step S202, so that the terminal device in the inactive state or idle state can also implement the first key Acquisition of updated information.
  • the terminal device determines that the update information of the first key is needed.
  • the specific implementation process refer to the related implementation process described in the foregoing step S102, which will not be repeated here.
  • the first configuration further includes a second configuration information set, the second configuration information set is associated with the second key, and the second configuration information set is a subset of the first configuration information set.
  • the first configuration can be further encrypted.
  • the specific encryption refer to the related implementation process described in the foregoing step S102, which will not be repeated here.
  • the access network device sends a multicast data packet encrypted with the second key to the terminal device.
  • the terminal device can use the information obtained in step S202.
  • the second key decrypts the multicast data packet to obtain the multicast data in the multicast data packet, so that during the multicast data transmission process between the access network device and the terminal device, the access network device and the terminal device.
  • the update and alignment of multicast keys between terminal devices further enhances the security of multicast data communication.
  • the access network device sends a first message to the terminal device.
  • the first message includes a first key and a first set of configuration information associated with the first key.
  • the first key is used for encryption.
  • Multicast data packet that is, the terminal device can process the received multicast data packet from the access network device according to the first key; after that, when the first key is updated, the access network device can The first configuration is sent to the terminal device in a unicast manner, and the first configuration is used to update the first key, so that the terminal device can update the first key according to the first configuration, and further according to the updated key Process the received multicast data packets from the access network equipment.
  • the access network device sends the first configuration in unicast mode.
  • the second embodiment implements the first configuration during the one-to-one communication between the access network device and the terminal device.
  • the transmission of key information can selectively implement multicast key update for some terminal devices, further improving the security of key information transmission.
  • the access network device can carry the first key and the first configuration information set associated with the first key in the first message, so that the terminal device can obtain the multicast data packet through the first message.
  • the first key and the corresponding first configuration information set can save the signaling overhead of the access network equipment.
  • different terminal devices may have different connection states ( Connected state, inactive state or idle state), and the encryption and scrambling methods of the access network equipment during data transmission are different.
  • connection states Connected state, inactive state or idle state
  • encryption and scrambling methods of the access network equipment during data transmission are different.
  • the embodiments of this application provide adaptive corresponding solutions for different application scenarios. The following description will be given through the embodiments shown in FIGS. 7 to 13.
  • Fig. 7 is a schematic flowchart of another method for transmitting a key provided by the third embodiment of the application, as shown in Fig. 7, including:
  • the access network device sends a first message to the terminal device.
  • the access network device sends a first message to the terminal device.
  • the terminal device receives the first message from the access network device in step S301, where the first message except for the encrypted multicast data
  • the terminal device may further include G-RNTI and other multicast configuration parameters (specifically including the first multicast configuration parameter set in step S101), first moment information, and/or One or more of the first timers.
  • the terminal device uses the first key carried in the first message and other parameters that may exist to process the multicast data packet.
  • the implementation process of G-RNTI and other multicast configuration parameters can refer to the aforementioned step S101 The relevant implementation process will not be repeated here.
  • the first message may be sent in a unicast manner, or may be sent in a broadcast or multicast manner.
  • the relevant implementation process of S101 in S101 will not be repeated here.
  • the terminal device determines the validity of the first key.
  • the terminal device may further determine a first timer indicating the aging information of the first key, and/or first time information, where the first timer is used to indicate the first The effective duration of the key, and the first time information is used to indicate the effective start time of the first key.
  • the terminal device may be determined according to the preset time configuration inside the terminal device, or it may be determined according to a message sent by the access network device.
  • it may be determined according to the first effective moment and time carried in step S301.
  • the first timer determines that the determination process of the first key aging can be referred to the related determination process in step S101 from the two perspectives of the effective time of the first key and the valid duration of the first key. I won't repeat it here.
  • the terminal device sends a first request message to the access network device.
  • the terminal device sends a first request message to the access network device.
  • the access network device receives the first request message from the terminal device in step S303, and the first request message is used to request the first request message.
  • Update information of a key may be sent to the access network device when it is determined that the update information of the first key is required according to the aging of the first key in step S302, and thereafter, the access network device responds to the first request The message goes to step 304.
  • the terminal device sends a first request message to the access network device to request the update information of the first key, that is, the way the terminal device actively queries the update information of the first key can ensure that the terminal device Keep up-to-date key configuration in, avoid the situation that the multicast data packet cannot be processed because the key is not updated in time.
  • the access network device can subsequently trigger the execution of the process of obtaining the update information of the first key according to the first request message, and there is no need to separately configure the update strategy of the first key, which can save further Signaling consumption of access network equipment.
  • step S302 and step S303 are optional steps.
  • the access network device determines to update the first key.
  • the access network device can determine whether the first key needs to be updated according to a preset condition.
  • the determination process can be implemented in multiple ways, for example, the access network The device determines that the first timer corresponding to the first key has expired; or, the access network device determines that the first key needs to be updated according to the first request message from the terminal device in step S303, and the first request message is used for Request the update information of the first key, the access network further queries according to the first request message to determine that the first key needs to be updated; or, the access network device determines that it needs to be updated according to the first configuration from the core network device The first key, or the access network device determines that a certain terminal device in the multicast group leaves the group, and in order to prevent the key from being leaked, the first key is updated uniformly. That is, the access network device can perform flexible processing for different usage scenarios, and determine that the first key needs to be updated in a variety of ways, so as to realize the timely update of the multicast key
  • the access network device sends the first configuration encrypted with the first key to the terminal device in a multicast manner.
  • the access network device sends the first configuration encrypted with the first key in a multicast manner.
  • the terminal device receives the use of the first encryption from the access network device in a multicast manner in step S305.
  • the first configuration after key encryption.
  • the access network device obtains the first configuration for updating the first key.
  • the access network device encrypts and scrambles the first configuration. Broadcast to the access network equipment.
  • the encryption process may be direct encryption using the first key in step S301, and the scrambling process may be implemented by using the G-RNTI in step S301 to scramble a message (such as a DCI message) carrying the first configuration, or it may be The preset RNTI scrambles the realization of the message carrying the first configuration.
  • the preset RNTI may be a preset RNTI that the access network device aligns with the terminal device in advance. For example, in the process that the access network device communicates with the terminal device in advance, the access network device is allocated to a terminal device of a specified type.
  • the access network device determines the preset RNTI according to the instructions of the core network device, for example, the preset RNTI preset in the storage module of the terminal device by the operator, such as the preset RNTI in the terminal device, the SIM, USIM, ISIM, embedded eSIM or other such as electronic signature authentication, electronic wallet, etc.
  • the first configuration can be a second key directly used to replace the first key, or an update strategy used to update the first key (such as NH, NCC or other parameters, which can be derived using relevant parameters).
  • the updated second key can also be in other ways, which is not limited here.
  • the terminal device updates the first key according to the first configuration.
  • the terminal device updates the first key according to the first configuration in step S305 to obtain the second key.
  • the first configuration may also carry a second timer that is used to indicate the second key corresponding to, and/or second time information, where the second timer is used to indicate the effective duration of the second key ,
  • the first time information is used to indicate the effective start time of the second key.
  • the implementation of the second timer and the second time information can refer to the first timer and the first time information in step S101. The relevant implementation process will not be repeated here.
  • the access network device can be applied to a terminal device in a connected state.
  • the access network device sends the The terminal device sends the first configuration for updating the first key.
  • the update of the keys in multiple terminal devices can be achieved through a single sending process, which saves money compared with the prior art.
  • the access network equipment unicasts the signaling overhead caused by sending update messages one by one for each terminal device, which saves the signaling overhead caused by unicast sending update messages one by one for each UE, and optimizes the processing of the access network equipment. Realize updates and improve communication efficiency.
  • FIG. 8 is a schematic flowchart of another method for transmitting a key provided by Embodiment 4 of this application, as shown in FIG. 8, including:
  • the access network device sends a first message to the terminal device.
  • the access network device sends a first message to the terminal device.
  • the terminal device receives the first message from the access network device in step S401, where the first message except for the encrypted multicast data
  • the first message except for the encrypted multicast data
  • it may further include G-RNTI and other multicast configuration parameters (specifically, it may include the first multicast configuration parameter set in step S301), the first effective time, and/ Or one or more of the first timers.
  • the terminal device uses the first key carried in the first message and other parameters that may exist to process the multicast data packet.
  • the implementation process of G-RNTI and other multicast configuration parameters can refer to the aforementioned step S101
  • first time information can refer to the aforementioned step S101
  • first timer and other parameters can refer to the aforementioned step S101
  • the first message can be sent in unicast mode or broadcast mode.
  • S101 for the specific process of sending the first message, please refer to S101 in the previous step. The relevant implementation process will not be repeated here.
  • the first message can also carry a third key.
  • the access network can use the third key to encrypt the update information of the first key.
  • the access network device may also send the third time information and/or the third timer to the terminal device through the first message or other messages, where the third timing The device is used to indicate the effective duration of the third key, and the third time information is used to indicate the effective start time of the third key.
  • the implementation of the third timer and the third time information can refer to the aforementioned step S101. The related implementation process of the first timer and the first moment information in the first time information will not be repeated here.
  • the first message can carry the third key.
  • the third key is used to encrypt the update information of the multicast key.
  • the first key is used to encrypt the update information of the multicast key.
  • the access network device may additionally set a third key to implement the update information process of the encrypted multicast key.
  • the access network device determines that the third key has been updated.
  • the access network device can determine whether the third key is updated according to preset conditions. There are multiple ways to determine whether the third key is updated. For example, the access network device can determine the third key corresponding to the third key. The timer expires; or, the access network device determines that the third key needs to be updated according to the second request message from the terminal device, the second request message is used to request update information of the third key, and the access network further Inquire according to the second request message to determine that the third key needs to be updated; or, the access network device determines that a certain terminal device in the multicast group has left the group, and in order to prevent the key from being leaked, the third key is updated uniformly . That is, the access network device can perform flexible processing for different usage scenarios, and determine that the third key needs to be updated in a variety of ways, so that this embodiment can be adapted to a variety of application scenarios.
  • S403 The access network device sends the second configuration to the terminal device.
  • the access network device sends the second configuration to the terminal device.
  • the terminal device receives the second configuration from the access network device in step S403.
  • the access network device determines in step S402 that the third key needs to be updated
  • the access network device sends a second configuration to the terminal device, where the second configuration includes the update information of the third key, which is used to update the third key.
  • the third key is updated to obtain the updated third key.
  • the second configuration may also carry a fourth timer used to indicate the updated third key, and/or fourth time information, where the fourth timer is used to indicate the updated third key
  • the valid duration of the key, the fourth time information is used to indicate the effective start time of the updated third key.
  • the implementation of the fourth timer and the fourth time information can refer to the aforementioned first timer and the first timer. The relevant implementation process of the information at a moment will not be repeated here.
  • the second configuration can be directly used to replace the key information of the third key, or it can be an update strategy used to update the third key (such as NH, NCC or other parameters, and use relevant parameters to derive the update.
  • the third key afterwards can also be in other ways, which is not limited here.
  • step S402 and step S403 are optional execution steps.
  • the terminal device determines the validity of the first key.
  • S405 The terminal device sends a first request message to the access network device.
  • the terminal device sends the first request message to the access network device.
  • the access network device receives the first request message from the terminal device in step S405 in step S405.
  • the implementation process of step S404 and step S405 can refer to the related implementation process of the aforementioned steps S302 and S303, which will not be repeated here.
  • step S404 and step S405 are optional steps.
  • S406 The access network device determines to update the first key.
  • step S406 can refer to the related implementation process of step S304, which will not be repeated here.
  • the access network device sends the first configuration encrypted with the third key to the terminal device in a multicast manner.
  • the access network device sends the first configuration encrypted with the third key in a multicast manner.
  • the terminal device receives the third key from the access network device in a multicast manner in step S407.
  • the first configuration after encryption.
  • the access network device obtains the first configuration for updating the first key.
  • the access network device encrypts and scrambles the first configuration. Broadcast to the access network equipment.
  • the encryption process may be encryption using the third key in step S401, or, when the access network device performs step S403, that is, step S404, the encryption process may be encryption using the updated third key in step S404 .
  • the scrambling process can be implemented by using the G-RNTI in step S301 to scramble a message (for example, a DCI message) carrying the first configuration, or can be implemented by using a preset RNTI to scramble a message carrying the first configuration.
  • the preset RNTI may be a preset RNTI that the access network device aligns with the terminal device in advance. For example, in the process that the access network device communicates with the terminal device in advance, the access network device is allocated to a terminal device of a specified type.
  • the access network device determines the preset RNTI according to the instructions of the core network device, for example, the preset RNTI preset in the storage module of the terminal device by the operator, such as the preset RNTI in the terminal device, the SIM, USIM, ISIM, embedded eSIM or other such as electronic signature authentication, electronic wallet, etc.
  • the first configuration can be a second key directly used to replace the first key, or an update strategy used to update the first key (such as NH, NCC or other parameters, which can be derived using relevant parameters).
  • the updated second key can also be in other ways, which is not limited here.
  • S408 The terminal device updates the first key according to the first configuration.
  • step S408 can refer to the related implementation process of step S306, which will not be repeated here.
  • the process of the related steps performed by the access network device and the terminal device can also be implemented through the corresponding process of the foregoing embodiment of FIG. 5, which will not be repeated here.
  • the access network device can be applied to a terminal device in a connected state.
  • the difference is that compared with the corresponding embodiment in FIG. 7 :
  • the first message also carries a third key.
  • the third key is used for encryption.
  • the access network device may additionally provide step S403 and step S404 to implement the process of updating the third key.
  • a new key sending and updating mechanism is provided, and the first key used in normal operation and the third key used in group update are distinguished. The update between two sets of keys is also Without affecting each other, the third key used for group update is made more secure through different configurations.
  • FIG. 9 is a schematic flowchart of another method for transmitting a key provided by Embodiment 5 of this application, as shown in FIG. 9, including:
  • S501 The access network device sends a first message to the terminal device.
  • the access network device sends the first message to the terminal device. Accordingly, in step S501, the terminal device receives the first message from the access network device.
  • the terminal device determines the validity of the first key.
  • S503 The terminal device sends a first request message to the access network device.
  • the terminal device sends the first request message to the access network device, and correspondingly, the access network device receives the first request message from the terminal device in step S503.
  • S504 The access network device determines to update the first key.
  • step S501 to step S504 can refer to the related implementation process of step S301 to step S304 in the corresponding embodiment of FIG. 7, which will not be repeated here.
  • the access network device sends the first configuration encrypted with the first key to the terminal device in a unicast manner.
  • the access network device sends the first configuration encrypted with the first key in unicast mode. Accordingly, the terminal device unicasts the first configuration from the access network device in step S505. The first configuration after key encryption. The access network device uses the first key carried in the first message in step S501 to encrypt the first configuration.
  • the first configuration is specifically sent in unicast mode, and sending in unicast mode refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection, where:
  • the specific implementation of the first message in the unicast sending process may be an RRC message, a MAC CE message, a PDCCH message, or other types of unicast messages, which are not limited here.
  • the first configuration may also carry a second timer used to indicate corresponding to the second key, and/or second time information, where the second timer is used to indicate the effective duration of the second key,
  • the first time information is used to indicate the effective start time of the second key.
  • the implementation of the second timer and the second time information can refer to the aforementioned related implementation process of the first timer and the first time information. I won't repeat it here.
  • S506 The terminal device updates the first key according to the first configuration.
  • step S506 can refer to the related implementation process of step S306, which will not be repeated here.
  • the access network device can be applied to a terminal device in a connected state.
  • the access network device unicasts the first configuration encrypted by the first key, compared with the corresponding embodiment in FIG. 7, the difference lies in:
  • the access network device sends the first configuration in unicast mode instead of multicast in step S305.
  • the process of sending the first configuration in unicast mode can improve the data transmission process. Compared with the embodiment corresponding to FIG. 7, it can prevent the terminal device from exiting the multicast group from the initial first key. Risk of leakage.
  • FIG. 10 is a schematic flowchart of another method for transmitting a key provided by Embodiment 6 of this application, as shown in FIG. 10, including:
  • the core network device sends the first multicast configuration and the first security configuration container (security Config container) to the access network device.
  • security Config container first security configuration container
  • the core network device sends the first multicast configuration and the first security configuration container to the access network device.
  • the access network device receives the first multicast configuration and the first multicast configuration from the core network device in step S601.
  • a safe configuration container may be used to transmit security configuration related parameters, such as transmission encryption key, transmission security algorithm, transmission digital certificate, etc., or transmit other security configuration related parameters.
  • the core network device may send the first multicast configuration and the first security configuration container to the access network device through the first interface with the access network device. During the sending process, the first multicast configuration and the first security configuration container The two information of the configuration container can be sent independently of each other.
  • the two information of the first multicast configuration and the first security configuration container can also be sent in a mutually contained relationship, for example, sending the first security configuration containing the first multicast configuration.
  • the container, or sending the first multicast configuration containing the first security configuration container is not limited here.
  • the first interface may be an N2 interface, or an S1 interface, or may be an interface with other names, which is not limited in this embodiment.
  • the interface as the N2 interface as an example for description:
  • the sending mode in step S601 includes:
  • Manner 1 The core network device sends the first multicast configuration to the access network device through an N2 message, where the first multicast configuration includes the first security configuration container, that is, the first security configuration container can be used as the first multicast configuration Part of the information of is included in the first multicast configuration;
  • Manner 2 The core network device sends the first multicast configuration and the first security configuration container to the access network device through multiple N2 messages, that is, the first security configuration container and the first multicast configuration are carried by different N2 messages;
  • Manner 3 The core network device sends the first multicast configuration and the first security configuration container to the access network device through an N2 message, where the first security configuration container and the first security configuration are used as two different information elements to pass through the same An N2 message is carried.
  • the access network device receives the N2 message carrying the first multicast configuration and the first security configuration container sent by the core network device.
  • the access network device receives the N2 message carrying the first multicast configuration and the first security configuration container sent by the core network device.
  • the first security configuration container may include the first key, or the first security configuration container may include parameters for determining the first key, where the parameters for determining the first key may include NH, NCC Or other related parameters, so that after the access network device (or terminal device) obtains the parameter used to determine the first key in the first security configuration container, the first key can be derived by using the related parameters;
  • the first multicast configuration includes the related configuration of the first key.
  • the related configuration of the first key may include: a first timer of the first key, and/or first time information, where the first timer is used to indicate the effective duration of the first key, The first time information is used to indicate the effective start time of the first key; in addition, the related configuration of the first key may also include: a first configuration information set of the first key, the first configuration information set It includes at least one multicast configuration information, and the multicast configuration information includes at least one of the following: multicast service identifier, G-RNTI, BWP indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search Space indication, control resource collection indication, etc.
  • step S101 and step S102 For the specific implementation process of the above parameters, refer to the related implementation processes in the aforementioned step S101 and step S102, which will not be repeated here.
  • step S101 and step S102 In the first multicast configuration, other parameters related to the first key can also be carried. Make a limit.
  • the access network device sends a first message to the terminal device.
  • the access network device sends the first message to the terminal device.
  • the terminal device receives the first message from the access network device in step S602.
  • the access network device determines to send the first message to the terminal device according to the first multicast configuration and the first security configuration container obtained in step S601.
  • the access network device may have different processing procedures in step S602:
  • the access network device can forward the first key carried in the first security configuration container of the core network, and transfer the first key
  • the key is carried in the first message of the signaling (air interface signaling for short) communicated between the terminal device and the access network device. After the terminal device obtains the first message, it can directly read the first secret through the first message. key;
  • the access network device may forward the parameter used to determine the first key carried in the first security configuration container of the core network, which will be used to determine the first key.
  • the parameter of a key is carried in the first message of the signaling (air interface signaling for short) communicated between the terminal device and the access network device. After the terminal device obtains the first message, it can pass the first message carried
  • the parameters used to determine the first key are derived to obtain the first key.
  • the access network device can forward the first multicast configuration carried in the first security configuration container of the core network, and carry the first multicast configuration between the terminal device and the access network device.
  • the terminal device can directly read the first multicast configuration through the first message.
  • step S602 for the implementation process of the access network device sending the first message to the terminal device in step S602, refer to the related implementation process of step S101 and step S102 in the embodiment corresponding to FIG. Steps S201 and S202) are not repeated here.
  • the core network device sends a second multicast configuration and a second security configuration container (security Config container) to the access network device.
  • security Config container a second security configuration container
  • the core network device sends the second multicast configuration and the second security configuration container to the access network device. Accordingly, the access network device receives the second multicast configuration and the second multicast configuration from the core network device in step S603. 2. Safely configure the container.
  • the core network device may send the first multicast configuration and the first security configuration container to the access network device through the first interface with the access network device, where the first interface may be an N2 interface or an S1 interface, It may also be an interface with other names, which is not limited in this embodiment.
  • the N2 interface is taken as an example for description.
  • the process of sending the second multicast configuration and the second security configuration container to the access network device through the N2 message can refer to the sending of the first multicast configuration and the first security in step S601.
  • the implementation process of the security Config container security Config container
  • the access network device receives the N2 message that carries the second multicast configuration and the second security configuration container sent by the core network device.
  • the second multicast configuration and the second security configuration container are implemented using the following steps:
  • the second security configuration container may include the second key, or the second security configuration container may include parameters for determining the second key, where the parameters for determining the second key may include NH, NCC Or other related parameters, so that after the access network device (or the terminal device) obtains the parameters used to determine the second key in the second security configuration container, the second key can be derived by using the related parameters;
  • the second multicast configuration includes the related configuration of the second key.
  • the related configuration of the second key may include: a second timer of the second key, and/or second time information, where the second timer is used to indicate the effective duration of the second key, The second time information is used to indicate the effective start time of the second key; in addition, the related configuration of the second key may also include: a second set of configuration information of the second key, the second set of configuration information It includes at least one multicast configuration information, and the multicast configuration information includes at least one of the following: multicast service identifier, G-RNTI, BWP indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search Space indication, control resource collection indication, etc.
  • the second configuration information set is a subset of the first configuration information set, and the association relationship between the second configuration information set and the first configuration information set can refer to the relevant implementation process in step S102 in the foregoing embodiment, which will not be repeated here. .
  • step S101 and step S102 For the specific implementation process of the above parameters, please refer to the related implementation processes in the aforementioned step S101 and step S102, which will not be repeated here.
  • step S101 and step S102 In the second multicast configuration, other parameters related to the second key can also be carried. Make a limit.
  • the access network device sends the first configuration to the terminal device.
  • the access network device sends the first configuration to the terminal device.
  • the terminal device receives the first configuration from the access network device in step S604.
  • the access network device determines to send the first configuration to the terminal device according to the second multicast configuration and the second security configuration container obtained in step S603.
  • the access network device may have different processing procedures, including:
  • the access network device can forward the second key carried in the second security configuration container of the core network, and transfer the second key
  • the key is carried in the first configuration of the signaling (air interface signaling for short) for communication between the terminal device and the access network device. After the terminal device obtains the first configuration, it can directly read the second secret through the first configuration. key;
  • the access network device may forward the parameter used to determine the second key carried in the second security configuration container of the core network, which will be used to determine the second key.
  • the parameters of the two keys are carried in the first configuration of the signaling (air interface signaling for short) for communication between the terminal device and the access network device.
  • the parameters used to determine the second key are derived to obtain the second key.
  • the access network device can forward the second multicast configuration carried in the second security configuration container of the core network, and carry the second multicast configuration between the terminal device and the access network device.
  • the terminal device can directly read the second multicast configuration through the first configuration.
  • the implementation process of the access network device sending the first configuration to the terminal device in step S604 can refer to the related implementation process of step S101 and step S102 in the embodiment corresponding to FIG. Steps S201 and S202) are not repeated here.
  • the access network device can determine the management of the multicast key by itself.
  • the management of the multicast key is implemented through core network equipment (for example, AMF, UPF or other core network equipment). Since the multicast key management is in the core network device, the first key and the first configuration used to update the first key can be used as the multicast context, which is sent by the core network device to the access network device. Realize multicast key management through core network equipment, improve signaling interaction between core network equipment and access network equipment, and reduce the storage and interaction signaling consumption of access network equipment for multicast key management.
  • core network equipment for example, AMF, UPF or other core network equipment
  • FIG. 11 is a schematic flowchart of another method for transmitting a key provided by Embodiment 7 of the application, as shown in FIG. 11, including:
  • the terminal device determines that it needs to obtain a multicast configuration
  • the terminal device if the terminal device is not in the RRC connected state, such as when the terminal device is in the RRC inactive state or the RRC idle state, at this time, when the terminal device determines that multicast configuration is required, the terminal device initiates step 702 The RRC connection establishment process or the RRC connection recovery process enters the RRC connected state.
  • the manner in which the terminal device determines that multicast configuration is required includes at least one of the following:
  • the terminal device When a terminal device is interested in a multicast service and does not have a corresponding multicast configuration, it is determined that a multicast configuration is required. At this time, the terminal device stores the configuration of some services, but there is no multicast corresponding to the interested multicast service Configuration, in other words, the stored partial service configuration does not include the multicast configuration corresponding to the multicast service of interest.
  • the terminal device initiates an RRC connection establishment process or an RRC connection recovery process.
  • the terminal device can enter the connected state to obtain the multicast configuration. Specifically, during the implementation of step S702, the terminal device can initiate an RRC connection The establishment process or the RRC connection recovery process enters the RRC connection state.
  • the RRC connection request message or the RRC connection recovery request message sent by the terminal device to the access network device in the process may carry a specific identifier, and the specific identifier is used to indicate that the terminal device requires multicast configuration.
  • the access network device sends the first message to the terminal device in a unicast manner.
  • the access network device sends the first message to the terminal device in a unicast manner.
  • the terminal device receives the first message from the access network device in a unicast manner in step S703.
  • the access network device may unicast the first message to the designated terminal device, where the designated terminal device may be the access network device determined according to the instructions of the core network device, or it may be determined by the access network device according to its own
  • the configuration determination can also be determined by the access network device according to the RRC connection request message sent by the terminal device or the specific identifier carried in the RRC connection recovery request message, where the specific identifier is used to indicate that the terminal device requires multicast configuration, and It can be determined in other ways and is not limited here.
  • sending in unicast mode refers to the mode of sending based on the link of the RRC connection after the access network device and the terminal device have established an RRC connection, where the specific implementation of the first message in the unicast sending process may be RRC messages, MAC CE messages, PDCCH messages, or other types of unicast messages are not limited here.
  • the first message may specifically include a first key, and the first key is used to encrypt the multicast data packet, that is, the terminal device may subsequently receive the multicast from the access network device according to the first key pair.
  • the data packet is decrypted.
  • the first message may also carry other parameters associated with the first key, including:
  • a first timer corresponding to the first key, and/or first time information where the first timer is used to indicate the effective duration of the first key, and the first time information is used to indicate the The effective start time of the first key;
  • a first configuration information set associated with the first key includes at least one multicast configuration information
  • the multicast configuration information includes at least one of the following: multicast service identifier, G-RNTI, BWP Indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search space indication, control resource set indication, etc.;
  • step S101 and step S102 For the specific implementation process of the above parameters, reference may be made to the related implementation processes in the aforementioned step S101 and step S102, which will not be repeated here.
  • the terminal device determines the validity of the first key.
  • step S704 can refer to the related implementation process of step S301, which will not be repeated here.
  • the access network device sends a first instruction to the terminal device.
  • the access network device sends the first instruction to the terminal device, and correspondingly, the terminal device receives the first instruction from the access network device in step S705.
  • the terminal device may exit the connected state according to the first instruction sent by the access network device, but does not release the first configuration information set and the first key; continue to use the first configuration information set And the first key to receive the multicast data packet.
  • the terminal device If the first instruction is carried in the message that the access network device transfers the terminal device from the RRC connected state to the RRC inactive state, when the terminal device receives the first instruction, the terminal device enters the RRC inactive state, but does not release the first instruction.
  • a configuration information set and a first key so that subsequent terminal devices can use the first configuration information set and the first key to receive the multicast data packet, that is, the terminal device can use the first configuration information set and the first key in the RRC inactive state.
  • a key decrypts the multicast data packet received through the first configuration information set to obtain the multicast data.
  • the terminal device transfers the terminal device from the RRC connected state to the RRC idle state
  • the terminal device enters the RRC idle state, but does not release the first configuration Information set and the first key, so that the first configuration information set and the first key can be used to receive the multicast data packet later, that is, the terminal device can use the first key pair to pass through in the RRC idle state
  • the multicast data packet received in the first configuration information set is decrypted to obtain the multicast data.
  • the terminal device may also exit the connected state based on the first instruction sent by the access network device, the access network device may further send a first instruction to the terminal device, and the first instruction is used to indicate
  • the terminal device enters the RRC idle state or the RRC inactive state, does not release the first configuration information set and the first key (or suspends the first configuration information set and the first key to keep it still valid), and continues The multicast data packet is received by using the first configuration information set and the first key.
  • the first indication may be carried in the first message in step S703, or may be sent to the terminal device through other RRC messages, such as RRC release message, RRC connection release message, RRC recovery message, RRC connection recovery message, and so on.
  • the access network device can use the first instruction to cause the terminal device to enter the radio resource control RRC idle state or the RRC inactive state according to the first instruction.
  • the terminal device can also determine to exit the connected state by itself based on its own configuration strategies such as reducing power consumption and/or improving performance, or determine to exit the connected state by other means, which is not limited in the present invention.
  • the terminal device sends a third instruction to the access network device.
  • the third instruction is used to instruct the terminal device to determine to exit the connected state by itself, or the third instruction is used to request the release of the RRC connection, or The third instruction is used to request to suspend the RRC connection, or the third instruction to the access network device that the terminal device requests to exit the connected state.
  • the third indication may be carried in an RRC message, and the RRC message may be an RRC connection request message or an RRC connection suspension message or other RRC messages, which is not limited in the present invention.
  • the third instruction is used to instruct the access network device that the terminal device decides to exit the connected state by itself, so that the access network device and the terminal device can align the state of the terminal device, so that the access network device will exit the connected state after exiting the connected state. In the idle state or the inactive state, the first message can still be used to realize receiving the multicast data packet from the access network device.
  • S706 The access network device determines to update the first key.
  • the access network device sends the first configuration to the terminal device in a multicast manner.
  • the access network device sends the first configuration to the terminal device in a multicast manner.
  • the terminal device receives the first configuration from the access network device in a multicast manner in step S707.
  • the terminal device updates the first key according to the first configuration.
  • step S706 to step S708 can refer to the related implementation process of step S304 to step S306 corresponding to FIG. 7, which will not be repeated here.
  • the process of the related steps performed by the access network device and the terminal device can also be implemented with reference to the related process corresponding to the foregoing embodiment of FIG. 5, which will not be repeated here.
  • step 701 and step 702 the terminal device is originally in the idle state or inactive state, and enters the connected state when it is determined that it needs to obtain the multicast configuration, and performs the process of receiving the first message in step S703 and step S704.
  • the terminal device can also exit the connected state according to the first instruction of the access network device, that is, if the access network device currently has a large number of multicast terminal devices, the access network device can Let some terminal devices exit the connected state, but do not release the multicast configuration information (including the first multicast configuration parameter set), the multicast key information (including the first key, the first configuration, etc.), that is, let the UE be in the idle state. Or the inactive state receives the multicast data packet. Compared with the corresponding embodiment in FIG. 7, the terminal device in the idle state or the inactive state can also receive the first key and the first configuration for updating the first key.
  • the terminal device in the idle state or the inactive state can also receive the first key and the first configuration for updating the first key.
  • FIG. 12 is a schematic flowchart of another method for transmitting a key provided by Embodiment 8 of this application, as shown in FIG. 12, including:
  • S801 The terminal device determines that it needs to obtain the multicast configuration
  • the terminal device initiates an RRC connection establishment process or an RRC connection recovery process
  • step S801 and step S802 can refer to the implementation process of step S701 and step S702 in FIG. 11, which will not be repeated here.
  • step S801 and step S802 are suitable for the terminal device in the idle state or inactive state to actively determine the application scenario of obtaining the multicast configuration, and then the terminal device executes step S805 to execute the corresponding process of obtaining the multicast configuration; when the terminal device is in In the connected state or when the terminal device in the idle state or in the inactive state is instructed by the access network device/core network device to obtain the application scenario of the multicast configuration, the steps S801 and S802 are optional steps.
  • the management of the multicast key is realized by the existing core network equipment (for example, AMF, UPF or other core network equipment). Since the multicast key management is in the core network equipment, when the core network equipment is The network equipment can determine the access network equipment and the terminal equipment’s information about the multicast data packet transmission periodically or based on the request of the terminal equipment or the request of the access network equipment or the configuration of the operator service provider according to the preset configuration rules. A key, where the first key is used to encrypt multicast data packets.
  • the core network device sends the first multicast configuration and the first security configuration container (security Config container) to the access network device.
  • the core network device sends the first multicast configuration and the first security configuration container to the access network device.
  • the access network device receives the first multicast configuration and the first multicast configuration from the core network device in step S804.
  • a safe configuration container is
  • the access network device sends the first message to the terminal device in a unicast manner.
  • the access network device sends the first message to the terminal device in a unicast manner.
  • the terminal device receives the first message from the access network device in a unicast manner in step S805.
  • step S804 and step S805 reference may be made to the related implementation process of step S601 and step S602, which will not be repeated here.
  • the terminal device determines the validity of the first key.
  • step S806 and step S807 can refer to the related implementation process of step S704 and step S705 in FIG. 11, which will not be repeated here.
  • S808 The core network device determines that the first key needs to be updated
  • the multicast key management since the multicast key management is in the core network device, when the core network device can perform according to preset configuration rules periodically or based on the request of the terminal device or the request of the access network device or based on The configuration of the operator service provider determines that the first key needs to be updated.
  • the core network device sends a paging message indicating a bearer key update instruction to the terminal device.
  • the core network device sends a paging message indicating a bearer key update instruction to the terminal device.
  • the terminal device receives a paging message indicating a bearer key update instruction from the core network device in step S809.
  • the core network device determines that the connection state of the terminal device with the first key is idle or inactive, the core network device sends a paging message bearing a key update indication to the terminal device, and thereafter, the terminal device
  • the RRC connection can be established based on the paging message to enter the connected state.
  • the terminal device in the process of establishing an RRC connection by the terminal device, the terminal device can enter the RRC connection state by initiating the RRC connection establishment process or the RRC connection recovery process.
  • it can be in the RRC connection establishment request message sent by the terminal device to the access network device or It is the indication that the bearer needs to obtain the update information of the first key in the RRC connection recovery request message, or the bearer specific cause value is used to indicate that the current RRC connection establishment request or the RRC connection recovery request is used to obtain the first key Update information.
  • the core network device may not perform step S809 and directly perform the subsequent step S810.
  • the core network device sends a second multicast configuration and a second security configuration container (security Config container) to the access network device.
  • security Config container a second security configuration container
  • the core network device sends the second multicast configuration and the second security configuration container to the access network device.
  • the access network device receives the second multicast configuration and the second multicast configuration from the core network device in step S810. 2. Safely configure the container.
  • the access network device sends the first configuration to the terminal device.
  • the access network device sends the first configuration to the terminal device. Accordingly, the terminal device receives the first configuration from the access network device in step S811.
  • the implementation process of step S810 and step S811 reference may be made to the related implementation process of step S603 and step S604, which will not be repeated here.
  • S812 The terminal device updates the first key according to the first configuration.
  • step S812 can refer to the related implementation process in step S506 in FIG. 9, which will not be repeated here.
  • the process of the related steps performed by the access network device and the terminal device can also be implemented with reference to the related process corresponding to the foregoing embodiment in FIG. 6, which will not be repeated here.
  • the process of sending the first configuration in unicast mode further improves the security of data transmission.
  • FIG. 13 is a schematic flowchart of yet another key transmission method provided by Embodiment 9 of this application, as shown in FIG. 13, including:
  • the access network device sends an encrypted broadcast message to the terminal device.
  • the access network device sends an encrypted broadcast message to the terminal device.
  • the terminal device receives the encrypted broadcast message from the access network device in step S901.
  • the access network device sends a broadcast message encrypted using the fourth key to the terminal device, where the broadcast message includes the first key, and the first key is used for the access network device to encrypt the multicast data packet.
  • the terminal device The multicast data packet from the access network device can be decrypted according to the first key.
  • the broadcast message may also carry other parameters associated with the first key, including:
  • a first timer corresponding to the first key, and/or first time information where the first timer is used to indicate the effective duration of the first key, and the first time information is used to indicate the The effective start time of the first key;
  • a first configuration information set associated with the first key includes at least one multicast configuration information
  • the multicast configuration information includes at least one of the following: multicast service identifier, G-RNTI, BWP Indication information, PDSCH scrambling sequence, DRX, demodulation reference signal, rate matching reference signal, search space indication, control resource set indication, etc.;
  • step S101 and step S102 For the specific implementation process of the above parameters, reference may be made to the related implementation processes in the aforementioned step S101 and step S102, which will not be repeated here.
  • the fourth key may be pre-configured in the terminal device, or obtained from the access network device or the core network device.
  • the fourth key may be a key pre-stored in a specific terminal device, so that the terminal device can obtain the fourth key, and the access network device determines the second key according to the instruction of the core network device.
  • the access network device may determine the fourth key used to broadcast the first message according to the instruction issued by the core network device corresponding to the operator service provider.
  • the terminal device may obtain the fourth key from the access network device or the core network device, and the fourth key used by the access network device and the terminal device are aligned. For example, the terminal device receives the fourth key sent by the access network device, or the terminal device receives the key sent by the core network device.
  • the specific terminal device with the fourth key can decrypt the broadcast message according to the fourth key to obtain the first key, while the terminal device without the fourth key cannot completely decrypt the broadcast message.
  • the broadcast message when the terminal device cannot decrypt the broadcast message, the broadcast message can be discarded/ignored.
  • S902 The terminal device processes the broadcast message from the access network device.
  • step S901 the terminal device receives the encrypted broadcast message and processes the encrypted broadcast message. If the decryption is successful, the terminal device delivers the decrypted broadcast message to the upper layer. If the decryption fails, the terminal device can discard or Ignore the broadcast message.
  • the terminal device before the terminal device processes the encrypted broadcast message, it also includes: the terminal device determines whether a fourth key is available, and if so, the terminal device can use the fourth key to decrypt the received broadcast message; if If there is no available fourth key, the terminal device can discard or ignore the broadcast message; or the terminal device uses any available key to try to decrypt the received broadcast message. If the decryption fails, the terminal device can discard or ignore the broadcast message.
  • the terminal device may also indicate a decryption error to the upper layer, that is, the terminal device may indicate that the upper layer fails to process the encrypted broadcast message.
  • the terminal device may specifically include Service Data Adaptation Protocol (SDAP), PDCP, and Radio Link Control Protocol (Radio Link Control, RLC), media access control layer (MAC), physical layer (physical, PHY), etc.
  • SDAP Service Data Adaptation Protocol
  • PDCP Packet Control Protocol
  • RLC Radio Link Control Protocol
  • MAC media access control layer
  • PHY physical layer
  • multiple protocol layers in which the terminal device delivers the decrypted broadcast message to the upper layer and the terminal device indicates the decryption error to the upper layer
  • the process can be specifically implemented in the information exchange between multiple protocol layers in the terminal device.
  • the terminal device uses the fourth key to decrypt the broadcast message obtained in step S901. If the decryption is successful, it is determined that the terminal device is an authorized terminal device, Subsequently, the terminal device can use the first message carried by the broadcast message to realize the reception of the multicast data packet. If the decryption fails, it is determined that the terminal device is not an authorized terminal device, and the terminal device can discard/ignore the broadcast message .
  • the authorized terminal device may be a terminal designated by the access network device in accordance with the preset rules preset in the access network device or the instructions of the core network device in the process of the access network device communicating with the terminal device in advance.
  • the device for example, when the multicast data packet that the access network device needs to send subsequently is about a local promotion message (such as local food information, local tourist attraction information, etc.), it can designate a non-local terminal device at the home location as an authorized terminal device; When the subsequent multicast data packet that the access network device needs to send is an advertisement message about a specified group of people (such as sports equipment advertisements, game advertisements), the terminal device whose registration information is male can be designated as an authorized terminal device, or other The implementation method is not limited here.
  • a local promotion message such as local food information, local tourist attraction information, etc.
  • Broadcast transmission refers to the "one-to-all" communication mode of the data sender, that is, the terminal equipment within the coverage of the access network equipment can receive the broadcast information, and the first part associated with the terminal equipment Four-key encryption and broadcast transmission, but what this embodiment wants to achieve is a multicast process, that is, to make a specific terminal device receive the first message, therefore, step S901 can be passed (only available for specific terminal devices)
  • the fourth key encrypts the broadcast message and sends it.
  • the fourth key may be a key pre-stored in a specific terminal device. Therefore, in step S902, the specific terminal device having the fourth key can decrypt the broadcast message according to the fourth key to obtain the multicast Configuration information and multicast key information, that is, it is determined that the terminal device is an authorized terminal device, and then the multicast configuration information and multicast key information can be used to process multicast data packets without the fourth key If the terminal device cannot completely decrypt the broadcast message, the broadcast message can be discarded/ignored, that is, the terminal device is determined to be an unauthorized terminal device, and the subsequent multicast configuration information and multicast key information cannot be used for multicast packet processing. deal with.
  • the implementation process of the fourth key can refer to the related implementation process in the aforementioned step S101 or step S102, which will not be repeated here.
  • the multicast configuration information and the multicast key information can be uniformly sent through broadcast messages (such as SIB), and encrypted broadcast messages are used to carry multiple broadcast messages. Broadcast configuration information and multicast key information can also ensure security to a certain extent.
  • an embodiment of the present application provides a communication device 1400.
  • the communication device 1400 may be a key transmission device.
  • the communication device 1400 includes: a transceiver unit 1401 and a processing unit 1402;
  • the processing unit 1402 is configured to send a first message to the terminal device through the transceiver unit 1401, the first message includes a first key, and the first key is used to encrypt a multicast data packet;
  • the processing unit 1402 is further configured to send a first configuration to the terminal device in a multicast manner through the transceiving unit 1401, and the first configuration is used to update the first key.
  • the first message further includes a first timer, and/or first time information, where the first timer is used to indicate the effective duration of the first key, and the first The time information is used to indicate the effective start time of the first key.
  • the first message further includes a first configuration information set associated with the first key, the first configuration information set includes at least one multicast configuration information, and the multicast configuration information includes At least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, bandwidth part BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the processing unit 1402 is further configured to send a first instruction to the terminal device through the transceiver unit 1401, and the first instruction is used to instruct the terminal device to enter the radio resource control RRC idle state or the RRC non-RRC state. Active state, and continue to use the first configuration information set and the first key to receive the multicast data packet.
  • the first configuration is used to update the first key to the second key
  • the first configuration further includes a second configuration information set
  • the second configuration information set is the same as the second configuration information set.
  • the key is associated, and the second configuration information set is a subset of the first configuration information set.
  • the processing unit 1402 determines that the first key needs to be updated according to one of the following conditions, including:
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the first configuration is carried in the first downlink control information, which is scrambled by the group radio network temporary identifier G-RNTI, or by the preset radio network temporary identifier RNTI Scrambled.
  • the first message is an RRC message, a MAC CE message of a media access control control unit, or a physical downlink control channel PDCCH message.
  • the first message is sent in unicast mode
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • the processing unit 1402 is further configured to send the paging message to the terminal device through the transceiving unit 1401, the paging message includes a second indication, and the second indication is used to indicate the first The key is updated;
  • the processing unit is also used to establish an RRC connection with the terminal device.
  • an embodiment of the present application provides a communication device 1500.
  • the communication device 1500 may be a key transmission device.
  • the communication device 1500 includes: a transceiver unit 1501 and a processing unit 1502;
  • the transceiver unit 1501 is configured to receive a first message from an access network device, where the first message includes a first key, and the first key is used to encrypt a multicast data packet;
  • the transceiving unit 1501 is further configured to receive a first configuration from the access network device in a multicast manner, and the first configuration is used to update the first key;
  • the processing unit 1502 is configured to update the first key to the second key according to the first configuration
  • the transceiver unit 1501 is further configured to receive the multicast data packet from the access network device according to the second key.
  • the first message further includes a first timer, and/or first time information, where the first timer is used to indicate the effective duration of the first key, and the first The time information is used to indicate the effective start time of the first key.
  • the first message further includes a first configuration information set associated with the first key, the first configuration information set includes at least one multicast configuration information, and the multicast configuration information includes At least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, partial bandwidth BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the transceiver unit 1501 is further configured to:
  • the first instruction is used to instruct the terminal device to enter the radio resource control RRC idle state or the RRC inactive state, and continue to use the first configuration information set and the first key to receive The multicast packet.
  • the first configuration further includes a second configuration information set, the second configuration information set is associated with the second key, and the second configuration information set is of the first configuration information set Subset.
  • the transceiver unit 1501 is further configured to send a first request message to the access network device, where the first request message is used to request update information of the first key.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the first configuration is carried by the first downlink control information from the access network device, the first downlink control information is scrambled by the group radio network temporary identification RNTI, or the first The downlink control information is scrambled by the preset wireless network temporary identifier RNTI.
  • the first message is an RRC message, a MAC CE message of a media access control control unit, or a physical downlink control channel PDCCH message.
  • processing unit 1502 is further configured to:
  • the RRC connection establishment process or the RRC connection recovery process is initiated to receive the first message from the access network device.
  • processing unit 1502 is specifically configured to:
  • the paging message is used to indicate that the first key is updated;
  • the first message is sent in unicast mode; or
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • an embodiment of the present application provides another communication device 1600.
  • the communication device 1600 may be a key transmission device.
  • the communication device 1600 includes: a transceiver unit 1601 and a processing unit 1602;
  • the processing unit 1602 is configured to send a first message to the terminal device through the transceiver unit 1601.
  • the first message includes a first key and a first set of configuration information associated with the first key.
  • the processing unit 1602 is further configured to send a first configuration to the terminal device in a unicast manner through the transceiving unit 1601, and the first configuration is used to update the first key.
  • the first message further includes a first timer, and/or first time information, where the first timer is used to indicate the effective duration of the first key, and the first The time information is used to indicate the effective start time of the first key.
  • the first configuration information set includes at least one piece of multicast configuration information
  • the multicast configuration information includes at least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, bandwidth part BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the processing unit 1602 is further configured to send a first instruction to the terminal device through the sending unit 1601, and the first instruction is used to instruct the terminal device to enter the radio resource control RRC idle state or the RRC non-RRC state. Active state, and continue to use the first configuration information set and the first key to receive the multicast data packet.
  • the first configuration is used to update the first key to the second key
  • the first configuration further includes a second configuration information set
  • the second configuration information set is the same as the second configuration information set.
  • the key is associated, and the second configuration information set is a subset of the first configuration information set.
  • processing unit 1602 is further configured to determine that the first key needs to be updated according to one of the following conditions, including:
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the first message is an RRC message, a MAC CE message of a media access control control unit, or a physical downlink control channel PDCCH message.
  • the first message is sent in unicast mode; or
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • the processing unit 1602 is further configured to send the paging message to the terminal device through the sending unit 1601, the paging message includes a second indication, and the second indication is used to indicate the first The key is updated;
  • the processing unit 1602 is also used to establish an RRC connection with the terminal device.
  • an embodiment of the present application provides another communication device 1700.
  • the communication device 1700 may be a key transmission device.
  • the communication device 1700 includes: a transceiver unit 1701 and a processing unit 1702;
  • the transceiving unit 1701 is configured to receive a first message from an access network device, the first message including a first key and a first set of configuration information associated with the first key, and the first key is used for Encrypting the multicast data packet, the first configuration information set is used to receive the multicast data packet;
  • the transceiving unit 1701 is further configured to receive a first configuration from the access network device in a unicast manner, and the first configuration is used to update the first key;
  • the processing unit 1702 is configured to update the first key to the second key according to the first configuration update
  • the transceiving unit 1701 is further configured to receive the multicast data packet from the access network device according to the second key.
  • the first message further includes a first timer, and/or first time information, where the first timer is used to indicate the effective duration of the first key, and the first The time information is used to indicate the effective start time of the first key.
  • the first configuration information set includes at least one piece of multicast configuration information
  • the multicast configuration information includes at least one of the following:
  • Multicast service identification group wireless network temporary identification G-RNTI, partial bandwidth BWP indication information, physical downlink shared channel PDSCH scrambling sequence, discontinuous reception DRX parameters, demodulation reference signal, rate matching reference signal, search space indication, control Resource collection instructions.
  • the transceiving unit 1701 is further configured to:
  • the first instruction is used to instruct the terminal device to enter the radio resource control RRC idle state or the RRC inactive state, and continue to use the first configuration information set and the first key to receive The multicast packet.
  • the first configuration further includes a second configuration information set, the second configuration information set is associated with the second key, and the second configuration information set is a part of the first configuration information set. Subset.
  • the transceiving unit 1701 is further configured to send a first request message to the access network device, where the first request message is used to request update information of the first key.
  • the first configuration is encrypted by the first key
  • the first configuration is encrypted by a third key, and the third key is configured by the first message;
  • the first configuration is encrypted by a fourth key associated with the terminal device.
  • the first message is an RRC message, a MAC CE message of a media access control control unit, or a physical downlink control channel PDCCH message.
  • the processing unit 1702 is further configured to initiate an RRC connection establishment process or an RRC connection recovery process to receive the first message from the access network device when it is determined that the multicast configuration is required.
  • processing unit 1702 is further configured to:
  • the paging message is used to indicate that the first key is updated;
  • the first message is sent in unicast mode; or
  • the first message is encrypted by a fourth key associated with the terminal device and sent in a broadcast manner.
  • FIG. 18 is a schematic diagram of the structure of the communication device involved in the above-mentioned embodiments provided by the embodiments of this application, where the communication device may specifically be the key transmission device in the foregoing embodiment, and the structure of the communication device Refer to the structure shown in FIG. 18.
  • the communication device includes at least one processor 1811, at least one memory 1812, at least one transceiver 1813, at least one network interface 1814, and one or more antennas 1815.
  • the processor 1811, the memory 1812, the transceiver 1813, and the network interface 1814 are connected, for example, by a bus. In the embodiment of the present application, the connection may include various interfaces, transmission lines, or buses, etc., which is not limited in this embodiment. .
  • the antenna 1815 is connected to the transceiver 1813.
  • the network interface 1814 is used to connect the communication device to other communication devices through a communication link.
  • the network interface 1814 may include a network interface between the communication device and the core network device, such as an S1 interface, and the network interface may include a communication device and other networks.
  • Network interfaces between devices such as other access network devices or core network devices, such as X2 or Xn interfaces.
  • the processor 1811 is mainly used to process the communication protocol and communication data, and to control the entire communication device, execute the software program, and process the data of the software program, for example, to support the communication device to perform the actions described in the embodiments.
  • the communication device may include a baseband processor and a central processing unit.
  • the baseband processor is mainly used to process communication protocols and communication data.
  • the central processing unit is mainly used to control the entire terminal device, execute software programs, and process data in the software programs. .
  • the processor 1811 in FIG. 18 can integrate the functions of a baseband processor and a central processing unit. Those skilled in the art can understand that the baseband processor and the central processing unit can also be independent processors and are interconnected by technologies such as a bus.
  • the terminal device may include multiple baseband processors to adapt to different network standards, the terminal device may include multiple central processors to enhance its processing capabilities, and the various components of the terminal device may be connected through various buses.
  • the baseband processor may also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit can also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and the communication data can be built in the processor, or can be stored in the memory in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the memory is mainly used to store software programs and data.
  • the memory 1812 may exist independently and is connected to the processor 1811.
  • the memory 1812 may be integrated with the processor 1811, for example, integrated in one chip.
  • the memory 1812 can store program codes for executing the technical solutions of the embodiments of the present application, and the processor 1811 controls the execution, and various types of computer program codes executed can also be regarded as the driver programs of the processor 1811.
  • Figure 18 shows only one memory and one processor. In an actual terminal device, there may be multiple processors and multiple memories.
  • the memory may also be referred to as a storage medium or storage device.
  • the memory may be a storage element on the same chip as the processor, that is, an on-chip storage element, or an independent storage element, which is not limited in the embodiment of the present application.
  • the transceiver 1813 may be used to support the reception or transmission of radio frequency signals between the communication device and the terminal, and the transceiver 1813 may be connected to the antenna 1815.
  • the transceiver 1813 includes a transmitter Tx and a receiver Rx.
  • one or more antennas 1815 can receive radio frequency signals
  • the receiver Rx of the transceiver 1813 is used to receive the radio frequency signals from the antennas, and convert the radio frequency signals into digital baseband signals or digital intermediate frequency signals, and transfer the digital
  • the baseband signal or digital intermediate frequency signal is provided to the processor 1811, so that the processor 1811 performs further processing on the digital baseband signal or digital intermediate frequency signal, such as demodulation processing and decoding processing.
  • the transmitter Tx in the transceiver 1813 is also used to receive a modulated digital baseband signal or digital intermediate frequency signal from the processor 1811, and convert the modulated digital baseband signal or digital intermediate frequency signal into a radio frequency signal, and pass it through a Or multiple antennas 1815 transmit the radio frequency signal.
  • the receiver Rx can selectively perform one or more stages of down-mixing processing and analog-to-digital conversion processing on the radio frequency signal to obtain a digital baseband signal or a digital intermediate frequency signal. The order of precedence is adjustable.
  • the transmitter Tx can selectively perform one or more stages of up-mixing processing and digital-to-analog conversion processing on the modulated digital baseband signal or digital intermediate frequency signal to obtain a radio frequency signal, the up-mixing processing and the digital-to-analog conversion processing
  • the order of precedence is adjustable.
  • Digital baseband signals and digital intermediate frequency signals can be collectively referred to as digital signals.
  • the transceiver may also be referred to as a transceiver unit, transceiver, transceiver, and so on.
  • the device used to implement the receiving function in the transceiver unit can be regarded as the receiving unit
  • the device used to implement the transmitting function in the transceiver unit can be regarded as the transmitting unit. That is, the transceiver unit includes a receiving unit and a transmitting unit. It can be called a receiver, an input port, a receiving circuit, etc., and a sending unit can be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the communication device shown in Figure 18 can be specifically used to implement the steps implemented by the access network equipment in the method embodiments corresponding to Figures 5 to 13 and achieve the technical effects corresponding to the access network equipment, as shown in Figure 18
  • the communication device For the specific implementation of the communication device, reference may be made to the descriptions in the respective method embodiments corresponding to FIG. 5 to FIG. 13, and details are not repeated here.
  • FIG. 19 is a schematic diagram of a possible logical structure of the communication device 1900 involved in the above-mentioned embodiments provided by the embodiments of this application.
  • the communication device may specifically be the key transmission device in the foregoing embodiment.
  • the communication device 1900 may include, but is not limited to, a processor 1901, a communication port 1902, a memory 1903, and a bus 1904.
  • the processor 1901 is configured to control actions of the communication device 1900.
  • the processor 1901 may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination that implements computing functions, for example, a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the communication device shown in FIG. 19 can be specifically used to implement the steps implemented by the terminal device in the method embodiments corresponding to FIGS. 5 to 13 and achieve the corresponding technical effects of the terminal device.
  • the specific communication device shown in FIG. 19 For implementation manners, reference may be made to the descriptions in the respective method embodiments corresponding to FIG. 5 to FIG. 13, and details are not repeated here.
  • the embodiments of the present application also provide a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes as described in the possible implementation of the communication device in the foregoing embodiment.
  • the communication device may specifically be the key transmission device in the foregoing embodiment, that is, the access network device in the method embodiment corresponding to FIG. 5 to FIG. 13.
  • the embodiments of the present application also provide a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes as described in the possible implementation of the communication device in the foregoing embodiment.
  • the communication device may specifically be the key transmission device in the foregoing embodiment, that is, the terminal device in the method embodiment corresponding to FIG. 5 to FIG. 13.
  • the embodiments of the present application also provide a computer program product (or computer program) storing one or more computers.
  • the processor executes the method of the possible implementation of the above-mentioned communication device, wherein
  • the communication device may specifically be the key transmission device in the foregoing embodiment, that is, the access network device in the method embodiment corresponding to FIG. 5 to FIG. 13.
  • the embodiment of the present application also provides a computer program product storing one or more computers.
  • the processor executes the method of the foregoing possible implementation of the communication device, wherein the communication device may specifically It is the key transmission device in the foregoing embodiment, that is, the terminal device in the method embodiment corresponding to FIG. 5 to FIG. 13.
  • the embodiments of the present application also provide a chip system, which includes a processor, and is used to support the communication device to implement the functions involved in the foregoing possible implementation manners of the communication device.
  • the chip system may also include a memory, and the memory is used to store the necessary program instructions and data of the communication device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the communication device may specifically be the key transmission device in the foregoing embodiment, that is, the access in the method embodiment corresponding to FIG. 5 to FIG. 13 ⁇ Net equipment.
  • the embodiments of the present application also provide a chip system, which includes a processor, and is used to support the communication device to implement the functions involved in the foregoing possible implementation manners of the communication device.
  • the chip system may also include a memory, and the memory is used to store the necessary program instructions and data of the communication device.
  • the chip system may be composed of a chip, or may include a chip and other discrete devices.
  • the communication device may specifically be the key transmission device in the foregoing embodiment, that is, the terminal in the method embodiment corresponding to FIG. 5 to FIG. 13 equipment.
  • the embodiment of the present application also provides a network system architecture.
  • the network system architecture includes the above-mentioned communication device.
  • the communication device may specifically be the key transmission device in the foregoing embodiment. Terminal equipment and access network equipment.
  • the disclosed system, device, and method can be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of the present application essentially or the part that contributes to the existing technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , Including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供了一种密钥的传输方法及装置，用于实现多播过程中密钥的传输，在该方法中，接入网设备向终端设备发送第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；以多播方式向所述终端设备发送第一配置，所述第一配置用于更新所述第一密钥。其中，通过多播方式向终端设备发送用于更新第一密钥的第一配置，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，从而实现多播过程中密钥的传输，保证多播业务传输安全性的同时，降低通信系统的信令开销。

Description

一种密钥的传输方法及装置 技术领域
本申请涉及通信领域，尤其涉及一种密钥的传输方法及装置。
背景技术
多播是一种允许一个发送数据包到多个接收者的网络技术，数据源可以通过发送一次数据包，使得多播组内需要数据包的接收者收到该数据包。在长期演进(LTE，Long Term Evolution)网络可以通过多媒体广播多播业务(MBMS，Multimedia Broadcast Multicast Service)技术实现数据的多播过程。
在现有MBMS实现的过程中，网络侧设备作为数据源可以将多播数据包发送至多个终端设备，其中，网络侧中的接入网设备需要将多播数据包的配置信息一一发送至终端设备，并且在网络侧中的核心网侧新增网元进行多播数据的密钥管理。
然而，上述MBMS通过新增网元管理密钥的方式中，需要在网络中设置对应于该新增网元对应的服务器和核心网接口，通过这种方式实现多播数据的传输方式过于繁琐。因此，如何简单有效地实现多播过程中的密钥传输是亟需解决的技术问题。
发明内容
本申请实施例提供了一种密钥的传输方法及装置，用于实现多播过程中密钥的传输，保证多播业务传输安全性的同时，降低通信系统的信令开销。
本申请实施例第一方面提供了一种密钥的传输方法，该方法应用于接入网设备，在该方法中，接入网设备向终端设备发送第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包，即终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；此后，在第一密钥存在更新的时候，该接入网设备可以以多播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥，使得该终端设备可以在根据第一配置更新第一密钥之后，进一步根据更新后的密钥对接收到的来自于接入网设备的多播数据包进行处理。其中，接入网设备通过多播方式向终端设备发送用于更新第一密钥的第一配置，当终端设备的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，从而保证多播业务传输安全性的同时，降低通信系统的信令开销。
需要说明的是，在本申请实施例第一方面的实现过程中，接入网设备以多播方式向终端设备发送第一配置的过程中，多播方式可以是通过多播控制信道(Multicast Control Channel,MCCH)发送第一配置来实现，也可以是接入网设备使用预设标识对发送第一配置的下行控制信息(Downlink Control Information,DCI)进行加扰来实现，还可以是其它的多播方式，此处不做限定；此外，第一配置也可以灵活配置，例如该第一配置可以是配置为直接用于替换该第一密钥的数据、也可以是配置为用于更新第一密钥的更新策略、还可以是其他方式，此处不做限定。
在本申请实施例第一方面的一种可能的实现方式中，在接入网设备向终端设备发送的第一消息中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
本实施例中，接入网设备可以在第一消息中承载该第一密钥的时间指示信息，具体地，可以是承载指示该第一密钥的有效持续时间的第一定时器，和/或，可以是承载指示该第一密钥的生效起始时刻的第一时刻信息，使得终端设备可以根据该第一定时器和/或第一时刻信息接收来自接入网设备的多播数据包，使得后续终端设备对于第一密钥的使用时效可以与接入网设备对齐，且第一密钥的使用时效可以更加灵活地控制多播传输的加密策略，提升通信安全性。
在本申请实施例第一方面的一种可能的实现方式中，该第一消息还包括与该第一密钥相关联的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、组无线网络临时标识(group radio network temporary identifier,G-RNTI)、带宽部分(bandwidth part,BWP)指示信息、物理下行共享信道(physical downlink share channel，PDSCH)加扰序列、非连续接收(discontinuous reception，DRX)参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
本实施例中，接入网设备可以在该第一消息中承载与该第一密钥相关联的第一配置信息集合，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，可以进一步节省接入网设备的信令开销。
在本申请实施例第一方面的一种可能的实现方式中，该方法还包括：接入网设备向该终端设备发送第一指示，该第一指示用于指示该终端设备进入无线资源控制(radio resource control，RRC)空闲态或者RRC非激活态，不释放该第一配置信息集合和该第一密钥，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
本实施例中，由于接入网设备向终端设备发送多播数据包并不依赖于两者之间的RRC连接，为了进一步节省接入网设备与终端设备之间的信令消耗，接入网设备可以通过第一指示，使得终端设备根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，且不释放该第一配置信息集合和该第一密钥，即继续使用该第一配置信息集合和该第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态或者RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据，使得处于RRC空闲态或者RRC非激活态的终端设备也可以实现多播业务的传输。
在本申请实施例第一方面的一种可能的实现方式中，该第一配置用于将该第一密钥更新为第二密钥，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
本实施例中，第二配置信息集合是该第一配置信息集合的子集，接入网设备向终端设备发送的第一配置可以指示将第二配置信息集合对应的第一密钥更新为第二密钥，使得终端设备可以实现更新部分第一密钥或者更新全部第一密钥，从而实现对多播密钥的选择性更新。
在本申请实施例第一方面的一种可能的实现方式中，在接入网设备以多播方式向该终端设备发送第一配置之前，可以根据如下之一条件，使得该接入网设备确定需要更新该第一密钥，包括：
确定该第一定时器超时；或者，
根据来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息；或者，
根据来自核心网设备的该第一配置确定需要更新该第一密钥。
本实施例中，该接入网设备可以进一步灵活处理，通过多种方式来确定需要更新该第一密钥，具体地，该确定过程的确定依据可以是第一密钥对应的第一定时器、终端设备的第一请求消息、核心网发送的第一配置，使得该密钥的传输方法适应于多种应用场景。
在本申请实施例第一方面的一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
本实施例中，为了提升该密钥的传输方法中的数据安全性，接入网设备可以通过多种方式对第一配置的发送过程进行加密处理，具体地，该加密方式可以是通过第一密钥加密、在第一消息中另设的第三密钥、或者是使用与终端设备相关联的第四密钥，通过加密的方式传输用于更新第一密钥的第一配置可以提升传输过程中的数据安全性。
在本申请实施例第一方面的一种可能的实现方式中，该第一配置承载于第一下行控制信息，该第一下行控制信息通过组无线网络临时标识G-RNTI加扰，或者通过预设无线网络临时标识(radio network temporary identifier，RNTI)加扰。
本实施例中，在接入网设备以多播方式向终端设备发送第一下行控制信息时，其中，该第一下行控制信息可以通过该第一密钥相关联的G-RNTI加扰、也可以是通过终端设备中的预设RNTI加扰，可以将该第一配置承载于该第一下行控制信息，而无需另设专门用于发送该第一配置的消息，进一步节省接入网设备的信令消耗。
在本申请实施例第一方面的一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元(media access control control element，MAC CE)消息或物理下行控制信道PDCCH消息。
本实施例中，接入网设备向终端设备发送的第一消息具体可以为RRC消息、MAC CE消息或者是PDCCH消息，提供了第一消息发送过程中具体的实施方式，提升方案的可实现性。
在本申请实施例第一方面的一种可能的实现方式中，该第一消息是以单播方式发送的；或，该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
本实施例中，第一消息可以是以单播方式发送的，其中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，该第一消息可以是通过与该终端设备相关联的第四密钥加密且以广播方式发送的，广播方式指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，该第四密钥为预存于该终端设备中的密钥，例如该接入 网设备预先与该终端设备通信并为该终端设备分配的第四密钥，或者是运营服务商预设于该终端设备的第四密钥。从而，提供了第一消息发送的具体实现过程，提升方案的可实现性。
在本申请实施例第一方面的一种可能的实现方式中，在接入网设备以多播方式向该终端设备发送第一配置之前，该方法还包括：
接入网设备向该终端设备发送该寻呼消息，该寻呼消息包括第二指示，该第二指示用于指示该第一密钥存在更新；此后，在该接入网设备与该终端设备建立RRC连接之后，接入网设备以多播方式向该终端设备发送第一配置。
本实施例中，如果在接入网设备以多播方式向该终端设备发送第一配置之前，该终端设备并不处于RRC连接态，例如处于RRC非激活态(inactive)或者是RRC空闲态(idle)，此时，该接入网设备可以通过寻呼消息使得在与该终端设备建立RRC连接之后，使得该终端设备处于RRC连接态，再以多播方式向该终端设备发送第一配置，从而实现对处于RRC非激活态或者是RRC空闲态的终端设备中第一密钥的更新。
本申请实施例第二方面提供了一种密钥的传输方法，该方法应用于终端设备，在该方法中，终端设备接收来自接入网设备的第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包，此时，终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；在第一密钥存在更新的时候，该终端设备以多播方式接收来自该接入网设备的第一配置，其中，该第一配置用于更新该第一密钥；此后，该终端设备根据该第一配置将该第一密钥更新为第二密钥，此时，该终端设备可以根据该第二密钥接收来自该接入网设备的多播数据包。其中，终端设备通过多播方式接收来自接入网设备的用于更新第一密钥的第一配置，当终端设备的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，从而实现多播过程中密钥的传输，保证多播业务传输安全性的同时，降低通信系统的信令开销。
需要说明的是，在本申请实施例第二方面的实现过程中，终端设备接收来自接入网设备以多播方式发送的第一配置的过程中，多播方式可以是通过MCCH承载第一配置来实现，也可以是接入网设备使用预设标识对发送第一配置的下行控制信息进行加扰来实现，还可以是其它的多播方式，此处不做限定；此外，第一配置也可以灵活配置，例如该第一配置可以是配置为直接用于替换该第一密钥的数据、也可以是配置为用于更新第一密钥的更新策略、还可以是其他方式，此处不做限定。
在本申请实施例第二方面的一种可能的实现方式中，在终端设备接收来自接入网设备的第一消息中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
本实施例中，接入网设备可以在第一消息中承载该第一密钥的时间指示信息，具体地，可以是承载指示该第一密钥的有效持续时间的第一定时器，和/或，可以是承载指示该第一密钥的生效起始时刻的第一时刻信息，使得终端设备可以根据该第一定时器和/或第一时刻 信息接收来自接入网设备的多播数据包，从而，使得终端设备对于第一密钥的使用时效与接入网设备对齐，且第一密钥的使用时效可以更加灵活地控制多播传输的加密策略，提升通信安全性。
在本申请实施例第二方面的一种可能的实现方式中，该第一消息还包括与该第一密钥相关联的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、部分带宽BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
本实施例中，接入网设备可以在该第一消息中承载与该第一密钥相关联的第一配置信息集合，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，对于终端设备来说，可以相应的节省终端设备的信令开销。
在本申请实施例第二方面的一种可能的实现方式中，该方法还包括：接收来自接入网设备的第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
本实施例中，由于接入网设备向终端设备发送多播数据包并不依赖于两者之间的RRC连接，为了进一步节省终端设备的信令消耗，终端设备可以根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，且不释放该第一配置信息集合和该第一密钥，即继续使用该第一配置信息集合和该第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态或者RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据，使得终端设备在RRC空闲态或者RRC非激活态也可以实现多播数据包的接收。
在本申请实施例第二方面的一种可能的实现方式中，该第一配置还包括第二配置信息集合指示，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
本实施例中，第二配置信息集合是该第一配置信息集合的子集，接入网设备向终端设备发送的第一配置可以指示将第二配置信息集合对应的第一密钥更新为第二密钥，对于终端设备来说，可以实现更新部分第一密钥或者更新全部第一密钥，从而实现对多播密钥的选择性更新。
在本申请实施例第二方面的一种可能的实现方式中，在终端设备以多播方式接收来自该接入网设备的第一配置之前，该方法还包括：向该接入网设备发送第一请求消息，其中，该第一请求消息用于请求该第一密钥的更新信息。
本实施例中，终端设备可以在确定需要第一密钥的更新信息时，向接入网设备发送第一请求消息，此后，接入网设备响应于该第一请求消息，向该终端设备发送第一配置，终端设备主动查询第一密钥的更新信息的方式可以确保终端设备中保持最新的密钥配置，避免因密钥未及时更新而产生无法处理多播数据包的情况。相应的，对于接入网设备来说，接入网设备后续可以根据该第一请求消息触发执行获取第一密钥的更新信息的过程，无需 另行配置第一密钥的更新策略，可以进一步节省接入网设备的信令消耗。
在本申请实施例第二方面的一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
本实施例中，为了提升该密钥的传输方法中的数据安全性，接入网设备可以通过多种方式对第一配置的发送过程进行加密处理，具体地，该加密方式可以是通过第一密钥加密、在第一消息中另设的第三密钥、或者是使用与终端设备相关联的第四密钥，通过加密的方式传输用于更新第一密钥的第一配置可以提升传输过程中的数据安全性。
在本申请实施例第二方面的一种可能的实现方式中，该第一配置承载于来自该接入网设备的第一下行控制信息，该第一下行控制信息通过组无线网络临时标识RNTI加扰，或者该第一下行控制信息通过预设无线网络临时标识RNTI加扰。
本实施例中，在终端设备以多播方式接收来自接入网设备的第一下行控制信息时，其中，该第一下行控制信息可以通过该第一密钥相关联的G-RNTI加扰、也可以是通过预设于终端设备中的RNTI加扰，可以将该第一配置承载于该第一下行控制信息，而无需另设专门用于发送该第一配置的消息，进一步节省接入网设备的信令消耗。
在本申请实施例第二方面的一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
本实施例中，接入网设备向终端设备发送的第一消息具体可以为RRC消息、MAC CE消息或者是PDCCH消息，提供了第一消息发送过程中具体的实施方式，提升方案的可实现性。
在本申请实施例第二方面的一种可能的实现方式中，该方法还包括：
在终端设备确定需要多播配置时，终端设备发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息。
本实施例中，如果终端设备在接收来自该接入网设备的第一消息之前，该终端设备未处于连接态，即该终端设备处于非激活态或者是空闲态时，只有在该终端设备确定需要多播配置的时候，该终端设备才会发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于多播数据包的第一密钥的获取。
在本申请实施例第二方面的一种可能的实现方式中，该终端设备确定需要多播配置包括：终端设备确定无可用的多播配置，或
终端设备确定对多播业务感兴趣且无对应的多播配置。
本实施例中，终端设备确定需要多播配置的方式有多种，其中，可以是终端设备确定无可用的多播配置，或，终端设备确定对多播业务感兴趣且无对应的多播配置，从而提供了终端设备需要多播配置的具体实现方式，使得该密钥的传输方法适应于多种应用场景，并提升方案的可实现性。
在本申请实施例第二方面的一种可能的实现方式中，该方法还包括：
在终端设备确定需要第一密钥的更新信息时，终端设备发起RRC连接建立过程或RRC 连接恢复过程接收来自该接入网设备的该第一配置。
本实施例中，如果终端设备在接收来自该接入网设备的第一密钥的更新信息之前，该终端设备未处于连接态，即该终端设备处于非激活态或者是空闲态时，只有在该终端设备确定需要多播配置的时候，该终端设备才会发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一配置，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于第一配置的获取。
在本申请实施例第二方面的一种可能的实现方式中，该终端设备确定需要第一密钥的更新信息包括：根据来自接入网设备的寻呼消息确定需要获取多播配置，所述寻呼消息用于指示所述第一密钥存在更新；或，该终端设备确定所述第一定时器超时。
本实施例中，终端设备确定需要需要第一密钥的更新信息的方式有多种，其中，可以是根据来自接入网设备的寻呼消息确定需要获取多播配置，所述寻呼消息用于指示所述第一密钥存在更新；或，确定所述第一定时器超时，从而提供了终端设备需要多播配置的具体实现方式，使得该密钥的传输方法适应于多种应用场景，并提升方案的可实现性。
在本申请实施例第二方面的一种可能的实现方式中，该第一消息是以单播方式发送的；或，该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
本实施例中，第一消息可以是以单播方式发送的，其中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，该第一消息可以是通过与该终端设备相关联的第四密钥加密且以广播方式发送的，广播方式指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，该第四密钥为预存于该终端设备中的密钥，例如该接入网设备预先与该终端设备通信并为该终端设备分配的第四密钥，或者是运营服务商预设于该终端设备的第四密钥。从而，提供了第一消息发送的具体实现过程，提升方案的可实现性。
本申请实施例第三方面提供了一种密钥的传输方法，应用于接入网设备，在该方法中，接入网设备向终端设备发送第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包；即终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；此后，在第一密钥存在更新的时候，该接入网设备可以以单播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥，使得该终端设备可以在根据第一配置更新第一密钥之后，进一步根据更新后的密钥对接收到的来自于接入网设备的多播数据包进行处理。其中，接入网设备可以在该第一消息中承载第一密钥以及与该第一密钥相关联的第一配置信息集合，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，从而节省接入网设备的信令开销。
需要说明的是，本申请实施例第三方面在实现的过程中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，第一配置也可以灵活配置，例如该第一配置可以是配置为直接用于替换该第一密钥的数据、也可以是配置为用于更新第一密钥的更新策略、还可以是其他方式，此处不做限定。
在本申请实施例第三方面的一种可能的实现方式中，在接入网设备向终端设备发送的第一消息中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
本实施例中，接入网设备可以在第一消息中承载该第一密钥的时间指示信息，具体地，可以是承载指示该第一密钥的有效持续时间的第一定时器，和/或，可以是承载指示该第一密钥的生效起始时刻的第一时刻信息，使得终端设备可以根据该第一定时器和/或第一时刻信息接收来自接入网设备的多播数据包，使得终端设备对于第一密钥的使用时效可以与接入网设备对齐，且第一密钥的使用时效可以更加灵活地控制多播传输的加密策略，提升通信安全性。
在本申请实施例第三方面的一种可能的实现方式中，在接入网设备向终端设备发送的第一消息中，该第一配置信息集合包括至少一个多播配置信息，其中，该多播配置信息包括以下至少一种：多播业务标识、组无线网络临时标识G-RNTI、带宽部分BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
本实施例中，接入网设备可以在第一配置信息集合中配置至少一个多播配置信息，具体提供了该多播配置信息在实现过程中所包含的相关参数，从而提升了方案的可实现性。
在本申请实施例第三方面的一种可能的实现方式中，该方法还包括：接入网设备向该终端设备发送第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
本实施例中，由于接入网设备向终端设备发送多播数据包并不依赖于两者之间的RRC连接，为了进一步节省接入网设备与终端设备之间的信令消耗，接入网设备可以通过第一指示，使得终端设备根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，且不释放该第一配置信息集合和该第一密钥，即继续使用该第一配置信息集合和该第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态或者RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据，从而，处于非激活态或者是空闲态的终端设备中也可以实现多播数据包的获取。
在本申请实施例第三方面的一种可能的实现方式中，该第一配置用于将该第一密钥更新为第二密钥，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
本实施例中，第二配置信息集合是该第一配置信息集合的子集，接入网设备向终端设备发送的第一配置可以指示将第二配置信息集合对应的第一密钥更新为第二密钥，使得终端设备可以实现更新部分第一密钥或者更新全部第一密钥，从而实现对多播密钥的选择性更新。
在本申请实施例第三方面的一种可能的实现方式中，在接入网设备以单播方式向该终端设备发送第一配置之前，接入网设备可以根据如下之一条件，确定需要更新该第一密钥，包括：
确定该第一定时器超时；或者，
根据来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息；或者，
根据来自核心网设备的该第一配置确定需要更新该第一密钥。
本实施例中，该接入网设备可以进一步灵活处理，通过多种方式来确定需要更新该第一密钥，具体地，该确定过程的确定依据可以是第一密钥对应的第一定时器、终端设备的第一请求消息、核心网发送的第一配置，使得该密钥的传输方法适应于多种应用场景。
在本申请实施例第三方面的一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
本实施例中，为了提升该密钥的传输方法中的数据安全性，接入网设备可以通过多种方式对第一配置的发送过程进行加密处理，具体地，该加密方式可以是通过第一密钥加密、在第一消息中另设的第三密钥、或者是使用与终端设备相关联的第四密钥，通过加密的方式传输用于更新第一密钥的第一配置可以提升传输过程中的数据安全性。
在本申请实施例第三方面的一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
本实施例中，接入网设备向终端设备发送的第一消息具体可以为RRC消息、MAC CE消息或者是PDCCH消息，提供了第一消息发送过程中具体的实施方式，提升方案的可实现性。
在本申请实施例第三方面的一种可能的实现方式中，
该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
本实施例中，第一消息可以是以单播方式发送的，其中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，该第一消息可以是通过与该终端设备相关联的第四密钥加密且以广播方式发送的，广播方式指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，该第四密钥为预存于该终端设备中的密钥，例如该接入网设备预先与该终端设备通信并为该终端设备分配的第四密钥，或者是运营服务商预设于该终端设备的第四密钥。从而，提供了第一消息发送的具体实现过程，提升方案的可实现性。
在本申请实施例第三方面的一种可能的实现方式中，在接入网设备以单播方式向该终端设备发送第一配置之前，该方法还包括：接入网设备向该终端设备发送该寻呼消息，该寻呼消息包括第二指示，该第二指示用于指示该第一密钥存在更新；在接入网设备与该终端设备建立RRC连接之后，接入网设备以单播方式向该终端设备发送第一配置。
本实施例中，如果在接入网设备以多播方式向该终端设备发送第一配置之前，该终端设备并不处于连接态，例如处于非激活态(inactive)或者是空闲态(idle)，此时，该接入网设备可以通过寻呼消息使得在与该终端设备建立RRC连接之后，使得该终端设备处于连接态，再以多播方式向该终端设备发送第一配置，从而实现对处于非激活态或者是空 闲态的终端设备中第一密钥的更新。
本申请实施例第四方面提供了一种密钥的传输方法，应用于终端设备，在该方法中，终端设备接收来自接入网设备的第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包，该第一配置信息集合用于接收该多播数据包；此时，终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；在第一密钥存在更新的时候，该终端设备以单播方式接收来自该接入网设备的第一配置，其中，该第一配置用于更新该第一密钥；此后，该终端设备根据该第一配置将该第一密钥更新为第二密钥，此时，该终端设备可以根据该第二密钥接收来自该接入网设备的多播数据包。其中，终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，从而节省接入网设备的信令开销。
需要说明的是，本申请实施例第四方面在实现的过程中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，第一配置也可以灵活配置，例如该第一配置可以是配置为直接用于替换该第一密钥的数据、也可以是配置为用于更新第一密钥的更新策略、还可以是其他方式，此处不做限定。
在本申请实施例第四方面的一种可能的实现方式中，终端设备接收来自接入网设备的第一消息中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
本实施例中，接入网设备可以在第一消息中承载该第一密钥的时间指示信息，具体地，可以是承载指示该第一密钥的有效持续时间的第一定时器，和/或，可以是承载指示该第一密钥的生效起始时刻的第一时刻信息，使得终端设备可以根据该第一定时器和/或第一时刻信息接收来自接入网设备的多播数据包，使得终端设备对于第一密钥的使用时效与接入网设备对齐，且第一密钥的使用时效可以更加灵活地控制多播传输的加密策略，提升通信安全性。
在本申请实施例第四方面的一种可能的实现方式中，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、部分带宽BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
本实施例中，接入网设备可以在第一配置信息集合中配置至少一个多播配置信息，具体提供了该多播配置信息在实现过程中所包含的相关参数，从而提升了方案的可实现性。
在本申请实施例第四方面的一种可能的实现方式中，该方法还包括：终端设备接收来自接入网设备的第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且不释放第一配置信息集合和该第一密钥，即该终端设备继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
本实施例中，由于接入网设备向终端设备发送多播数据包并不依赖于两者之间的RRC连接，为了进一步节省接入网设备与终端设备之间的信令消耗，接入网设备可以通过第一指示，使得终端设备根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，同 时不释放该第一配置信息集合和该第一密钥，即继续使用该第一配置信息集合和该第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态或者RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据，使得终端设备在RRC空闲态或者RRC非激活态也可以实现多播数据包的接收。
在本申请实施例第四方面的一种可能的实现方式中，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
本实施例中，第二配置信息集合是该第一配置信息集合的子集，接入网设备向终端设备发送的第一配置可以指示将第二配置信息集合对应的第一密钥更新为第二密钥，使得终端设备可以实现更新部分第一密钥或者更新全部第一密钥，从而实现对多播密钥的选择性更新。
在本申请实施例第四方面的一种可能的实现方式中，在终端设备以单播方式接收来自该接入网设备的第一配置之前，该方法还包括：该终端设备向该接入网设备发送第一请求消息，该第一请求消息用于请求该第一密钥的更新信息。
本实施例中，终端设备可以在确定需要第一密钥的更新信息时，向接入网设备发送第一请求消息，此后，接入网设备响应于该第一请求消息，向该终端设备发送第一配置，终端设备主动查询第一密钥的更新信息的方式可以确保终端设备中保持最新的密钥配置，避免因密钥未及时更新而产生无法处理多播数据包的情况。相应的，对于接入网设备来说，接入网设备后续可以根据该第一请求消息触发执行获取第一密钥的更新信息的过程，无需另行配置第一密钥的更新策略，可以进一步节省接入网设备的信令消耗。
在本申请实施例第四方面的一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
本实施例中，为了提升该密钥的传输方法中的数据安全性，接入网设备可以通过多种方式对第一配置的发送过程进行加密处理，具体地，该加密方式可以是通过第一密钥加密、在第一消息中另设的第三密钥、或者是使用与终端设备相关联的第四密钥，通过加密的方式传输用于更新第一密钥的第一配置可以提升传输过程中的数据安全性。
在本申请实施例第四方面的一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
本实施例中，接入网设备向终端设备发送的第一消息具体可以为RRC消息、MAC CE消息或者是PDCCH消息，提供了第一消息发送过程中具体的实施方式，提升方案的可实现性。
在本申请实施例第四方面的一种可能的实现方式中，该方法还包括：
在终端设备确定需要多播配置时，终端设备发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息。
本实施例中，如果终端设备在接收来自该接入网设备的第一消息之前，该终端设备未处于连接态，即该终端设备处于非激活态或者是空闲态时，只有在该终端设备确定需要多 播配置的时候，该终端设备才会发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于多播数据包的第一密钥的获取。
在本申请实施例第四方面的一种可能的实现方式中，该终端设备确定需要多播配置包括：终端设备确定无可用的多播配置，或
终端设备确定对多播业务感兴趣且无对应的多播配置。
本实施例中，终端设备确定需要多播配置的方式有多种，其中，可以是终端设备确定无可用的多播配置，或，终端设备确定对多播业务感兴趣且无对应的多播配置，从而提供了终端设备需要多播配置的具体实现方式，提升方案的可实现性。
在本申请实施例第四方面的一种可能的实现方式中，该方法还包括：
在终端设备确定需要第一密钥的更新信息时，终端设备发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一配置。
本实施例中，如果终端设备在接收来自该接入网设备的第一密钥的更新信息之前，该终端设备未处于连接态，即该终端设备处于非激活态或者是空闲态时，只有在该终端设备确定需要多播配置的时候，该终端设备才会发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一配置，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于第一配置的获取。
在本申请实施例第四方面的一种可能的实现方式中，该终端设备确定需要第一密钥的更新信息包括：根据来自接入网设备的寻呼消息确定需要获取多播配置，所述寻呼消息用于指示所述第一密钥存在更新；
确定所述第一定时器超时。
本实施例中，终端设备确定需要第一密钥的更新信息的方式有多种，其中，可以是根据来自接入网设备的寻呼消息确定需要获取多播配置，所述寻呼消息用于指示所述第一密钥存在更新；或，确定所述第一定时器超时，从而提供了终端设备需要多播配置的具体实现方式，提升方案的可实现性。
在本申请实施例第四方面的一种可能的实现方式中，
该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
本实施例中，第一消息可以是以单播方式发送的，其中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式；此外，该第一消息可以是通过与该终端设备相关联的第四密钥加密且以广播方式发送的，广播方式指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，该第四密钥为预存于该终端设备中的密钥，例如该接入网设备预先与该终端设备通信并为该终端设备分配的第四密钥，或者是运营服务商预设于该终端设备的第四密钥。从而，提供了第一消息发送的具体实现过程，提升方案的可实现性。
本申请实施例第五方面提供了一种通信装置，该通信装置具体可以为密钥的传输装置， 其中，该通信装置包括收发单元和处理单元；其中，该处理单元用于通过该收发单元向终端设备发送第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包；该处理单元还用于通过该收发单元以多播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥。其中，该处理单元用于通过该收发单元通过多播方式向终端设备发送用于更新第一密钥的第一配置，当终端设备的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省该通信装置为各个终端设备进行一一单播发送更新消息带来的信令开销，从而保证多播业务传输安全性的同时，降低通信系统的信令开销。
本申请实施例第五方面中，通信装置的组成模块还可以用于执行第一方面的各个可能实现方式中所执行的步骤，具体均可以参阅第一方面，此处不再赘述。
本申请实施例第六方面提供了一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括收发单元和处理单元；其中，该收发单元，用于接收来自接入网设备的第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包；该收发单元，还用于以多播方式接收来自该接入网设备的第一配置，该第一配置用于更新该第一密钥；该处理单元，用于根据该第一配置将该第一密钥更新为第二密钥；该收发单元，还用于根据该第二密钥接收来自该接入网设备的该多播数据包。其中，通信装置中的收发单元通过多播方式接收来自接入网设备的用于更新第一密钥的第一配置，当该通信装置的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省接入网设备为各个通信装置进行一一单播发送更新消息带来的信令开销，从而实现多播过程中密钥的传输，保证多播业务传输安全性的同时，降低通信系统的信令开销。
本申请实施例第六方面中，通信装置的组成模块还可以用于执行第二方面的各个可能实现方式中所执行的步骤，具体均可以参阅第二方面，此处不再赘述。
本申请实施例第七方面提供了一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括收发单元和处理单元；其中，该处理单元用于通过该收发单元向终端设备发送第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包；该处理单元还用于通过该收发单元以单播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥。其中，通信装置中的处理单元通过收发单元可以在该第一消息中承载第一密钥以及与该第一密钥相关联的第一配置信息集合，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，从而节省该通信装置的信令开销。
本申请实施例第七方面中，通信装置的组成模块还可以用于执行第三方面的各个可能实现方式中所执行的步骤，具体均可以参阅第三方面，此处不再赘述。
本申请实施例第八方面提供了一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括收发单元和处理单元；其中，该收发单元，用于接收来自接入网设备的第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包，该第一配置信息集合用于接收该多播数据包；该收发单元，还用于以单播方式接收来自该接入网设备的第一配置，该第一配置用于更新该第一密钥；该处理单元，用于根据该第一配置更新将该第一密钥更新为第二密钥；该收发单元， 还用于根据该第二密钥接收来自该接入网设备的该多播数据包。其中，通信装置中的收发单元可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，从而节省接入网设备的信令开销。
本申请实施例第八方面中，通信装置的组成模块还可以用于执行第四方面的各个可能实现方式中所执行的步骤，具体均可以参阅第四方面，此处不再赘述。
本申请实施例第九方面提供一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括处理器，该处理器与存储器耦合，该存储器用于存储计算机程序或指令，该处理器用于执行存储器中的所述计算机程序或指令，使得前述第一方面或第一方面任意一种可能的实现方式所述的方法被执行，或者，使得前述第三方面或第三方面任意一种可能的实现方式所述的方法被执行。
本申请实施例第十方面提供一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括处理器，该处理器与存储器耦合，该存储器用于存储计算机程序或指令，该处理器用于执行存储器中的所述计算机程序或指令，使得前述第二方面或第二方面任意一种可能的实现方式所述的方法被执行，或者，使得前述第四方面或第四方面任意一种可能的实现方式所述的方法被执行。
本申请实施例第十一方面提供一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括处理器和通信接口，该通信接口和该处理器耦合，该处理器用于运行计算机程序或指令，使得前述第一方面或第一方面任意一种可能的实现方式所述的方法被执行，或者，使得前述第三方面或第三方面任意一种可能的实现方式所述的方法被执行。
本申请实施例第十二方面提供一种通信装置，该通信装置具体可以为密钥的传输装置，其中，该通信装置包括处理器和通信接口，该通信接口和该处理器耦合，该处理器用于运行计算机程序或指令，使得前述第二方面或第二方面任意一种可能的实现方式所述的方法被执行，或者，使得前述第四方面或第四方面任意一种可能的实现方式所述的方法被执行。
本申请实施例第十三方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，该处理器执行如上述第一方面或第一方面任意一种可能的实现方式、上述第三方面或第三方面任意一种可能的实现方式所述的方法。
本申请实施例第十四方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，该处理器执行如上述第二方面或第二方面任意一种可能的实现方式所述的方法，或者，该处理器执行如上述第四方面或第四方面任意一种可能的实现方式所述的方法。
本申请实施例第十五方面提供一种存储一个或多个计算机的计算机程序产品(或称计算机程序)，当计算机程序产品被该处理器执行时，该处理器执行上述第一方面或第一方面任意一种可能实现方式、上述第三方面或第三方面任意一种可能的实现方式的方法。
本申请实施例第十六方面提供一种存储一个或多个计算机的计算机程序产品，当计算机程序产品被该处理器执行时，该处理器执行上述第二方面或第二方面任意一种可能实现方式的方法，或者，该处理器执行上述第四方面或第四方面任意一种可能实现方式的方法。
本申请实施例第十七方面提供了一种芯片系统，该芯片系统包括处理器，用于支持接 入网设备实现上述第一方面或第一方面任意一种可能的实现方式、上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，该芯片系统还可以包括存储器，存储器，用于保存该接入网设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例第十八方面提供了一种芯片系统，该芯片系统包括处理器，用于支持终端设备实现上述第二方面或第二方面任意一种可能的实现方式、上述第四方面或第四方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，该芯片系统还可以包括存储器，存储器，用于保存该终端设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请实施例第十九方面提供了一种通信系统，该通信系统包括上述第五方面的通信装置和第六方面的通信装置，或，该通信系统包括上述第五方面的通信装置和第六方面的通信装置，或，该通信系统包括上述第七方面的通信装置和第八方面的通信装置，或，该通信系统包括上述第九方面的通信装置和第十方面的通信装置，或，该通信系统包括上述第十一方面的通信装置和第十二方面的通信装置。
其中，第五、第七、第九、第十一、第十三、第十五、第十七和第十九方面或者其中任一种可能实现方式所带来的技术效果可参见第一方面或第一方面不同可能实现方式所带来的技术效果，或者是，参见第三方面或第三方面不同可能实现方式所带来的技术效果，此处不再赘述。
其中，第六、第八、第十、第十二、第十四、第十六方面、第十八和第十九或者其中任一种可能实现方式所带来的技术效果可参见第二方面或第二方面不同可能实现方式所带来的技术效果，或者是，参见第四方面或第四方面不同可能实现方式所带来的技术效果，此处不再赘述。
从以上技术方案可以看出，本申请实施例具有以下优点：接入网设备向终端设备发送第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；以多播方式向所述终端设备发送第一配置，所述第一配置用于更新所述第一密钥。其中，通过多播方式向终端设备发送用于更新第一密钥的第一配置，通过一次发送过程就可以实现多个终端设备中密钥的更新，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，从而实现多播过程中密钥的传输，保证多播业务传输安全性的同时，降低通信系统的信令开销。
附图说明
图1-1为现有技术中多播过程的系统架构的一个示意图；
图1-2为现有技术中多播过程的系统架构的另一个示意图；
图1-3为现有技术中多播过程中数据交互的一个示意图；
图1-4为现有技术中多播过程中数据交互的另一个示意图；
图1-5为现有技术中多播过程中数据交互的另一个示意图；
图1-6为现有技术中多播过程中数据交互的另一个示意图；
图2为本申请实施例中多播过程实现过程的一个示意图；
图3为本申请实施例中多播过程实现过程的另一个示意图；
图4为本申请实施例中多播过程的系统架构的一个示意图；
图5为本申请实施例中一种密钥的传输方法的一个示意图；
图6为本申请实施例中一种密钥的传输方法的另一个示意图；
图7为本申请实施例中一种密钥的传输方法的另一个示意图；
图8为本申请实施例中一种密钥的传输方法的另一个示意图；
图9为本申请实施例中一种密钥的传输方法的另一个示意图；
图10为本申请实施例中一种密钥的传输方法的另一个示意图；
图11为本申请实施例中一种密钥的传输方法的另一个示意图；
图12为本申请实施例中一种密钥的传输方法的另一个示意图；
图13为本申请实施例中一种密钥的传输方法的另一个示意图；
图14为本申请实施例中一种接入网设备的一个示意图；
图15为本申请实施例中一种终端设备的一个示意图；
图16为本申请实施例中一种接入网设备的另一个示意图；
图17为本申请实施例中一种终端设备的另一个示意图；
图18为本申请实施例中一种接入网设备的另一个示意图；
图19为本申请实施例中一种终端设备的另一个示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
首先，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
(1)终端设备：可以是能够接收网络设备调度和指示信息的无线终端设备，无线终端设备可以是指向用户提供语音和/或数据连通性的设备，或具有无线连接功能的手持式设备、或连接到无线调制解调器的其他处理设备。
终端设备可以经无线接入网(radio access network，RAN)与一个或多个核心网或者互联网进行通信，终端设备可以是移动终端设备，如移动电话(或称为“蜂窝”电话，手机(mobile phone))、计算机和数据卡，例如，可以是便携式、袖珍式、手持式、计算机内置的或者车载的移动装置，它们与无线接入网交换语言和/或数据。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、平板电脑(Pad)、带无线收发功能的电脑等设备。无线终端设备也可以称为系统、订户单元(subscriber unit)、订户站(subscriber station)，移动站(mobile station)、移动台(mobile station，MS)、远程站(remote station)、接入点(access point，AP)、远程终端设备(remote terminal)、接入终端设备(access terminal)、用户终端设备(user terminal)、用户代理(user agent)、用户站(subscriber  station，SS)、用户端设备(customer premises equipment，CPE)、终端(terminal)、用户设备(user equipment，UE)、移动终端(mobile terminal，MT)等。终端设备也可以是可穿戴设备以及下一代通信系统，例如，5G通信系统中的终端设备或者未来演进的公共陆地移动网络(public land mobile network，PLMN)中的终端设备等。
(2)网络设备：可以是无线网络中的设备，例如网络设备可以为将终端设备接入到无线网络的无线接入网(radio access network，RAN)节点(或设备)，又可以称为基站。目前，一些RAN设备的举例为：5G通信系统中的新一代基站(generation Node B，gNodeB)、传输接收点(transmission reception point，TRP)、演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(Node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved Node B，或home Node B，HNB)、基带单元(base band unit，BBU)，或无线保真(wireless fidelity，Wi-Fi)接入点(access point，AP)等。另外，在一种网络结构中，网络设备可以包括集中单元(centralized unit，CU)节点、或分布单元(distributed unit，DU)节点、或包括CU节点和DU节点的RAN设备。
其中，网络设备能够向终端设备发送配置信息(例如承载于调度消息和/或指示消息中)，终端设备进一步根据该配置信息进行网络配置，使得网络设备与终端设备之间的网络配置对齐；或者，通过预设于网络设备的网络配置以及预设于终端设备的网络配置，使得网络设备与终端设备之间的网络配置对齐。具体来说，“对齐”是指网络设备与终端设备之间存在交互消息时，两者对于交互消息收发的载波频率、交互消息类型的确定、交互消息中所承载的字段信息的含义、或者是交互消息的其它配置的理解一致。
此外，在其它可能的情况下，网络设备可以是其它为终端设备提供无线通信功能的装置。本申请的实施例对网络设备所采用的具体技术和具体设备形态不做限定。为方便描述，本申请实施例并不限定。
网络设备还可以包括核心网设备，核心网设备例如包括访问和移动管理功能(access and mobility management function，AMF)、用户面功能(user plane function，UPF)或会话管理功能(session management function，SMF)等。
本申请实施例中，用于实现网络设备的功能的装置可以是网络设备，也可以是能够支持网络设备实现该功能的装置，例如芯片系统，该装置可以被安装在网络设备中。在本申请实施例提供的技术方案中，以用于实现网络设备的功能的装置是网络设备为例，描述本申请实施例提供的技术方案。
(3)无线资源控制(radio resource control，RRC)状态，终端设备有3种RRC状态：RRC连接态(connected态)、RRC空闲态(idle态)和非激活态(inactive态)。
RRC连接态(或，也可以简称为连接态。在本文中，“连接态”和“RRC连接态”，是同一概念，两种称呼可以互换)：终端设备与网络建立了RRC连接，可以进行数据传输。
RRC空闲态(或，也可以简称为空闲态。在本文中，“空闲态”和“RRC空闲态”，是同一概念，两种称呼可以互换)：终端设备没有与网络建立RRC连接，基站没有存储该终端设备的上下文。如果终端设备需要从RRC空闲态进入RRC连接态，则需要发起RRC连接 建立过程。
RRC非激活态(或，也可以简称为非激活态。在本文中，“去活动态”、“去激活态”、“非激活态”、“RRC非激活态”和“RRC去激活态”，是同一概念，这几种称呼可以互换)：终端设备之前进入了RRC连接态，然后基站释放了RRC连接，但是基站保存了该终端设备的上下文。如果该终端设备需要从RRC非激活态再次进入RRC连接态，则需要发起RRC恢复过程(或者称为RRC连接恢复过程)。RRC恢复过程相对于RRC建立过程来说，时延更短，信令开销更小。但是基站需要保存终端设备的上下文，会占用基站的存储开销。
(4)本申请实施例中的术语“系统”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A、同时存在A和B、单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如“A，B和C中的至少一个”包括A，B，C，AB，AC，BC或ABC。以及，除非有特别说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。
多播是一种允许一个或者多个发送者发送单一数据包到多个接收者的网络技术，数据源可以通过发送一次数据包，使得多播组内需要数据包的接收者收到该数据包，相应的，单播指的是在一个发送者和一个接受者之间通过网络进行的通信。在第四代(Forth Generation，4G)LTE中可以通过MBMS技术实现数据的多播过程。
(1)图1-1和图1-2是现有多播网络架构示意图；
请参阅图1-1，为终端设备(user equipment，UE)在单播过程实现的网络架构的一个示意图，UE通过演进型基站(evolutional Node B,eNB)与核心网设备连接实现网络数据的单播过程，该核心网设备包括其中的移动性管理实体(Mobility Management Entity，MME)、分组数据网络网关(Packet Data Network Gateway，PDN GW/P-GW)、内容服务单元(content service)。
请参阅图1-2，为MBMS实现多播过程的系统架构的一个示意图，相比于图1-1，在图1-2所示4G LTE中MBMS网络架构中，引入了MBMS专有网元以及相应的多个接口协议，包括广播多播业务中心(broadcast/multicast service center，BM-SC)，MBMS网关(MBMS Gateway，MBMS-GW)和多小区多播协作实体(multi-cell/multicast coordination entity，MCE)，其中：
BM-SC，主要实现对增强型MBMS(enhanced-MBMS，eMBMS)业务的分发和控制功能。BM-SC作为内容提供商eMBMS业务的传输入口，是eMBMS会话的发起者，提供调度和交付eMBMS业务、以及安全密钥(key)管理的功能等；
MCE，是LTE eMBMS为实现多小区传输而引入的逻辑实体，负责对其连接的多媒体广播单频网(multimedia broadcast single frequency network，MBSFN)区域内eNB的无线资源进行分配和eMBMS会话管理；
MBMS-GW，负责传递MBMS会话控制消息至MME，并将MBMS业务数据转发至eNB，MBMS-GW可以与P-GW共部署。
基于图1-2所示MBMS的网络架构可以实现数据的多播发送，下面以多播相关的4G单小区的多播(SC-PTM,single cell point to multi-point)实现的过程进行示例性说明。
其中，SC-PTM技术是一种利用共享数据信息同时向多个UE传输相同业务的技术，接收同一业务的一组UE使用相同的下行配置来进行业务接收，不必为每个UE建立自己的通信链路。如图1-3所示，SC-PTM有一个控制信道单小区组播控制信道(SC-MCCH,single cell multicast control channel)和一个单小区组播传输信道(SC-MTCH,single cell multicast transport channel)，这两个逻辑信道都映射到下行共享信道(DL-SCH,downlink shared channel)上。其中控制信道SC-MCCH上包含业务标识和接收广播业务逻辑信道(MTCH,multicast traffic channel)的时间信息，SC-MTCH用来传输业务数据。SC-MCCH以周期进行发送，SC-MCCH周期有重复周期(Repetition Period,RP)和修改周期(Modification Period,MP)，每个重复周期发送个SC-MCCH，一个修改周期中包含若干个重复周期且修改周期内SC-MCCH的内容不变。
(2)现有技术中的多播配置方法
在SC-PTM技术中，小区通过G-RNTI来同时向多个UE调度业务数据，每个G-RNTI可以关联一个MBMS业务。下面通过一个具体的示例说明终端接收SC-PTM业务的一般过程：
首先，终端从基站获取系统信息块20(system information block 20，SIB)，其中，系统消息中包含传输SC-PTM业务的控制信息，即SC-MCCH的配置信息，终端通过系统消息就可以知道如何来接收SC-MCCH，具体地，系统消息中包含SC-MCCH的重复周期(RepetitionPeriod,RP)及偏移量(sc-mcch-Offset)，即SC-MCCH周期出现的边界，在每个满足SFN mod sc-mcch-RepetitionPeriod＝sc-mcch-Offset的系统帧上出现SC-MCCH。例如sc-mcch-RepetitionPeriod为rf16，即16个radio frame无线帧，sc-mcch-Offset＝1，则出现SC-MCCH的系统帧，如图1-4所示。其中，SC-MCCH传输时间(sc-mcch-duration)表示SC-MCCH传输持续时间，SC-MCCH起始位置(sc-mcch-FirstSubframe)，在一个系统帧内，例如sc-mcch-FirstSubframe＝4,sc-mcch-duration＝3，则SC-MCCH出现的子帧位置如图1-5所示；修改周期(Modification period,MP)，例如MP＝48，如图1-6所示。SC-MTCH中包含的配置信息中包括SC-PTM业务的标识MBMSSessionInfo(TMGI,Session ID)，用于接收SC-MTCH的标识G-RNTI，接收SC-MTCH的时间信息sc-mtch-schedulingInfo。终端根据SC-MCCH的控制信息及相应的PDCCH的调度信息即可以接收SC-MTCH中的多播业务数据。在SC-MCCH的配置中，MCCH在每个MP中重复发送，重复周期为RP，在一个MP中，SC-MCCH的内容一样，当MCCH发生变化时，会发送包含修改通知的PDCCH，修改通知为MCCH change Notification，当UE在PDCCH上检测到SC-N-RNTI，即认为检测到了修改通知，UE重新获取SC-MCCH。UE在获取SC-MCCH时，需要检测SC-RNTI加扰的PDCCH，以获取SC-MCCH的调度信息。
(3)现有技术存在问题
此外，4G LTE通过MBMS技术实现上述多播配置方法的过程中，需要通过对多播数据 进行密钥加密传输的方式以保证数据的安全性，其中，密钥管理功能在BM-SC网元实现，在BM-SC网元中包括：密钥管理功能(Key Management Function)、而密钥管理功能又进一步分为：密钥请求功能(Key Request Function)和密钥分发功能(Key Distribution Function)。在实现密钥分发的过程中，BM-SC采用单播(单独发送)的方式将密钥发给UE，但密钥分发过程所涉及的过程是通过应用层信令的交互所实现的。
综上所述，在现有技术中，MBMS实现的过程中，网络侧设备作为数据源可以将多播数据包发送至多个终端设备，其中，网络侧中的接入网侧需要将用于指示如何接收多播数据包的配置信息通过多播方式一一发送至终端设备，另外，在网络侧中的核心网侧新增广播多播业务中心(broadcast/multicast service center，BM-SC)网元进行多播数据的密钥管理，该BM-SC网元通过用户面数据传输的方式将多播相关的密钥通过单播方式发给多播组内的终端设备。如果运营商使用MBMS实现过程中的key管理方式，需要新增服务器和核心网接口，使得key管理的架构和流程比较复杂：一方面，在多播组内的终端设备的数量较多时，新增的BM-SC网元需要与多个终端设备一一建立单播连接再发送多播密钥，效率过低；另一方面，新增的BM-SC网元发送的多播密钥也是通过接入网设备通过应用层信令转发至终端设备，而接入网设备是通过多播方式发送用于指示如何接收多播数据包的配置信息，分别发送多播密钥和多播配置信息的方式对于终端设备来说，存在一定的延迟，影响网络通信的效率。
为了解决上述问题，本申请实施例提供了一种密钥的传输方法及装置，用于实现多播过程中密钥的传输方式。
图4为本申请实施例适用的一种网络架构示意图，如图4所示，该网络架构包括多个UE，示例为UE1、UE2、UE3；接入网设备,示例为NR基站(NR Node B，gNB)，包括gNB-控制面功能实体(gNB-CP)和gNB-用户面功能实体(gNB-UP)；核心网设备(CN，core network),示例为接入和移动性管理网元(access and mobility management function，AMF)和用户面功能(user plane function，UPF)。
在图4中，虚线表示控制面连接，实线表示用户数据的发送路径。三个终端设备都与基站均有连接，对于每个终端设备分别配置了小区RNTI(Cell RNTI,C-RNTI)和用于单播承载的数据无线承载(data radio bearer，DRB)，同时DRB还关联一个G-RNTI，通过G-RNTI和C-RNTI调度实现单播与多播之间的动态转换。图中三个终端设备接收同一业务，每个终端设备都有单播承载，即基于C-RNTI接收数据的通道，基站同时为三个终端设备还配置了相同的G-RNTI。在采用C-RNTI调度的情况下，基站可以将同一数据分别调度给三个终端设备，此时是利用单播调度。在采用G-RNTI调度数据的情况下，基站调度一份数据三个终端设备都能收到。
基于图4所示网络架构示意图，针对上述现有技术中存在的问题，本申请实施例从多播数据的加密过程以及多播密钥的管理网元考虑用以解决上述问题：
1、从多播数据的加密过程的角度--
方式一：通过接入网设备实现多播数据加密，示例性的，如图2所示，可以通过终端设备与接入网设备对齐的分组数据汇聚协议(packet data convergence protocol，PDCP) 实现；
方式二：通过核心网设备新增功能或协议层实现多播数据加密，示例性的，如图3所示，在已有的网络协议中，在终端设备和核心网设备分别增加新协议层(New layer)实现；
2、从多播密钥的管理网元的角度--
方式三：新增服务器管理，可以沿用已有MBMS应用层管理方式,空口不可见，新增服务器与核心网接口,比较简单；
方式四：通过接入网设备管理，接入网网元通过多播方式可实现统一多播密钥的更新,在保证安全的前提下,节省信令开销；
方式五：通过核心网设备管理，密钥针对多播群组,通过核心网设备统一维护,密钥作为多播上下文(multicast context)发送。
本申请实施例中，考虑到方式二、方式三的实现过程需要新增核心网设备和对应的核心网接口，这种方式过于繁琐，因此，后续实施例采用上述方式一、方式四和方式五的结合进行描述，即多播数据的加密过程通过接入网设备实现，多播密钥的管理网元通过接入网设备/核心网设备实现。
本申请实施例中，多播数据的加密过程通过接入网设备实现，多播密钥的管理网元通过接入网设备或核心网设备实现，此外，当多播密钥存在更新时，接入网设备与终端设备对齐的方式可以是单播发送、也可以是通过多播方式发送，下面将通过发送方式的不同这一角度来分别对本申请实施例进行介绍：
实施例一
在实施例一中，接入网设备通过多播方式发送密钥更新信息；图5为本申请实施例中提供的一种密钥的传输方法的流程示意图，如图5所示，包括：
S101、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，终端设备在步骤S101中接收来自接入网设备的第一消息。该接入网设备向终端设备发送的第一消息中包括第一密钥，其中，第一密钥用于加密多播数据包，即终端设备后续可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行解密处理。
具体地，接入网设备向终端设备发送的第一消息中还可以包括第一定时器，和/或第一时刻信息，其中，第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。终端设备在步骤S101中接收来自接入网设备的第一消息的过程中获取得到该第一定时器，和/或第一时刻信息。此外，该终端设备也可以是根据预设在该终端设备内部的时间配置确定第一定时器，和/或第一时刻信息，还可以是根据接入网设备与终端设备交互其它的消息中确定第一定时器，和/或第一时刻信息，此处不做限定。具体在方案的实现过程中，接入网设备可能处理大量的多种多播业务，而不同的多播业务可能有不同的时效需求，例如，当该多播业务为广告推送业务时，一般来说，通过一次多播数据包的传输就可以完成，终端设备中可维持第一密钥有效的时效长度较短；当该多播业务为体育比赛实时直播业务时，一般来说，需要多次多播数据包的传输，终端设备需要维持第一密钥有效的时效长度较长。通过如上接入网设备向该终端设备发送用于指示第一 密钥的时效信息的第一定时器，和/或第一时刻信息，可以实现接入网设备与终端设备之间关于多播密钥所使用时效的对齐。在后续终端设备对于第一密钥的使用时效与接入网设备对齐的情况下，可以进一步实现密钥传输过程的优化，并且为第一密钥配置生效时间信息可以更加灵活地控制多播传输的加密策略，提升通信安全性。
下面将分别从第一密钥的生效时刻、第一密钥的有效持续时间这两个角度进行说明：
对于第一密钥的生效时刻来说，终端设备在接收到接入网设备发送的第一时刻信息之后，使用该第一时刻信息所指示的第一密钥的生效起始时刻的应用方式有多种，包括：
方式1：终端设备可以在收到第一消息后，立即生效第一密钥。
方式2：接入网设备在第一消息中承载生效时刻指示T(即第一时刻信息)，对应的，终端设备收到第一消息后，根据生效时刻指示确定第一密钥对应的密钥配置生效时刻。可选地，第一密钥对应的密钥生效时刻指示可以是一个绝对时刻指示，比如：第一密钥对应的密钥生效时刻指示可以指示某日某时某分某秒某毫秒，具体的时刻指示粒度不做限制；或者，第一密钥对应的密钥生效时刻指示可以是一个无线帧帧号、或无线帧号+子帧号、或无线帧号+子帧号+时隙号，比如无线帧号(System Frame Number,SFN)X，对应地，终端设备在SFN X对应的边界生效第一密钥对应的密钥配置。
方式3：终端设备在收到第一消息后的一个相对时刻，生效第一密钥对应的密钥配置，其中，该相对时刻具体可以指示特定事件发生的时刻，即在离该特定事件发生的时刻(例如最近的无线帧边界或无线子帧边界或时隙边界或符号边界)，终端设备生效第一密钥对应的密钥配置。比如，该特定事件可以是该终端设备接收到来自接入网设备的一个完整的无线帧，此时，终端设备可以在该第一消息所在的无线帧的边界生效密钥配置；再如，该特定事件可以是该终端设备接收到来自接入网设备的多播数据包，此时，该终端设备可以在收到第一消息后，在接收到来自该接入网设备的多播数据包所在的无线帧的边界生效密钥配置，所述特定事件可以是终端设备中预配置的、或者由接入网设备指示的，例如，可以是由接入网设备通过专用信令向终端设备发送承载特定事件的指示，显然，该特定事件还可以是其它的实现方式，此处不做限定。此外，终端设备可以通过多种方式确定该特定事件，例如该特定事件可以是承载在第一消息，也可以是在该终端设备中预定义的，或者是承载在接入网设备向终端设备发送的其它消息中，此处不做限定。
方式4：当第一消息为RRC重配置消息时，终端设备在收到RRC重配置完成消息的混合自动重传请求(hybrid automatic repeat request，HARQ)成功反馈后，生效第一密钥对应的密钥配置；其中，终端设备收到接入网设备发送的重配置消息后，会给接入网设备发送重配置完成消息，为了确保接入网设备成功收到重配置完成消息(以保证终端设备和接入网设备两端是对齐的)，接入网设备在收到重配置完成消息后，会给终端设备回复HARQ反馈，指示成功接收到重配置完成，终端设备可在收到接入网设备发送的针对RRC重配置完成消息的成功反馈确认后，终端设备生效第一密钥对应的密钥配置。
对于第一密钥对应的第一定时器，其中，第一定时器用于指示该第一密钥的有效持续时间，终端设备在接收到接入网设备发送的第一定时器之后，使用该第一定时器的方式有多种，包括：
1)当终端设备收到第一密钥时，启动该第一定时器；
2)在第一定时器超时之前，如果终端设备收到更新的key，重启第一定时器；
3)当该第一定时器超时的时候，终端设备确定第一密钥失效。
终端设备可以向接入网设备发送查询消息，该查询消息用于查询接入网设备此时是否有更新密钥key；可选地，终端设备可以在第一定时器超时的时候向接入网设备发送查询消息、或者终端设备可以在第一定时器超时之前向接入网设备发送查询消息。
在一种可能的设计中，终端设备可以维护一个周期查询定时器，此周期查询定时器的持续时间以及启动时刻可以从接入网设备或核心网设备获取，例如由接入网设备或核心网设备向终端设备发送的消息中指定，也可以由终端设备中预配置的，当周期查询定时器超时的时候，终端设备发送上述查询消息。
在步骤S101实现之前，还包括步骤S101A：终端设备确定需要多播配置。
具体地，如果该终端设备未处于RRC连接态，如该终端设备处于RRC非激活态或者是RRC空闲态时，当终端设备确定需要多播配置时，终端设备通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态，此后通过步骤S101接收来自该接入网设备的该第一消息，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于多播数据包的第一密钥的获取。
该终端设备确定需要多播配置的方式包括以下至少一种：
1)当终端设备无可用的多播配置时，确定需要多播配置，例如该终端设备未存储任何多播配置；
2)当终端设备对多播业务感兴趣且无对应的多播配置时，确定需要多播配置，此时，该终端设备存储有部分业务的配置，但是没有感兴趣多播业务对应的多播配置，换句话说，存储的部分业务配置中不包括感兴趣多播业务对应的多播配置。
具体地，在步骤S101的实现过程中，第一消息可以通过多种方式发送：包括：
1)第一消息可以是以单播方式发送的，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式，其中，第一消息可以是RRC消息、MAC CE消息、PDCCH消息，或者是其它类型的单播消息，此处不做限定。
2)第一消息也可以是以广播方式发送，其中，广播方式指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，与该终端设备相关联的第四密钥加密且以广播方式发送的，但是本实施例所要实现的是多播过程，即使得特定的终端设备接收到该第一消息，因此，可以通过第四密钥加密该广播消息的方式发送。其中，该第四密钥可以是终端设备中预配置的，例如，第四密钥可以是预存于特定的终端设备中的密钥，使得具备该第四密钥的特定的终端设备可以根据该第四密钥解密广播消息得到该第一消息，而不具备该第四密钥的终端设备则无法完整解密该广播消息，可以丢弃/忽略该广播消息。其中，第四密钥在实现的时候，具体可以是接入网设备预先与终端设备对齐的密钥，例如该接入网设备预先与该终端设备通信过程中，接入网设备为指定类型的终端设备所分配的第四密钥，或者是接入网设备根据核心网设备的指示确定该第四密钥。举个例子，运营服务商可以将第四密钥预置于该终端设备的存储模块中， 如预置在终端设备中用户识别模块(Subscriber Identity Module，SIM)通用用户识别模块(Universal Subscriber Identity Module，USIM)、IP多媒体业务识别模块(IP Multi Media Service Identity Module，简称ISIM)，嵌入式SIM卡(embedded SIM，eSIM)或者是其他如电子签名认证、电子钱包等，后续接入网设备可以根据该运营服务商对应的核心网设备所下发的指示确定出用于广播第一消息的第四密钥。此外，在另一种实现方式中，终端设备可以从接入网设备或核心网设备获取第四密钥，接入网设备与终端设备使用的第四密钥是对齐的。例如，终端设备接收接入网设备发送的第四密钥，或终端设备接收核心网设备发送的密钥。相应地，具备该第四密钥的特定的终端设备可以根据该第四密钥解密广播消息得到第一密钥，而不具备该第四密钥的终端设备则无法完整解密该广播消息，当终端设备无法解密该广播消息时，可以丢弃/忽略该广播消息。
3)第一消息还可以通过多播方式发送，具体来说，多播方式发送可以是通过在MCCH信道发送该第一消息实现，其中，MCCH相关的时频配置可以在接入网设备预先向终端设备发送的广播消息中承载；多播方式发送也可以是使用G-RNTI加扰该第一消息实现，其中，G-RNTI可以承载于接入网设备预先向终端设备发送的(单播、多播或广播)消息中所包含的多播配置信息中；该第一消息还可以通过其它的多播方式发送，此处不做限定。
在一种可能的设计中，接入网设备还可以在向终端设备发送第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等。此后，该接入网设备向该终端设备发送的多播数据包可以通过该多播配置信息配置，对于终端设备来说，可以通过该多播配置信息接收来自接入网设备的多播数据包。此外，该接入网设备可以通过向该终端设备指示该第一配置信息集合关联于步骤S101中第一消息所承载的第一密钥，即指示终端设备可以使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密处理，其中，该指示可以是显性的指示方式或者是隐性的指示方式，具体来说：
当该指示为显性的指示方式时，该显性的指示方式可以在该第一配置信息集合中包含有该第一密钥的标识的方式来实现，例如该第一密钥的标识可以是承载该第一密钥所在信息的类型标识、可以是该第一密钥自身字段中的验证位标识或者是其它可以指示该第一密钥的标识，此时，该第一配置信息集合可以承载在接入网设备向终端设备发送的不同于承载该第一密钥的第一消息中，从而实现多播配置信息和多播密钥的分开发送，进一步实现多播数据包传输的安全性；
当该指示为显性的指示方式时，该隐性的指示方式可以向终端设备指示承载在同一条消息中的密钥和配置信息集合默认为存在关联关系，此时，该第一配置信息集合承载在该第一密钥所在的第一消息中，当终端设备确定该第一消息中包含有该第一配置信息集合和该第一密钥时，确定该第一配置信息集合关联于该第一密钥，从而，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，与需要另设发送多播配置信息的消息相比，可以进一步节省接入网设备的信令开销。
此外，该第一配置信息集合包括至少一个多播配置信息，即该第一配置信息集合可以 包括多个多播配置信息，示例性的，以多个多播配置信息包括多个多播业务标识为例，多个多播配置信息包括多播业务标识1、多播业务标识2...多播业务标识10，即该第一配置信息集合中包括该多播业务标识1、多播业务标识2...多播业务标识10，后续终端设备接收到来自接入网设备的多播数据包中，若该多播数据包括该多播业务标识1、多播业务标识2...多播业务标识10中的任一个时，该终端设备可以使用关联于该第一配置信息集合的第一密钥对该多播数据包进行解密，得到多播数据；其中，第一配置信息集合中的其它参数也可以实现多个多播配置信息的配置，此处不再赘述。
在一种可能的设计中，接入网设备在步骤S101所发送的第一消息中还可以承载有第一指示，相应的，该终端设备可以进一步地通过该第一消息获取第一指示，该第一指示用于指示该终端设备进入RRC空闲态或者RRC非激活态，同时不释放该第一配置信息集合和该第一密钥(或挂起第一配置信息集合和该第一密钥维持其仍然有效)，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包，使得终端设备在RRC空闲态或者RRC非激活态也可以实现多播数据包的接收。此外，对于该终端设备来说，该终端设备获取第一指示的方式有多种，例如可以是通过预设在该终端设备内部存储模块中包含有该第一指示，该存储模块可以是SIM、USIM、ISIM，eSIM或者是其他如电子签名认证、电子钱包等；也可以是通过接入网设备发送的特定消息中承载该第一指示，其中，该特定消息可以是步骤S101中的第一消息、或者是其它的RRC消息，例如RRC释放(RRCRelease)消息、RRC连接释放(RRCConnectionRelease)消息，RRC恢复(RRCResume)消息，RRC连接恢复(RRCConnectionResume)消息等。此时，该第一指示在该特定消息中具体的实现上至少可以包括以下的一种或多种：
1)第一指示可以是该特定消息中所承载的1bit指示，当该特定消息中承载“1bit指示”时，即该bit置为1，标识该终端设备进入RRC空闲态或者RRC非激活态，同时不释放该第一配置信息集合和该第一密钥(或挂起第一配置信息集合和该第一密钥维持其仍然有效)，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包，反之，该bit置为其它取值时，可以标识该终端设备释放该第一配置信息集合和/或该第一密钥，或者标识其他信息，此处不做限定；
2)第一指示可以是该特定消息中所承载的字段信息，当该特定消息中承载此字段信息时，标识该终端设备进入RRC空闲态或者RRC非激活态，同时不释放该第一配置信息集合和该第一密钥(或挂起第一配置信息集合和该第一密钥维持其仍然有效)，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包，反之，该特定消息中未承载该字段信息时，可以标识该终端设备释放该第一配置信息集合和/或该第一密钥，或者标识其他信息，此处不做限定；
3)第一指示信息可以是该特定消息所承载的指定的原因值Cause，当该特定消息中承载此指定的Cause时，标识该终端设备进入RRC空闲态或者RRC非激活态，同时不释放该第一配置信息集合和该第一密钥(或挂起第一配置信息集合和该第一密钥维持其仍然有效)，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包，反之，该特定消息中未承载该指定的Cause时，可以标识该终端设备释放该第一配置信息集合和/或该第一 密钥，或者标识其他信息，此处不做限定。
由于多播数据包的接收并不依赖于终端设备与接入网设备之间的RRC连接，为了使得终端设备在退出RRC连接态时，即终端设备处于RRC空闲态或者RRC非激活态也可以实现多播数据的接收，终端设备根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，且不释放该第一配置信息集合和该第一密钥，即继续使用该第一配置信息集合和该第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态或者RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据，从而，可以进一步节省接入网设备与终端设备之间的信令消耗。其中，终端设备还可以基于其自身降低电耗和/或提升性能等配置策略自行确定退出连接态，或者是通过其它方式来确定退出连接态，在本发明中不做限制。当终端设备确定退出连接态时该终端设备向接入网设备发送第三指示，该第三指示用于指示该终端设备自行确定退出连接态，或者第三指示用于请求释放RRC连接，或者所述第三指示用于请求暂停RRC连接，或者第三指示接入网设备该终端设备请求退出连接态。其中，所述第三指示可以承载在RRC消息中，所述RRC消息可为RRC连接请求消息或RRC连接暂停消息或其他RRC消息，本发明中不做限制。其中，该第三指示用于向接入网设备指示该终端设备自行确定退出连接态，使得接入网设备和终端设备可以对齐该终端设备的状态，使得该接入网设备在退出连接态之后，在空闲态或者是非激活态仍然可以使用该第一消息实现接收来自接入网设备的多播数据包。
在一种可能的设计中，在步骤S101之后，接入网设备向该终端设备发送使用第一密钥加密的多播数据包，对于终端设备来说，该终端设备可以使用步骤S101中得到的第一密钥对该多播数据包进行解密，得到多播数据包中的多播数据，从而在接入网设备与终端设备之间的多播数据传输过程中，实现多播密钥的加密过程，提升多播数据通信的安全性。
S102、接入网设备以多播方式向终端设备发送第一配置。
本实施例中，接入网设备以多播方式向终端设备发送第一配置，相应的，终端设备在步骤S102中以多播方式接收来自接入网设备的第一配置。接入网设备以多播方式向终端设备发送用于更新第一密钥的第一配置，使得该终端设备可以在根据第一配置更新第一密钥为第二密钥之后，进一步根据第二密钥对接收到的来自于接入网设备的多播数据包进行处理。
在步骤S102实现的过程中，该第一配置用于将该第一密钥更新为第二密钥，第一配置也可以灵活配置，例如该第一配置可以是配置为直接用于替换该第一密钥的第二密钥、也可以是配置为用于更新第一密钥的更新策略(例如下一跳参数(Next Hop parameter，NH)、下一跳链计数参数(Next Hop Chaining Counter parameter，NCC)或者其他参数，利用相关参数推导出更新的第二密钥)、还可以是其他方式，此处不做限定。此处以该第一配置包括该第二密钥为例进行说明，其中，在步骤S101中的第一密钥用于加密接入网设备向终端设备发送的多播数据包，在步骤S102之后，接入网设备向终端设备发送的多播数据包的加密密钥由第一密钥更新为第二密钥，因此，在方案的实现过程中，该第一配置可以是通过显式或隐式的方式来指示将第一密钥更新为第二密钥，具体来说：
第一配置显示指示UE更新第一密钥为第二密钥，此时，第一配置中包括第二密钥以及 第一密钥的标识，示例性的，该第一密钥的标识可以是承载该第一密钥所在信息的类型标识、可以是该第一密钥自身字段中的验证位标识或者是其它可以指示该第一密钥的标识；
在第二种可能的实现中，第一配置隐式指示UE更新第一密钥为第二密钥，例如，第一配置中包括第二密钥以及关联于该第二密钥的第二配置信息集合，该第二配置信息集合是该第一配置信息集合的子集。其中，第二配置信息集合是该第一配置信息集合的子集，接入网设备向终端设备发送的第一配置可以指示将第二配置信息集合对应的第一密钥更新为第二密钥，使得终端设备可以实现更新部分第一密钥或者更新全部第一密钥，从而实现密钥的传输方式的进一步优化。示例性的，以第一配置信息集合中的多播业务标识为例，第一密钥对应的第一配置信息集合包括多播业务标识1、多播业务标识2...多播业务标识10；而在第一配置中，第二密钥对应的第二配置信息集合包括多播业务标识1、多播业务标识2...多播业务标识4；则终端设备将多播业务标识1、多播业务标识2...多播业务标识4对应的多播数据包更新为第二密钥进行处理，其他多播业务标识(多播业务标识5...多播业务标识10)对应的多播数据包还是对应第一密钥进行处理。另外，以第一配置信息集合中的参数“BWP指示信息”指示终端设备可以使用BWP1：40兆赫兹MHz带宽、以及BWP2：10MHz带宽；其中，BWP1和BWP2方式发送的多播业务都是使用第一密钥加密处理的，在第一配置中的第二配置信息集合中可以仅指示其中的BWP1对应的多播业务更新为使用第二密钥加密处理，而不改变BWP2对应的密钥，也就是说BWP2对应的多播业务仍使用第一密钥进行处理。其中，考虑到第一配置信息集合中存在多种参数，第一配置信息集合中的其它参数也可以实现类似的过程，此处不再赘述。
可选的，第一配置还包括第二密钥的生效时间信息，具体的，第一配置包括第二定时器，和/或第二时刻信息，其中，该第二定时器用于指示该第二密钥的有效持续时间，该第一时刻信息用于指示该第二密钥的生效起始时刻，其中，第二定时器及第二时刻信息的实现可以参考前述第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
可选的，在步骤S102之前，还包括步骤S1021：接入网设备确定是否需要更新该第一密钥，该确定过程有多种实现，例如可以是接入网设备确定对应于第一密钥的第一定时器超时；或者，接入网设备根据来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息，接入网进一步根据该第一请求消息去查询确定需要更新该第一密钥；或者，接入网设备根据来自核心网设备的该第一配置确定需要更新该第一密钥，或者，接入网设备确定多播组中有某个终端设备离开该群组，为了防止密钥泄露，统一更新第一密钥。即该接入网设备可以针对不同的使用场景进行灵活处理，通过多种方式来确定需要更新该第一密钥，实现多播密钥的及时更新，从而提升通信的安全性。
相应的，在步骤S102实现之前，还包括步骤S1022：终端设备确定需要第一密钥的更新信息。具体地，如果该终端设备未处于RRC连接态，如该终端设备处于RRC非激活态或者是RRC空闲态时，当终端设备确定需要第一密钥的更新信息时，终端设备通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态，此后通过步骤S102接收来自该接入网设备的该第一配置，从而，处于非激活态或者是空闲态的终端设备中也可以实现第一密钥 的更新信息的获取。
该终端设备确定需要第一密钥的更新信息的方式有多种，具体可包括：
1)终端设备根据来自接入网设备的寻呼消息确定需要获取多播配置，其中，该寻呼消息用于指示该第一密钥存在更新；其中，如果密钥管理网元为核心网设备的话，当核心网设备确定需要更新第一密钥时，可以向接入网设备发送寻呼消息，而接入网设备向该终端设备转发该寻呼消息，其中，该寻呼消息可以包括第二指示，该第二指示用于指示该第一密钥存在更新；此后，在该接入网设备与该终端设备建立RRC连接之后，接入网设备以多播方式向该终端设备发送第一配置。即该接入网设备可以通过寻呼消息使得在与该终端设备建立RRC连接之后，使得该终端设备处于连接态，再以多播方式向该终端设备发送第一配置，从而实现对处于非激活态或者是空闲态的终端设备中第一密钥的更新。
2)终端设备确定对应于第一密钥的第一定时器超时的时候确定需要第一密钥的更新信息。
本实施例中，接入网设备向终端设备发送第一配置的过程中，多播方式可以是通过MCCH承载第一配置来实现，也可以是接入网设备使用预设标识对承载该第一配置的消息(例如DCI消息)进行加扰来实现，还可以是其它的多播方式，此处不做限定。这里以预设标识加扰处理实现的过程为例进行说明，其中，该第一配置在实现的过程中，该第一配置具体可以承载于第一下行控制信息，该第一下行控制信息通过G-RNTI加扰，或者通过预设RNTI加扰。其中，G-RNTI可以承载于步骤S101实现过程中的第一配置信息集合，所述预设RNTI为不同于G-RNTI的、用于加扰承载第一配置的DCI的无线网络临时标识，具体的，可以为预定义的专用标识，也可以为由网络设备动态配置的标识，也可以是预先设置在终端设备中的标识。例如该接入网设备预先与该终端设备通信过程中，接入网设备为指定类型的终端设备所分配的预设RNTI，或者是接入网设备根据核心网设备的指示确定该预设RNTI，例如运营服务商预设于该终端设备中存储模块的预设RNTI，如预设在终端设备中SIM、USIM、ISIM、嵌eSIM或者是其他如电子签名认证、电子钱包等，后续接入网设备可以根据该运营服务商对应的核心网设备所下发的指示确定出该预设RNTI。从而，可以将该第一配置承载在接入网设备向终端设备发送的第一下行控制信息中，而无需另设专门用于发送该第一配置的消息，进一步节省接入网设备的信令消耗。
可选的，在步骤S102的发送过程中，可以进一步对该第一配置进行加密处理，具体加密实现有多种方式，例如，该第一配置可以是直接通过该第一密钥加密的；或者，该第一配置可以是通过第三密钥加密的，该第三密钥是承载于步骤S101中的第一消息且不同于该第一密钥的密钥；或者，该第一配置也可以是通过与该终端设备相关联的第四密钥加密的，从而，通过加密的方式传输用于更新第一密钥的第一配置可以提升传输过程中的数据安全性。此外，为了加强数据传输的安全性，接入网设备可以另设与终端设备之间的交互信息来实现对第三密钥的更新过程。
在一种可能的设计中，在步骤S102之后，接入网设备向该终端设备发送使用第二密钥加密的多播数据包，对于终端设备来说，该终端设备可以使用步骤S102中得到的第二密钥对该多播数据包进行解密，得到多播数据包中的多播数据，从而在该接入网设备与终端设 备之间的多播数据传输过程中，实现接入网设备与终端设备之间关于多播密钥的更新与对齐，进一步提升多播数据通信的安全性。
本实施例中，接入网设备向终端设备发送第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包，即终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；此后，在第一密钥存在更新的时候，该接入网设备可以以多播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥，使得该终端设备可以在根据第一配置更新第一密钥之后，进一步根据更新后的密钥对接收到的来自于接入网设备的多播数据包进行处理。其中，接入网设备通过多播方式向终端设备发送用于更新第一密钥的第一配置，当终端设备的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，与现有技术相比，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，从而实现多播过程中密钥的传输方式的优化。
实施例二
在实施例二中，接入网设备通过单播方式发送密钥更新信息，图6为本申请实施例中提供的另一种密钥的传输方法的流程示意图，如图6所示，包括：
S201、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，终端设备在步骤S201中接收来自接入网设备的第一消息。第一消息包括第一密钥以及与所述第一密钥相关联的第一配置信息集合，其中，第一密钥用于加密多播数据包，或者终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行解密处理。
此外，在实现多播数据的传输过程，终端设备中可以进一步与接入网设备对齐多播配置所使用的各种配置参数，其中，该配置参数可以承载在步骤S201中的第一消息中，该第一消息还包括与该第一密钥相关联的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等。从而，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，与现有技术中需要另设发送配置信息的过程相比，可以进一步节省接入网设备的信令开销。其中，该第一配置信息集合的具体实现过程可以参考步骤S101中相关说明，此处不再赘述。
其中，该终端设备可以进一步确定指示第一密钥的时效信息的第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻关于第一密钥的生效时刻、第一密钥的有效持续时间这两个角度实现第一密钥时效的确定过程，具体参见步骤S101中的相关内容，此处不再赘述。
在步骤S201实现之前，还包括步骤S201A：终端设备确定需要多播配置。
具体地，如果该终端设备未处于RRC连接态，如该终端设备处于RRC非激活态或者是RRC空闲态时，当终端设备确定需要多播配置时，终端设备通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态，此后通过步骤S201接收来自该接入网设备的该第一消 息，从而，处于非激活态或者是空闲态的终端设备中也可以实现对应于多播数据包的第一密钥的获取。该终端设备确定需要多播配置的方式有多种，具体实现过程可以参考前述步骤中S101的相关实现过程，此处不再赘述。
在步骤S201的实现过程中，第一消息可以是以单播方式发送的，也可以是以广播方式发送，其中，具体第一消息的发送方式所实现的过程可以参考前述步骤中S101的相关实现过程，此处不再赘述。
在一种可能的设计中，接入网设备在步骤S201所发送的第一消息中还可以承载有第一指示，相应的，该终端设备可以进一步地通过该第一消息获取第一指示，其中，该第一指示的实现具体过程可以参考前述步骤S101中第一指示的相关实现过程，此处不再赘述。
在一种可能的设计中，其中，终端设备还可以基于其自身降低电耗和/或提升性能等配置策略自行确定退出连接态，或者是通过其它方式来确定退出连接态，在本发明中不做限制。当终端设备确定退出连接态时该终端设备向接入网设备发送第三指示，其中，该第三指示的实现具体过程可以参考前述步骤S101中第三指示的相关实现过程，此处不再赘述。
在一种可能的设计中，在步骤S201之后，接入网设备向该终端设备发送使用第一密钥加密的多播数据包，对于终端设备来说，该终端设备可以使用步骤S201中得到的第一密钥对该多播数据包进行解密，得到多播数据包中的多播数据，从而在接入网设备与终端设备之间的多播数据传输过程中，实现多播密钥的加密过程，提升多播数据通信的安全性。
S202、接入网设备以单播方式向终端设备发送第一配置，其中，该第一配置用于更新步骤S201中的第一密钥。
本实施例中，接入网设备以单播方式向终端设备发送第一配置，相应的，终端设备在步骤S202中以单播方式接收来自接入网设备的第一配置。该第一配置用于更新该第一密钥，使得该终端设备可以在根据第一配置更新第一密钥之后，进一步根据更新后的密钥对接收到的来自于接入网设备的多播数据包进行处理。其中，第一配置是以单播方式发送的，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式，其中，第一消息在单播发送过程的具体实现可以是RRC消息、MAC CE消息、PDCCH消息，或者是其它类型的单播消息，此处不做限定。此外，接入网设备通过单播方式发送第一配置，相比于实施例一中多播的实现方式，实施例二在接入网设备与终端设备一对一的通信过程中实现第一配置的传输，可以选择性地针对部分终端设备实现多播密钥更新，进一步提升密钥信息传输的安全性。
其中，第一配置还可以承载用于指示对应于第二密钥的第二定时器，和/或第二时刻信息，其中，该第二定时器用于指示该第二密钥的有效持续时间，该第一时刻信息用于指示该第二密钥的生效起始时刻，其中，第二定时器及第二时刻信息的实现可以参考前述实施例中第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
可选的，在步骤S202之前，还包括步骤S2021：接入网设备确定是否需要更新该第一密钥，该确定过程有多种实现，具体该确定过程的实现可以参考前述步骤S102中描述的相关实现过程，此处不再赘述。
在步骤S202实现之前，终端设备确定需要第一密钥的更新信息。具体地，如果该终端 设备未处于RRC连接态，如该终端设备处于RRC非激活态或者是RRC空闲态时，当终端设备确定需要第一密钥的更新信息时，终端设备通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态，此后通过步骤S202接收来自该接入网设备的该第一配置，从而，处于非激活态或者是空闲态的终端设备中也可以实现第一密钥的更新信息的获取。
该终端设备确定需要第一密钥的更新信息的方式有多种，具体实现的过程可以参考前述步骤S102中描述的相关实现过程，此处不再赘述。
此外，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。其中，第二配置信息集合与第一配置信息集合的关联关系可以参考前述实施例中步骤S102中的相关实现过程，此处不再赘述。
在步骤S202的发送过程中，可以进一步对该第一配置进行加密处理，具体加密实现有多种方式，具体实现的过程可以参考前述步骤S102中描述的相关实现过程，此处不再赘述。
在一种可能的设计中，在步骤S202之后，接入网设备向该终端设备发送使用第二密钥加密的多播数据包，对于终端设备来说，该终端设备可以使用步骤S202中得到的第二密钥对该多播数据包进行解密，得到多播数据包中的多播数据，从而在该接入网设备与终端设备之间的多播数据传输过程中，实现接入网设备与终端设备之间关于多播密钥的更新与对齐，进一步提升多播数据通信的安全性。
本实施例中，接入网设备向终端设备发送第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包；即终端设备可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行处理；此后，在第一密钥存在更新的时候，该接入网设备可以以单播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥，使得该终端设备可以在根据第一配置更新第一密钥之后，进一步根据更新后的密钥对接收到的来自于接入网设备的多播数据包进行处理。此外，接入网设备通过单播方式发送第一配置，相比于实施例一中多播的实现方式，实施例二在接入网设备与终端设备一对一的通信过程中实现第一配置的传输，可以选择性地针对部分终端设备实现多播密钥更新，进一步提升密钥信息传输的安全性。其中，接入网设备可以在该第一消息中承载第一密钥以及与该第一密钥相关联的第一配置信息集合，使得终端设备可以通过第一消息获取用于处理多播数据包的第一密钥以及对应的第一配置信息集合，与现有技术中需要另设发送配置信息的过程相比，可以节省接入网设备的信令开销。
基于图5通过多播方式发送第一配置的过程和图6通过单播方式发送第一配置的过程对应的实施例，在方案的实现过程中，由于不同的终端设备可能存在不同的连接状态(连接态、非激活态或者是空闲态)，以及接入网设备在数据传输过程中的加密、加扰方式的不同，本申请实施例针对不同的应用场景提供适应性的对应解决的实施例，下面将通过图7至图13所示意的实施例进行说明。
实施例三
图7为本申请实施例三提供的又一种密钥的传输方法的流程示意图，如图7所示，包 括：
S301、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，终端设备在步骤S301中接收来自接入网设备的第一消息，其中，第一消息除了包括用于加密多播数据包的第一密钥之外，可选地，还可以进一步包括G-RNTI以及其它多播配置参数(具体包括步骤S101中的第一多播配置参数集)、第一时刻信息、和/或第一定时器中的一项或多项。此后，终端设备使用该第一消息中所承载的第一密钥以及可能存在的其它参数进行多播数据包的处理。其中，G-RNTI以及其它多播配置参数(参见步骤S101中的第一多播配置参数集)、第一时刻信息、和/或第一定时器等参数的实现过程可以参考前述步骤S101中的相关实现过程，此处不再赘述。
此外，在步骤S301的实现过程中，第一消息可以是以单播方式发送的，也可以是以广播或多播方式发送，其中，具体第一消息的发送方式所实现的过程可以参考前述步骤中S101的相关实现过程，此处不再赘述。
S302、终端设备确定第一密钥的时效；
本实施例中，该终端设备在步骤S301之后，可以进一步确定指示第一密钥的时效信息的第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。例如，该终端设备可以是根据预设在该终端设备内部的时间配置确定，也可以是根据接入网设备发送的消息确定，示例性的，可以是根据步骤S301中承载的第一生效时刻和/或第一定时器确定，关于第一密钥的生效时刻、第一密钥的有效持续时间这两个角度实现第一密钥时效的确定过程可以参考前述步骤S101中的相关确定过程，此处不再赘述。
S303、终端设备向接入网设备发送第一请求消息；
本实施例中，终端设备向该接入网设备发送第一请求消息，相应的，接入网设备在步骤S303中接收来自终端设备的第一请求消息，该第一请求消息用于请求该第一密钥的更新信息。其中，终端设备可以根据步骤S302中的第一密钥的时效确定需要第一密钥的更新信息时，向接入网设备发送第一请求消息，此后，接入网设备响应于该第一请求消息执行步骤304。
其中，对于终端设备来说，终端设备向接入网设备发送第一请求消息用于请求该第一密钥的更新信息，即终端设备主动查询第一密钥的更新信息的方式可以确保终端设备中保持最新的密钥配置，避免因密钥未及时更新而产生无法处理多播数据包的情况。相应的，对于接入网设备来说，接入网设备后续可以根据该第一请求消息触发执行获取第一密钥的更新信息的过程，无需另行配置第一密钥的更新策略，可以进一步节省接入网设备的信令消耗。
其中，步骤S302和步骤S303为可选步骤。
S304、接入网设备确定更新第一密钥；
本实施例中，在步骤S301之后，在步骤S304中，接入网设备可以根据预设的条件来确定是否需要更新该第一密钥，该确定过程有多种实现，例如可以是接入网设备确定对应 于第一密钥的第一定时器超时；或者，接入网设备根据步骤S303中来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息，接入网进一步根据该第一请求消息去查询确定需要更新该第一密钥；或者，接入网设备根据来自核心网设备的该第一配置确定需要更新该第一密钥，或者，接入网设备确定多播组中有某个终端设备离开该群组，为了防止密钥泄露，统一更新第一密钥。即该接入网设备可以针对不同的使用场景进行灵活处理，通过多种方式来确定需要更新该第一密钥，实现多播密钥的及时更新，从而提升通信的安全性。
S305、接入网设备以多播方式向终端设备发送使用第一密钥加密后的第一配置；
本实施例中，接入网设备以多播方式发送使用第一密钥加密后的第一配置，相应的，终端设备在步骤S305中以多播方式接收来自接入网设备的使用第一密钥加密后的第一配置。接入网设备在步骤S304确定需要更新第一密钥的时候，获取用于更新第一密钥的第一配置，此后，接入网设备对该第一配置进行加密、加扰处理后以多播方式发送至接入网设备。其中，加密过程可以是使用步骤S301中的第一密钥直接加密，加扰过程可以是使用步骤S301中的G-RNTI加扰承载该第一配置的消息(例如DCI消息)实现，也可以是预设RNTI加扰承载该第一配置的消息实现。具体来说，预设RNTI可以是接入网设备预先与终端设备对齐的预设RNTI，例如该接入网设备预先与该终端设备通信过程中，接入网设备为指定类型的终端设备所分配的预设RNTI，或者是接入网设备根据核心网设备的指示确定该预设RNTI，例如运营服务商预设于该终端设备中存储模块的预设RNTI，如预设在终端设备中SIM、USIM、ISIM、嵌eSIM或者是其他如电子签名认证、电子钱包等。
此外，该第一配置可以是直接用于替换该第一密钥的第二密钥、也可以是用于更新第一密钥的更新策略(例如NH、NCC或者其他参数，利用相关参数推导出更新的第二密钥)、还可以是其他方式，此处不做限定。
S306、终端设备根据第一配置更新第一密钥；
本实施例中，终端设备根据步骤S305中的第一配置对第一密钥进行更新，得到第二密钥。具体地，第一配置还可以承载用于指示对应于第二密钥的第二定时器，和/或第二时刻信息，其中，该第二定时器用于指示该第二密钥的有效持续时间，该第一时刻信息用于指示该第二密钥的生效起始时刻，其中，第二定时器及第二时刻信息的实现可以参考前述步骤S101中的第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
其中，图7对应实施例中，接入网设备和终端设备所执行相关步骤的过程还可以通过前述图5实施例对应的过程实现，此处不再赘述。
本实施例中，可以适用于处于连接态的终端设备，接入网设备通过多播方式发送第一密钥加密后的第一配置的应用场景中，其中，接入网设备通过多播方式向终端设备发送用于更新第一密钥的第一配置，当终端设备的数量为多个时，通过一次发送过程就可以实现多个终端设备中密钥的更新，与现有技术相比，节省接入网设备为各个终端设备进行一一单播发送更新消息带来的信令开销，节省为各个UE一一单播发送更新消息带来的信令开销，优化接入网设备的处理，批量实现更新，提高通信效率。
实施例四
图8为本申请实施例四提供的又一种密钥的传输方法的流程示意图，如图8所示，包括：
S401、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，终端设备在步骤S401中接收来自接入网设备的第一消息，其中，第一消息除了包括用于加密多播数据包的第一密钥之外，可选地，还可以进一步包括G-RNTI以及其它多播配置参数(具体可以包括步骤S301中的第一多播配置参数集)、第一生效时刻、和/或第一定时器中的一项或多项。此后，终端设备使用该第一消息中所承载的第一密钥以及可能存在的其它参数进行多播数据包的处理。其中，G-RNTI以及其它多播配置参数(参见步骤S101中的第一多播配置参数集)、第一时刻信息、和/或第一定时器等参数的实现过程可以参考前述步骤S101中的相关实现过程，此处不再赘述。此外，在步骤S401的实现过程中，第一消息可以是以单播方式发送的，也可以是以广播方式发送，其中，具体第一消息的发送方式所实现的过程可以参考前述步骤中S101的相关实现过程，此处不再赘述。
此外，该第一消息除了包括用于加密多播数据包的第一密钥之外，还可以承载第三密钥，其中，第三密钥不同于该第一密钥，后续在第一密钥存在更新的时候，接入网可以使用该第三密钥对第一密钥的更新信息进行加密。可选地，在方案的实现过程中，接入网设备还可以通过该第一消息或者是其它的消息向该终端设备发送第三时刻信息和/或第三定时器，其中，该第三定时器用于指示该第三密钥的有效持续时间，该第三时刻信息用于指示该第三密钥的生效起始时刻，其中，第三定时器及第三时刻信息的实现可以参考前述步骤S101中第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
其中，该第一消息可以承载该第三密钥，相比于用于加密多播数据包的第一密钥，该第三密钥用于加密多播密钥的更新信息，相比于实施例三中使用第一密钥加密多播密钥的更新信息的过程，在实施例四中，接入网设备可以另设第三密钥实现加密多播密钥的更新信息过程。
S402、接入网设备确定第三密钥存在更新；
本实施例中，接入网设备可以根据预设的条件来确定第三密钥是否存在更新，确定方式有多种实现，例如，可以是接入网设备确定对应于第三密钥的第三定时器超时；或者，接入网设备根据来自该终端设备的第二请求消息确定需要更新该第三密钥，该第二请求消息用于请求该第三密钥的更新信息，接入网进一步根据该第二请求消息去查询确定需要更新该第三密钥；或者，接入网设备确定多播组中有某个终端设备离开该群组，为了防止密钥泄露，统一更新第三密钥。即该接入网设备可以针对不同的使用场景进行灵活处理，通过多种方式来确定需要更新该第三密钥，使得本实施例可以适应于多种应用场景。
S403、接入网设备向终端设备发送第二配置；
本实施例中，接入网设备向终端设备发送第二配置，相应的，终端设备在步骤S403中接收来自接入网设备的第二配置。当接入网设备在步骤S402中确定需要更新第三密钥时，该接入网设备向该终端设备发送第二配置，其中，第二配置包括该第三密钥的更新信息，用于将该第三密钥进行更新，得到更新后的第三密钥。其中，第二配置还可以承载用于指 示对应于更新后的第三密钥的第四定时器，和/或第四时刻信息，其中，该第四定时器用于指示该更新后的第三密钥的有效持续时间，该第四时刻信息用于指示该更新后的第三密钥的生效起始时刻，其中，第四定时器及第四时刻信息的实现可以参考前述第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
此外，该第二配置可以是直接用于替换该第三密钥的密钥信息、也可以是用于更新第三密钥的更新策略(例如NH、NCC或者其他参数，利用相关参数推导出更新后的第三密钥)、还可以是其他方式，此处不做限定。
其中，步骤S402和步骤S403为可选的执行步骤。
S404、终端设备确定第一密钥的时效；
S405、终端设备向接入网设备发送第一请求消息；
本实施例中，终端设备向接入网设备发送第一请求消息，相应的，接入网设备在步骤S405中在步骤S405中接收来自终端设备的第一请求消息。其中，步骤S404和步骤S405的实现过程可以参考前述步骤S302和S303的相关实现过程，此处不再赘述。
其中，步骤S404和步骤S405为可选步骤。
S406、接入网设备确定更新第一密钥；
本实施例中，步骤S406的实现过程可以参考前述步骤S304的相关实现过程，此处不再赘述。
S407、接入网设备以多播方式向终端设备发送使用第三密钥加密后的第一配置；
本实施例中，接入网设备以多播方式发送使用第三密钥加密后的第一配置，相应的，终端设备在步骤S407中以多播方式接收来自接入网设备的第三密钥加密后的第一配置。接入网设备在步骤S304确定需要更新第一密钥的时候，获取用于更新第一密钥的第一配置，此后，接入网设备对该第一配置进行加密、加扰处理后以多播方式发送至接入网设备。其中，加密过程可以是使用步骤S401中的第三密钥加密，或者是，当接入网设备执行步骤S403即步骤S404时，加密过程可以是使用步骤S404中的更新后的第三密钥加密。
此外，加扰过程可以是使用步骤S301中的G-RNTI加扰承载该第一配置的消息(例如DCI消息)实现，也可以是预设RNTI加扰承载该第一配置的消息实现。具体来说，预设RNTI可以是接入网设备预先与终端设备对齐的预设RNTI，例如该接入网设备预先与该终端设备通信过程中，接入网设备为指定类型的终端设备所分配的预设RNTI，或者是接入网设备根据核心网设备的指示确定该预设RNTI，例如运营服务商预设于该终端设备中存储模块的预设RNTI，如预设在终端设备中SIM、USIM、ISIM、嵌eSIM或者是其他如电子签名认证、电子钱包等。
此外，该第一配置可以是直接用于替换该第一密钥的第二密钥、也可以是用于更新第一密钥的更新策略(例如NH、NCC或者其他参数，利用相关参数推导出更新的第二密钥)、还可以是其他方式，此处不做限定。
S408、终端设备根据第一配置更新第一密钥；
本实施例中，步骤S408的实现过程可以参考前述步骤S306的相关实现过程，此处不再赘述。
其中，图8对应实施例中，接入网设备和终端设备所执行相关步骤的过程还可以通过前述图5实施例对应的过程实现，此处不再赘述。
本实施例中，可以适用于处于连接态的终端设备，接入网设备多播发送第三密钥加密后的第一配置的应用场景中，其中，与图7对应实施例相比，区别在于：在步骤S401中，第一消息还承载第三密钥，此后，接入网设备在步骤S407发送用于更新第一密钥的第一配置时，是使用该第三密钥进行加密的。此外，为了加强数据传输的安全性，接入网设备可以另设步骤S403和步骤S404来实现对第三密钥的更新过程。相比于图7对应的实施例，提供了新的密钥发送及更新机制，而且区分正常工作使用的第一密钥和组更新时使用的第三密钥，两套密钥之间更新也是互不影响的，通过不同配置使得用于组更新的第三密钥更安全。
实施例五
图9为本申请实施例五提供的又一种密钥的传输方法的流程示意图，如图9所示，包括：
S501、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，在步骤S501中终端设备接收来自接入网设备的第一消息。
S502、终端设备确定第一密钥的时效；
S503、终端设备向接入网设备发送第一请求消息；
本实施例中，终端设备向接入网设备发送第一请求消息，相应的，接入网设备在步骤S503中接收来自终端设备的第一请求消息。
S504、接入网设备确定更新第一密钥；
本实施例中，步骤S501至步骤S504的实现过程可以参考前述图7对应实施例中步骤S301至步骤S304的相关实现过程，此处不再赘述。
S505、接入网设备以单播方式向终端设备发送使用第一密钥加密后的第一配置；
本实施例中，接入网设备以单播方式发送使用第一密钥加密后的第一配置，相应的，终端设备在步骤S505中以单播方式接收来自接入网设备的使用第一密钥加密后的第一配置。接入网设备使用步骤S501中第一消息中承载的第一密钥对该第一配置进行加密处理。此外，该第一配置具体是以单播方式发送的，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式，其中，第一消息在单播发送过程的具体实现可以是RRC消息、MAC CE消息、PDCCH消息，或者是其它类型的单播消息，此处不做限定。其中，第一配置还可以承载用于指示对应于第二密钥的第二定时器，和/或第二时刻信息，其中，该第二定时器用于指示该第二密钥的有效持续时间，该第一时刻信息用于指示该第二密钥的生效起始时刻，其中，第二定时器及第二时刻信息的实现可以参考前述第一定时器及第一时刻信息的相关实现过程，此处不再赘述。
S506、终端设备根据第一配置更新第一密钥；
本实施例中，步骤S506的实现过程可以参考前述步骤S306的相关实现过程，此处不再赘述。
其中，图9对应实施例中，接入网设备和终端设备所执行相关步骤的过程还可以通过前述图6实施例对应的过程实现，此处不再赘述。
本实施例中，可以适用于处于连接态的终端设备，接入网设备单播发送第一密钥加密后的第一配置的应用场景中，与图7对应实施例相比，区别在于：在步骤S505中，接入网设备是使用单播方式发送第一配置，而不是步骤S305中使用多播方式发送，相比之下，通过单播方式发送第一配置的过程可以提高数据传输过程中的安全性，并且对于终端设备离开多播群组的情况来说，相比于图7对应的实施例，可以防止存在终端设备退出多播群组的情况而造成的初始的第一密钥的泄露的风险。
实施例六
图10为本申请实施例六提供的又一种密钥的传输方法的流程示意图，如图10所示，包括：
S601、核心网设备向接入网设备发送第一多播配置和第一安全配置容器(security Config container)；
本实施例中，核心网设备向接入网设备发送第一多播配置和第一安全配置容器，相应的，接入网设备在步骤S601中接收来自核心网设备的第一多播配置和第一安全配置容器。其中，所述第一安全配置容器可以用于传输安全配置相关的参数，例如传输加密密钥、传输安全算法、传输数字证书等，或者是传输其它安全配置相关的参数。核心网设备可以通过与接入网设备之间的第一接口向该接入网设备发送第一多播配置和第一安全配置容器，在发送过程中，该第一多播配置和第一安全配置容器这两个信息可以相互独立发送，该第一多播配置和第一安全配置容器这两个信息也可以是相互包含的关系发送，例如发送包含有第一多播配置的第一安全配置容器，或者是发送包含有第一安全配置容器的第一多播配置，此处不做限定。其中，第一接口可以是N2接口、或者是S1接口，也可以是其他名称的接口，本实施例不做限制。此处以该接口为N2接口为例进行说明：S601步骤中的发送方式包括：
方式1：核心网设备通过一条N2消息向接入网设备发送第一多播配置，其中，第一多播配置包括第一安全配置容器，即该第一安全配置容器可以作为第一多播配置的部分信息而包含于该第一多播配置；
方式2：核心网设备通过多条N2消息分别向接入网设备发送第一多播配置和第一安全配置容器，即第一安全配置容器和第一多播配置通过不同的N2消息承载；
方式3：核心网设备通过一条N2消息向接入网设备发送第一多播配置和第一安全配置容器，其中，第一安全配置容器和该第一安全配置作为两个不同的信元通过同一条N2消息承载。
具体地，接入网设备接收核心网设备发送承载第一多播配置和第一安全配置容器的N2消息，该第一多播配置和第一安全配置容器的实现过程中：
1)第一安全配置容器可以包括第一密钥，或者，该第一安全配置容器可以包括用于确定第一密钥的参数，其中，用于确定第一密钥的参数可以包括NH、NCC或者是其它相关参数，使得接入网设备(或者是终端设备)得到第一安全配置容器中用于确定第一密钥的参 数之后，可以利用相关参数推导出第一密钥；
2)第一多播配置包括第一密钥的相关配置。其中，该第一密钥的相关配置可以包括：第一密钥的第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻；此外，该第一密钥的相关配置还可以包括：第一密钥的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等。
上述参数的具体实现过程可以参考前述步骤S101、步骤S102中的相关实现过程，此处不再赘述，在该第一多播配置中还可以承载关联于第一密钥的其它参数，此处不做限定。
S602、接入网设备向终端设备发送第一消息；
本实施例中，接入网设备向终端设备发送第一消息，相应的，终端设备在步骤S602中接收来自接入网设备的第一消息。接入网设备根据步骤S601中得到的第一多播配置和第一安全配置容器确定向终端设备发送第一消息。
其中，根据步骤S601中的N2消息中承载的不同的第一多播配置和第一安全配置容器的实现方式，接入网设备在步骤S602中可以存在不同的处理过程：
1)对于第一安全配置容器来说，当第一安全配置容器包括第一密钥时，接入网设备可以转发核心网的第一安全配置容器中承载的第一密钥，将第一密钥承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一消息中，终端设备在得到第一消息之后，可以通过该第一消息直接读取得到第一密钥；
当第一安全配置容器包括用于确定第一密钥的参数时，接入网设备可以转发核心网的第一安全配置容器中承载的用于确定第一密钥的参数，将用于确定第一密钥的参数承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一消息中，终端设备在得到第一消息之后，可以通过该第一消息所承载的用于确定第一密钥的参数进行推导得到第一密钥。
2)对于第一多播配置来说，接入网设备可以转发核心网的第一安全配置容器中承载的第一多播配置，将第一多播配置承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一消息中，终端设备在得到第一消息之后，可以通过该第一消息直接读取得到第一多播配置。
本实施例中，步骤S602中接入网设备向终端设备发送第一消息的实现过程，可以参考前述图5对应实施例中步骤S101和步骤S102的相关实现过程(或前述图6对应实施例中步骤S201和步骤S202)，此处不再赘述。
S603、核心网设备向接入网设备发送第二多播配置和第二安全配置容器(security Config container)。
本实施例中，核心网设备向接入网设备发送第二多播配置和第二安全配置容器，相应的，接入网设备在步骤S603中接收来自核心网设备的第二多播配置和第二安全配置容器。核心网设备可以通过与接入网设备之间的第一接口向该接入网设备发送第一多播配置和第 一安全配置容器，其中，第一接口可以是N2接口、或者是S1接口，也可以是其他名称的接口，本实施例不做限制。此处以该接口为N2接口为例进行说明，具体通过N2消息向接入网设备发送第二多播配置和第二安全配置容器的过程可以参考步骤S601中发送第一多播配置和第一安全配置容器(security Config container)的相关实现过程，此处不再赘述。
具体地，接入网设备接收核心网设备发送承载第二多播配置和第二安全配置容器的N2消息，该第二多播配置和第二安全配置容器的实现过程中：
1)第二安全配置容器可以包括第二密钥，或者，该第二安全配置容器可以包括用于确定第二密钥的参数，其中，用于确定第二密钥的参数可以包括NH、NCC或者是其它相关参数，使得接入网设备(或者是终端设备)得到第二安全配置容器中用于确定第二密钥的参数之后，可以利用相关参数推导出第二密钥；
2)第二多播配置包括第二密钥的相关配置。其中，该第二密钥的相关配置可以包括：第二密钥的第二定时器，和/或第二时刻信息，其中，该第二定时器用于指示该第二密钥的有效持续时间，该第二时刻信息用于指示该第二密钥的生效起始时刻；此外，该第二密钥的相关配置还可以包括：第二密钥的第二配置信息集合，该第二配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等。其中，第二配置信息集合为第一配置信息集合的子集，第二配置信息集合与第一配置信息集合的关联关系可以参考前述实施例中步骤S102中的相关实现过程，此处不再赘述。
上述参数的具体实现过程可以参考前述步骤S101、步骤S102中的相关实现过程，此处不再赘述，在该第二多播配置中还可以承载关联于第二密钥的其它参数，此处不做限定。
S604、接入网设备向终端设备发送第一配置；
本实施例中，接入网设备向终端设备发送第一配置，相应的，终端设备在步骤S604中接收来自接入网设备的第一配置。接入网设备根据步骤S603中得到的第二多播配置和第二安全配置容器确定向终端设备发送第一配置。
其中，根据步骤S603中的N2消息中承载的不同的第二多播配置和第二安全配置容器的实现方式，接入网设备可以存在不同的处理过程，包括：
1)对于第二安全配置容器来说，当第二安全配置容器包括第二密钥时，接入网设备可以转发核心网的第二安全配置容器中承载的第二密钥，将第二密钥承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一配置中，终端设备在得到第一配置之后，可以通过该第一配置直接读取得到第二密钥；
当第二安全配置容器包括用于确定第二密钥的参数时，接入网设备可以转发核心网的第二安全配置容器中承载的用于确定第二密钥的参数，将用于确定第二密钥的参数承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一配置中，终端设备在得到第一配置之后，可以通过该第一配置所承载的用于确定第二密钥的参数进行推导得到第二密钥。
2)对于第二多播配置来说，接入网设备可以转发核心网的第二安全配置容器中承载的第二多播配置，将第二多播配置承载在终端设备和接入网设备之间通信的信令(简称空口信令)的第一配置中，终端设备在得到第一配置之后，可以通过该第一配置直接读取得到第二多播配置。
本实施例中，步骤S604中接入网设备向终端设备发送第一配置的实现过程，可以参考前述图5对应实施例中步骤S101和步骤S102的相关实现过程(或前述图6对应实施例中步骤S201和步骤S202)，此处不再赘述。
本实施例中，可以适用于核心网设备实现管理多播密钥的应用场景中，相比于图7、图8、图9对应实施例可以是接入网设备自行确定多播密钥的管理实现方式，本实施例中是通过核心网设备(例如，AMF、UPF或者其它核心网设备)来实现多播密钥的管理。由于多播密钥管理在核心网设备中,第一密钥以及用于更新第一密钥的第一配置可作为多播上下文multicast context，由核心网设备发给接入网设备。通过核心网设备实现多播密钥管理，改进核心网设备与接入网设备之间信令交互，减少接入网设备对多播密钥管理所涉及的存储及交互的信令消耗。
实施例七
图11为本申请实施例七提供的又一种密钥的传输方法的流程示意图，如图11所示，包括：
S701、终端设备确定需要获取多播配置；
本实施例中，如果该终端设备未处于RRC连接态，如该终端设备处于RRC非激活态或者是RRC空闲态时，此时，当终端设备确定需要多播配置时，终端设备通过步骤702发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态。
该终端设备确定需要多播配置的方式包括以下至少一种：
1)当终端设备无可用的多播配置时，确定需要多播配置，例如该终端设备未存储任何多播配置；
2)当终端设备对多播业务感兴趣且无对应的多播配置时，确定需要多播配置，此时，该终端设备存储有部分业务的配置，但是没有感兴趣多播业务对应的多播配置，换句话说，存储的部分业务配置中不包括感兴趣多播业务对应的多播配置。
S702、终端设备发起RRC连接建立过程或RRC连接恢复过程；
本实施例中，在步骤S701中若终端设备确定需要获取多播配置时，则该终端设备可以进入连接态来获取多播配置，具体在步骤S702的实现过程中，终端设备可以通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态。可选地，终端设备可以在该过程中向接入网设备发送的RRC连接请求消息或者是RRC连接恢复请求消息承载特定标识，该特定标识用于指示该终端设备需要多播配置。
S703、接入网设备以单播方式向终端设备发送第一消息；
本实施例中，接入网设备以单播方式向终端设备发送第一消息，相应的，终端设备在步骤S703中以单播方式接收来自接入网设备的第一消息。接入网设备可以向指定的终端设备以单播方式发送该第一消息，其中，指定的终端设备可以是接入网设备根据核心网设备 的指示确定，也可以是该接入网设备根据自身配置确定，还可以是接入网设备根据终端设备发送的RRC连接请求消息或者是RRC连接恢复请求消息中承载的特定标识确定，其中，该特定标识用于指示该终端设备需要多播配置，还可以是其它方式确定，此处不做限定。
其中，以单播方式发送指的是接入网设备与终端设备已建立RRC连接之后，基于该RRC连接的链路进行发送的方式，其中，第一消息在单播发送过程的具体实现可以是RRC消息、MAC CE消息、PDCCH消息，或者是其它类型的单播消息，此处不做限定。
其中，该第一消息具体可以包括第一密钥，该第一密钥用于加密多播数据包，即终端设备后续可以根据第一密钥对接收到的来自于接入网设备的多播数据包进行解密处理，具体在该第一消息还可以承载关联于该第一密钥的其他参数，包括：
1)对应于第一密钥的第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻；
2)关联于第一密钥的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等；
上述参数的具体实现过程可以参考前述步骤S101、步骤S102中的相关实现过程，此处不再赘述。
S704、终端设备确定第一密钥的时效；
本实施例中，步骤S704的实现过程可以参考前述步骤S301的相关实现过程，此处不再赘述。
S705、接入网设备向终端设备发送第一指示；
本实施例中，接入网设备向终端设备发送第一指示，相应的，终端设备在步骤S705中接收来自接入网设备的第一指示。终端设备在步骤S703得到第一消息之后，该终端设备可以根据接入网设备发送第一指示退出连接态，但不释放第一配置信息集合和第一密钥；继续使用该第一配置信息集合和该第一密钥接收该多播数据包。具体地：
如果第一指示承载在接入网设备将终端设备从RRC连接态转移到RRC非激活态的消息中，则当终端设备收到第一指示后，终端设备进入RRC非激活态，但不释放第一配置信息集合和第一密钥，以便后续终端设备可以使用该第一配置信息集合和第一密钥接收该多播数据包，也就是说，终端设备可以在RRC非激活态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据。
如果第一指示承载在接入网设备将终端设备从RRC连接态转移到RRC空闲态的消息中，则当终端设备收到第一指示后，终端设备进入RRC空闲态，但不释放第一配置信息集合和第一密钥，以便后续可以使用该第一配置信息集合和第一密钥接收该多播数据包，也就是说，终端设备可以在RRC空闲态中使用该第一密钥对通过该第一配置信息集合接收到的多播数据包进行解密，得到多播数据。
具体地，对于该终端设备也可以是基于接入网设备发送的第一指示退出连接态的方式来说，接入网设备可以进一步向该终端设备发送第一指示，该第一指示用于指示该终端设备进入RRC空闲态或者RRC非激活态，不释放该第一配置信息集合和该第一密钥(或挂起 第一配置信息集合和该第一密钥维持其仍然有效)，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。其中，第一指示可以承载于步骤S703中的第一消息中，也可以是通过其它的RRC消息发送至终端设备，例如RRC释放消息、RRC连接释放消息、RRC恢复消息，RRC连接恢复消息等。由于多播数据包(包括多播方式发送的第一配置)的接收并不依赖于终端设备与接入网设备之间的RRC连接，为了使得终端设备在退出RRC连接态时，即终端设备处于RRC空闲态或者RRC非激活态也可以实现多播数据的接收，接入网设备可以通过第一指示，使得终端设备根据该第一指示进入无线资源控制RRC空闲态或者RRC非激活态，同时不释放该第一配置信息集合和该第一密钥，继续使用该第一配置信息集合和该第一密钥接收该多播数据包，从而，使得后续该终端设备与接入网设备之间无需建立RRC连接即可实现多播数据包(包括多播方式发送的第一配置)的接收，进一步节省接入网设备与终端设备之间的信令消耗。
其中，终端设备还可以基于其自身降低电耗和/或提升性能等配置策略自行确定退出连接态，或者是通过其它方式来确定退出连接态，在本发明中不做限制。当终端设备确定退出连接态时该终端设备向接入网设备发送第三指示，该第三指示用于指示该终端设备自行确定退出连接态，或者第三指示用于请求释放RRC连接，或者所述第三指示用于请求暂停RRC连接，或者第三指示接入网设备该终端设备请求退出连接态。其中，所述第三指示可以承载在RRC消息中，所述RRC消息可为RRC连接请求消息或RRC连接暂停消息或其他RRC消息，本发明中不做限制。其中，该第三指示用于向接入网设备指示该终端设备自行确定退出连接态，使得接入网设备和终端设备可以对齐该终端设备的状态，使得该接入网设备在退出连接态之后，在空闲态或者是非激活态仍然可以使用该第一消息实现接收来自接入网设备的多播数据包。
S706、接入网设备确定更新第一密钥；
S707、接入网设备以多播方式向终端设备发送第一配置；
本实施例中，接入网设备以多播方式向终端设备发送第一配置，相应的，终端设备在步骤S707中以多播方式接收来自接入网设备的第一配置。
S708、终端设备根据第一配置更新第一密钥；
本实施例中，步骤S706至步骤S708的实现过程可以参考前述图7对应步骤S304至步骤S306的相关实现过程，此处不再赘述。
其中，图11对应实施例中，接入网设备和终端设备所执行相关步骤的过程还可以参考前述图5实施例对应的相关过程实现，此处不再赘述。
本实施例中，可以适用于处于空闲态或者是非激活态的终端设备、接入网设备多播发送第一密钥加密后的第一配置的应用场景中，与图7对应实施例相比，区别在于：在步骤701和步骤702中，终端设备原本处于空闲态或者非激活态，在确定需要获取多播配置时才会进入连接态执行步骤S703和步骤S704接收第一消息的过程。此外，在步骤S705中，终端设备还可以根据接入网设备的第一指示退出连接态，也就是说，如果接入网设备当前的多播的终端设备个数较多时，接入网设备可以让部分终端设备退出连接态，但是不释放多播配置信息(包括第一多播配置参数集)、多播密钥信息(包括第一密钥、第一配置等)， 即让UE在空闲态或者非激活态接收多播数据包。相比于图7对应实施例，可以实现空闲态或者非激活态的终端设备也能接收第一密钥、以及用于更新第一密钥的第一配置。
实施例八
图12为本申请实施例八提供的又一种密钥的传输方法的流程示意图，如图12所示，包括：
S801、终端设备确定需要获取多播配置；
S802、终端设备发起RRC连接建立过程或RRC连接恢复过程；
本实施例中，步骤S801和步骤S802的实现过程可以参考前述图11中步骤S701和步骤S702的实现过程，此处不再赘述。
其中，步骤S801和步骤S802适用于处于空闲态或者是非激活态的终端设备主动确定获取多播配置的应用场景，此后终端设备执行步骤S805执行相应的获取多播配置的过程；当该终端设备处于连接态或者是由接入网设备/核心网设备指示处于空闲态或者是非激活态的该终端设备获取多播配置的应用场景时，该步骤S801和步骤S802为可选步骤。
S803、核心网设备确定第一密钥；
本实施例中是通过现有的核心网设备(例如，AMF、UPF或者其它核心网设备)来实现多播密钥的管理，由于多播密钥管理在核心网设备中,因此，当该核心网设备可以按照预设配置规则进行周期性地或者基于终端设备的请求或者基于接入网设备的请求或者基于运营服务商的配置确定出接入网设备以及终端设备关于多播数据包传输的第一密钥，其中，该第一密钥用于加密多播数据包。
S804、核心网设备向接入网设备发送第一多播配置和第一安全配置容器(security Config container)；
本实施例中，核心网设备向接入网设备发送第一多播配置和第一安全配置容器，相应的，接入网设备在步骤S804中接收来自核心网设备的第一多播配置和第一安全配置容器。
S805、接入网设备以单播方式向终端设备发送第一消息；
本实施例中，接入网设备以单播方式向终端设备发送第一消息，相应的，终端设备在步骤S805中以单播方式接收来自接入网设备的第一消息。步骤S804和步骤S805的实现过程可以参考前述步骤S601和步骤S602的相关实现过程，此处不再赘述。
S806、终端设备确定第一密钥的时效；
S807、终端设备退出连接态；
本实施例中，步骤S806和步骤S807可以参考前述图11中步骤S704和步骤S705的相关实现过程，此处不再赘述。
S808、核心网设备确定需要更新第一密钥；
本实施例中，由于多播密钥管理在核心网设备中,因此，当该核心网设备可以按照预设配置规则进行周期性地或者基于终端设备的请求或者基于接入网设备的请求或者基于运营服务商的配置确定需要更新第一密钥。
S809、核心网设备向终端设备发送承载密钥更新指示的寻呼消息；
本实施例中，核心网设备向终端设备发送承载密钥更新指示的寻呼消息，相应的，终 端设备在步骤S809中接收来自核心网设备的承载密钥更新指示的寻呼消息。当该核心网设备确定存在第一密钥的终端设备的连接状态为空闲态或者是非激活态时，该核心网设备向该终端设备发送承载密钥更新指示的寻呼消息，此后，该终端设备可以基于该寻呼消息建立RRC连接进入连接态。其中，在该终端设备建立RRC连接的过程中，终端设备可以通过发起RRC连接建立过程或RRC连接恢复过程进入RRC连接态，具体可以在终端设备向接入网设备发送的RRC连接建立请求消息或者是RRC连接恢复请求消息中，承载需要获取第一密钥的更新信息的指示，或者是承载特定的cause值，用于指示当前RRC连接建立请求或RRC连接恢复请求用于获取第一密钥的更新信息。
此外，当该核心网设备确定存在第一密钥的终端设备的连接状态连接态时，核心网设备可以不执行步骤S809，直接执行后续步骤S810。
S810、核心网设备向接入网设备发送第二多播配置和第二安全配置容器(security Config container)；
本实施例中，核心网设备向接入网设备发送第二多播配置和第二安全配置容器，相应的，接入网设备在步骤S810中接收来自核心网设备的第二多播配置和第二安全配置容器。
S811、接入网设备向终端设备发送第一配置；
本实施例中，接入网设备向终端设备发送第一配置，相应的，终端设备在步骤S811中接收来自接入网设备的第一配置。步骤S810和步骤S811的实现过程可以参考前述步骤S603和步骤S604的相关实现过程，此处不再赘述。
S812、终端设备根据第一配置更新第一密钥；
本实施例中，步骤S812的实现过程可以参考前述图9中步骤S506中的相关实现过程，此处不再赘述。
其中，图12对应实施例中，接入网设备和终端设备所执行相关步骤的过程还可以参考前述图6实施例对应的相关过程实现，此处不再赘述。
本实施例中，可以适用于对于处于空闲态或者是非激活态的终端设备、接入网设备单播发送第一密钥加密后的第一配置的应用场景中，相比于图11对应实施例，由接入网设备管理密钥的方式调整为使用核心网设备管理密钥的方式，并且在步骤S809至步骤S811中，通过寻呼消息使得终端设备进入连接态，并且在连接态下使用单播方式接收来自接入网设备转发的第一配置，相比于图11对应实施例，使得处于空闲态或者非激活态的终端设备也可以接收第一密钥、以及用于更新第一密钥的第一配置之外，通过单播方式发送第一配置的过程进一步提升数据传输的安全性。
实施例九
图13为本申请实施例九提供的又一种密钥的传输方法的流程示意图，如图13所示，包括：
S901、接入网设备向终端设备发送加密的广播消息；
本实施例中，接入网设备向终端设备发送加密的广播消息，相应的，终端设备在步骤S901中接收来自接入网设备加密的广播消息。接入网设备向终端设备发送使用第四密钥加密的广播消息，其中，该广播消息包括第一密钥，第一密钥用于接入网设备加密多播数据 包，对应地，终端设备可以根据第一密钥对来自于接入网设备的多播数据包进行解密处理。
可选地，所述广播消息中除了可以承载该第一密钥之外，还可以承载其它关联于该第一密钥的参数，包括：
1)对应于第一密钥的第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻；
2)关联于第一密钥的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：多播业务标识、G-RNTI、BWP指示信息、PDSCH加扰序列、DRX、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示等；
上述参数的具体实现过程可以参考前述步骤S101、步骤S102中的相关实现过程，此处不再赘述。
可选地，该第四密钥可以是终端设备中预配置的，或者是从接入网设备或者从核心网设备获取的。例如，在一种实现方式中，第四密钥可以是预存于特定的终端设备中的密钥，使得终端设备可以获取第四密钥，该接入网设备根据核心网设备的指示确定该第四密钥，例如运营服务商预设于该终端设备中存储模块的第四密钥，如预设在终端设备中SIM、USIM、ISIM，eSIM或者是其他如电子签名认证、电子钱包等，后续接入网设备可以根据该运营服务商对应的核心网设备所下发的指示确定出用于广播第一消息的第四密钥。在另一种实现方式中，终端设备可以从接入网设备或核心网设备获取第四密钥，接入网设备与终端设备使用的第四密钥是对齐的。例如，终端设备接收接入网设备发送的第四密钥，或终端设备接收核心网设备发送的密钥。
相应地，在步骤901中，具备该第四密钥的特定的终端设备可以根据该第四密钥解密广播消息得到第一密钥，而不具备该第四密钥的终端设备则无法完整解密该广播消息，当终端设备无法解密该广播消息时，可以丢弃/忽略该广播消息。
S902、终端设备处理来自接入网设备的广播消息。
本实施例中，在步骤S901中终端设备接收到加密的广播消息，对加密的广播消息进行处理，如果解密成功，终端设备将解密后的广播消息递交上层，如果解密失败，终端设备可以丢弃或忽略该广播消息。
可选地，终端设备对加密的广播消息进行处理之前，还包括，终端设备确定是否有可用的第四密钥，如果有，终端设备可以使用第四密钥对接收的广播消息进行解密；如果没有可用的第四密钥，终端设备可以丢弃或忽略该广播消息；或者终端设备使用任意可用的密钥尝试对接收的广播消息进行解密，如果解密失败，终端设备可以丢弃或忽略该广播消息。可选地，在上述解密失败时，终端设备除了可以丢弃或忽略该广播消息外，终端设备还可以向上层指示解密出错，即终端设备可以指示上层对加密的广播消息处理失败。示例性的，如图2所示，终端设备内部中存在多个协议层，具体可以包括服务数据适配协议(Service Data Adaptation Protocol，SDAP)、PDCP、无线链路层控制协议(Radio Link Control，RLC)、媒体介入控制层(Media Access Control，MAC)、物理层(physical，PHY)等中的多个协议层，其中，终端设备将解密后的广播消息递交上层以及终端设备向上层指示解密出错的过程，具体可以在终端设备内部中的多个协议层之间的信息交互实现。
此外，当终端设备中存在该第四密钥时，该终端设备使用该第四密钥对步骤S901中得到的广播消息进行解密，若解密成功，则确定该终端设备为已授权的终端设备，后续该终端设备可以使用该广播消息所承载的第一消息实现多播数据包的接收，若解密失败，则确定该终端设备不是已授权的终端设备，则该终端设备可以丢弃/忽略该广播消息。其中，已授权的终端设备可以是该接入网设备预先与该终端设备通信过程中，接入网设备按照预设于该接入网设备的预设规则或者核心网设备的指示所指定的终端设备，例如当接入网设备后续需要发送的多播数据包是关于本地推广消息(如本地美食信息、本地旅游景点信息等)时可以指定归属地非本地的终端设备为已授权的终端设备；当接入网设备后续需要发送的多播数据包是关于指定人群的广告消息(如运动装备广告、游戏广告)时可以指定注册信息为男性的终端设备为已授权的终端设备，还可以是其它的实现方式，此处不做限定。
其中，图13对应实施例中，接入网设备和终端设备所执行相关步骤的过程具体可以参见前述图5实施例或图6实施例中对应的实现过程，此处不再赘述。
本实施例中，可以适用于对于处于空闲态或者非激活态的终端设备，接入网设备广播发送多播配置的应用场景中，相比于图7至图12对应实施例，通过广播方式发送，广播方式发送指的是数据的发送者“一对所有”接收者的通讯模式，即接入网设备所覆盖范围内的终端设备都可以接收到该广播信息，与该终端设备相关联的第四密钥加密且以广播方式发送的，但是本实施例所要实现的是多播过程，即使得特定的终端设备接收到该第一消息，因此，步骤S901可以通过(特定终端设备才具备的)第四密钥加密该广播消息的方式发送。其中，该第四密钥可以是预存于特定的终端设备中的密钥，因此，步骤S902中，具备该第四密钥的特定的终端设备可以根据该第四密钥解密广播消息得到多播配置信息和多播密钥信息，即确定该终端设备为已授权的终端设备，后续可以使用多播配置信息和多播密钥信息进行多播数据包的处理，而不具备该第四密钥的终端设备则无法完整解密该广播消息，可以丢弃/忽略该广播消息，即确定该终端设备为未授权的终端设备，后续无法使用多播配置信息和多播密钥信息进行多播数据包的处理。其中，第四密钥的实现过程可参考前述步骤S101或步骤S102中的相关实现过程，此处不再赘述。
本实施例中，相比于图7至图12对应实施例，方案简单，可以通过广播消息(例如SIB)统一发送多播配置信息和多播密钥信息，且采用加密的广播消息来承载多播配置信息和多播密钥信息，也可以在一定程度上保证安全性。
上面从方法的角度对本申请实施例进行了说明，下面从具体装置实现的角度对本申请实施例中的通信装置进行介绍。
请参阅图14，本申请实施例提供了一种通信装置1400，具体该通信装置1400可以为密钥的传输装置，该通信装置1400包括：收发单元1401和处理单元1402；
该处理单元1402用于通过该收发单元1401向终端设备发送第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包；
该处理单元1402还用于通过该收发单元1401以多播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥。
在一种可能的实现方式中，该第一消息还包括第一定时器，和/或第一时刻信息，其中， 该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
在一种可能的实现方式中，该第一消息还包括与该第一密钥相关联的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、带宽部分BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
在一种可能的实现方式中，该该处理单元1402还用于通过收发单元1401向该终端设备发送第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
在一种可能的实现方式中，该第一配置用于将该第一密钥更新为第二密钥，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
在一种可能的实现方式中，该处理单元1402，根据如下之一条件，确定需要更新该第一密钥，包括：
确定该第一定时器超时；
或者，
根据来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息；
或者，
根据来自核心网设备的该第一配置确定需要更新该第一密钥。
在一种可能的实现方式中，该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
在一种可能的实现方式中，该第一配置承载于第一下行控制信息，该第一下行控制信息通过组无线网络临时标识G-RNTI加扰，或者通过预设无线网络临时标识RNTI加扰。
在一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
在一种可能的实现方式中，该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
在一种可能的实现方式中，该处理单元1402还用于通过该收发单元1401向该终端设备发送该寻呼消息，该寻呼消息包括第二指示，该第二指示用于指示该第一密钥存在更新；
该处理单元，还用于与该终端设备建立RRC连接。
需要说明的是，上述通信装置1400的单元的信息执行过程等内容，具体可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
请参阅图15，本申请实施例提供了一种通信装置1500，具体该通信装置1500可以为密钥的传输装置，该通信装置1500包括：收发单元1501和处理单元1502；
收发单元1501，用于接收来自接入网设备的第一消息，该第一消息包括第一密钥，该第一密钥用于加密多播数据包；
该收发单元1501，还用于以多播方式接收来自该接入网设备的第一配置，该第一配置用于更新该第一密钥；
处理单元1502，用于根据该第一配置将该第一密钥更新为第二密钥；
该收发单元1501，还用于根据该第二密钥接收来自该接入网设备的该多播数据包。
在一种可能的实现方式中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
在一种可能的实现方式中，该第一消息还包括与该第一密钥相关联的第一配置信息集合，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、部分带宽BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
在一种可能的实现方式中，该收发单元1501还用于：
接收来自接入网设备的第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
在一种可能的实现方式中，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
在一种可能的实现方式中，
该收发单元1501，还用于向该接入网设备发送第一请求消息，该第一请求消息用于请求该第一密钥的更新信息。
在一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
在一种可能的实现方式中，该第一配置承载于来自该接入网设备的第一下行控制信息，该第一下行控制信息通过组无线网络临时标识RNTI加扰，或者该第一下行控制信息通过预设无线网络临时标识RNTI加扰。
在一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
在一种可能的实现方式中，该处理单元1502还用于：
在确定需要多播配置时，发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息。
在一种可能的实现方式中，该处理单元1502具体用于：
根据来自接入网设备的寻呼消息确定需要获取多播配置，该寻呼消息用于指示该第一 密钥存在更新；或
确定无可用的多播配置，或
确定对多播业务感兴趣且无对应的多播配置；或
确定该第一定时器超时。
在一种可能的实现方式中，
该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
需要说明的是，上述通信装置1500的单元的信息执行过程等内容，具体可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
请参阅图16，本申请实施例提供了另一种通信装置1600，具体该通信装置1600可以为密钥的传输装置，该通信装置1600包括：收发单元1601和处理单元1602；
该处理单元1602用于通过该收发单元1601向终端设备发送第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包；
该处理单元1602还用于通过该收发单元1601以单播方式向该终端设备发送第一配置，该第一配置用于更新该第一密钥。
在一种可能的实现方式中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
在一种可能的实现方式中，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、带宽部分BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
在一种可能的实现方式中，该处理单元1602还用于通过该发送单元1601向该终端设备发送第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
在一种可能的实现方式中，该第一配置用于将该第一密钥更新为第二密钥，该第一配置还包括第二配置信息集合，该第二配置信息集合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
在一种可能的实现方式中，该处理单元1602还用于根据如下之一条件，确定需要更新该第一密钥，包括：
确定该第一定时器超时；
或者，
根据来自该终端设备的第一请求消息确定需要更新该第一密钥，该第一请求消息用于请求该第一密钥的更新信息；
或者，
根据来自核心网设备的该第一配置确定需要更新该第一密钥。
在一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
在一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
在一种可能的实现方式中，
该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
在一种可能的实现方式中，该处理单元1602还用于通过该发送单元1601向该终端设备发送该寻呼消息，该寻呼消息包括第二指示，该第二指示用于指示该第一密钥存在更新；
该处理单元1602，还用于与该终端设备建立RRC连接。
需要说明的是，上述通信装置1600的单元的信息执行过程等内容，具体可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
请参阅图17，本申请实施例提供了另一种通信装置1700，具体该通信装置1700可以为密钥的传输装置，该通信装置1700包括：收发单元1701和处理单元1702；
该收发单元1701，用于接收来自接入网设备的第一消息，该第一消息包括第一密钥以及与该第一密钥相关联的第一配置信息集合，该第一密钥用于加密多播数据包，该第一配置信息集合用于接收该多播数据包；
该收发单元1701，还用于以单播方式接收来自该接入网设备的第一配置，该第一配置用于更新该第一密钥；
该处理单元1702，用于根据该第一配置更新将该第一密钥更新为第二密钥；
该收发单元1701，还用于根据该第二密钥接收来自该接入网设备的该多播数据包。
在一种可能的实现方式中，该第一消息还包括第一定时器，和/或第一时刻信息，其中，该第一定时器用于指示该第一密钥的有效持续时间，该第一时刻信息用于指示该第一密钥的生效起始时刻。
在一种可能的实现方式中，该第一配置信息集合包括至少一个多播配置信息，该多播配置信息包括以下至少一种：
多播业务标识、组无线网络临时标识G-RNTI、部分带宽BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
在一种可能的实现方式中，该收发单元1701还用于：
接收来自接入网设备的第一指示，该第一指示用于指示该终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用该第一配置信息集合和该第一密钥接收该多播数据包。
在一种可能的实现方式中，该第一配置还包括第二配置信息集合，该第二配置信息集 合与该第二密钥相关联，该第二配置信息集合是该第一配置信息集合的子集。
在一种可能的实现方式中，该收发单元1701还用于向该接入网设备发送第一请求消息，该第一请求消息用于请求该第一密钥的更新信息。
在一种可能的实现方式中，
该第一配置是通过该第一密钥加密的；或
该第一配置是通过第三密钥加密的，该第三密钥是通过该第一消息配置的；或
该第一配置是通过与该终端设备相关联的第四密钥加密的。
在一种可能的实现方式中，该第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
在一种可能的实现方式中，该处理单元1702还用于在确定需要多播配置时，发起RRC连接建立过程或RRC连接恢复过程接收来自该接入网设备的该第一消息。
在一种可能的实现方式中，该处理单元1702还用于：
根据来自接入网设备的寻呼消息确定需要获取多播配置，该寻呼消息用于指示该第一密钥存在更新；或
确定无可用的多播配置，或
确定对多播业务感兴趣且无对应的多播配置；或
确定该第一定时器超时。
在一种可能的实现方式中，
该第一消息是以单播方式发送的；或
该第一消息是通过与该终端设备相关联的第四密钥加密且以广播方式发送的。
需要说明的是，上述通信装置1700的单元的信息执行过程等内容，具体可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
请参阅图18，为本申请的实施例提供的上述实施例中所涉及的通信装置的结构示意图，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，该通信装置的结构可以参考图18所示的结构。
通信装置包括至少一个处理器1811、至少一个存储器1812、至少一个收发器1813、至少一个网络接口1814和一个或多个天线1815。处理器1811、存储器1812、收发器1813和网络接口1814相连，例如通过总线相连，在本申请实施例中，所述连接可包括各类接口、传输线或总线等，本实施例对此不做限定。天线1815与收发器1813相连。网络接口1814用于使得通信装置通过通信链路，与其它通信设备相连，例如网络接口1814可以包括通信装置与核心网设备之间的网络接口，例如S1接口，网络接口可以包括通信装置和其他网络设备(例如其他接入网设备或者核心网设备)之间的网络接口，例如X2或者Xn接口。
处理器1811主要用于对通信协议以及通信数据进行处理，以及对整个通信装置进行控制，执行软件程序，处理软件程序的数据，例如用于支持通信装置执行实施例中所描述的动作。通信装置可以可以包括基带处理器和中央处理器，基带处理器主要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端设备进行控制，执行软件程序，处理软件程序的数据。图18中的处理器1811可以集成基带处理器和中央处理器的功能， 本领域技术人员可以理解，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。本领域技术人员可以理解，终端设备可以包括多个基带处理器以适应不同的网络制式，终端设备可以包括多个中央处理器以增强其处理能力，终端设备的各个部件可以通过各种总线连接。所述基带处理器也可以表述为基带处理电路或者基带处理芯片。所述中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储器中，由处理器执行软件程序以实现基带处理功能。
存储器主要用于存储软件程序和数据。存储器1812可以是独立存在，与处理器1811相连。可选的，存储器1812可以和处理器1811集成在一起，例如集成在一个芯片之内。其中，存储器1812能够存储执行本申请实施例的技术方案的程序代码，并由处理器1811来控制执行，被执行的各类计算机程序代码也可被视为是处理器1811的驱动程序。
图18仅示出了一个存储器和一个处理器。在实际的终端设备中，可以存在多个处理器和多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以为与处理器处于同一芯片上的存储元件，即片内存储元件，或者为独立的存储元件，本申请实施例对此不做限定。
收发器1813可以用于支持通信装置与终端之间射频信号的接收或者发送，收发器1813可以与天线1815相连。收发器1813包括发射机Tx和接收机Rx。具体地，一个或多个天线1815可以接收射频信号，该收发器1813的接收机Rx用于从天线接收所述射频信号，并将射频信号转换为数字基带信号或数字中频信号，并将该数字基带信号或数字中频信号提供给所述处理器1811，以便处理器1811对该数字基带信号或数字中频信号做进一步的处理，例如解调处理和译码处理。此外，收发器1813中的发射机Tx还用于从处理器1811接收经过调制的数字基带信号或数字中频信号，并将该经过调制的数字基带信号或数字中频信号转换为射频信号，并通过一个或多个天线1815发送所述射频信号。具体地，接收机Rx可以选择性地对射频信号进行一级或多级下混频处理和模数转换处理以得到数字基带信号或数字中频信号，所述下混频处理和模数转换处理的先后顺序是可调整的。发射机Tx可以选择性地对经过调制的数字基带信号或数字中频信号时进行一级或多级上混频处理和数模转换处理以得到射频信号，所述上混频处理和数模转换处理的先后顺序是可调整的。数字基带信号和数字中频信号可以统称为数字信号。
收发器也可以称为收发单元、收发机、收发装置等。可选的，可以将收发单元中用于实现接收功能的器件视为接收单元，将收发单元中用于实现发送功能的器件视为发送单元，即收发单元包括接收单元和发送单元，接收单元也可以称为接收机、输入口、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
需要说明的是，图18所示通信装置具体可以用于实现图5至图13对应方法实施例中接入网设备所实现的步骤，并实现接入网设备对应的技术效果，图18所示通信装置的具体实现方式，均可以参考图5至图13对应的各个方法实施例中的叙述，此处不再一一赘述。
请参阅图19，为本申请的实施例提供的上述实施例中所涉及的通信装置1900的一种可能的逻辑结构示意图，该通信装置具体可以为前述实施例中的密钥的传输装置，该通信 装置1900可以包括但不限于处理器1901、通信端口1902、存储器1903、总线1904，在本申请的实施例中，处理器1901用于对通信装置1900的动作进行控制处理。
此外，处理器1901可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。该处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
需要说明的是，图19所示通信装置具体可以用于实现图5至图13对应方法实施例中终端设备所实现的步骤，并实现终端设备对应的技术效果，图19所示通信装置的具体实现方式，均可以参考图5至图13对应的各个方法实施例中的叙述，此处不再一一赘述。
本申请实施例还提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，该处理器执行如前述实施例中通信装置可能的实现方式所述的方法，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中接入网设备。
本申请实施例还提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当计算机执行指令被处理器执行时，该处理器执行如前述实施例中通信装置可能的实现方式所述的方法，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中终端设备。
本申请实施例还提供一种存储一个或多个计算机的计算机程序产品(或称计算机程序)，当计算机程序产品被该处理器执行时，该处理器执行上述通信装置可能实现方式的方法，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中接入网设备。
本申请实施例还提供一种存储一个或多个计算机的计算机程序产品，当计算机程序产品被该处理器执行时，该处理器执行上述通信装置可能实现方式的方法，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中终端设备。
本申请实施例还提供了一种芯片系统，该芯片系统包括处理器，用于支持通信装置实现上述通信装置可能的实现方式中所涉及的功能。在一种可能的设计中，该芯片系统还可以包括存储器，存储器，用于保存该通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中接入网设备。
本申请实施例还提供了一种芯片系统，该芯片系统包括处理器，用于支持通信装置实现上述通信装置可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存该通信装置必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件，其中，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中的终端设备。
本申请实施例还提供了一种网络系统架构，该网络系统架构包括上述通信装置，该通信装置具体可以为前述实施例中的密钥的传输装置，即图5至图13对应方法实施例中的终端设备和接入网设备。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (27)

  1. 一种密钥的传输方法，其特征在于，所述方法应用于接入网设备，包括：
    向终端设备发送第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；
    以多播方式向所述终端设备发送第一配置，所述第一配置用于更新所述第一密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息还包括第一定时器，和/或第一时刻信息，其中，所述第一定时器用于指示所述第一密钥的有效持续时间，所述第一时刻信息用于指示所述第一密钥的生效起始时刻。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一消息还包括与所述第一密钥相关联的第一配置信息集合，所述第一配置信息集合包括至少一个多播配置信息，所述多播配置信息包括以下至少一种：
    多播业务标识、组无线网络临时标识G-RNTI、带宽部分BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    向所述终端设备发送第一指示，所述第一指示用于指示所述终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用所述第一配置信息集合和所述第一密钥接收所述多播数据包。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一配置用于将所述第一密钥更新为第二密钥，所述第一配置还包括第二配置信息集合，所述第二配置信息集合与所述第二密钥相关联，所述第二配置信息集合是所述第一配置信息集合的子集。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，在所述以多播方式向所述终端设备发送第一配置之前，包括：
    根据如下之一条件，确定需要更新所述第一密钥，包括：
    确定所述第一定时器超时；
    或者，
    根据来自所述终端设备的第一请求消息确定需要更新所述第一密钥，所述第一请求消息用于请求所述第一密钥的更新信息；
    或者，
    根据来自核心网设备的所述第一配置确定需要更新所述第一密钥。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，
    所述第一配置是通过所述第一密钥加密的；或
    所述第一配置是通过第三密钥加密的，所述第三密钥是通过所述第一消息配置的；或
    所述第一配置是通过与所述终端设备相关联的第四密钥加密的。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述第一配置承载于第一下行控制信息，所述第一下行控制信息通过组无线网络临时标识G-RNTI加扰，或者通过预设无线网络临时标识RNTI加扰。
  9. 根据权利要求1至8任一项所述的方法，其特征在于，所述第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，
    所述第一消息是以单播方式发送的；或
    所述第一消息是通过与所述终端设备相关联的第四密钥加密且以广播方式发送的。
  11. 根据权利要求1至10任一项所述的方法，其特征在于，在以多播方式向所述终端设备发送第一配置之前，所述方法还包括：
    向所述终端设备发送所述寻呼消息，所述寻呼消息包括第二指示，所述第二指示用于指示所述第一密钥存在更新；
    与所述终端设备建立RRC连接。
  12. 一种密钥的传输方法，其特征在于，所述方法应用于终端设备，包括：
    接收来自接入网设备的第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；
    以多播方式接收来自所述接入网设备的第一配置，所述第一配置用于更新所述第一密钥；
    根据所述第一配置将所述第一密钥更新为第二密钥；
    根据所述第二密钥接收来自所述接入网设备的所述多播数据包。
  13. 根据权利要求12所述的方法，其特征在于，所述第一消息还包括第一定时器，和/或第一时刻信息，其中，所述第一定时器用于指示所述第一密钥的有效持续时间，所述第一时刻信息用于指示所述第一密钥的生效起始时刻。
  14. 根据权利要求12或13所述的方法，其特征在于，所述第一消息还包括与所述第一密钥相关联的第一配置信息集合，所述第一配置信息集合包括至少一个多播配置信息，所述多播配置信息包括以下至少一种：
    多播业务标识、组无线网络临时标识G-RNTI、部分带宽BWP指示信息、物理下行共享信道PDSCH加扰序列、非连续接收DRX参数、解调参考信号、速率匹配参考信号、搜索空间指示、控制资源集合指示。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    接收来自接入网设备的第一指示，所述第一指示用于指示所述终端设备进入无线资源控制RRC空闲态或者RRC非激活态，且继续使用所述第一配置信息集合和所述第一密钥接收所述多播数据包。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第一配置还包括第二配置信息集合，所述第二配置信息集合与所述第二密钥相关联，所述第二配置信息集合是所述第一配置信息集合的子集。
  17. 根据权利要求12至16任一项所述的方法，其特征在于，以多播方式接收来自所述接入网设备的第一配置之前，所述方法还包括：
    向所述接入网设备发送第一请求消息，所述第一请求消息用于请求所述第一密钥的更新信息。
  18. 根据权利要求12至17任一项所述的方法，其特征在于，
    所述第一配置是通过所述第一密钥加密的；或
    所述第一配置是通过第三密钥加密的，所述第三密钥是通过所述第一消息配置的；或
    所述第一配置是通过与所述终端设备相关联的第四密钥加密的。
  19. 根据权利要求12至18任一项所述的方法，其特征在于，所述第一配置承载于来自所述接入网设备的第一下行控制信息，所述第一下行控制信息通过组无线网络临时标识RNTI加扰，或者所述第一下行控制信息通过预设无线网络临时标识RNTI加扰。
  20. 根据权利要求12至19任一项所述的方法，其特征在于，所述第一消息为RRC消息、媒体接入控制的控制单元MAC CE消息或物理下行控制信道PDCCH消息。
  21. 根据权利要求12至20任一项所述的方法，其特征在于，所述方法还包括：
    在确定需要多播配置时，发起RRC连接建立过程或RRC连接恢复过程以进入RRC连接态，
    当处于RRC连接态时，接收来自所述接入网设备的所述多播配置；
    所述确定需要多播配置包括：
    确定无可用的多播配置；或
    确定对多播业务感兴趣且无对应的多播配置。
  22. 根据权利要求12至21任一项所述的方法，其特征在于，所述方法还包括：
    在确定需要所述第一密钥的更新信息时，发起RRC连接建立过程或RRC连接恢复过程以进入RRC连接态，
    当处于RRC连接态时，接收来自所述接入网设备的所述第一配置；
    所述确定需要所述第一密钥的更新信息包括：
    根据来自接入网设备的寻呼消息确定需要获取多播配置，所述寻呼消息用于指示所述第一密钥存在更新；或
    确定所述第一定时器超时。
  23. 根据权利要求12至22任一项所述的方法，其特征在于，
    所述第一消息是以单播方式发送的；或
    所述第一消息是通过与所述终端设备相关联的第四密钥加密且以广播方式发送的。
  24. 一种密钥的传输装置，其特征在于，包括：处理单元和收发单元；
    所述处理单元用于通过所述收发单元向终端设备发送第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；
    所述处理单元还用于通过所述收发单元以多播方式向所述终端设备发送第一配置，所述第一配置用于更新所述第一密钥。
  25. 一种密钥的传输装置，其特征在于，包括：处理单元和收发单元；
    所述收发单元，用于接收来自接入网设备的第一消息，所述第一消息包括第一密钥，所述第一密钥用于加密多播数据包；
    所述收发单元，还用于以多播方式接收来自所述接入网设备的第一配置，所述第一配置用于更新所述第一密钥；
    所述处理单元，用于根据所述第一配置将所述第一密钥更新为第二密钥；
    所述收发单元，还用于根据所述第二密钥接收来自所述接入网设备的所述多播数据包。
  26. 一种计算机可读存储介质，其特征在于，存储有用于实现权利要求1至11任一项所述的方法的程序或者指令，或者，存储有用于实现权利要求12至23任一项的方法的程序或者指令。
  27. 一种密钥的传输装置，其特征在于，所述密钥的传输装置包括处理器和通信接口，所述通信接口和所述处理器耦合，所述处理器用于运行计算机程序或指令，使得权利要求1至11任一项所述的方法被执行，或者，使得权利要求12至23任一项所述的方法被执行。
PCT/CN2020/086416 2020-04-23 2020-04-23 一种密钥的传输方法及装置 WO2021212413A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/086416 WO2021212413A1 (zh) 2020-04-23 2020-04-23 一种密钥的传输方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/086416 WO2021212413A1 (zh) 2020-04-23 2020-04-23 一种密钥的传输方法及装置

Publications (1)

Publication Number Publication Date
WO2021212413A1 true WO2021212413A1 (zh) 2021-10-28

Family

ID=78270958

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/086416 WO2021212413A1 (zh) 2020-04-23 2020-04-23 一种密钥的传输方法及装置

Country Status (1)

Country Link
WO (1) WO2021212413A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024031458A1 (zh) * 2022-08-10 2024-02-15 北京小米移动软件有限公司 资源配置方法、装置、存储介质以及终端

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1553600A (zh) * 2003-05-29 2004-12-08 华为技术有限公司 一种共享密钥更新的方法
CN101400057A (zh) * 2007-09-30 2009-04-01 华为技术有限公司 密钥更新方法、基站和移动台
CN103621124A (zh) * 2011-07-11 2014-03-05 Lg电子株式会社 用于机器对机器多播组的业务加密密钥管理
US20140149745A1 (en) * 2011-07-04 2014-05-29 Snu R&Db Foundation Method and apparatus for managing group key for mobile device

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1553600A (zh) * 2003-05-29 2004-12-08 华为技术有限公司 一种共享密钥更新的方法
CN101400057A (zh) * 2007-09-30 2009-04-01 华为技术有限公司 密钥更新方法、基站和移动台
US20140149745A1 (en) * 2011-07-04 2014-05-29 Snu R&Db Foundation Method and apparatus for managing group key for mobile device
CN103621124A (zh) * 2011-07-11 2014-03-05 Lg电子株式会社 用于机器对机器多播组的业务加密密钥管理

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024031458A1 (zh) * 2022-08-10 2024-02-15 北京小米移动软件有限公司 资源配置方法、装置、存储介质以及终端

Similar Documents

Publication Publication Date Title
US10827342B2 (en) Operator-assisted device-to-device (D2D) discovery
US8811258B2 (en) Enhanced local communications in mobile broadband networks
KR101549804B1 (ko) 무선 통신 시스템에서 멀티미디어 브로드캐스트 멀티캐스트 서비스를 위한 멀티-셀 코디네이션
EP3047696B1 (en) Device-to-device communication among wireless communication devices using group id and application id
WO2011018037A1 (zh) 一种配置mbms控制信息的方法、设备和系统
JP2012531769A (ja) ピアツーピア通信のためのページングメッセージを送信する装置及び方法
WO2013131438A1 (zh) 一种集群传输通知、处理方法及装置
US20220360951A1 (en) Communication method and apparatus
TW202224454A (zh) 用於mbs的無線通信的裝置和方法
WO2021212413A1 (zh) 一种密钥的传输方法及装置
WO2020253849A1 (zh) 一种通信方法及设备
WO2022006849A1 (zh) Mbs业务的tci状态管理方法及装置、终端设备
TWI446768B (zh) 傳輸及處理ＣｏｕｎｔｉｎｇＲｅｓｐｏｎｓｅ訊息之方法
WO2022099539A1 (zh) 一种通信方法及装置
WO2021138801A1 (zh) 一种业务安全传输方法及装置、终端设备、网络设备
WO2021051322A1 (zh) 一种bwp配置方法及装置、终端设备、网络设备
WO2022006882A1 (zh) Mbs业务的传输方法及装置、网络设备、终端设备
WO2024037210A1 (zh) 广播安全通信的方法和装置
WO2023202386A1 (zh) 一种通信方法及装置
WO2023115559A1 (zh) 无线通信的方法、终端设备和网络设备
WO2024099230A1 (zh) 广播安全通信的方法和装置
WO2023011137A1 (zh) 一种通信方法及装置
WO2022126658A1 (zh) 一种mbs配置变更的方法及装置、终端设备、网络设备
CN117135707A (zh) 用于实现用户设备间中继通信的本地id分配的方法和设备
JP2014042346A (ja) ピアツーピア通信のためのページングメッセージを送信する装置及び方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20932831

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20932831

Country of ref document: EP

Kind code of ref document: A1