WO2021238813A1 - 一种获取密钥的方法及装置 - Google Patents

一种获取密钥的方法及装置 Download PDF

Info

Publication number
WO2021238813A1
WO2021238813A1 PCT/CN2021/095315 CN2021095315W WO2021238813A1 WO 2021238813 A1 WO2021238813 A1 WO 2021238813A1 CN 2021095315 W CN2021095315 W CN 2021095315W WO 2021238813 A1 WO2021238813 A1 WO 2021238813A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
network device
access network
terminal device
cell
Prior art date
Application number
PCT/CN2021/095315
Other languages
English (en)
French (fr)
Inventor
许斌
李秉肇
陈磊
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21812373.5A priority Critical patent/EP4145760A4/en
Publication of WO2021238813A1 publication Critical patent/WO2021238813A1/zh
Priority to US17/994,050 priority patent/US20230092744A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/40—Security arrangements using identity modules
    • H04W12/47—Security arrangements using identity modules using near field communication [NFC] or radio frequency identification [RFID] modules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W28/00—Network traffic management; Network resource management
    • H04W28/02—Traffic management, e.g. flow control or congestion control
    • H04W28/06—Optimizing the usage of the radio link, e.g. header compression, information sizing, discarding information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0055—Transmission or use of information for re-establishing the radio link
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0055—Transmission or use of information for re-establishing the radio link
    • H04W36/0064—Transmission or use of information for re-establishing the radio link of control information between different access points
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W36/00—Hand-off or reselection arrangements
    • H04W36/0005—Control or signalling for completing the hand-off
    • H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
    • H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
    • H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/20—Manipulation of established connections
    • H04W76/22—Manipulation of transport tunnels

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for obtaining a key.
  • the transmission of wireless communication is divided into user plane transmission and control plane transmission.
  • User plane transmission mainly transmits data
  • control plane transmission mainly transmits signaling.
  • both the sender and receiver must perform security processing on data and signaling.
  • the sender encrypts the data, and the receiver decrypts the data accordingly to prevent the data from being Three-party reading; the sender protects the integrity of the data, and the receiver verifies the integrity of the data accordingly to prevent the data from being tampered with by a third party.
  • a separated base station architecture can be adopted, and the separated base station can include a centralized unit (CU) and a distributed unit (distributed unit, DU).
  • the security processing of the access layer includes the security processing of control plane signaling and the security processing of user plane data.
  • the security processing of the access layer is performed on the radio access network (RAN) side. There are two security processing procedures. The inability to isolate each other makes the entire security processing process risky.
  • the embodiments of the present application provide a method and device for obtaining a key, which are used to isolate the control plane processing process of the access network equipment from the user plane processing process, so as to reduce the risk of the security processing process.
  • a first method for obtaining a key includes: a first core network device obtains a first key; the first core network device derives according to the first key to obtain a second key A key and a third key, the second key is used to securely process the control plane signaling of the terminal device, and the third key is used to securely process the user plane data of the terminal device; The first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device, so The control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.
  • the method may be executed by a first communication device, and the first communication device may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip.
  • the first communication device is a network device, or a chip set in the network device for realizing the function of the network device, or other component used for realizing the function of the network device.
  • the first communication device is a network device.
  • the network device is a core network device.
  • control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane process of the first access network device can be compared with the user plane entity of the first access network device.
  • the surface treatment process is isolated to reduce the risk of the safe treatment process.
  • the second key used to securely process control plane signaling is sent to the control plane entity
  • the third key used to securely process user plane data is sent to the user plane entity.
  • control plane The entity and the user plane entity will not be able to obtain the other party's key, and thus cannot crack the other party's transmission content, achieving the effect of isolating the control plane processing process of the first access network device from the user plane processing process, reducing the security of the entire system risk.
  • control plane entity of the first access network device is located on the side of the first access network device, and the user plane entity of the first access network device is located on the side of the core network device.
  • the control plane entity of the first access network device may be located on the access network side, and the user plane entity of the first access network device may be located on the core network side.
  • the control signaling of the access layer is to assist the user plane data transmission.
  • the security processing of the user plane data is placed on the core network side to ensure the user plane data processing first.
  • the security processing process of the user plane and the control plane it can further ensure that the access network side cannot obtain the key for the secure processing of the user plane data, which can significantly reduce the security risk of the user plane data.
  • the first key is obtained according to a first root key corresponding to the terminal device, and the first root key is stored in a core network device.
  • the root key corresponding to each terminal device can be pre-stored, and then at least one core network device can perform a step-by-step deduction process based on the root key, so as to obtain the required use in different devices or different security processes Key.
  • the first core network device can obtain the root key corresponding to the terminal device, for example, it is called the first root key.
  • the first core network device may perform deduction based on the first root key, or the first core network device may perform further deduction based on the key derived from the first root key to obtain the key used by the first core network device , For example, called the fourth key.
  • the first core network device can derive based on the fourth key to obtain the first key, and can also derive other keys based on the fourth key, for example, to obtain security processing during non-access layer communication Key.
  • the method further includes:
  • the first core network device receives input parameters from a second access network device, where the input parameters are used to determine the first key, and the second access network device is the terminal device.
  • the terminal device switches from the cell of the second access network device to the cell of the first access network device for communication.
  • the first access network device The key used for security processing used by the network access device and the second access network device when communicating with the terminal device cannot be the same.
  • the key used by the first access network device when communicating with the terminal device can be deduced based on the key of the second access network device corresponding to the terminal device.
  • the core network device is required to perform the key derivation process. Therefore, the second access network device needs to derive the key used by the first access network device.
  • the input parameters of is sent to the first core network device, and the first core network device derives the key used by the first access network device. After the deduction, the key used by the first access network device is sent to the first access network equipment.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter may include the PCI of the first cell, or include the frequency of the first cell, or include the PCI of the first cell and the frequency of the first cell.
  • the input parameter may also include other information, as long as the input parameter can be used to determine the first key.
  • the frequency of the first cell is, for example, the ARFCN of the first cell.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request to handover the terminal device to a first cell, and the first cell is The target cell of the terminal device during cell handover.
  • the cell handover process is a cross-base station cell handover process based on the N2 interface between the base station and the core network device
  • the second access network device may send the cell handover process to the first core network when determining that the terminal device performs the cell handover.
  • the device sends a handover request message to forward the handover request message to the first access network device through the first core network device.
  • the handover request message sent by the second access network device to the first core network device may include the input parameters, which can be understood as the second access network device sending handover to the first core network device
  • the request message is called a first handover request message, for example, the first core network device receives the first handover request message from the second access network device, and the first handover request message includes input parameters. That is to say, the embodiment of this application does not need to add a new message, but can send input parameters to the first core network device through an existing handover request message, which is more conducive to compatibility with existing solutions and can save signaling overhead .
  • the second key is included in a second handover request message, and the second handover request message is used to request the terminal device to be handed over to the first cell.
  • the cell handover process is a cross-base station cell handover process based on the N2 interface between the base station and the core network device.
  • the first core network device receives the first handover request message from the second access network device.
  • the first core network device will forward the first handover request message to the first access network device.
  • the embodiment of the application can use this process.
  • the first core network device can generate the second handover request message, the second handover request message includes the second key, and the first core network device sends the second handover request message to the first handover request message.
  • the access network device sends the second key to the first access network device.
  • the first core network device can add the second key to the first handover request message to obtain the second handover request message.
  • the second key is also sent to the first access network device, so there is no need to send the second key to the first access network device through a new message, which helps to be compatible with the existing solution , And can reduce signaling overhead.
  • the method further includes:
  • the first core network device sends an NCC to the terminal device, where the NCC is used to determine the second key and/or the third key.
  • the terminal device can determine the key used according to the NCC to ensure that it is consistent with the key used on the network side.
  • NCC has a counting function, and different NCC values correspond to different key deduction processes or different key deduction times.
  • the NCC can be used to indicate the number of times the first core network device derives the first key, or the NCC can be used to instruct the first core network device to derive the trajectory of the first key according to the derivation of the first key, or to record the derivation process.
  • the terminal device has a built-in root key of the terminal device, which is called a second root key, for example, and the second root key and the first root key may be the same root key or different root keys.
  • the terminal device can use the same deduction method as the core network device according to the second key to obtain the key used by the terminal device.
  • it can determine the deduction method of the core network device according to the instruction of the NCC, so that the key used by the terminal device and the first access network device are consistent. For example, if the NCC indicates that the number of deductions is n, the terminal device deduces n times to obtain the first key, and n is a positive integer, the terminal device can further obtain the second key and the third key; for another example, NCC indicates the deduction track or deduction Process recording, the terminal device can perform deduction according to the same track or the same deduction process to obtain the first key, and further obtain the second key and the third key.
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • the security processing of the control plane entity or the user plane entity of the first access network device described in the embodiment of the present application may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption.
  • a second method for obtaining a key includes: a second access network device determines to switch a terminal device from the second access network device to the first access network device; the second access network device The network device sends input parameters to the first core network device, where the input parameters are used to determine the first key, the first key is used to determine the second key and the third key, and the second key is used To perform security processing on the control plane signaling of the terminal device, the third key is used to perform security processing on the user plane data of the terminal device.
  • the method may be executed by a second communication device, and the second communication device may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip.
  • the second communication device is a network device, or a chip set in the network device for realizing the function of the network device, or other component used for realizing the function of the network device.
  • the network device is an access network device, for example, referred to as a second access network device. In the following introduction process, it is taken as an example that the second communication device is a second access network device.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request to handover the terminal device to a first cell, and the first cell is The target cell of the terminal device during cell handover.
  • a method for sending a data packet includes: obtaining a first data packet; using a first key at a first protocol layer to perform security processing on the first data packet to obtain a second data packet;
  • the PDCP layer uses the second key to encrypt the second data packet to obtain a third data packet; and sends the third data packet.
  • the method may be executed by a third communication device, and the third communication device may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip.
  • the third communication device is a terminal device, or a chip set in the terminal device for realizing the function of the terminal device, or other component used for realizing the function of the terminal device.
  • the third communication device is a network device, or a chip set in the network device for realizing the function of the network device, or other component used for realizing the function of the network device, such as the The network equipment is the core network equipment.
  • a two-level security processing mechanism is set up for data packets.
  • security processing at the PDCP layer only one level of security processing (ie, security processing at the PDCP layer) can be performed, and the first level cannot be performed.
  • Security processing at the protocol layer Therefore, the data is invisible to the access network equipment, and the access network equipment cannot obtain the data, thereby ensuring the security of the data on the access network equipment side.
  • the first key is obtained according to the first root key corresponding to the terminal device.
  • the first device Before the first device uses the first key to perform security processing on the first data packet at the first protocol layer, it first needs to obtain the first key. If the first device is a terminal device, for the terminal device, a root key can be built in, and the terminal device can derive the root key according to the first rule to obtain the first key. Or, if the first device is a core network device, for the core network device, there is also a key corresponding to the terminal device, such as a third key. For example, the core network device is an AMF, and the core network device corresponds to the terminal device. The key (that is, the third key) of the terminal device is K AMF .
  • the key of the core network device corresponding to the terminal device refers to the key used by the core network device when communicating with the terminal device, or refers to the key that can be used to determine whether the core network device is communicating with the terminal device.
  • the key used in communication can be understood as that the core network device can use the corresponding terminal device when communicating with different terminal devices, which is used to secure the access layer control plane signaling and user plane data.
  • the processed key is processed securely.
  • the core network device may derive the third key according to the first rule to obtain the first key.
  • the first rule may be configured by the core network device, or determined through negotiation between the terminal device and the core network device, or specified through an agreement.
  • the terminal device can interact with the core network device to ensure that the first rule used by both parties is consistent.
  • using the first key at the first protocol layer to securely process the first data packet to obtain the second data packet includes:
  • the PDCP layer of the sender of the data packet can compress the header of the data packet, for example, use the header compression protocol to compress the IP header or the Ethernet header ,
  • the length of the compressed header is shortened, which can save transmission resource overhead.
  • the embodiment of this application introduces the first protocol layer, which may cause a problem: the entire data packet is processed securely at the first protocol layer. After the first protocol layer submits the securely processed data packet to the PDCP layer, the PDCP layer cannot The header of the data packet is recognized, so that the header cannot be compressed. To this end, the embodiments of the present application provide a solution.
  • the first device removes the header of the first data packet at the first protocol layer, or understood as separating the header and the load of the first data packet. After that, the first device uses the first key at the first protocol layer to perform security processing, such as encryption and/or integrity protection, on the load of the first data packet to obtain a securely encrypted load. The first device combines the header of the first data packet with the security-processed load at the first protocol layer, and calls the combined data packet the second data packet. Then, the header of the second data packet is the header of the first data packet, and the load of the second data packet is the load that has been safely processed. After that, the first protocol layer can deliver the second data packet to the PDCP layer of the first device.
  • security processing such as encryption and/or integrity protection
  • the PDCP layer of the first device can compress the header of the second data packet. Therefore, the PDCP layer can compress the packet header normally to save transmission overhead.
  • encrypting the second data packet using the second key at the PDCP layer to obtain the third data packet includes:
  • the first device can remove the header of the second data packet (that is, the header of the first data packet) at the PDCP layer, Or it can be understood as separating the header and the load of the first data packet. After that, the first device compresses the header of the first data packet at the PDCP layer to obtain the compressed header, and then combines the compressed header with the security-processed load to obtain a whole, and the second key is used on the PDCP layer to perform the whole The second security process, the third data packet is obtained. In this way, the PDCP layer can continue to compress the header of the data packet, thereby saving transmission resource overhead.
  • using the first key at the first protocol layer to perform security processing on the first data packet to obtain the second data packet includes:
  • the first device removes the header of the first data packet at the first protocol layer, or understood as separating the header and the load of the first data packet. After that, the first device compresses the header of the first data packet at the first protocol layer to obtain the compressed header. The first device combines the compressed header with the load of the first data packet at the first protocol layer to obtain a whole, and performs security processing on the whole, such as encryption and/or integrity protection, to obtain the second data packet, that is, the first data packet.
  • the second data packet is a data packet that has undergone security processing.
  • the first protocol layer then submits the second data packet to the PDCP layer of the first device.
  • the PDCP layer cannot decrypt or verify the integrity of the second data packet, so the PDCP layer No more compression operation is required.
  • the first device has compressed the header of the first data packet at the first protocol layer, so the transmission resource overhead can also be saved.
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • the security processing here may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption.
  • integrity protection integrity verification
  • encryption integrity protection and encryption
  • decryption if the first device is the sender of the first data packet, the first device may perform integrity protection, or encryption, or integrity protection and encryption on the first data packet at the first protocol layer.
  • the first device if the first device is the receiving end of the first data packet, the first device may perform integrity verification, or decryption, or integrity verification and decryption on the first data packet at the first protocol layer.
  • the first device is the sender of the first data packet as an example.
  • a method for receiving a data packet includes: receiving a third data packet; decrypting the third data packet using a second key at a PDCP layer to obtain a second data packet, the second data packet Is a data packet that has undergone security processing; the second data packet is sent to the core network device.
  • the method may be executed by a fourth communication device, and the fourth communication device may be a communication device or a communication device capable of supporting the communication device to implement the functions required by the method, such as a chip.
  • the fourth communication device is a second device.
  • the second device is a network device, or a chip set in the network device for realizing the function of the network device, or other component used for realizing the function of the network device, for example, the network device is Access network equipment.
  • the method may be sending the second data packet to the core network device; or, if the sending end of the second data packet is the core network device; Network equipment, the receiving end is a terminal equipment, then the method may be to send the second data packet to the terminal equipment.
  • a two-level security processing mechanism is set for data packets. For intermediate devices (such as access network devices), only one level of security processing (ie, security processing at the PDCP layer) can be performed. The security processing of the first protocol layer cannot be performed. Therefore, the data is invisible to the access network equipment, and the access network equipment cannot obtain the data, thereby ensuring the security of the data on the access network equipment side.
  • using the second key at the PDCP layer to decrypt the third data packet to obtain the second data packet includes:
  • the second device After receiving the third data packet, the second device sends the third data packet to the PDCP layer of the second device. Then, the second device can use the second key to perform third security processing on the third data packet at the PDCP layer, and the third security processing is, for example, decryption. If the second device performs the third security processing on the third data packet at the PDCP layer and obtains the compressed header and the load after the security processing, the second device can transfer the header of the second data packet (that is, the first data packet) at the PDCP layer. The header of the packet) is removed, or understood as separating the header of the first data packet from the security-processed load.
  • the second device decompresses the compressed header at the PDCP layer to obtain the header, which is the header of the first data packet.
  • the second device combines the packet header and the security-processed load at the PDCP layer to obtain the second data packet.
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • the security processing here may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption.
  • integrity protection integrity verification
  • encryption integrity protection and encryption
  • decryption if the first device is the sender of the first data packet, the first device may perform integrity protection, or encryption, or integrity protection and encryption on the first data packet at the first protocol layer.
  • the first device if the first device is the receiving end of the first data packet, the first device may perform integrity verification, or decryption, or integrity verification and decryption on the first data packet at the first protocol layer.
  • the first device is the sender of the first data packet as an example.
  • a communication device is provided, for example, the communication device is the first communication device as described above.
  • the first communication device is configured to execute the method in the foregoing first aspect or any possible implementation manner.
  • the first communication device may include a module for executing the method in the first aspect or any possible implementation manner, such as a processing module, and optionally, a transceiver module.
  • the transceiver module may include a sending module and a receiving module.
  • the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions.
  • the first communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a network device.
  • the network device is a core network device, such as a first core network device.
  • the first communication device is the first core network device.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit).
  • the sending module may be realized by a transmitter, and the receiving module may be realized by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or transmitter and receiver) is, for example, a communication interface in the chip, and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the introduction is continued by taking the first communication device as the first core network device, and the processing module and the transceiver module as examples. in,
  • the processing module is used to obtain the first key
  • the processing module is configured to derive a second key and a third key according to the first key, and the second key is used to securely process the control plane signaling of the terminal device.
  • the third key is used to securely process the user plane data of the terminal device;
  • the transceiver module is configured to send the second key to the control plane entity of the first access network device, and send the third key to the user plane entity of the first access network device.
  • the control plane entity of the first access network device performs control plane signaling communication with the terminal device, and the user plane entity of the first access network device performs user plane data communication with the terminal device.
  • control plane entity of the first access network device is located on the side of the first access network device, and the user plane entity of the first access network device is located on the side of the core network device.
  • the first key is obtained according to a first root key corresponding to the terminal device, and the first root key is stored in a core network device.
  • the transceiver module is further configured to receive input parameters from a second access network device, and the input parameters are used to determine the first key, wherein the second The access network device is the source access network device when the terminal device performs cell handover, and the first access network device is the target access network device when the terminal device performs cell handover.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request to handover the terminal device to a first cell, and the first cell is The target cell of the terminal device during cell handover.
  • the second key is included in a second handover request message, and the second handover request message is used to request the terminal device to be handed over to the first cell.
  • the transceiver module is further configured to send an NCC to the terminal device, and the NCC is used to determine the second key and/or the third key.
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • a communication device is provided, for example, the communication device is the second communication device as described above.
  • the second communication device is used to execute the method in the above-mentioned second aspect or any possible implementation manner.
  • the second communication device may include a module for executing the method in the second aspect or any possible implementation manner, such as a processing module, and optionally, a transceiver module.
  • the transceiver module may include a sending module and a receiving module.
  • the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions.
  • the second communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a network device.
  • the network device is an access network device, such as a second access network device.
  • the access network device is a base station.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit).
  • the sending module may be realized by a transmitter, and the receiving module may be realized by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or, transmitter and receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the second communication device is continued to be a second access network device, and the processing module and the transceiver module are used as examples for the introduction. in,
  • the processing module is configured to determine to switch the terminal device from the second access network device to the first access network device;
  • the transceiver module is configured to send input parameters to a first core network device, the input parameters are used to determine a first key, and the first key is used to determine a second key and a third key.
  • the second key is used to perform security processing on the control plane signaling of the terminal device, and the third key is used to perform security processing on the user plane data of the terminal device.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request to handover the terminal device to a first cell, and the first cell is The target cell of the terminal device during cell handover.
  • a communication device is provided, for example, the communication device is the aforementioned third communication device.
  • the third communication device is used to execute the method in the third aspect or any possible implementation manner.
  • the third communication device may include a module for executing the method in the third aspect or any possible implementation manner, such as a processing module, and optionally, a transceiver module.
  • the transceiver module may include a sending module and a receiving module. The sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions.
  • the third communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a first device.
  • the first device is a terminal device.
  • the first device is a core network device.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit).
  • the sending module may be realized by a transmitter
  • the receiving module may be realized by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the third communication device is a communication device
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the transceiver (or, the transmitter and the receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the processing module and the transceiver module are taken as examples for introduction. in,
  • the processing module is used to obtain the first data packet
  • the processing module is further configured to perform security processing on the first data packet using a first key at the first protocol layer to obtain a second data packet;
  • the processing module is further configured to encrypt the second data packet using a second key at the PDCP layer to obtain a third data packet;
  • the transceiver module is used to send the third data packet.
  • the first key is obtained according to the first root key corresponding to the terminal device.
  • the processing module is configured to perform security processing on the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:
  • the processing module is configured to encrypt the second data packet using a second key at the PDCP layer in the following manner to obtain a third data packet:
  • the processing module is configured to perform security processing on the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • a communication device is provided, for example, the communication device is the fourth communication device as described above.
  • the fourth communication device is used to execute the method in the foregoing fourth aspect or any possible implementation manner.
  • the fourth communication device may include a module for executing the method in the fourth aspect or any possible implementation manner, such as a processing module, and optionally, a transceiver module.
  • the transceiver module may include a sending module and a receiving module.
  • the sending module and the receiving module may be different functional modules, or may also be the same functional module, but can implement different functions.
  • the fourth communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a network device.
  • the network device is an access network device.
  • the access network device is a base station.
  • the fourth communication device is an access network device.
  • the transceiver module may also be implemented by a transceiver, and the processing module may also be implemented by a processor (or a processing circuit).
  • the sending module may be realized by a transmitter, and the receiving module may be realized by a receiver.
  • the transmitter and the receiver may be different functional modules, or may be the same functional module, but can implement different functions.
  • the fourth communication device is a communication device
  • the transceiver is realized by, for example, an antenna, a feeder, and a codec in the communication device.
  • the fourth communication device is a chip set in a communication device
  • the transceiver (or, transmitter and receiver) is, for example, a communication interface in the chip, and the communication interface is connected to the radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • the fourth communication device is continued to be an access network device, and the processing module and the transceiver module are used as examples for the introduction. in,
  • the transceiver module is configured to receive a third data packet
  • the processing module is configured to decrypt the third data packet using a second key at the PDCP layer to obtain a second data packet, and the second data packet is a data packet that has undergone security processing;
  • the transceiver module is also used to send the second data packet to the core network device.
  • the processing module is configured to use a second key at the PDCP layer to decrypt the third data packet to obtain the second data packet in the following manner:
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • a communication device (or, referred to as a network device) is provided.
  • the communication device is, for example, the first communication device as described above.
  • the communication device includes a processor (or processing circuit) and a communication interface (or interface circuit), and the communication interface can be used to communicate with other devices or equipment.
  • it may also include a memory for storing computer instructions.
  • the processor and the memory are coupled with each other, and are used to implement the methods described in the first aspect or various possible implementation manners.
  • the first communication device may not include a memory, and the memory may be located outside the first communication device.
  • the processor, the memory, and the communication interface are coupled with each other, and are used to implement the methods described in the first aspect or various possible implementation manners.
  • the first communication device when the processor executes the computer instructions stored in the memory, the first communication device is caused to execute the method in the foregoing first aspect or any one of the possible implementation manners.
  • the first communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a network device.
  • the network device is a core network device, such as a first core network device.
  • the communication interface is implemented, for example, by a transceiver (or, a transmitter and a receiver) in the communication device, for example, the transceiver is implemented by an antenna, a feeder and a receiver in the communication device. Codec and other implementations.
  • the communication interface is, for example, an input/output interface of the chip, such as an input/output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • a communication device (or, referred to as a network device) is provided.
  • the communication device is, for example, the second communication device as described above.
  • the communication device includes a processor (or processing circuit) and a communication interface (or interface circuit), and the communication interface can be used to communicate with other devices or equipment.
  • it may also include a memory for storing computer instructions.
  • the processor and the memory are coupled with each other, and are used to implement the methods described in the second aspect or various possible implementation manners.
  • the second communication device may not include a memory, and the memory may be located outside the second communication device.
  • the processor, the memory, and the communication interface are coupled with each other to implement the methods described in the second aspect or various possible implementation manners.
  • the second communication device when the processor executes the computer instructions stored in the memory, the second communication device is caused to execute the method in the second aspect or any one of the possible implementation manners.
  • the second communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a network device.
  • the network device is an access network device, such as a second access network device.
  • the communication interface is realized by, for example, a transceiver (or a transmitter and a receiver) in the communication device, for example, the transceiver is realized by an antenna, a feeder and a receiver in the communication device. Codec and other implementations.
  • the communication interface is, for example, an input/output interface of the chip, such as an input/output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • a communication device (or, referred to as a network device) is provided.
  • the communication device is, for example, the aforementioned third communication device.
  • the communication device includes a processor (or processing circuit) and a communication interface (or interface circuit), and the communication interface can be used to communicate with other devices or equipment.
  • it may also include a memory for storing computer instructions.
  • the processor and the memory are coupled with each other, and are used to implement the methods described in the third aspect or various possible implementation manners.
  • the first communication device may not include a memory, and the memory may be located outside the third communication device.
  • the processor, the memory, and the communication interface are coupled with each other, and are used to implement the methods described in the third aspect or various possible implementation manners.
  • the first communication device when the processor executes the computer instructions stored in the memory, the first communication device is caused to execute the method in the foregoing third aspect or any one of the possible implementation manners.
  • the third communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a first device.
  • the first device is a terminal device.
  • the first device is a network device.
  • the network device is a core network device.
  • the communication interface is realized by, for example, a transceiver (or a transmitter and a receiver) in the communication device.
  • the transceiver is realized by the antenna, feeder, and Codec and other implementations.
  • the third communication device is a chip set in a communication device, the communication interface is, for example, an input/output interface of the chip, such as an input/output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • a communication device (or, referred to as a network device) is provided.
  • the communication device is, for example, the fourth communication device as described above.
  • the communication device includes a processor (or processing circuit) and a communication interface (or interface circuit), and the communication interface can be used to communicate with other devices or equipment.
  • it may also include a memory for storing computer instructions.
  • the processor and the memory are coupled with each other, and are used to implement the methods described in the fourth aspect or various possible implementation manners.
  • the fourth communication device may not include a memory, and the memory may be located outside the fourth communication device.
  • the processor, the memory, and the communication interface are coupled with each other, and are used to implement the methods described in the fourth aspect or various possible implementation manners.
  • the fourth communication device is caused to execute the method in the foregoing fourth aspect or any one of the possible implementation manners.
  • the fourth communication device is a communication device, or a chip or other component provided in the communication device.
  • the communication device is a second device.
  • the second device is a network device.
  • the network device is an access network device.
  • the communication interface is implemented by, for example, the transceiver (or transmitter and receiver) in the communication device, for example, the transceiver is implemented by the antenna, feeder, and Codec and other implementations.
  • the fourth communication device is a chip set in a communication device
  • the communication interface is, for example, an input/output interface of the chip, such as an input/output pin, etc., and the communication interface is connected to a radio frequency transceiver component in the communication device to Information is sent and received through radio frequency transceiver components.
  • a first communication system includes the communication device described in the fifth aspect or the communication device described in the ninth aspect, and the communication device described in the sixth aspect or the communication device described in the tenth aspect ⁇ Communication device.
  • a fourteenth aspect provides a second communication system.
  • the second communication system includes the communication device according to the seventh aspect or the communication device according to the eleventh aspect, and the communication device according to the eighth aspect or the twelfth aspect The communication device.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes the first aspect or any one of the above. The method described in one possible implementation mode.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes the second aspect or any one of the above. The method described in one possible implementation mode.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes the third aspect or any one of the above. The method described in one possible implementation mode.
  • a computer-readable storage medium is provided, the computer-readable storage medium is used to store a computer program, and when the computer program runs on a computer, the computer executes the fourth aspect or any one of the above. The method described in one possible implementation mode.
  • a computer program product containing instructions is provided.
  • the computer program product is used to store a computer program.
  • the computer program runs on a computer, the computer executes the first aspect or any one of the above. The method described in one possible implementation mode.
  • a computer program product containing instructions is provided.
  • the computer program product is used to store a computer program.
  • the computer program runs on a computer, the computer executes the second aspect or any one of the above. The method described in one possible implementation mode.
  • a computer program product containing instructions is provided, the computer program product is used to store a computer program, and when the computer program runs on a computer, the computer executes the third aspect or any of the above The method described in one possible implementation.
  • a computer program product containing instructions is provided, the computer program product is used to store a computer program, and when the computer program runs on a computer, the computer executes the fourth aspect or any of the above The method described in one possible implementation.
  • a core network device or communication device configured to execute the method involved in the above-mentioned first aspect.
  • an access network device or communication device configured to execute the method involved in the second aspect.
  • a core network device, terminal device, or communication device configured to execute the method involved in the third aspect.
  • an access network device or communication device configured to execute the method involved in the fourth aspect.
  • control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane process of the first access network device can be compared with the user plane entity of the first access network device.
  • the surface treatment process is isolated to reduce the risk of the safe treatment process.
  • Figure 1 is a schematic diagram of an air interface protocol stack for terminal equipment and access network equipment
  • Figure 2 is a schematic diagram of the protocol stack of the CU-DU separated base station architecture
  • Figure 3 is a flow chart of a cell handover process based on an Xn interface between base stations
  • FIG. 5 is a flowchart of the first method for obtaining a key provided by an embodiment of this application.
  • FIG. 6 is a flowchart of a second method for obtaining a key provided by an embodiment of this application.
  • FIG. 7 is a flowchart of a third method for obtaining a key provided by an embodiment of the application.
  • FIG. 8 is a flowchart of a method for sending and receiving data packets according to an embodiment of the application.
  • FIG. 9 is a schematic diagram of a protocol stack for data packet transmission using a method for sending and receiving data packets provided by an embodiment of the present application.
  • FIG. 10 is a schematic block diagram of a core network device provided by an embodiment of this application.
  • FIG. 11 is a schematic block diagram of an access network device provided by an embodiment of this application.
  • FIG. 12 is a schematic block diagram of a first device according to an embodiment of this application.
  • FIG. 13 is a schematic block diagram of a second device according to an embodiment of this application.
  • FIG. 14 is a schematic block diagram of a communication device provided by an embodiment of this application.
  • FIG. 15 is another schematic block diagram of a communication device according to an embodiment of this application.
  • FIG. 16 is still another schematic block diagram of a communication device according to an embodiment of this application.
  • FIG. 17 is another schematic block diagram of a communication device according to an embodiment of this application.
  • Terminal devices including devices that provide users with voice and/or data connectivity, specifically, include devices that provide users with voice, or include devices that provide users with data connectivity, or include devices that provide users with voice and data connectivity Sexual equipment.
  • it may include a handheld device with a wireless connection function, or a processing device connected to a wireless modem.
  • the terminal device can communicate with the core network via a radio access network (RAN), exchange voice or data with the RAN, or exchange voice and data with the RAN.
  • RAN radio access network
  • the terminal equipment may include user equipment (UE), wireless terminal equipment, mobile terminal equipment, device-to-device communication (device-to-device, D2D) terminal equipment, vehicle to everything (V2X) terminal equipment , Machine-to-machine/machine-type communications (M2M/MTC) terminal equipment, Internet of things (IoT) terminal equipment, subscriber unit, subscriber station), mobile station (mobile station), remote station (remote station), access point (AP), remote terminal (remote terminal), access terminal (access terminal), user terminal (user terminal), user Agent (user agent), or user equipment (user device), etc.
  • UE user equipment
  • wireless terminal equipment mobile terminal equipment
  • mobile terminal equipment device-to-device communication
  • D2D device-to-device communication
  • V2X vehicle to everything
  • M2M/MTC Machine-to-machine/machine-type communications
  • IoT Internet of things
  • subscriber unit subscriber station
  • mobile station mobile station
  • remote station remote station
  • access point AP
  • remote terminal remote
  • PCS personal communication service
  • SIP session initiation protocol
  • WLL wireless local loop
  • PDA personal digital assistant
  • restricted devices such as devices with low power consumption, or devices with limited storage capabilities, or devices with limited computing capabilities. Examples include barcodes, radio frequency identification (RFID), sensors, global positioning system (GPS), laser scanners and other information sensing equipment.
  • RFID radio frequency identification
  • GPS global positioning system
  • the terminal device may also be a wearable device.
  • Wearable devices can also be called wearable smart devices or smart wearable devices, etc. It is the general term for the application of wearable technology to intelligently design daily wear and develop wearable devices, such as glasses, gloves, watches, clothing and shoes Wait.
  • a wearable device is a portable device that is directly worn on the body or integrated into the user's clothes or accessories. Wearable devices are not only a hardware device, but also realize powerful functions through software support, data interaction, and cloud interaction.
  • wearable smart devices include full-featured, large-sized, complete or partial functions that can be achieved without relying on smart phones, such as smart watches or smart glasses, and only focus on a certain type of application function, which need to cooperate with other devices such as smart phones.
  • Use such as all kinds of smart bracelets, smart helmets, smart jewelry, etc. for physical sign monitoring.
  • the various terminal devices introduced above if they are located on the vehicle (for example, placed in the vehicle or installed in the vehicle), can be considered as vehicle-mounted terminal equipment.
  • vehicle-mounted terminal equipment is, for example, also called on-board unit (OBU). ).
  • the terminal device may also include a relay. Or it can be understood that everything that can communicate with the base station can be regarded as a terminal device.
  • the device used to implement the function of the terminal device may be a terminal device, or a device capable of supporting the terminal device to implement the function, such as a chip system, and the device may be installed in the terminal device.
  • the chip system may be composed of chips, or may include chips and other discrete devices.
  • the device for implementing the functions of the terminal is a terminal device as an example to describe the technical solutions provided by the embodiments of the present application.
  • Network equipment including, for example, access network (AN) equipment, such as a base station (e.g., access point), which can refer to equipment that communicates with wireless terminal equipment through one or more cells on the air interface in the access network
  • AN access network
  • a base station e.g., access point
  • V2X vehicle-to-everything
  • RSU roadside unit
  • the base station can be used to convert received air frames and IP packets into each other, and act as a router between the terminal device and the rest of the access network, where the rest of the access network can include the IP network.
  • the RSU can be a fixed infrastructure entity that supports V2X applications, and can exchange messages with other entities that support V2X applications.
  • the network equipment can also coordinate the attribute management of the air interface.
  • the network equipment may include the LTE system or the evolved base station (NodeB or eNB or e-NodeB, evolutional Node B) in the long term evolution-advanced (LTE-A), or may also include the 5G NR system (The next generation node B (next generation node B, gNB) in the NR system for short) may also include the CU and DU in the cloud radio access network (Cloud RAN) system.
  • LTE system or the evolved base station (NodeB or eNB or e-NodeB, evolutional Node B) in the long term evolution-advanced (LTE-A) or may also include the 5G NR system
  • the next generation node B (next generation node B, gNB) in the NR system for short) may also include the CU and DU in the cloud radio access network (Cloud RAN) system.
  • Cloud RAN cloud radio access network
  • the network equipment may also include core network equipment.
  • the core network equipment includes, for example, the mobility management entity (MME) in the 4G system, or the access and mobility management function (AMF) in the 5G system, or User plane function (user plane function, UPF), etc.
  • MME mobility management entity
  • AMF access and mobility management function
  • UPF User plane function
  • the device used to implement the function of the network device may be a network device, or a device capable of supporting the network device to implement the function, such as a chip system, and the device may be installed in the network device.
  • the device used to implement the functions of the network equipment is a network device as an example to describe the technical solutions provided in the embodiments of the present application.
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of this application are used to distinguish multiple objects, and are not used to limit the size, content, order, and timing of multiple objects. , Priority or importance, etc.
  • the first key and the second key are only for distinguishing different keys, but do not indicate the difference in the data size, content, priority, or importance of the two keys.
  • the transmission of wireless communication is divided into user plane transmission and control plane transmission.
  • User plane transmission mainly transmits data
  • control plane transmission mainly transmits signaling.
  • both the sender and receiver must perform security processing on data and signaling.
  • the sender encrypts the data, and the receiver decrypts the data accordingly to prevent the data from being Three-party reading; the sender protects the integrity of the data, and the receiver verifies the integrity of the data accordingly to prevent the data from being tampered with by a third party.
  • user plane transmission and control plane transmission can be separated so that they do not affect each other.
  • FIG. 1 is a schematic diagram of a user plane air interface protocol stack for terminal equipment and access network equipment.
  • Data or signaling first reaches the packet data convergence protocol (PDCP) layer of the terminal device, and is processed by the PDCP layer and then transmitted to the radio link control (RLC) layer and
  • the media access control (MAC) layer after corresponding processing, is sent from the physical layer (PHY) to the physical layer of the access network device, and the physical layer of the access network device delivers the received data to the access network device.
  • the MAC layer of the network access device reaches the RLC layer of the access network device after corresponding processing at the MAC layer, and then reaches the PDCP layer of the access network device after corresponding processing at the RLC layer.
  • the transmission channel composed of a PDCP and an RLC can be called a radio bearer.
  • the data transmitted on each radio bearer needs to be processed by various layers, and each layer has corresponding functional entities to perform corresponding functions.
  • the PDCP entity of the PDCP layer or the RLC entity of the RLC layer Each RLC entity corresponds to one logical channel, and one MAC entity corresponds to multiple logical channels. Data in different logical channels can be multiplexed at the MAC layer, that is, multiplexed into the same data block for transmission.
  • Another user plane protocol stack architecture is based on the protocol stack shown in Figure 1.
  • SDAP service data adaptation protocol
  • the layer is used to process the mapping of the quality of service (QoS) flow to the data radio bearer (DRB).
  • QoS quality of service
  • DRB data radio bearer
  • the difference between the protocol stack of the control plane and the protocol stack of the user plane is that the protocol stack of the control plane is based on the protocol stack shown in FIG.
  • RRC radio resource control
  • the CU-DU separated base station architecture is a newly introduced base station architecture for 5G networks.
  • each base station is independently deployed and connected to the 4G core network; in the 5G architecture, the DU parts of different base stations are deployed independently, but the CU parts of different base stations can be deployed centrally, that is, multiple base stations can share a CU.
  • the CU is connected to the core network, and the DU is connected to the CU through the F1 interface. But the CU and DU are concentrated in one device, which is located at the base station side.
  • the physical bottom layer (low-PHY) in the indoor baseband processing unit (building baseband unit, BBU) of the original 4G base station is sunk to the active antenna unit (active antenna unit, AAU).
  • AAU also includes radio frequency (RF), etc.
  • the physical layer that requires high real-time performance for example, called the high-PHY
  • MAC layer for example, MAC layer
  • RLC layer etc.
  • the security processing of the access layer is performed at the PDCP layer, that is, the transmitting end performs security processing (such as encryption or integrity protection, etc.) on data or signaling at the PDCP layer, and the receiving end also performs data or signaling at the PDCP layer. Perform corresponding security processing (such as decryption or integrity verification, etc.).
  • security processing such as encryption or integrity protection, etc.
  • the sender and receiver perform security processing, they need to use the same key for processing.
  • the key is derived from the root key built into the terminal device; for the base station, the key is derived from the key sent by the core network device to the base station, and then the terminal device The same key as the base station can be used to securely process data and signaling.
  • the embodiment of the present application also relates to the cell handover procedure.
  • the following describes the cell handover procedure.
  • Cell handover is divided into two ways, one way is based on the Xn interface between the base stations to realize the handover, and the other way is based on the N2 interface between the base station and the core network equipment to realize the handover. If there is no Xn interface between the base stations, handover can be implemented based on the N2 interface between the base station and the core network equipment; or, if there is an Xn interface between the base stations, the handover can be implemented based on the Xn interface between the base stations, or based on the base station The N2 interface with core network equipment realizes handover. The two switching processes are described below.
  • the cross-base station cell handover process based on the Xn interface between the base stations is a handover process initiated by the source base station.
  • the main process is: the source base station decides to perform cell handover on the terminal equipment according to the measurement report reported by the terminal equipment, and The target base station initiates a handover request. After receiving the positive handover response from the target base station, the source base station sends a handover command to the terminal device. After receiving the handover command, the terminal device stops sending uplink data or downlink data with the source base station, and the terminal device starts to synchronize with the target base station and initiates a random access process to the target base station.
  • the source base station After the source base station sends a handover command to the terminal device, it stops the uplink data or downlink data transmission with the terminal device, and sends the data that has not been successfully sent to the target base station. After successfully accessing the target base station, the terminal device starts to transmit uplink data or downlink data with the target base station.
  • Figure 3 is a flowchart of this process.
  • the source base station sends uplink scheduling information to the terminal device, and the terminal device receives the uplink scheduling information from the source base station.
  • the uplink scheduling information can schedule corresponding uplink resources for the terminal equipment.
  • the terminal device in the RRC connected state sends a measurement report (MR) through the uplink resource scheduled in S301 according to the measurement report trigger criterion configured by the base station.
  • MR measurement report
  • the source base station determines the target base station for the terminal device when the terminal device meets the handover condition, or in other words, determines the target cell for the terminal device, or , Determine to switch the terminal equipment to the target cell (or target base station).
  • RRM radio resource management
  • the source base station sends a handover request (handover request) message to the target base station, and the target base station receives the handover request message from the source base station.
  • handover request handover request
  • the source base station may send the context (UE context) information of the terminal device to the target base station along with the handover request message.
  • context UE context
  • the target base station sends a handover request acknowledgement (handover request ACK) message to the source base station, and the source base station receives the handover request acknowledgement message from the target base station.
  • handover request ACK handover request acknowledgement
  • the target gNB prepares for the terminal device to be handed over, and at the same time allocates a cell-radio network temporary identifier (C-RNTI) and other parameters for the terminal device.
  • C-RNTI cell-radio network temporary identifier
  • the target base station may return the C-RNTI and other parameters allocated to the terminal device in the handover request confirmation message to the source base station.
  • the source base station After receiving the handover request confirmation message, the source base station prepares to forward the data of the terminal device to the target base station.
  • the data of the terminal device may include downlink data to be sent to the terminal device, or uplink data received from the terminal device.
  • the source base station sends downlink scheduling information to the terminal device, and the terminal device receives the downlink scheduling information from the source base station.
  • the downlink scheduling information can schedule corresponding downlink resources for the terminal equipment.
  • the source base station sends a handover command to the terminal device, and the terminal device receives the handover command from the source base station.
  • the handover command may include the following information: the C-RNTI described in S305, the system information block (SIB) of the target base station, the configuration information of the terminal device, and so on.
  • SIB of the target base station includes, for example, random access resources used by the terminal device to perform random access at the target base station, and may also include some other configuration information.
  • the configuration information of the terminal device includes, for example, the MAC layer configuration, RLC configuration, or PDCP configuration of the terminal device.
  • the terminal device After receiving the handover command, the terminal device stops the uplink data or downlink data transmission with the source base station, and synchronizes with the target base station.
  • the source base station sends sequence number (SN) status information to the target base station, and the target base station receives the SN status information from the source base station.
  • SN sequence number
  • the SN status information may include uplink SN status information, or include downlink SN status information, or include uplink SN status information and downlink SN status information.
  • the uplink SN status information is, for example, the uplink SN, which may be the sequence number of the data packet with the largest sequence number from the terminal device received by the source base station, or the sequence of the data packet with the largest sequence number from the terminal device received by the source base station Number plus 1.
  • the downlink SN status information is, for example, a downlink SN, which may be the sequence number of the data packet with the largest sequence number to be sent by the source base station to the terminal device, or the data packet with the largest sequence number to be sent by the source base station to the terminal device Add 1 to the serial number.
  • the source base station may perform data forwarding to the target base station, that is, the source base station buffers the uplink data from the terminal device and/or the downlink data from the core network device (for example, UPF) corresponding to the terminal device.
  • the data is forwarded to the target base station, and correspondingly, the target base station receives the data from the source base station.
  • This step is not mandatory and is represented by a dashed line.
  • the terminal device After disconnecting the data transmission from the source base station, the terminal device starts a downlink synchronization process with the target base station, and then initiates a random access process to the target base station to obtain uplink timing and uplink resources.
  • the target base station sends the uplink time advance (TA) to the terminal equipment, and indicates to the terminal equipment the resources allocated to the terminal equipment.
  • the resources mentioned here are mainly used for the random access process.
  • the terminal equipment can use this resource to
  • the target base station sends the third message (Msg3) in the random access process.
  • the information sent by the target base station to the terminal device can be used by the terminal device to send an RRC connection reconfiguration complete message to the target base station to indicate the completion of the cell handover.
  • the terminal device sends handover confirmation information to the target base station, and the target base station receives the handover confirmation information from the terminal device.
  • the switch confirmation message is used to indicate the completion of the switch.
  • the handover confirmation information may be carried in the RRC connection reconfiguration complete message, for example.
  • the target base station sends a handover complete message to the source base station, and the source base station receives the handover complete message from the target base station.
  • the source base station After receiving the handover complete message, the source base station can release the context information of the terminal device and so on.
  • the target base station may perform S312, that is, the target base station sends a path switch (path switch) message to the core network device, and the core network device receives the path switch message from the target base station.
  • the path switch message is used to notify the core network device to update the information of the data forwarding destination base station, and to change the address of the destination base station corresponding to the terminal device from the address of the source base station to the address of the target base station.
  • the core network device can change the address of the target base station corresponding to the terminal device from the address of the source base station to the address of the target base station, so that the core network device can subsequently send the terminal device data to the target base station.
  • Target base station the target base station sends a path switch (path switch) message to the core network device, and the core network device receives the path switch message from the target base station.
  • the path switch message is used to notify the core network device to update the information of the data forwarding destination base station, and to change the address of the destination base station corresponding to the terminal device
  • the core network device can perform S313, that is, the core network device sends a path switch ACK message to the target base station, and the target base station receives the path switch acknowledgment message from the core network device, and the path switch acknowledgment message is used to instruct data forwarding
  • the information of the destination base station has been updated.
  • the cross-base station cell handover process based on the N2 interface between the base station and the core network equipment is also the handover process initiated by the source base station.
  • the main difference between this process and the cross-base station cell handover process based on the Xn interface between the base stations is that In this process, the source base station and the target base station cannot communicate directly, but need to be forwarded through the core network equipment.
  • the rest of the steps are the same as the process shown in FIG. 3, so no more details are given here.
  • the security processing of data or signaling is performed at the PDCP layer of the terminal equipment and the base station.
  • the security processing of the access layer includes the security processing of control plane signaling and the security processing of user plane data.
  • the base station the current security processing of the access layer is performed on the RAN side, and the two security processing procedures cannot be isolated from each other. There are risks in the entire safe handling process.
  • the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that The control plane processing process and the user plane processing process of the first access network device can be isolated from each other, thereby reducing the risk of the security processing process.
  • the second key used to securely process control plane signaling is sent to the control plane entity
  • the third key used to securely process user plane data is sent to the user plane entity.
  • the control plane The entity and the user plane entity will not be able to obtain the key of the other party, and thus cannot crack the transmission content of the other party.
  • the effect of isolating the control plane processing process of the first access network device from the user plane processing process is achieved, and the security of the entire system is reduced. risk.
  • the technical solutions provided by the embodiments of this application can be applied to the fourth generation mobile communication technology (the 4th generation, 4G) system, such as the LTE system, or can be applied to the 5G system, such as the NR system, or can also be applied to the next generation
  • the 4th generation, 4G mobile communication technology
  • the 5G system such as the NR system
  • the next generation For mobile communication systems or other similar communication systems, as long as there is one entity that can initiate paging to another entity, there is no specific limitation.
  • the air interface communication process between the network device and the terminal device is taken as an example.
  • the technical solution provided by the embodiment of this application can also be applied to a sidelink (SL). As long as one terminal device can initiate paging to another terminal device.
  • SL sidelink
  • the technical solutions provided by the embodiments of the present application can be applied to device-to-device (D2D) scenarios, can be NR D2D scenarios, LTE D2D scenarios, etc., or can be applied to vehicle-to-everything (vehicle-to-everything) scenarios.
  • everything (V2X) scenario it can be NR V2X scenario or LTE V2X scenario, etc., for example, it can be applied to the Internet of Vehicles, such as V2X, LTE-V, vehicle-to-vehicle (V2V), etc., or can be used for Intelligent driving, intelligent networked vehicles and other fields.
  • FIG. 4A, FIG. 4B or FIG. 4C are three application scenarios of the embodiments of this application.
  • the access network device serves the terminal device through wireless transmission.
  • the core network equipment in FIG. 4A, FIG. 4B or FIG. 4C includes, for example, UPF, and of course, may also include other core network equipment, such as AMF, etc., which are not shown here.
  • FIG. 4A, FIG. 4B, and FIG. 4C also show the protocol stack architecture provided by the embodiment of the present application.
  • the protocol stack on the terminal equipment side can include the MAC layer, RLC layer, PDCP layer, SDAP layer, and RRC layer, etc.
  • the DU on the base station side can include the MAC layer and the RLC layer
  • the CU on the base station side can be divided into CU-control plane ( control plane, CP) and CU-user plane (UP).
  • An implementation manner is that the CU-CP is located on the base station side, the CU-UP is moved to the core network side, and the CU-UP is independently deployed on the core network side, as shown in FIG. 4A.
  • Another implementation manner is that CU-CP and CU-UP are located on the base station side, and part of the functions of the PDCP layer are reserved in CU-UP, and another part of the functions of the PDCP layer of CU-UP (such as security processing functions, etc.) is deployed In the core network equipment, for example, it can be deployed in the UPF.
  • the CU-UP also includes the PDCP layer, but the functions implemented by the PDCP layer are limited, as shown in FIG. 4B.
  • the SDAP layer can continue to remain in the CU-UP on the base station side, or it can also be moved to the UPF.
  • CU-CP and CU-UP are located on the base station side, and all functions of the PDCP layer of CU-UP (for example, including security processing functions, etc.) are deployed in the core network equipment, for example, may be deployed in UPF, It can be considered that the CU-UP no longer includes the PDCP layer, as shown in Figure 4C.
  • the SDAP layer may continue to remain in the CU-UP on the base station side, or may be deployed in the UPF instead. No matter which implementation method is adopted, the security processing process of the control plane and the user plane can be isolated from each other, thereby reducing the risk of security processing.
  • the access network device in FIG. 4A, FIG. 4B, or FIG. 4C is, for example, a base station.
  • the base station corresponds to different equipment in different systems.
  • a 4G system it can correspond to a base station in 4G, such as an eNB
  • a 5G system it corresponds to a base station in 5G, such as gNB.
  • the technical solutions provided by the embodiments of the present application can also be applied to future mobile communication systems. Therefore, the access network equipment in FIG. 4A, FIG. 4B, or FIG. 4C can also correspond to the access network equipment in the future mobile communication system.
  • Figure 4A, Figure 4B or Figure 4C takes the access network device as a base station as an example.
  • the access network device may also be a device such as an RSU.
  • the terminal device in FIG. 4A, FIG. 4B, or FIG. 4C uses a mobile phone as an example.
  • the terminal device in the embodiment of the present application is not limited to a mobile phone.
  • FIG. 5 is a flowchart of this method.
  • the following introduction process take the method applied to the network architecture shown in FIG. 4A, FIG. 4B or FIG. 4C as an example.
  • the method executed by the network device and the terminal device is taken as an example.
  • the first core network device described below is, for example, the network shown in FIG. 4A, FIG. 4B, or FIG. 4C
  • the AMF in the architecture may also be other core network devices other than AMF and UPF.
  • the first access network device described below may be the one in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C.
  • Access network device, the terminal device described below may be the terminal device in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C.
  • the first core network device obtains the first key.
  • the first key can be used to derive the key used by the first access network device to perform security processing on the access layer control plane signaling, or it can be used to derive the first access network device to access the user plane of the access layer.
  • the key used for data security processing, or used to derive the key used by the first access network device to perform security processing for access layer control plane signaling, and the key used to derive the first access network device for access The key for secure processing of layered user plane data.
  • the security processing of the access layer control plane signaling may include one or more of the following processing methods: integrity protection, integrity verification, encryption, Or decrypt.
  • integrity protection integrity verification
  • encryption integrity protection
  • decryption the control plane entity of the first access network device may perform integrity verification, or decryption, or integrity verification on the signaling.
  • the security processing of the access layer user plane data may include one or more of the following processing methods: integrity protection, integrity verification, and encryption of the access layer user plane data , Or decrypt.
  • integrity protection integrity verification
  • encryption encryption
  • the first key may be an intermediate key of the first access network device corresponding to the terminal device. This can be understood as that when the first access network device communicates with different terminal devices, it can be derived based on different intermediate keys to obtain information corresponding to different terminal devices, which is used to control the access layer control plane signaling and user plane.
  • the key for the secure processing of data may include K gnb and/or NH.
  • the root key corresponding to each terminal device can be stored in advance, and then at least one core network device can perform a step-by-step derivation process based on the root key, so as to obtain the required use in different devices or different security processes Key.
  • the core network equipment that can derive the key used by itself based on the root key includes, but is not limited to: authentication credential repository and processing function (authentication credential repository and processing function, ARPF), and authentication server function entity (authentication).
  • AUSF server function
  • SEAF security anchor function
  • the first core network device can obtain the root key corresponding to the terminal device, for example, it is called the first root key.
  • the first core network device may perform deduction based on the first root key, or the first core network device may perform further deduction based on the key derived from the first root key to obtain the key used by the first core network device , For example, called the fourth key.
  • the first core network device is AMF
  • the fourth key can be expressed as K AMF .
  • the first core network device can derive based on the fourth key to obtain the first key, and can also derive other keys based on the fourth key, for example, to obtain security processing during non-access layer communication Key.
  • the first core network device performs deduction according to the first key to obtain the second key and the third key.
  • the first core network device may perform one or more deductions based on the first key to obtain the second key and the third key.
  • the first key may include the second key and the third key, that is, the first core network device does not need to derive the first key to obtain the second key And the third key.
  • S502 can also be changed to that the first core network device determines the second key and the third key according to the first key.
  • One way of determining is that the first core network device derives the second key and the third key according to the first key. The second key or the third key is obtained.
  • Another way of determining is that the first core network device obtains the first key and also obtains the second key and the third key (the first key includes the second key). Key and third key).
  • the second key is used to perform security processing on the control plane signaling of the access layer
  • the third key is used to perform security processing on user plane data.
  • the deduction process here can be understood as a process of obtaining at least one output parameter by performing a specific operation with at least one first parameter and a safety algorithm.
  • the first parameter is the first key
  • the second key and/or the third key are obtained through the operation of the security algorithm.
  • the second key may include the first subkey, or include the second subkey, or include the first subkey and the second subkey.
  • the first subkey is represented as K RRCenc , for example, and can be used by the access network device to encrypt or decrypt control plane signaling.
  • the second subkey is expressed as K RRCint , for example, and can be used by the access network device to perform integrity protection or integrity verification on the control plane signaling.
  • integrity protection means that the sender of the data packet takes information such as the key as input parameters, performs arithmetic processing on the data packet through the integrity protection algorithm to obtain the first value, and then calculates the first value.
  • a value is transmitted with the data packet to protect the data packet.
  • Integrity verification means that the receiving end of the data packet takes information such as the key as input parameters, and performs arithmetic processing on the data packet through the integrity protection algorithm to obtain the second value, and the receiving end compares the first value with the second value. If the first value is consistent with the second value, the integrity verification of the data packet is passed, and if the first value is inconsistent with the second value, the integrity verification of the data packet fails.
  • the first value is message authentication code (MAC)-I
  • XMAC expected message authentication code
  • the third key may include a third subkey, or a fourth subkey, or a third subkey and a fourth subkey.
  • the third subkey is represented as K UPenc , for example, and can be used by the access network device to encrypt or decrypt user plane data.
  • the fourth subkey is represented as K UPint , for example, and can be used by the access network device to perform integrity protection or integrity verification on user plane data.
  • the first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.
  • the control plane entity of the first access network device is responsible for the communication processing of the control plane signaling of the access layer.
  • the control plane entity of the first access network device can perform control plane communication with the terminal device, or the first access network device
  • the control plane entity of the network access device can perform signaling communication with the terminal device, that is, the first access network device performs control plane signaling communication with the terminal device through the control plane entity of the first access network device.
  • the control plane entity of the first access network device performs control plane signaling communication with the terminal device, which may include the control plane entity of the first access network device sending signaling to the terminal device, and may also include the terminal device sending signaling to the first access network.
  • the control plane entity of the device sends signaling.
  • the control plane signaling includes signaling radio bearer (SRB) signaling or RRC signaling.
  • the user plane entity of the first access network device is responsible for user plane data communication with the terminal device, or in other words, the user plane entity of the first access network device can perform user plane communication with the terminal device, or the first access network device
  • the control plane entity of may perform data communication with the terminal device, that is, when the first access network device performs user plane data communication with the terminal device, the user plane entity of the first access network device performs data communication.
  • the user plane entity of the first access network device performs user plane data communication with the terminal device, which may include the user plane entity of the first access network device sending data to the terminal device, and may also include the communication of the terminal device to the first access network device.
  • the user plane entity sends data.
  • the user plane data includes IP packets, Ethernet packets or other types of data packets from the upper layer.
  • the control plane entity of the first access network device After the control plane entity of the first access network device receives the second key, it can use the second key to perform security processing on the control plane signaling of the terminal device. For example, for the signaling to be sent by the control plane entity of the first access network device to the terminal device, the control plane entity of the first access network device can use the second key to encrypt or integrity protect the signaling, etc. ; For the signaling from the terminal device received by the control plane entity of the first access network device, the control plane entity of the first access network device can use the second key to decrypt or verify the integrity of the signaling.
  • the user plane entity of the first access network device can use the third key to perform security processing on the user plane data of the terminal device. For example, for data to be sent by the user plane entity of the first access network device to the terminal device, the user plane entity of the first access network device can use the third key to encrypt or integrity protect the data; The user plane entity of the first access network device receives the data from the terminal device, and the user plane entity of the first access network device can use the third key to decrypt the data or verify the integrity.
  • the control plane entity of the first access network device and the user plane entity of the first access network device are different network entities, so that the control plane of the first access network device can be processed The process is separated from the user plane process.
  • the first core network device derives the key used by the first access network device without the first access network device to derive it by itself. After deriving the second key and the third key, the first core network device can send the second key to the control plane entity of the first access network device, and send the third key to the first access network device. Therefore, the control plane entity of the first access network device cannot obtain the third key. That is, the control plane entity of the first access network device will neither perceive the processing of user plane data nor The third key that will touch the user interface can effectively reduce the risk of security processing.
  • the access network equipment is provided by equipment vendors, deployed by operators, and generally deployed outdoors, if the access network equipment can read user data, it will pose a certain risk to data security.
  • the security processing of user plane data and control plane signaling are isolated from each other, they are still on the side of the access network, and user data still has security risks.
  • the control plane entity of the first access network device may be located on the access network side, and the user plane entity of the first access network device may be located on the core network side.
  • CU-CP and CU-UP continue to be located in the CU on the side of the first access network device, and part of the functions of the PDCP layer are retained in the CU-UP, and another part of the functions of the PDCP layer of the CU-UP (such as security Processing functions, etc.) are deployed in the core network equipment, for example, can be deployed in the UPF.
  • the control plane entity of the first access network device is, for example, CU-CP
  • the user plane of the first access network device The entity is, for example, a PDCP layer deployed in a core network device (such as UPF) (that is, another part of the PDCP layer function of CU-UP can be realized); or, both CU-CP and CU-UP continue to be located in the first access network In the CU on the device side, all functions of the PDCP layer of the CU-UP (such as security processing functions, etc.) are deployed in the core network device (such as UPF).
  • a core network device such as UPF
  • the control plane entity is, for example, CU-CP
  • the user plane entity of the first access network device is, for example, the PDCP layer in the core network device (for example, UPF) (that is, it can implement all the functions of the PDCP layer of CU-UP).
  • the control signaling of the access layer is to assist the user plane data transmission. What the user really cares about is the user plane data, so the security processing of the user plane data is placed on the core network side to ensure the user plane data processing first. At the same time, by isolating the security processing process of the user plane and the control plane, it can further ensure that the access network side cannot obtain the key for the secure processing of the user plane data, which can significantly reduce the security risk of the user plane data.
  • the control plane entity of the first access network device is CU-CP
  • the user plane entity of the first access network device is CU-UP
  • the AMF can communicate with the CU-CP
  • the interface of the AMF sends the second key to the CU-CP;
  • the AMF sends the third key to the CU-UP on the core network side, which can be sent through the interface of AMF and CU-UP, or through UPF or other core network
  • the device is forwarded to CU-UP.
  • the control plane entity of the first access network device may be located on the access network side, and the user plane entity of the first access network device may be located on the core network side.
  • the control plane entity of the access layer The control signaling is to assist the user plane data transmission. What users really care about is the user plane data. Therefore, the security processing of the user plane data is placed on the core network side. First, the security of the user plane data processing can be guaranteed, and the user plane data can be isolated by isolating users. The security processing process of the plane and the control plane can further ensure that the access network side cannot obtain the key for the secure processing of the user plane data, and can significantly reduce the security risk of the user plane data.
  • the first core network device sends a next hop chaining counter (NCC) to the terminal device, and the terminal device receives the NCC from the first core network device.
  • NCC next hop chaining counter
  • the terminal device can determine the key used according to the NCC to ensure that it is consistent with the key used on the network side.
  • NCC has a counting function, and different NCC values correspond to different key deduction processes or different key deduction times.
  • the NCC can be used to indicate the number of times the first core network device derives the first key, or the NCC can be used to instruct the first core network device to derive the trajectory of the first key according to the derivation of the first key, or to record the derivation process.
  • the terminal device has a built-in root key of the terminal device, which is called a second root key, for example, and the second root key and the first root key may be the same root key or different root keys.
  • the terminal device can use the same deduction method as the core network device according to the second key to obtain the key used by the terminal device.
  • it can determine the deduction method of the core network device according to the instruction of the NCC, so that the key used by the terminal device and the first access network device are consistent. For example, if the NCC indicates that the number of deductions is n, the terminal device deduces n times to obtain the first key, and n is a positive integer, the terminal device can further obtain the second key and the third key; for another example, NCC indicates the deduction track or deduction Process recording, the terminal device can perform deduction according to the same track or the same deduction process to obtain the first key, and further obtain the second key and the third key.
  • the first core network device may not send the NCC to the terminal device.
  • the number of deductions (or deduction trajectory, or deduction record) of the first core network device is specified by the agreement, or the first core network device has previously If the terminal device is notified, the first core network device may not send the NCC to the terminal device. Therefore, S504 is an optional step, which is represented by a dashed line in FIG. 5.
  • the security processing of the access layer includes the security processing of control plane signaling and the security processing of user plane data.
  • the current security processing of the access layer is performed on the RAN side. Take the above line transmission as an example.
  • the data is safely processed (such as encryption or integrity protection) on the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after DU processing, it is transmitted to the CU-UP on the access network side.
  • the PDCP layer performs corresponding security processing (such as decryption or integrity verification), and then transmits it to the UPF on the core network side; and the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and security is performed in the PDCP layer of the terminal device.
  • CU-CP and CU-UP are located in one entity, which is located on the side of the access network device. It can be seen that, for the base station, the current security processing of the access layer is performed on the RAN side, and the two security processing procedures cannot be isolated from each other, making the entire security processing process risky.
  • the access network equipment is provided by equipment vendors, deployed by operators, and generally deployed outdoors, if the access network equipment can read user data, it will pose a certain risk to data security.
  • CU-CP and CU-UP are both on the access network side, and user data still has security risks.
  • control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • control plane entity is located on the access network side
  • user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • the data After the data is securely processed (such as encryption or integrity protection) in the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after the DU is processed, it is transmitted to the user plane entity on the core network side, and in the PDCP of the user plane entity
  • the layer performs corresponding security processing (such as decryption or integrity verification), and then transmits it to the UPF on the core network side; and the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and the security processing is performed on the PDCP layer of the terminal device.
  • security processing such as decryption
  • Or integrity verification submitted to the RRC layer of the control plane entity for analysis.
  • control signaling of the access layer is to assist the user plane data transmission.
  • What the user really cares about is the user plane data, so the security processing of the user plane data is placed on the core network side to ensure the user plane data first. Processing security, and by isolating the user plane and the control plane's security processing process, it can further ensure that the access network side cannot obtain the key for the secure processing of user plane data, which can significantly reduce the security risk of user plane data.
  • the embodiment shown in FIG. 5 relates to a non-cell handover procedure, and in the cell handover procedure, the solution provided by the embodiment of the present application can also improve data security.
  • the following introduces the second method for obtaining a key provided by an embodiment of the present application, and this method can improve data security in a cell handover scenario. Please refer to Figure 6, which is a flowchart of this method.
  • the cell handover procedure involved in the embodiment of the present application is a cross-base station cell handover procedure based on the Xn interface between the base stations.
  • the method executed by the network device and the terminal device is taken as an example.
  • the first core network device described below is, for example, the network shown in FIG. 4A, FIG. 4B, or FIG. 4C as an example
  • the AMF in the architecture may also be other core network devices other than AMF and UPF.
  • the first access network device described below may be the one in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C. Access network equipment.
  • the second access network equipment described below is not shown in Figure 4A, Figure 4B or Figure 4C. It is another access network equipment served by the first core network equipment in the network architecture.
  • the terminal device described in the text may be a terminal device in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C.
  • the second access network device sends input parameters to the first core network device, and the first core network device receives input parameters from the second access network device.
  • the input parameters can be used to derive the first key (or in other words, use
  • the first key is obtained by deduction, which can be understood as the first core network deduced according to the input parameters to obtain the first key), or used to determine the first key.
  • a new message may be added to the original handover process, for example, called the first message.
  • the first message may include input parameters, that is, the second access network device may input parameters through the first message. Sent to the first core network device.
  • the first message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • the second access network device is the source access network device when the terminal device performs cell handover, or the second access network device is the access network device that the terminal device accesses before the cell handover.
  • the first access network device which is the target access network device of the terminal device during cell handover, or the first access network device is the access network device that the terminal device accesses after the cell handover.
  • the input parameter is related to the target cell, and it can be understood that the key used by the first access network device to communicate with the terminal device after the handover needs to be obtained according to the input parameter.
  • the terminal device switches from the cell of the second access network device to the cell of the first access network device for communication.
  • the first access network device The key used for security processing used by the network access device and the second access network device when communicating with the terminal device cannot be the same.
  • the key used by the first access network device when communicating with the terminal device can be deduced based on the key of the second access network device corresponding to the terminal device.
  • the core network device is required to perform the key derivation process. Therefore, the second access network device needs to derive the key used by the first access network device.
  • the input parameters of is sent to the first core network device, and the first core network device derives the key used by the first access network device. After the deduction, the key used by the first access network device is sent to the first access network equipment.
  • S602 can also be performed, and the second access network device connects to the first The network access device sends a handover request message, and the first access network device receives a handover request message from the second access network device.
  • the handover request message is used to request the terminal device to be switched to the first access network device.
  • the second access network device may send a handover request message to the control plane entity of the first access network device, and the control plane entity of the first access network device receives the handover request message from the second access network device.
  • S602 refer to S304 in the process of FIG. 3. After S602 is executed, S601 may be executed, and the second access network device sends the input parameters to the first core network device.
  • the input parameter may include the physical cell identity (PCI) of the first cell, or include the frequency of the first cell, or include the PCI of the first cell and the frequency of the first cell. Or the input parameter may also include other information, as long as the input parameter can be used to determine the first key.
  • the frequency of the first cell is, for example, the absolute radio frequency channel number (ARFCN) of the first cell.
  • the first cell is the target cell of the terminal device, or in other words, the first cell is the target cell of the terminal device during cell handover. It can be understood that, in this embodiment of the present application, the terminal device performs cell handover, that is, to switch to the first cell, so the first cell is called the target cell of the terminal device.
  • the first cell is provided by the first access network device, so the first access network device is also referred to as the target access network device of the terminal device.
  • the first core network device obtains the first key.
  • the first core network device obtains the input parameters, and can derive the first key according to the input parameters.
  • S602 in FIG. 6 takes this as an example.
  • the first core network device may derive the first key according to the input parameters and the key of the second access network device.
  • the key of the second access network device is, for example, that the second access network device corresponds to the terminal.
  • the intermediate key of the device is called the fifth key, for example, and the first core network device can derive the first key according to the fifth key and input parameters.
  • the fifth key is known by the first core network device.
  • the first core network device can determine the second key and the third key for the first access network device.
  • the first core network device Before determining the second key and the third key, the first core network device will obtain the first key first, so in the same way, the first core network device can also obtain the fifth key of the second access network device , The second access network device does not need to send the fifth key to the first core network device, but only needs to send the input parameters to the first core network device to save signaling overhead.
  • the first core network device performs deduction according to the first key to obtain the second key and the third key.
  • the first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.
  • the first core network device may send the third key to the first access network device.
  • the user plane entity of the device For example, if the first core network device is AMF, and the user plane entity of the first access network device is deployed in UPF, or the user plane entity of the first access network device is an independent device on the core network side, the AMF can set the first The three keys are sent to the user plane entity of the first access network device.
  • the first core network device may not need to send the third key to the user plane entity of the first access network device, and the first access network device The user plane entity of the network access device can obtain the third key deduced by the first core network device.
  • a new message may be added to the original handover procedure, such as a second message, and the second message may include the second key. That is, the first core network device may send the second key to the control plane entity of the first access network device through the second message.
  • the second message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • a new message may be added to the original handover process, for example called a third message. If the first core network device needs to send the third key to the user plane entity of the first access network device, Then the third message may include the third key. That is, the first core network device may send the third key to the user plane entity of the first access network device through the third message.
  • the third message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • the first core network device may send the third message first and then send the second message, or may send the second message first and then send the second message. Send the third message, or you can send the third message and the second message at the same time.
  • the first core network device sends an NCC to the terminal device, and the terminal device receives the NCC from the first core network device.
  • the first core network device may send the NCC to the second access network device, and the second access network device forwards the NCC to the terminal device; or the first core network device may send the NCC to the first access network device.
  • the first access network device forwards the NCC to the second access network device
  • the second access network device forwards the NCC to the terminal device.
  • the first core network device can send the NCC to the control plane entity of the first access network device, and the first access network device is controlled by the first access network device.
  • the plane entity forwards the NCC to the second access network device, and the second access network device forwards the NCC to the terminal device.
  • the first access network device sends a handover request confirmation message to the second access network device, and the second access network device receives the handover request confirmation message from the first access network device.
  • the first access network device may also send a handover request confirmation message to the second access network device.
  • the control plane entity of the first access network device sends a handover request confirmation message to the second access network device
  • the second access network device receives the handover request confirmation message from the control plane entity of the first access network device.
  • S607 refer to S305 in the process shown in FIG. 3.
  • the second access network device sends a switching command to the terminal device, and the terminal device receives the switching command from the second access network device.
  • S602, S606 to S608 are optional steps, which are not necessary to be performed, and are represented by dashed lines in FIG. 6.
  • control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • control plane entity is located on the access network side
  • user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • the data After the data is securely processed (such as encryption or integrity protection) in the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after the DU is processed, it is transmitted to the user plane entity on the core network side, and in the PDCP of the user plane entity
  • the layer performs corresponding security processing (such as decryption or integrity verification), and then transmits it to the UPF on the core network side; and the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and the security processing is performed on the PDCP layer of the terminal device.
  • security processing such as decryption
  • Or integrity verification submitted to the RRC layer of the control plane entity for analysis.
  • control signaling of the access layer is to assist the user plane data transmission.
  • What the user really cares about is the user plane data, so the security processing of the user plane data is placed on the core network side to ensure the user plane data first. Processing security, and by isolating the user plane and the control plane's security processing process, it can further ensure that the access network side cannot obtain the key for the secure processing of user plane data, which can significantly reduce the security risk of user plane data.
  • the application scenario of the embodiment shown in FIG. 6 is a cross-cell handover process based on the Xn interface between base stations.
  • the embodiment of this application provides a third method for obtaining keys.
  • the application scenario of this method is based on the base station.
  • the cell handover process of the N2 interface between the N2 interface and the core network equipment can also improve the data security.
  • Figure 7 for a flowchart of this method.
  • the cell handover procedure involved in the embodiment of the present application is a cross-base station cell handover procedure based on the Xn interface between the base stations.
  • the method executed by the network device and the terminal device is taken as an example.
  • the first core network device described below is, for example, the network shown in FIG. 4A, FIG. 4B, or FIG. 4C as an example
  • the AMF in the architecture may also be other core network devices other than AMF and UPF.
  • the first access network device described below may be the one in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C. Access network equipment.
  • the second access network equipment described below is not shown in Figure 4A, Figure 4B or Figure 4C. It is another access network equipment served by the first core network equipment in the network architecture.
  • the terminal device described in the text may be a terminal device in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C.
  • the second access network device sends input parameters to the first core network device, and the first core network device receives input parameters from the second access network device.
  • the input parameters can be used to derive the first key, or in other words, Determine the first key.
  • the embodiment of the present application is based on the N2 interface between the base station and the core network device in the cross-base station cell handover process, then the second access network device may send a handover request to the first core network device when determining that the terminal device performs the cell handover Message to forward the handover request message to the first access network device through the first core network device.
  • the handover request message sent by the second access network device to the first core network device may include the input parameters.
  • Send a handover request message for example called a first handover request message.
  • the first core network device receives the first handover request message from the second access network device.
  • the first handover request message includes input parameters.
  • S701 in FIG. 7 uses this Take for example. That is to say, the embodiment of this application does not need to add a new message, but can send input parameters to the first core network device through an existing handover request message, which is more conducive to compatibility with existing solutions and can save signaling overhead .
  • the embodiment of the present application may also add a new message to the original handover process, for example, called the first message.
  • the first message may include input parameters, that is, the second access network device may input the input parameters through the first message.
  • the parameters are sent to the first core network device.
  • the first message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • the second access network device may send the first handover request message first and then send the first message, or may send the first message first and then send the first handover request message, or may also send the first message and the first handover request message at the same time.
  • the first core network device obtains the first key.
  • the first core network device obtains the input parameters, and can derive the first key according to the input parameters.
  • S702 in FIG. 7 takes this as an example.
  • the first core network device may derive the first key according to the input parameters and the key of the second access network device.
  • the key of the second access network device is, for example, that the second access network device corresponds to the terminal.
  • the intermediate key of the device is called the fifth key, for example, and the first core network device can derive the first key according to the fifth key and input parameters.
  • the first core network device performs deduction according to the first key to obtain the second key and the third key.
  • the first core network device sends the second key to the control plane entity of the first access network device, and sends the third key to the user plane entity of the first access network device.
  • the embodiment of this application is based on the N2 interface between the base station and the core network device in the inter-base station cell handover process.
  • the first core network device receives the first handover request message from the second access network device, if it follows the current situation If there is technology, the first core network device will forward the first handover request message to the first access network device. Then the embodiment of the application can use this process. For example, the first core network device can generate the second handover request message, the second handover request message includes the second key, and the first core network device sends the second handover request message to the first handover request message. The access network device sends the second key to the first access network device.
  • the first core network device can add the second key to the first handover request message to obtain the second handover request message.
  • the second key is also sent to the first access network device, so there is no need to send the second key to the first access network device through a new message, which helps to be compatible with the existing solution , And can reduce signaling overhead.
  • the handover request message is control plane signaling
  • the first core network device forwards the handover request message, it can forward the handover request message to the control plane entity of the first access network device. Therefore, the embodiment of the present application may
  • the second key used for control plane security processing is added to the first handover request message to obtain the second handover request message.
  • the first core network device can send the second handover request message to the control of the first access network device Surface entity.
  • the first core network device may not use the existing message to send the second key.
  • a new message may be added to the original handover procedure, for example, called the second message, and the second message may include the first message.
  • Two keys That is, the first core network device may send the second key to the control plane entity of the first access network device through the second message.
  • the second message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • the first core network device will also forward the first handover request message to the first access network device, then the first core network device may forward the first handover request message first and then send the second message, or The second message may be sent first and then the first handover request message may be forwarded, or the first handover request message and the second message may also be sent at the same time.
  • the first core network device may send the third key to the first access network device.
  • the user plane entity of the device For example, if the first core network device is AMF, and the user plane entity of the first access network device is deployed in UPF, or the user plane entity of the first access network device is an independent device on the core network side, the AMF can set the first The three keys are sent to the user plane entity of the first access network device.
  • the first core network device may not need to send the third key to the user plane entity of the first access network device, and the first access network device The user plane entity of the network access device can obtain the third key deduced by the first core network device.
  • This embodiment of the application may add a new message to the original handover process, for example, called the third message.
  • the third message Can include a third key. That is, the first core network device may send the third key to the user plane entity of the first access network device through the third message.
  • the third message can be regarded as a message related to safety, or can also be regarded as a message related to cell handover.
  • the first core network device may send the third message first and then send the second message, or may send the second message first and then send the second message. Send the third message, or you can send the third message and the second message at the same time.
  • the first core network device sends an NCC to the terminal device, and the terminal device receives the NCC from the first core network device.
  • the first core network device may send the NCC to the second access network device, and the second access network device forwards the NCC to the terminal device; or the first core network device may send the NCC to the first access network device.
  • the first access network device forwards the NCC to the second access network device
  • the second access network device forwards the NCC to the terminal device.
  • the first core network device can send the NCC to the control plane entity of the first access network device, and the first access network device is controlled by the first access network device.
  • the plane entity forwards the NCC to the second access network device, and the second access network device forwards the NCC to the terminal device.
  • the first access network device sends a handover request confirmation message to the first core network device, and the first core network device receives the handover request confirmation message from the first access network device.
  • control plane entity of the first access network device sends a handover request confirmation message to the first core network device, and the first core network device receives the handover request confirmation message from the control plane entity of the first access network device.
  • the first core network device forwards the handover request confirmation message to the second access network device, and the second access network device receives the handover request confirmation message from the first core network device.
  • the first access network device sends the handover request confirmation message to the second access network device, which needs to pass through the first core network device. Device forwarding.
  • the second access network device sends a handover command to the terminal device, and the terminal device receives the handover command from the second access network device.
  • S708 refer to S307 in the process shown in FIG. 3. Among them, S705 to S708 are optional steps, which are not necessary to be performed, and are represented by dashed lines in FIG. 6.
  • one or more steps of S308 to S313 in the process shown in FIG. 3 can also be executed, that is, one or more steps related to cell handover can also be executed, of course, during the execution process
  • the access network devices cannot communicate directly, and need to be forwarded through the first core network device.
  • the embodiment of the present application does not limit which steps related to cell handover need to be performed.
  • control plane entity and the user plane entity of the first access network device are two network entities, and the control plane entity is located on the access network side, and the user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • control plane entity is located on the access network side
  • user plane entity is located on the core network side, so that the data is safely processed It will be done on the core network side.
  • the data After the data is securely processed (such as encryption or integrity protection) in the PDCP on the terminal device side, it is transmitted to the DU on the access network side, and after the DU is processed, it is transmitted to the user plane entity on the core network side, and in the PDCP of the user plane entity
  • the layer performs corresponding security processing (such as decryption or integrity verification), and then transmits it to the UPF on the core network side; and the signaling is transmitted from the RRC layer of the terminal device to the PDCP layer of the terminal device, and the security processing is performed on the PDCP layer of the terminal device.
  • security processing such as decryption
  • Or integrity verification submitted to the RRC layer of the control plane entity for analysis.
  • control signaling of the access layer is to assist the user plane data transmission.
  • What the user really cares about is the user plane data, so the security processing of the user plane data is placed on the core network side to ensure the user plane data first. Processing security, and by isolating the user plane and the control plane's security processing process, it can further ensure that the access network side cannot obtain the key for the secure processing of user plane data, which can significantly reduce the security risk of user plane data.
  • each of the embodiment shown in FIG. 5 to the embodiment shown in FIG. 7 separates the control plane entity and the user plane entity of the access network device, thereby improving data security.
  • the embodiment of the present application provides a method for sending and receiving data packets. In this method, the control plane entity and the user plane entity of the access network device do not need to be separated, and data security can also be improved. Please refer to Figure 8 for a flowchart of this method. In the following introduction process, take the method applied to the network architecture shown in FIG. 4A, FIG. 4B or FIG. 4C as an example.
  • the cell handover procedure involved in the embodiment of the present application is a cross-base station cell handover procedure based on the Xn interface between the base stations.
  • the method is executed by the first device and the second device as an example, where the first device is the data packet sending end and the second device is the data packet receiving end.
  • the first device is a terminal device and the second device is an access network device; or, the first device is an access network device and the second device is a terminal device.
  • the core network device described in the embodiment of the present application is, for example, the one shown in FIG. 4A, FIG. 4B, or FIG. 4C
  • the AMF in the network architecture may also be other core network equipment other than AMF and UPF.
  • the access network equipment described in this embodiment of the application may be in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C
  • the terminal device described in the embodiment of the present application may be the terminal device in the network architecture shown in FIG. 4A, FIG. 4B, or FIG. 4C.
  • the first device obtains the first data packet.
  • S801 may be that the first protocol layer of the first device obtains the first data packet.
  • the first protocol layer is a newly added protocol layer in the embodiment of the present application, and may also be called a security layer (security layer), or may also have other names.
  • the first protocol layer can be located above the PDCP layer, as well as located below the IP layer and the industrial media access control (media access control, MAC) layer.
  • the industrial MAC layer is not the MAC layer located above the physical layer in the air interface protocol stack
  • the industrial MAC layer is located above the first protocol layer
  • the first protocol layer is located above the MAC layer of the air interface protocol stack.
  • the functional structure of the industrial MAC layer and the MAC layer of the air interface protocol stack are different.
  • the first data packet is, for example, an IP packet or an Ethernet packet.
  • the first device is the sender of the first data packet. If the first data packet is an IP packet, then the IP layer of the first device can generate the first data packet and send the first data packet to the first device. The first protocol layer. Or, if the first data packet is an Ethernet packet, the industrial MAC layer of the first device may generate the first data packet and send the first data packet to the first protocol layer of the first device.
  • the first device uses the first key to perform security processing on the first data packet at the first protocol layer to obtain the second data packet.
  • the security processing here may include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption.
  • integrity protection integrity verification
  • encryption integrity verification
  • decryption integrity verification and decryption on the first data packet at the first protocol layer.
  • the first device is the sender of the first data packet as an example.
  • the first device Before the first device uses the first key to perform security processing on the first data packet at the first protocol layer, it first needs to obtain the first key.
  • a root key for example, the second root key introduced in S504 in the embodiment shown in FIG. 5
  • the terminal device can pair according to the first rule The root key is deduced to obtain the first key.
  • the first device is a core network device, for the core network device, there is also a key corresponding to the terminal device, such as a third key.
  • the core network device is an AMF, and the core network device corresponds to the terminal device.
  • the key (that is, the third key) of the terminal device is K AMF , that is, the fourth key described in S501 in the embodiment shown in FIG. 5.
  • the key of the core network device corresponding to the terminal device refers to the key used by the core network device when communicating with the terminal device, or refers to the key that can be used to determine whether the core network device is communicating with the terminal device.
  • the key used in communication can be understood as that the core network device can use the corresponding terminal device when communicating with different terminal devices, which is used to secure the access layer control plane signaling and user plane data.
  • the processed key is processed securely.
  • the core network device may derive the third key according to the first rule to obtain the first key.
  • the first rule may be configured by the core network device, or determined through negotiation between the terminal device and the core network device, or specified through an agreement.
  • the terminal device can interact with the core network device to ensure that the first rule used by both parties is consistent.
  • the first key may include the first subkey, and the first subkey is used for A protocol layer performs integrity protection or integrity verification on data packets. If the first device uses the first key to encrypt or decrypt the first data packet at the first protocol layer, the first key may include a second subkey, and the second subkey is used to pair at the first protocol layer The data packet is encrypted or decrypted. That is, the first key may include the first subkey, or include the second subkey, or include the first subkey and the second subkey. Or, if the security processing further includes other security processing procedures, the first key may also include the corresponding keys of other security processing procedures.
  • the data packet is an IP packet or an Ethernet packet as an example.
  • the PDCP layer of the sender of the data packet can compress the header of the data packet, for example, use the header compression protocol to compress the IP header or the Ethernet header , The length of the compressed header is shortened, which can save transmission resource overhead.
  • the embodiment of this application introduces the first protocol layer, which may cause a problem: the entire data packet is processed securely at the first protocol layer.
  • the PDCP layer After the first protocol layer submits the securely processed data packet to the PDCP layer, the PDCP layer cannot The header of the data packet is recognized, so that the header cannot be compressed, which will affect the compression function, and may cause a waste of transmission resources or even cause transmission errors.
  • the first device removes the header of the first data packet at the first protocol layer, or understood as separating the header and the load of the first data packet. After that, the first device uses the first key at the first protocol layer to perform security processing, such as encryption and/or integrity protection, on the load of the first data packet to obtain a securely encrypted load. The first device combines the header of the first data packet with the security-processed load at the first protocol layer, and calls the combined data packet the second data packet. Then, the header of the second data packet is the header of the first data packet, and the load of the second data packet is the load that has been safely processed. After that, the first protocol layer can deliver the second data packet to the PDCP layer of the first device. Since the header of the second data packet (that is, the header of the first data packet) has not undergone security processing, the PDCP layer of the first device can compress the header of the second data packet.
  • security processing such as encryption and/or integrity protection
  • the first device removes the header of the first data packet at the first protocol layer, or understood as separating the header and the load of the first data packet. After that, the first device compresses the header of the first data packet at the first protocol layer to obtain the compressed header. The first device combines the compressed header with the load of the first data packet at the first protocol layer to obtain a whole, and performs security processing on the whole, such as encryption and/or integrity protection, to obtain the second data packet, that is, the first data packet.
  • the second data packet is a data packet that has undergone security processing.
  • the first protocol layer then submits the second data packet to the PDCP layer of the first device.
  • the PDCP layer cannot decrypt or verify the integrity of the second data packet, so the PDCP layer No more compression operation is required.
  • the first device has compressed the header of the first data packet at the first protocol layer, so the transmission resource overhead can also be saved.
  • the first device may also use other methods to save transmission resource overhead, or, on the basis of improving security, the first device may not consider compressing the header of the data packet.
  • the first device uses the second key to perform security processing on the second data packet at the PDCP layer to obtain the third data packet.
  • the security processing in S803 can be called the second security processing
  • the security processing in S802 can be called the first security processing.
  • the security processing of the PDCP layer is called the second security processing.
  • the security processing at the protocol layer is called the first security processing.
  • the second security processing may also include one or more of the following processing methods: integrity protection, integrity verification, encryption, or decryption. If the first device is the sender of the first data packet, the first device may perform integrity protection, or encryption, or integrity protection and encryption on the first data packet at the PDCP layer. Or, if the first device is the receiving end of the first data packet, the first device may perform integrity verification, or decryption, or integrity verification and decryption on the first data packet at the PDCP layer. In this embodiment of the present application, the first device is the sender of the first data packet as an example.
  • the first device is a terminal device.
  • a root key for example, the second root key introduced in S504 in the embodiment shown in FIG. 5
  • the terminal device can use the root key Perform deduction and get the second key.
  • the first device is a core network device, and for the core network device, there is also a key corresponding to the terminal device, for example, called the third key.
  • the core network device is AMF
  • the core network device corresponds to the terminal.
  • the key (that is, the third key) of the device is K AMF , that is, the fourth key described in S501 in the embodiment shown in FIG. 5.
  • the core network device can perform deduction based on the third key to obtain the second key.
  • the second key may include a third subkey, and the third subkey is used to pair at the PDCP layer The data packet is integrity protected or integrity verified. If the first device uses the second key to encrypt or decrypt the second data packet at the PDCP layer, the second key may include a fourth subkey, and the fourth subkey is used to encrypt the data packet at the PDCP layer Or decrypt. That is, the second key may include the third subkey, or include the fourth subkey, or include the third subkey and the fourth subkey. Or, if the second security processing further includes other security processing procedures, the second key may also include the corresponding keys of other security processing procedures.
  • the first device adopts the first solution at the first protocol layer in S802
  • the second data packet submitted by the first protocol layer to the PDCP layer is the header of the first data packet and the load after security processing.
  • the combined data packet may remove the header of the second data packet (ie, the header of the first data packet) at the PDCP layer, or understand it as separating the header and the load of the first data packet.
  • the first device compresses the header of the first data packet at the PDCP layer to obtain the compressed header, and then combines the compressed header with the security-processed load to obtain a whole, and the second key is used on the PDCP layer to perform the whole
  • the third data packet is obtained. In this way, the PDCP layer can continue to compress the header of the data packet, thereby saving transmission resource overhead.
  • the first device adopts the second solution at the first protocol layer in S802
  • the second data packet submitted by the first protocol layer to the PDCP layer is a data packet that has undergone the first security processing, and the PDCP layer cannot The first key is obtained, so the PDCP layer cannot perform operations such as decryption or integrity verification on the second data packet. Therefore, the first device will not perform compression and other processing on the header of the second data packet at the PDCP layer.
  • the first device uses the second key at the PDCP layer to perform the second security processing on the second data packet to obtain the third data packet. In this way, the header of the data packet is compressed at the first protocol layer, which can save transmission resource overhead.
  • the first device sends a third data packet, and correspondingly, the second device receives the third data packet from the first device.
  • the first device After the first device obtains the third data packet, it can send the third data packet, and the second device can receive the third data packet from the first device.
  • the second device uses the second key at the PDCP layer to perform third security processing on the third data packet to obtain the second data packet.
  • the second device After receiving the third data packet, the second device sends the third data packet to the PDCP layer of the second device. Then the second device can use the second key to perform the third security processing on the third data packet at the PDCP layer.
  • the second device is the receiving end of the third data packet.
  • the second device may perform integrity verification, or decryption, or integrity verification and decryption on the third data packet at the PDCP layer.
  • the third security process may include integrity verification, or decryption, or integrity verification and decryption.
  • the second data packet After the second device performs third security processing on the third data packet at the PDCP layer, the second data packet can be obtained.
  • the compressed packet header and the security processed load may be obtained. If this is the case, the second device can remove the header of the second data packet (that is, the header of the first data packet) at the PDCP layer, or understand that the header of the first data packet and the security processed Load separation. After that, the second device decompresses the compressed header at the PDCP layer to obtain the header, which is the header of the first data packet. The second device combines the packet header and the security-processed load at the PDCP layer to obtain the second data packet.
  • the second data packet can be obtained.
  • the second data packet as a whole is processed by the first security processing, then The second device does not need to perform other processing on the second data packet at the PDCP layer.
  • the second device does not set the first protocol layer and cannot obtain the corresponding key. Therefore, the first device cannot perform processing such as decryption or integrity protection on the second data packet.
  • the second device sends the second data packet to the core network device, and the core network device receives the second data packet from the second device.
  • the core network device uses the first key to perform fourth security processing on the second data packet at the first protocol layer to obtain the first data packet.
  • the core network device can remove the header of the first data packet at the first protocol layer, or it can be understood as The header of the data packet is separated from the payload after security processing. After that, the core network device performs fourth security processing on the security-processed load at the first protocol layer, such as decryption and/or integrity verification, to obtain the load of the first data packet. The core network device then combines the header of the first data packet and the load of the first data packet at the first protocol layer to obtain the first data packet, so that the core network device can obtain the data included in the first data packet.
  • the core network device performs fourth security processing on the second data packet at the first protocol layer, such as decryption and/or integrity verification, to obtain the first The payload and compressed header of the data packet.
  • the core network device can remove the compressed header at the first protocol layer, or it can be understood as separating the compressed header from the load of the first data packet. After that, the core network device decompresses the compressed header to obtain the header of the first data packet. The core network device then combines the header of the first data packet and the load of the first data packet at the first protocol layer to obtain the first data packet, so that the core network device can obtain the data included in the first data packet.
  • the key used in the fourth security process is also the first key.
  • the first device is a terminal device
  • the second device is an access network device
  • the first data packet is an uplink data packet sent by the terminal device.
  • the access network equipment After being processed by the access network equipment, it will be sent to the core network equipment.
  • the data packet first undergoes the first security processing of the first protocol layer on the terminal device side, is transmitted to the PDCP layer of the terminal device for second security processing, and then is transmitted to the access network device.
  • the data packet received by the access network device has undergone two-level security processing of the first protocol layer and the PDCP layer, and because the access network device has not set the first protocol layer, it can only unlock the terminal device’s security processing at the PDCP layer. Therefore, the access network device still cannot read the content of the data packet, thereby ensuring the security of the data on the access network device side.
  • the core network equipment such as UPF.
  • the core network equipment also sets the first protocol layer.
  • the first protocol layer of the core network equipment is used to communicate with the first protocol layer of the terminal device.
  • the content of the data packet can be read only after the corresponding security processing (for example, the fourth security processing).
  • the first device is a core network device
  • the second device is an access network device
  • the first data packet is a downlink data packet sent by the core network device
  • the downlink data packet is processed by the access network device , Will be sent to the terminal device again. That is, if it is a downlink transmission process, then S806 is that the second device sends the second data packet to the terminal device, and the terminal device receives the second data packet from the second device.
  • S807 is that the terminal device performs fourth security processing on the second data packet at the first protocol layer to obtain the first data packet.
  • the data packet first undergoes the first security processing of the first protocol layer on the core network device side, is transmitted to the PDCP layer of the core network device for second security processing, and then is transmitted to the access network device.
  • the data packet received by the access network device has undergone two-level security processing of the first protocol layer and the PDCP layer. Since the access network device has not set the first protocol layer, it can only unlock the security of the core network device at the PDCP layer. Therefore, the access network device still cannot read the content of the data packet, thereby ensuring the security of the data on the access network device side.
  • After the data is processed by the access network device it is transmitted to the terminal device.
  • the terminal device also sets the first protocol layer.
  • the first protocol layer of the terminal device performs the security processing corresponding to the first protocol layer of the core network device (for example, After the fourth security process), the content of the data packet can be read.
  • a two-level security processing mechanism is set for data packets, and the access network device can only perform one level of security processing (that is, the security processing of the PDCP layer), but cannot perform the security of the first protocol layer. deal with. Therefore, the data is invisible to the access network equipment, and the access network equipment cannot obtain the data, thereby ensuring the security of the data on the access network equipment side.
  • FIG. 10 is a schematic block diagram of a communication device 1000 according to an embodiment of the application.
  • the communication apparatus 1000 is, for example, a core network device 1000.
  • the core network device 1000 is, for example, the first core network device described in any one of the embodiment shown in FIG. 5 to the embodiment shown in FIG. 7.
  • the core network device 1000 includes a processing module 1010 and a transceiver module 1020.
  • the core network device 1000 may be a core network device, or may be a chip applied to the core network device or other combination devices, components, etc. having the functions of the core network device described above.
  • the transceiver module 1020 may be a transceiver, and the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1010 may be a processor (or processing circuit), such as a baseband processor, baseband processing
  • the processor may include one or more central processing units (central processing units, CPUs).
  • the transceiver module 1020 may be a radio frequency unit, and the processing module 1010 may be a processor (or processing circuit), such as a baseband processor.
  • the transceiver module 1020 may be an input/output interface of a chip (for example, a baseband chip), and the processing module 1010 may be a processor (or processing circuit) of the chip system, and may include one or more central Processing unit.
  • processing module 1010 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component (or processing circuit), and the transceiver module 1020 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1010 may be used to perform all operations other than the transceiving operations performed by the first core network device in the embodiment shown in FIG. 5, such as S501 and S502, and/or to support the operations described herein.
  • Other processes of technology such as S501 and S502, and/or to support the operations described herein.
  • the transceiving module 1020 may be used to perform all the transceiving operations performed by the first core network device in the embodiment shown in FIG. 5, such as S503 and S504, and/or other processes used to support the technology described herein.
  • the processing module 1010 may be used to perform all operations other than the transceiving operations performed by the first core network device in the embodiment shown in FIG. 6, such as S603 and S604, and/or to support the descriptions described herein.
  • Other processes of the technology such as S601, S605, and S606, and/or other processes used to support the technology described herein.
  • the processing module 1010 may be used to perform all operations performed by the first core network device in the embodiment shown in FIG. 7 except for the transceiving operations, such as S702 and S703, and/or to support the operations described herein.
  • the transceiver module 1020 can be used to perform all the transceiver operations performed by the first core network device in the embodiment shown in FIG. 7, such as S701, S704, S705, S706, and S707, and/or to support the technology described herein Other processes.
  • the transceiver module 1020 can be a functional module that can complete both sending and receiving operations.
  • the transceiver module 1020 can be used to perform the steps in the embodiment shown in FIG. 5 to the embodiment shown in FIG. 7 In any embodiment, all sending operations and receiving operations performed by the first core network device.
  • the transceiver module 1020 when performing a sending operation, can be considered as a sending module, and when performing a receiving operation, the transceiver module 1020 can be considered It is a receiving module; or, the transceiver module 1020 can also be two functional modules.
  • the transceiver module 1020 can be regarded as a collective term for these two functional modules.
  • the two functional modules are the sending module and the receiving module.
  • the sending module is used to complete the transmission.
  • the sending module can be used to perform all the sending operations performed by the first core network device in any one of the embodiments shown in FIG. 5 to the embodiment shown in FIG. 7, and the receiving module is used to complete receiving Operations, for example, the receiving module may be used to perform all receiving operations performed by the first core network device in any one of the embodiments shown in FIG. 5 to the embodiment shown in FIG. 7.
  • processing module 1010 is used to obtain the first key
  • the processing module 1010 is further configured to perform deduction according to the first key to obtain a second key and a third key, and the second key is used to securely process the control plane signaling of the terminal device.
  • the third key is used to securely process the user plane data of the terminal device;
  • the transceiver module 1020 is configured to send the second key to the control plane entity of the first access network device, and send the third key to the user plane entity of the first access network device,
  • the control plane entity of the first access network device performs control plane signaling communication with the terminal device
  • the user plane entity of the first access network device performs user plane data communication with the terminal device.
  • control plane entity of the first access network device is located on the side of the first access network device, and the user plane entity of the first access network device is located on the side of the core network device.
  • the first key is obtained according to a first root key corresponding to the terminal device, and the first root key is stored in a core network device.
  • the transceiver module 1020 is further configured to receive input parameters from a second access network device, where the input parameters are used to determine the first key, where the second access The network equipment is the source access network equipment of the terminal equipment during cell handover, and the first access network equipment is the target access network equipment of the terminal equipment during cell handover.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request the terminal device to be handed over to the first cell, and the first cell is The target cell of the terminal device during cell handover.
  • the second key is included in a second handover request message, and the second handover request message is used to request the terminal device to be handed over to the first cell.
  • the transceiver module 1020 is further configured to send an NCC to the terminal device, where the NCC is used to determine the second key and/or the third key.
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • FIG. 11 is a schematic block diagram of a communication device 1100 according to an embodiment of the application.
  • the communication apparatus 1100 is, for example, an access network device 1100.
  • the access network device 1100 is, for example, the second access network device described in the embodiment shown in FIG. 6 or the embodiment shown in FIG. 7.
  • the access network device 1100 includes a processing module 1110.
  • a transceiver module 1120 may also be included.
  • the access network device 1100 may be an access network device, or may be a chip applied to the access network device or other combination devices, components, etc. having the functions of the access network device described above.
  • the transceiver module 1120 may be a transceiver
  • the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1110 may be a processor (or processing circuit), such as a baseband processor, One or more CPUs can be included in the baseband processor.
  • the transceiver module 1120 may be a radio frequency unit, and the processing module 1110 may be a processor (or a processing circuit), such as a baseband processor.
  • the transceiver module 1120 may be an input and output interface of a chip (such as a baseband chip), and the processing module 1110 may be a processor (or processing circuit) of the chip system, and may include one or more Central processing unit.
  • processing module 1110 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component (or, referred to as a processing circuit), and the transceiver module 1120 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1110 may be used to perform all operations performed by the second access network device in the embodiment shown in FIG. 6 except for the transceiving operation, such as determining to switch the terminal device to the first access network device, And/or other processes used to support the technology described herein.
  • the transceiver module 1120 can be used to perform all the transceiver operations performed by the second access network device in the embodiment shown in FIG. 6, such as S601, S602, S607, and S608, and/or for supporting the technology described herein Other processes.
  • the processing module 1110 may be used to perform all operations performed by the second access network device in the embodiment shown in FIG. 7 except for the transceiving operation, such as determining to switch the terminal device to the first access network device. , And/or other processes used to support the technology described herein.
  • the transceiver module 1120 can be used to perform all the transceiver operations performed by the second access network device in the embodiment shown in FIG. 7, such as S701, S707, and S708, and/or other processes used to support the technology described herein .
  • transceiver module 1120 reference may be made to the introduction of the implementation of the transceiver module 1020.
  • processing module 1110 is configured to determine to switch the terminal device from the second access network device to the first access network device
  • the transceiver module 1120 is configured to send input parameters to a first core network device, where the input parameters are used to determine a first key, and the first key is used to determine a second key and a third key.
  • the second key is used to perform security processing on the control plane signaling of the terminal device, and the third key is used to perform security processing on the user plane data of the terminal device.
  • the input parameter includes the PCI of the first cell and/or the ARFCN of the first cell, and the first cell is a target cell of the terminal device during cell handover.
  • the input parameter is included in a first handover request message, and the first handover request message is used to request the terminal device to be handed over to the first cell, and the first cell is The target cell of the terminal device during cell handover.
  • FIG. 12 is a schematic block diagram of a communication device 1200 according to an embodiment of the application.
  • the communication apparatus 1200 is, for example, the first device 1200.
  • the first device 1200 includes a processing module 1210.
  • a transceiver module 1220 may also be included.
  • the first device 1200 may be a terminal device, and may also be a chip applied in a terminal device or other combination devices, components, etc. having the above-mentioned terminal device functions.
  • the transceiver module 1220 may be a transceiver
  • the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1210 may be a processor (or processing circuit), such as a baseband processor or a baseband processor. Can include one or more CPUs.
  • the transceiver module 1220 may be a radio frequency unit, and the processing module 1210 may be a processor (or a processing circuit), such as a baseband processor.
  • the transceiver module 1220 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1210 may be a processor (or processing circuit) of the chip system, and may include one or more central Processing unit.
  • processing module 1210 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component (or, referred to as a processing circuit), and the transceiver module 1220 may be implemented by a transceiver or a transceiver-related circuit component.
  • the first device 1200 may be a network device, or may be a chip applied in a network device, or other combination devices, components, etc. having the functions of the above-mentioned network device.
  • the network device is a core network device.
  • the transceiver module 1220 may be a transceiver, the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1210 may be a processor (or processing circuit), such as a baseband processor or a baseband processor. It may include one or more central processing units (central processing units, CPUs).
  • the transceiver module 1220 may be a radio frequency unit, and the processing module 1210 may be a processor (or a processing circuit), such as a baseband processor.
  • the transceiver module 1220 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1210 may be a processor (or processing circuit) of the chip system, and may include one or more central Processing unit.
  • processing module 1210 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component (or processing circuit), and the transceiver module 1220 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1210 may be used to perform all operations other than the transceiving operations performed by the first device in the embodiment shown in FIG. 8, such as S801 to S803, and/or to support the technology described herein.
  • the transceiving module 1220 may be used to perform all the transceiving operations performed by the first device in the embodiment shown in FIG. 8, such as S804, and/or other processes used to support the technology described herein.
  • transceiver module 1220 reference may be made to the introduction of the implementation of the transceiver module 1020.
  • processing module 1210 is used to obtain the first data packet
  • the processing module 1210 is further configured to perform security processing on the first data packet using the first key at the first protocol layer to obtain a second data packet;
  • the processing module 1210 is further configured to encrypt the second data packet using a second key at the PDCP layer to obtain a third data packet;
  • the transceiver module 1220 is configured to send the third data packet.
  • the first key is obtained according to the first root key corresponding to the terminal device.
  • the processing module 1210 is configured to perform security processing on the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:
  • the processing module 1210 is configured to encrypt the second data packet using a second key at the PDCP layer in the following manner to obtain a third data packet:
  • the processing module 1210 is configured to perform security processing on the first data packet using the first key at the first protocol layer in the following manner to obtain the second data packet:
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • FIG. 13 is a schematic block diagram of a communication device 1300 according to an embodiment of the application.
  • the communication apparatus 1300 is the second device 1300, for example.
  • the second device 1300 includes a processing module 1310.
  • a transceiver module 1320 may also be included.
  • the second device 1300 may be an access network device, or may be a chip applied to the access network device or other combination devices or components having the functions of the access network device described above.
  • the transceiver module 1320 may be a transceiver, the transceiver may include an antenna and a radio frequency circuit, etc.
  • the processing module 1310 may be a processor (or processing circuit), such as a baseband processor, baseband
  • the processor may include one or more CPUs.
  • the transceiver module 1320 may be a radio frequency unit, and the processing module 1310 may be a processor (or a processing circuit), such as a baseband processor.
  • the transceiver module 1320 may be an input/output interface of a chip (such as a baseband chip), and the processing module 1310 may be a processor (or processing circuit) of the chip system, and may include one or more central Processing unit.
  • processing module 1310 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component (or referred to as a processing circuit), and the transceiver module 1320 may be implemented by a transceiver or a transceiver-related circuit component.
  • the processing module 1310 may be used to perform all operations performed by the second device in the embodiment shown in FIG. 8 except for the transceiving operation, such as S507, and/or other processes used to support the technology described herein .
  • the transceiver module 1320 can be used to perform all the transceiver operations performed by the second device in the embodiment shown in FIG. 8, such as S501, S503, S506, S512, and S513, and/or other technologies used to support the technology described herein. process.
  • transceiver module 1320 reference may be made to the introduction of the implementation of the transceiver module 1020.
  • the transceiver module 1320 is used to receive the third data packet
  • the processing module 1310 is configured to decrypt the third data packet using a second key at the PDCP layer to obtain a second data packet, where the second data packet is a data packet that has undergone security processing;
  • the transceiver module 1320 is further configured to send the second data packet to the core network device.
  • the processing module 1310 is configured to use the second key at the PDCP layer to decrypt the third data packet to obtain the second data packet in the following manner:
  • the security processing includes one or more of the following: integrity protection, integrity verification, encryption, or decryption.
  • the embodiment of the present application also provides a communication device, and the communication device may be a terminal device or a circuit.
  • the communication apparatus may be used to perform actions performed by a terminal device (for example, the first device may be a terminal device) in the foregoing method embodiment.
  • FIG. 14 shows a simplified schematic diagram of the structure of the terminal device. It is easy to understand and easy to illustrate.
  • the terminal device uses a mobile phone as an example.
  • the terminal equipment includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the terminal device, execute the software program, and process the data of the software program.
  • the memory is mainly used to store software programs and data.
  • the radio frequency circuit is mainly used for the conversion of baseband signal and radio frequency signal and the processing of radio frequency signal.
  • the antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, keyboards, etc., are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal devices may not have input and output devices.
  • the processor When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal to the outside in the form of electromagnetic waves through the antenna.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data.
  • FIG. 14 only one memory and processor are shown in FIG. 14. In an actual terminal device product, there may be one or more processors and one or more memories.
  • the memory may also be referred to as a storage medium or storage device.
  • the memory may be set independently of the processor, or may be integrated with the processor, which is not limited in the embodiment of the present application.
  • the antenna and radio frequency circuit with transceiving functions can be regarded as the transceiving unit of the terminal device (the transceiving unit can be a functional unit that can realize the sending and receiving functions; alternatively, the transceiving unit can also be It includes two functional units, namely a receiving unit capable of realizing the receiving function and a transmitting unit capable of realizing the transmitting function), and the processor with the processing function is regarded as the processing unit of the terminal device.
  • the terminal device includes a transceiving unit 1410 and a processing unit 1420.
  • the transceiving unit may also be referred to as a transceiver, a transceiver, a transceiving device, and so on.
  • the processing unit may also be called a processor, a processing board, a processing module, a processing device, and so on.
  • the device for implementing the receiving function in the transceiver unit 1410 can be regarded as the receiving unit, and the device for implementing the sending function in the transceiver unit 1410 as the sending unit, that is, the transceiver unit 1410 includes a receiving unit and a sending unit.
  • the transceiver unit may sometimes be referred to as a transceiver, a transceiver, or a transceiver circuit.
  • the receiving unit may sometimes be referred to as a receiver, a receiver, or a receiving circuit.
  • the sending unit may sometimes be called a transmitter, a transmitter, or a transmitting circuit.
  • the transceiver unit 1410 is configured to perform the sending and receiving operations on the first device side in the embodiment shown in FIG. 8, and the processing unit 1420 is used to perform other operations on the first device in the embodiment shown in FIG. 8 except for the receiving and sending operations.
  • the device may include a transceiver unit and a processing unit.
  • the transceiver unit may be an input/output circuit and/or a communication interface;
  • the processing unit is an integrated processor or microprocessor or integrated circuit.
  • the device shown in FIG. 15 can be referred to.
  • the device can perform functions similar to the processing module 1210 in FIG. 12.
  • the processing module 1210 in the foregoing embodiment may be the processor 1510 in FIG. 15 and complete corresponding functions;
  • the transceiver module 1220 in the foregoing embodiment may be the sending data processor 1520 in FIG. 15 and/or receiving data Processor 1530, and complete the corresponding functions.
  • the channel encoder and the channel decoder are shown in FIG. 15, it can be understood that these modules do not constitute a restrictive description of this embodiment, and are only illustrative.
  • the processing device 1600 includes modules such as a modulation subsystem, a central processing subsystem, and a peripheral subsystem.
  • the communication device in this embodiment can be used as a modulation subsystem therein.
  • the modulation subsystem may include a processor 1603 and an interface 1604.
  • the processor 1603 completes the function of the aforementioned processing module 1210
  • the interface 1604 completes the function of the aforementioned transceiver module 1220.
  • the modulation subsystem includes a memory 1606, a processor 1603, and a program stored on the memory 1606 and running on the processor.
  • the processor 1603 executes the program to implement the terminal device side in the above method embodiment. Methods.
  • the memory 1606 can be non-volatile or volatile, and its location can be located inside the modulation subsystem or in the processing device 1600, as long as the memory 1606 can be connected to the The processor 1603 is fine.
  • FIG. 17 is a schematic diagram of another communication device provided in an embodiment of this application, which is used to implement the operations of the first core network device, the second access network device, or the second device in the above embodiments.
  • the communication device includes a processor 1730 and a communication interface 1720.
  • the communication device further includes a memory 1710.
  • the communication interface 1720 is used to implement communication with other devices.
  • the method executed by the first core network device, the second access network device, or the second device may call the memory through the processor 1730 (which may be the first core network device, the second access network device, or the second device).
  • the memory 1710 in the second device may also be a program stored in an external memory). That is, the apparatus used for the first core network device, the second access network device, or the second device may include the processor 1730, and the processor 1730 executes the first step in the above method embodiment by calling a program in the memory.
  • the processor here may be an integrated circuit with signal processing capability, such as a CPU.
  • the apparatus for the first core network device, the second access network device, or the second device may be implemented by one or more integrated circuits configured to implement the above method.
  • the above implementations can be combined.
  • the function/implementation process of the processing module 1010 in FIG. 10 can be implemented by the processor 1730 in the communication device 1700 shown in FIG.
  • the function/implementation process can be implemented through the communication interface 1720 in the communication device 1700 shown in FIG. 17.
  • the function/implementation process of the processing module 1110 in FIG. 11 can be implemented by the processor 1730 in the communication device 1700 shown in FIG.
  • the function/implementation process can be implemented through the communication interface 1720 in the communication device 1700 shown in FIG. 17.
  • the function/implementation process of the processing module 1210 in FIG. 12 can be implemented by the processor 1730 in the communication device 1700 shown in FIG.
  • the function/implementation process can be implemented through the communication interface 1720 in the communication device 1700 shown in FIG. 17.
  • the function/implementation process of the processing module 1310 in FIG. 13 can be implemented by the processor 1730 in the communication device 1700 shown in FIG.
  • the function/implementation process can be implemented through the communication interface 1720 in the communication device 1700 shown in FIG. 17.
  • the computer may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)).
  • the various illustrative logic units and circuits described in the embodiments of this application can be implemented by general-purpose processors, digital signal processors, application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, Discrete gates or transistor logic, discrete hardware components, or any combination of the above are designed to implement or operate the described functions.
  • the general-purpose processor may be a microprocessor.
  • the general-purpose processor may also be any traditional processor, controller, microcontroller, or state machine.
  • the processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, multiple microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration. accomplish.
  • the steps of the method or algorithm described in the embodiments of the present application can be directly embedded in hardware, a software unit executed by a processor, or a combination of the two.
  • the software unit can be stored in random access memory (RAM), flash memory, read-only memory (ROM), EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROM or this In any other form of storage media in the field.
  • the storage medium may be connected to the processor, so that the processor can read information from the storage medium, and can store and write information to the storage medium.
  • the storage medium may also be integrated into the processor.
  • the processor and the storage medium can be arranged in the ASIC.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.
  • the foregoing functions described in the embodiments of the present application may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted on a computer-readable medium in the form of one or more instructions or codes.
  • Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general-purpose or special computer.
  • Such computer-readable media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other device that can be used to carry or store instructions or data structures and Other program code media that can be read by general-purpose or special computers, or general-purpose or special processors.
  • any connection can be appropriately defined as a computer-readable medium, for example, if the software is from a website, server, or other remote source through a coaxial cable, fiber optic computer, twisted pair, or digital subscriber line (DSL) Or transmitted by wireless means such as infrared, wireless and microwave are also included in the definition of computer-readable media.
  • DSL digital subscriber line
  • the disks and discs include compressed disks, laser disks, optical discs, digital versatile discs (digital versatile discs, DVDs), floppy disks and Blu-ray discs. Disks are usually used to copy data magnetically, while discs are usually used to copy data. The laser performs optical reproduction of data. The combination of the above can also be contained in a computer readable medium.
  • the functions described in the embodiments of the present application may be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on the computer-readable medium.
  • the computer-readable medium includes a computer storage medium and a communication medium, where the communication medium includes any medium that facilitates the transfer of a computer program from one place to another.
  • the storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请涉及一种获取密钥的方法及装置。第一核心网设备获得第一密钥。第一核心网设备根据第一密钥进行推演，得到第二密钥和第三密钥，第二密钥用于对终端设备的控制面信令进行安全处理，第三密钥用于对终端设备的用户面数据进行安全处理。第一核心网设备将第二密钥发送给第一接入网设备的控制面实体，以及，将第三密钥发送给第一接入网设备的用户面实体。在本申请实施例中，第一接入网设备的控制面实体和第一接入网设备的用户面实体是不同的网络实体，从而能够将第一接入网设备的控制面处理过程和用户面处理过程相隔离，以此降低安全处理过程的风险。

Description

一种获取密钥的方法及装置
相关申请的交叉引用
本申请要求在2020年05月26日提交中国国家知识产权局、申请号为202010454178.9、申请名称为“一种获取密钥的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种获取密钥的方法及装置。
背景技术
无线通信的传输分为用户面传输和控制面传输，用户面传输主要是传输数据，而控制面传输主要是传输信令。在无线通信过程中，为了通信过程的安全性，发送端和接收端都要对数据和信令进行安全处理，例如发送端对数据进行加密，相应地接收端对数据进行解密，防止数据被第三方读取；发送端对数据进行完整性保护，相应地接收端对数据进行完整性验证，防止数据被第三方篡改。
在第五代移动通信技术(the 5th generation，5G)新空口(new radio，NR)系统中，可采用分离式基站架构，分离式基站可包括集中式单元(centralized unit，CU)和分布式单元(distributed unit，DU)。接入层的安全处理包括控制面信令的安全处理和用户面数据的安全处理，目前接入层的安全处理均在无线接入网(radio access network，RAN)侧进行，两种安全处理过程无法相互隔离，使得整个安全处理过程存在风险。
发明内容
本申请实施例提供一种获取密钥的方法及装置，用于将接入网设备的控制面处理过程和用户面处理过程相隔离，以降低安全处理过程的风险。
第一方面，提供第一种获取密钥的方法，该方法包括：第一核心网设备获得第一密钥；所述第一核心网设备根据所述第一密钥进行推演，得到第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理；所述第一核心网设备将所述第二密钥发送给第一接入网设备的控制面实体，以及，将所述第三密钥发送给所述第一接入网设备的用户面实体，所述第一接入网设备的控制面实体与所述终端设备进行控制面信令通信，所述第一接入网设备的用户面实体与所述终端设备进行用户面数据通信。
该方法可由第一通信装置执行，第一通信装置可以是通信设备或能够支持通信设备实现该方法所需的功能的通信装置，例如芯片。示例性地，所述第一通信装置为网络设备，或者为设置在网络设备中的用于实现网络设备的功能的芯片，或者为用于实现网络设备的功能的其他部件。在下文的介绍过程中，以第一通信装置是网络设备为例。示例性地，所述网络设备为核心网设备。
在本申请实施例中，第一接入网设备的控制面实体和第一接入网设备的用户面实体是 不同的网络实体，从而能够将第一接入网设备的控制面处理过程和用户面处理过程相隔离，以此降低安全处理过程的风险。具体来说，用于对控制面信令进行安全处理的第二密钥发送给控制面实体，而用于对用户面数据进行安全处理的第三密钥发送给用户面实体，这样，控制面实体和用户面实体将无法获得对方的密钥，从而无法破解对方的传输内容，达到将第一接入网设备的控制面处理过程和用户面处理过程相隔离的效果，降低了整个系统的安全风险。
在一种可选的实施方式中，所述第一接入网设备的控制面实体位于所述第一接入网设备侧，所述第一接入网设备的用户面实体位于核心网设备侧。
由于接入网设备由设备商提供，由运营商部署，一般部署在户外，所以如果接入网设备能够读取用户数据的话，会对数据安全造成一定的风险。那么，即使用户面数据和控制面信令的安全处理虽然相互隔离，但是如果用户面实体和控制面实体仍然都处于接入网侧，用户的数据依然会有安全风险。因此在本申请实施例中，第一接入网设备的控制面实体可位于接入网侧，第一接入网设备的用户面实体可位于核心网侧。一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
在一种可选的实施方式中，所述第一密钥为根据与所述终端设备对应的第一根密钥得到的，所述第一根密钥存储在核心网设备中。
在核心网侧，可以预先存储每个终端设备对应的根密钥，然后至少一个核心网设备可以基于该根密钥进行一步步的推演过程，从而得到不同设备或者不同安全过程中所需用到的密钥。例如第一核心网设备能够获得该终端设备对应的根密钥，例如称为第一根密钥。第一核心网设备可以根据第一根密钥进行推演，或者，第一核心网设备可以根据由第一根密钥推演得到的密钥进行进一步推演，得到第一核心网设备所使用的密钥，例如称为第四密钥。第一核心网设备再根据第四密钥进行推演，可以得到第一密钥，也可以根据第四密钥进行推演得到其他密钥，例如得到用于非接入层通信过程中进行安全处理的密钥。
在一种可选的实施方式中，所述方法还包括：
所述第一核心网设备接收来自第二接入网设备的输入参数，所述输入参数用于确定所述第一密钥，其中，所述第二接入网设备为所述终端设备在进行小区切换时的源接入网设备，所述第一接入网设备为所述终端设备在进行小区切换时的目标接入网设备。
在小区切换过程中，终端设备从第二接入网设备的小区切换到第一接入网设备的小区进行通信，为了保护不同的接入网设备之间安全处理过程的独立性，第一接入网设备和第二接入网设备在与该终端设备通信时所使用的用于安全处理的密钥不能相同。例如，第一接入网设备在与该终端设备通信时使用的密钥，可以根据第二接入网设备对应于该终端设备的密钥进行推演。在本申请实施例中考虑到接入网设备侧潜在的安全风险，需要核心网设备进行密钥推演过程，因此第二接入网设备需要将推演第一接入网设备使用的密钥所需的输入参数发送给第一核心网设备，由第一核心网设备推演第一接入网设备使用的密钥，推演以后将第一接入网设备所使用的密钥发送给第一接入网设备。
在一种可选的实施方式中，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
例如，输入参数可以包括第一小区的PCI，或包括第一小区的频率，或包括第一小区的PCI和第一小区的频率。或者输入参数还可以包括其他的信息，只要输入参数能够用于确定第一密钥即可。第一小区的频率例如为第一小区的ARFCN。
在一种可选的实施方式中，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
例如，所述的小区切换过程是基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，那么第二接入网设备在确定终端设备进行小区切换时，可以向第一核心网设备发送切换请求消息，以通过第一核心网设备将该切换请求消息转发给第一接入网设备。可选的，在第二接入网设备发送给第一核心网设备的切换请求消息中，可以包括所述的输入参数，可理解为，第二接入网设备向第一核心网设备发送切换请求消息，例如称为第一切换请求消息，第一核心网设备接收来自第二接入网设备的第一切换请求消息，第一切换请求消息包括输入参数。也就是说，本申请实施例无需新增消息，而是可通过已有的切换请求消息将输入参数发送给第一核心网设备，更有利于与现有的方案兼容，且能够节省信令开销。
在一种可选的实施方式中，所述第二密钥包括在第二切换请求消息中，所述第二切换请求消息用于请求将所述终端设备切换到所述第一小区。
例如，所述的小区切换过程是基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，那么第一核心网设备在接收来自第二接入网设备的第一切换请求消息后，如果按照现有技术，则第一核心网设备会将第一切换请求消息转发给第一接入网设备。那么本申请实施例可以利用这个流程，例如第一核心网设备可以生成第二切换请求消息，第二切换请求消息包括第二密钥，第一核心网设备将第二切换请求消息发送给第一接入网设备，从而就将第二密钥发送给了第一接入网设备。例如，第一核心网设备可以在第一切换请求消息中添加第二密钥，得到第二切换请求消息，通过这种方式，不仅实现了将第一切换请求消息转发给第一接入网设备的目的，还将第二密钥也发送给了第一接入网设备，从而无需通过新增的消息将第二密钥发送给第一接入网设备，有助于与现有的方案兼容，且能够减小信令开销。
在一种可选的实施方式中，所述方法还包括：
第一核心网设备向所述终端设备发送NCC，所述NCC用于确定所述第二密钥和/或所述第三密钥。
终端设备可以根据NCC确定所使用的密钥，来保证与网络侧所使用的密钥一致。NCC具有计数功能，不同的NCC值对应不同的密钥推演过程或者不同的密钥推演次数。例如，NCC可用于指示第一核心网设备推演第一密钥的推演次数，或者，NCC可用于指示第一核心网设备根据推演第一密钥的推演轨迹，或者说推演过程记录。终端设备内置有该终端设备的根密钥，例如称为第二根密钥，第二根密钥和第一根密钥可以是同一根密钥，或者也可以是不同的根密钥。终端设备能够根据第二根密钥采用与核心网设备相同的推演方式，推演得到终端设备所使用的密钥。其中，终端设备在获得NCC后，可依据NCC的指示，确定核心网设备的推演方式，使得终端设备和第一接入网设备所使用的密钥一致。例如，NCC指示推演次数为n，则终端设备推演n次得到第一密钥，n为正整数，终端设备可以进一步得到第二密钥和第三密钥；又例如，NCC指示推演轨迹或推演过程记录，则终端设 备可按照相同的轨迹或相同的推演过程进行推演得到第一密钥，进一步得到第二密钥和第三密钥。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
本申请实施例所述的第一接入网设备的控制面实体或用户面实体的安全处理，可以包括如下的一种或多种处理方式：完整性保护、完整性验证、加密、或解密。
第二方面，提供第二种获取密钥的方法，该方法包括：第二接入网设备确定将终端设备从第二接入网设备切换到第一接入网设备；所述第二接入网设备向第一核心网设备发送输入参数，所述输入参数用于确定第一密钥，所述第一密钥用于确定第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理。
该方法可由第二通信装置执行，第二通信装置可以是通信设备或能够支持通信设备实现该方法所需的功能的通信装置，例如芯片。示例性地，所述第二通信装置为网络设备，或者为设置在网络设备中的用于实现网络设备的功能的芯片，或者为用于实现网络设备的功能的其他部件。示例性地，所述网络设备为接入网设备，例如称为第二接入网设备。在下文的介绍过程中，以第二通信装置是第二接入网设备为例。
在一种可选的实施方式中，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
在一种可选的实施方式中，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
关于第二方面或各种可能的实施方式所带来的技术效果，可参考对于第一方面或相应的实施方式的技术效果的介绍。
第三方面，提供一种数据包发送方法，该方法包括：获得第一数据包；在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包；在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包；发送所述第三数据包。
该方法可由第三通信装置执行，第三通信装置可以是通信设备或能够支持通信设备实现该方法所需的功能的通信装置，例如芯片。示例性地，所述第三通信装置为终端设备，或者为设置在终端设备中的用于实现终端设备的功能的芯片，或者为用于实现终端设备的功能的其他部件。或者，示例性地，所述第三通信装置为网络设备，或者为设置在网络设备中的用于实现网络设备的功能的芯片，或者为用于实现网络设备的功能的其他部件，例如所述网络设备为核心网设备。
在本申请实施例中，对数据包设置了两级安全处理的机制，对于接入网设备来说，只能进行其中的一级安全处理(即PDCP层的安全处理)，而无法进行第一协议层的安全处理。因此数据对于接入网设备来说是不可见的，接入网设备无法获取数据，从而保证了数据在接入网设备侧的安全性。
在一种可选的实施方式中，所述第一密钥为根据与终端设备对应的第一根密钥得到的。
第一设备在第一协议层使用第一密钥对第一数据包进行安全处理之前，首先需要获得第一密钥。如果第一设备为终端设备，对于终端设备来说，可以内置根密钥，终端设备可按照第一规则对该根密钥进行推演，得到第一密钥。或者，如果第一设备为核心网设备， 对于核心网设备来说，也有对应于该终端设备的密钥，例如称为第三密钥，例如核心网设备为AMF，则核心网设备对应于该终端设备的密钥(即第三密钥)为K AMF。其中，核心网设备对应于该终端设备的密钥，是指核心网设备在与该终端设备通信时所使用的密钥，或者是指，根据该密钥能够确定核心网设备在与该终端设备通信时所使用的密钥，对此可以理解为，核心网设备在与不同的终端设备通信时可以使用对应于相应终端设备的，用于对接入层控制面信令和用户面数据进行安全处理的密钥，进行安全处理。核心网设备可以根据第一规则对第三密钥进行推演，得到第一密钥。第一规则可以是核心网设备配置的，或者是终端设备与核心网设备协商确定的，或者是通过协议规定的。另外，可选的，终端设备可以与核心网设备进行交互，来保证双方所用的第一规则是一致的。
在一种可选的实施方式中，在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包，包括：
在所述第一协议层，使用第一密钥对所述第一数据包的负载进行所述安全处理，得到安全处理后的负载；
将所述第一数据包的包头与所述安全处理后的负载组合，得到所述第二数据包。
以数据包是IP包或以太包为例。数据包的发送端在对一个数据包进行处理时，为了节省传输资源开销，数据包的发送端的PDCP层可以对该数据包的包头进行压缩，例如使用头压缩协议对IP包头或者以太包头进行压缩，压缩后的包头的长度缩短，可以节省传输资源开销。本申请实施例引入了第一协议层，这可能会导致一个问题：整个数据包在第一协议层进行安全处理，第一协议层将安全处理后的数据包递交到PDCP层后，PDCP层无法识别出该数据包的包头，从而无法对包头进行压缩。为此，本申请实施例提供一种解决方式，第一设备在第一协议层将第一数据包的包头移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在第一协议层使用第一密钥对第一数据包的负载进行安全处理，例如加密和/或完整性保护等，得到安全加密后的负载。第一设备在第一协议层再将第一数据包的包头与安全处理后的负载组合，将组合后的数据包称为第二数据包。那么，第二数据包的包头就是第一数据包的包头，第二数据包的负载是已经过安全处理的负载。之后，第一协议层可将第二数据包递交给第一设备的PDCP层。由于第二数据包的包头(即，第一数据包的包头)并未经过安全处理，因此第一设备的PDCP层能够对第二数据包的包头进行压缩。由此，PDCP层能够正常对包头进行压缩，以节省传输开销。
在一种可选的实施方式中，在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包，包括：
在所述PDCP层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第二密钥对所述压缩包头与所述安全处理后的负载进行加密，得到所述第三数据包。
如果第二数据包是包括了第一数据包的包头与安全处理后的负载组合，则第一设备可以在PDCP层将第二数据包的包头(即，第一数据包的包头)移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在PDCP层对第一数据包的包头进行压缩，得到压缩包头，再将压缩包头和安全处理后的负载组合，得到一个整体，在PDCP层使用第二密钥对这个整体进行第二安全处理，得到第三数据包。通过这种方式，在PDCP层可以继续对数据包的包头进行压缩，从而能够节省传输资源开销。
在一种可选的实施方式中，在第一协议层使用第一密钥对所述第一数据包进行安全处 理，得到第二数据包，包括：
在所述第一协议层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第一密钥对所述压缩包头与所述第一数据包的负载进行所述安全处理，得到所述第二数据包。
第一设备在第一协议层将第一数据包的包头移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在第一协议层将第一数据包的包头进行压缩，得到压缩包头。第一设备在第一协议层将压缩包头与第一数据包的负载组合，得到一个整体，对这个整体进行安全处理，例如加密和/或完整性保护等，得到第二数据包，即，第二数据包是经过安全处理的数据包。第一协议层再将第二数据包递交给第一设备的PDCP层，由于第二数据包是经过安全处理的，PDCP层无法对第二数据包进行解密或完整性验证等处理，因此PDCP层无需再进行压缩操作。但第一设备已在第一协议层对第一数据包的包头进行了压缩，因此同样能节省传输资源开销。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
此处的安全处理(例如称为第一安全处理)，可以包括如下的一种或多种处理方式：完整性保护、完整性验证、加密、或解密。例如，第一设备是第一数据包的发送端，则第一设备可以在第一协议层对第一数据包进行完整性保护，或者进行加密，或者进行完整性保护和加密。又例如，第一设备是第一数据包的接收端，则第一设备可以在第一协议层对第一数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密。本申请实施例以第一设备是第一数据包的发送端为例。
第四方面，提供一种数据包接收方法，该方法包括：接收第三数据包；在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包，所述第二数据包为经过安全处理的数据包；将所述第二数据包发送给核心网设备。
该方法可由第四通信装置执行，第四通信装置可以是通信设备或能够支持通信设备实现该方法所需的功能的通信装置，例如芯片。示例性地，所述第四通信装置为第二设备。示例性地，所述第二设备为网络设备，或者为设置在网络设备中的用于实现网络设备的功能的芯片，或者为用于实现网络设备的功能的其他部件，例如所述网络设备为接入网设备。
其中，如果第二数据包的发送端是终端设备，接收端是核心网设备，则所述方法可以是将第二数据包发送给核心网设备；或者，如果第二数据包的发送端是核心网设备，接收端是终端设备，则所述方法可以是将第二数据包发送给终端设备。在本申请实施例中，对数据包设置了两级安全处理的机制，对于中间设备(例如接入网设备)来说，只能进行其中的一级安全处理(即PDCP层的安全处理)，而无法进行第一协议层的安全处理。因此数据对于接入网设备来说是不可见的，接入网设备无法获取数据，从而保证了数据在接入网设备侧的安全性。
在一种可选的实施方式中，在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包，包括：
在所述PDCP层，使用第二密钥解密所述第三数据包，得到压缩包头和安全处理后的负载；
将所述压缩包头进行解压缩，得到包头；
将所述包头和所述安全处理后的负载组合，得到所述第二数据包。
第二设备接收第三数据包后，将第三数据包送达第二设备的PDCP层。则第二设备在PDCP层可使用第二密钥对第三数据包进行第三安全处理，第三安全处理例如为解密。如果第二设备在PDCP层对第三数据包进行第三安全处理后得到了压缩包头和安全处理后的负载，则第二设备可以在PDCP层将第二数据包的包头(即，第一数据包的包头)移除，或者理解为，将第一数据包的包头和安全处理后的负载分离。之后，第二设备在PDCP层将压缩包头进行解压缩，得到包头，该包头为第一数据包的包头。第二设备在PDCP层将该包头和安全处理后的负载进行组合，可得到第二数据包。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
此处的安全处理(例如称为第一安全处理)，可以包括如下的一种或多种处理方式：完整性保护、完整性验证、加密、或解密。例如，第一设备是第一数据包的发送端，则第一设备可以在第一协议层对第一数据包进行完整性保护，或者进行加密，或者进行完整性保护和加密。又例如，第一设备是第一数据包的接收端，则第一设备可以在第一协议层对第一数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密。本申请实施例以第一设备是第一数据包的发送端为例。
第五方面，提供一种通信装置，例如该通信装置为如前所述的第一通信装置。所述第一通信装置用于执行上述第一方面或任一可能的实施方式中的方法。具体地，所述第一通信装置可以包括用于执行第一方面或任一可能的实施方式中的方法的模块，例如包括处理模块，可选的，还可以包括收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第一通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为网络设备。示例性地，所述网络设备为核心网设备，例如第一核心网设备。下面以第一通信装置是第一核心网设备为例。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器(或者，处理电路)实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第一通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第一通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第五方面的介绍过程中，继续以所述第一通信装置是第一核心网设备，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于获得第一密钥；
所述处理模块，用于根据所述第一密钥进行推演，得到第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理；
所述收发模块，用于将所述第二密钥发送给第一接入网设备的控制面实体，以及，将所述第三密钥发送给所述第一接入网设备的用户面实体，所述第一接入网设备的控制面实体与所述终端设备进行控制面信令通信，所述第一接入网设备的用户面实体与所述终端设备进行用户面数据通信。
在一种可选的实施方式中，所述第一接入网设备的控制面实体位于所述第一接入网设 备侧，所述第一接入网设备的用户面实体位于核心网设备侧。
在一种可选的实施方式中，所述第一密钥为根据与所述终端设备对应的第一根密钥得到的，所述第一根密钥存储在核心网设备中。
在一种可选的实施方式中，所述收发模块，还用于接收来自第二接入网设备的输入参数，所述输入参数用于确定所述第一密钥，其中，所述第二接入网设备为所述终端设备在进行小区切换时的源接入网设备，所述第一接入网设备为所述终端设备在进行小区切换时的目标接入网设备。
在一种可选的实施方式中，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
在一种可选的实施方式中，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
在一种可选的实施方式中，所述第二密钥包括在第二切换请求消息中，所述第二切换请求消息用于请求将所述终端设备切换到所述第一小区。
在一种可选的实施方式中，所述收发模块，还用于向所述终端设备发送NCC，所述NCC用于确定所述第二密钥和/或所述第三密钥。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于第五方面或各种可选的实施方式所带来的技术效果，可参考对于第一方面或相应的实施方式的技术效果的介绍。
第六方面，提供一种通信装置，例如该通信装置为如前所述的第二通信装置。所述第二通信装置用于执行上述第二方面或任一可能的实施方式中的方法。具体地，所述第二通信装置可以包括用于执行第二方面或任一可能的实施方式中的方法的模块，例如包括处理模块，可选的，还可以包括收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第二通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为网络设备。示例性地，所述网络设备为接入网设备，例如第二接入网设备。示例性地，所述接入网设备为基站。下面以第二通信装置是第二接入网设备为例。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器(或者，处理电路)实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第二通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第二通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第六方面的介绍过程中，继续以所述第二通信装置是第二接入网设备，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于确定将终端设备从第二接入网设备切换到第一接入网设备；
所述收发模块，用于向第一核心网设备发送输入参数，所述输入参数用于确定第一密钥，所述第一密钥用于确定第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面 信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理。
在一种可选的实施方式中，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
在一种可选的实施方式中，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
关于第六方面或各种可选的实施方式所带来的技术效果，可参考对于第二方面或相应的实施方式的技术效果的介绍。
第七方面，提供一种通信装置，例如该通信装置为如前所述的第三通信装置。所述第三通信装置用于执行上述第三方面或任一可能的实施方式中的方法。具体地，所述第三通信装置可以包括用于执行第三方面或任一可能的实施方式中的方法的模块，例如包括处理模块，可选的，还可以包括收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第三通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为第一设备。示例性地，所述第一设备为终端设备。或者，示例性地，所述第一设备为核心网设备。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器(或者，处理电路)实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第三通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第三通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第七方面的介绍过程中，以所述处理模块和所述收发模块为例进行介绍。其中，
所述处理模块，用于获得第一数据包；
所述处理模块，还用于在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包；
所述处理模块，还用于在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包；
所述收发模块，用于发送所述第三数据包。
在一种可选的实施方式中，所述第一密钥为根据与终端设备对应的第一根密钥得到的。
在一种可选的实施方式中，所述处理模块用于通过如下方式在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包：
在所述第一协议层，使用第一密钥对所述第一数据包的负载进行所述安全处理，得到安全处理后的负载；
将所述第一数据包的包头与所述安全处理后的负载组合，得到所述第二数据包。
在一种可选的实施方式中，所述处理模块用于通过如下方式在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包：
在所述PDCP层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第二密钥对所述压缩包头与所述安全处理后的负载进行加密，得到所述第三数据包。
在一种可选的实施方式中，所述处理模块用于通过如下方式在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包：
在所述第一协议层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第一密钥对所述压缩包头与所述第一数据包的负载进行所述安全处理，得到所述第二数据包。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于第七方面或各种可选的实施方式所带来的技术效果，可参考对于第三方面或相应的实施方式的技术效果的介绍。
第八方面，提供一种通信装置，例如该通信装置为如前所述的第四通信装置。所述第四通信装置用于执行上述第四方面或任一可能的实施方式中的方法。具体地，所述第四通信装置可以包括用于执行第四方面或任一可能的实施方式中的方法的模块，例如包括处理模块，可选的，还可以包括收发模块。示例性地，收发模块可以包括发送模块和接收模块，发送模块和接收模块可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。示例性地，所述第四通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为网络设备。示例性地，所述网络设备为接入网设备。示例性地，所述接入网设备为基站。下面以第四通信装置是接入网设备为例。例如，所述收发模块也可以通过收发器实现，所述处理模块也可以通过处理器(或者，处理电路)实现。或者，发送模块可以通过发送器实现，接收模块可以通过接收器实现，发送器和接收器可以是不同的功能模块，或者也可以是同一个功能模块，但能够实现不同的功能。如果第四通信装置为通信设备，收发器例如通过通信设备中的天线、馈线和编解码器等实现。或者，如果第四通信装置为设置在通信设备中的芯片，那么收发器(或，发送器和接收器)例如为芯片中的通信接口，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。在第八方面的介绍过程中，继续以所述第四通信装置是接入网设备，以及，以所述处理模块和所述收发模块为例进行介绍。其中，
所述收发模块，用于接收第三数据包；
所述处理模块，用于在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包，所述第二数据包为经过安全处理的数据包；
所述收发模块，还用于将所述第二数据包发送给核心网设备。
在一种可选的实施方式中，所述处理模块用于通过如下方式在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包：
在所述PDCP层，使用第二密钥解密所述第三数据包，得到压缩包头和安全处理后的负载；
将所述压缩包头进行解压缩，得到包头；
将所述包头和所述安全处理后的负载组合，得到所述第二数据包。
在一种可选的实施方式中，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于第八方面或各种可选的实施方式所带来的技术效果，可参考对于第四方面或相应的实施方式的技术效果的介绍。
第九方面，提供一种通信装置(或者，称为网络装置)，该通信装置例如为如前所述 的第一通信装置。该通信装置包括处理器(或者，处理电路)和通信接口(或者，接口电路)，通信接口可用于与其他装置或设备进行通信。可选的，还可以包括存储器，用于存储计算机指令。处理器和存储器相互耦合，用于实现上述第一方面或各种可能的实施方式所描述的方法。或者，第一通信装置也可以不包括存储器，存储器可以位于第一通信装置外部。处理器、存储器和通信接口相互耦合，用于实现上述第一方面或各种可能的实施方式所描述的方法。例如，当处理器执行所述存储器存储的计算机指令时，使第一通信装置执行上述第一方面或任意一种可能的实施方式中的方法。示例性地，所述第一通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性的，所述通信设备为网络设备。示例性地，所述网络设备为核心网设备，例如第一核心网设备。
其中，如果第一通信装置为通信设备，通信接口例如通过所述通信设备中的收发器(或者，发送器和接收器)实现，例如所述收发器通过所述通信设备中的天线、馈线和编解码器等实现。或者，如果第一通信装置为设置在通信设备中的芯片，那么通信接口例如为芯片的输入/输出接口，例如输入/输出管脚等，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。
第十方面，提供一种通信装置(或者，称为网络装置)，该通信装置例如为如前所述的第二通信装置。该通信装置包括处理器(或者，处理电路)和通信接口(或者，接口电路)，通信接口可用于与其他装置或设备进行通信。可选的，还可以包括存储器，用于存储计算机指令。处理器和存储器相互耦合，用于实现上述第二方面或各种可能的实施方式所描述的方法。或者，第二通信装置也可以不包括存储器，存储器可以位于第二通信装置外部。处理器、存储器和通信接口相互耦合，用于实现上述第二方面或各种可能的实施方式所描述的方法。例如，当处理器执行所述存储器存储的计算机指令时，使第二通信装置执行上述第二方面或任意一种可能的实施方式中的方法。示例性地，所述第二通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性的，所述通信设备为网络设备。示例性地，所述网络设备为接入网设备，例如第二接入网设备。
其中，如果第二通信装置为通信设备，通信接口例如通过所述通信设备中的收发器(或者，发送器和接收器)实现，例如所述收发器通过所述通信设备中的天线、馈线和编解码器等实现。或者，如果第二通信装置为设置在通信设备中的芯片，那么通信接口例如为芯片的输入/输出接口，例如输入/输出管脚等，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。
第十一方面，提供一种通信装置(或者，称为网络装置)，该通信装置例如为如前所述的第三通信装置。该通信装置包括处理器(或者，处理电路)和通信接口(或者，接口电路)，通信接口可用于与其他装置或设备进行通信。可选的，还可以包括存储器，用于存储计算机指令。处理器和存储器相互耦合，用于实现上述第三方面或各种可能的实施方式所描述的方法。或者，第一通信装置也可以不包括存储器，存储器可以位于第三通信装置外部。处理器、存储器和通信接口相互耦合，用于实现上述第三方面或各种可能的实施方式所描述的方法。例如，当处理器执行所述存储器存储的计算机指令时，使第一通信装置执行上述第三方面或任意一种可能的实施方式中的方法。示例性地，所述第三通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为第一设备。示例性地，所述第一设备为终端设备。或者，示例性地，所述第一设备为网络设备。示例性地，所述网络设备为核心网设备。
其中，如果第三通信装置为通信设备，通信接口例如通过所述通信设备中的收发器(或者，发送器和接收器)实现，例如所述收发器通过所述通信设备中的天线、馈线和编解码器等实现。或者，如果第三通信装置为设置在通信设备中的芯片，那么通信接口例如为芯片的输入/输出接口，例如输入/输出管脚等，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。
第十二方面，提供一种通信装置(或者，称为网络装置)，该通信装置例如为如前所述的第四通信装置。该通信装置包括处理器(或者，处理电路)和通信接口(或者，接口电路)，通信接口可用于与其他装置或设备进行通信。可选的，还可以包括存储器，用于存储计算机指令。处理器和存储器相互耦合，用于实现上述第四方面或各种可能的实施方式所描述的方法。或者，第四通信装置也可以不包括存储器，存储器可以位于第四通信装置外部。处理器、存储器和通信接口相互耦合，用于实现上述第四方面或各种可能的实施方式所描述的方法。例如，当处理器执行所述存储器存储的计算机指令时，使第四通信装置执行上述第四方面或任意一种可能的实施方式中的方法。示例性地，所述第四通信装置为通信设备，或者为设置在通信设备中的芯片或其他部件。示例性地，所述通信设备为第二设备。示例性地，所述第二设备为网络设备。示例性地，所述网络设备为接入网设备。
其中，如果第四通信装置为通信设备，通信接口例如通过所述通信设备中的收发器(或者，发送器和接收器)实现，例如所述收发器通过所述通信设备中的天线、馈线和编解码器等实现。或者，如果第四通信装置为设置在通信设备中的芯片，那么通信接口例如为芯片的输入/输出接口，例如输入/输出管脚等，该通信接口与通信设备中的射频收发组件连接，以通过射频收发组件实现信息的收发。
第十三方面，提供第一通信系统，第一通信系统包括第五方面所述的通信装置或第九方面所述的通信装置，以及包括第六方面所述的通信装置或第十方面所述的通信装置。
第十四方面，提供第二通信系统，第二通信系统包括第七方面所述的通信装置或第十一方面所述的通信装置，以及包括第八方面所述的通信装置或第十二方面所述的通信装置。
第十五方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第一方面或任意一种可能的实施方式中所述的方法。
第十六方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第二方面或任意一种可能的实施方式中所述的方法。
第十七方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第三方面或任意一种可能的实施方式中所述的方法。
第十八方面，提供一种计算机可读存储介质，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第四方面或任意一种可能的实施方式中所述的方法。
第十九方面，提供一种包含指令的计算机程序产品，所述计算机程序产品用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第一方面或的任意一种可能的实施方式中所述的方法。
第二十方面，提供一种包含指令的计算机程序产品，所述计算机程序产品用于存储计 算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第二方面或的任意一种可能的实施方式中所述的方法。
第二十一方面，提供一种包含指令的计算机程序产品，所述计算机程序产品用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第三方面或的任意一种可能的实施方式中所述的方法。
第二十二方面，提供一种包含指令的计算机程序产品，所述计算机程序产品用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行上述第四方面或的任意一种可能的实施方式中所述的方法。
第二十三方面，提供一种核心网设备或通信装置，配置为执行上述第一方面所涉及的方法。
第二十四方面，提供一种接入网设备或通信装置，配置为执行上述第二方面所涉及的方法。
第二十五方面，提供一种核心网设备、终端设备或通信装置，配置为执行上述第三方面所涉及的方法。
第二十六方面，提供一种接入网设备或通信装置，配置为执行上述第四方面所涉及的方法。
在本申请实施例中，第一接入网设备的控制面实体和第一接入网设备的用户面实体是不同的网络实体，从而能够将第一接入网设备的控制面处理过程和用户面处理过程相隔离，以此降低安全处理过程的风险。
附图说明
图1为终端设备和接入网设备空口协议栈的示意图；
图2为CU-DU分离式基站架构的协议栈的示意图；
图3为基于基站之间的Xn接口的跨基站的小区切换过程的流程图；
图4A～图4C为本申请实施例所应用的几种场景的示意图；
图5为本申请实施例提供的第一种获取密钥的方法的流程图；
图6为本申请实施例提供的第二种获取密钥的方法的流程图；
图7为本申请实施例提供的第三种获取密钥的方法的流程图；
图8为本申请实施例提供的一种发送、接收数据包的方法的流程图；
图9为采用本申请实施例提供的一种发送、接收数据包的方法传输数据包的协议栈示意图；
图10为本申请实施例提供的一种核心网设备的示意性框图；
图11为本申请实施例提供的一种接入网设备的示意性框图；
图12为本申请实施例提供的一种第一设备的示意性框图；
图13为本申请实施例提供的一种第二设备的示意性框图；
图14为本申请实施例提供的一种通信装置的一种示意性框图；
图15为本申请实施例提供的一种通信装置的另一示意性框图；
图16为本申请实施例提供的一种通信装置的再一示意性框图；
图17为本申请实施例提供的一种通信装置的又一示意性框图。
具体实施方式
为了使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施例作进一步地详细描述。
以下，对本申请实施例中的部分用语进行解释说明，以便于本领域技术人员理解。
1)终端设备，包括向用户提供语音和/或数据连通性的设备，具体的，包括向用户提供语音的设备，或包括向用户提供数据连通性的设备，或包括向用户提供语音和数据连通性的设备。例如可以包括具有无线连接功能的手持式设备、或连接到无线调制解调器的处理设备。该终端设备可以经无线接入网(radio access network，RAN)与核心网进行通信，与RAN交换语音或数据，或与RAN交互语音和数据。该终端设备可以包括用户设备(user equipment，UE)、无线终端设备、移动终端设备、设备到设备通信(device-to-device，D2D)终端设备、车到一切(vehicle to everything，V2X)终端设备、机器到机器/机器类通信(machine-to-machine/machine-type communications，M2M/MTC)终端设备、物联网(internet of things，IoT)终端设备、签约单元(subscriber unit)、签约站(subscriber station)，移动站(mobile station)、远程站(remote station)、接入点(access point，AP)、远程终端(remote terminal)、接入终端(access terminal)、用户终端(user terminal)、用户代理(user agent)、或用户装备(user device)等。例如，可以包括移动电话(或称为“蜂窝”电话)，具有移动终端设备的计算机，便携式、袖珍式、手持式、计算机内置的移动装置等。例如，个人通信业务(personal communication service，PCS)电话、无绳电话、会话发起协议(session initiation protocol，SIP)话机、无线本地环路(wireless local loop，WLL)站、个人数字助理(personal digital assistant，PDA)、等设备。还包括受限设备，例如功耗较低的设备，或存储能力有限的设备，或计算能力有限的设备等。例如包括条码、射频识别(radio frequency identification，RFID)、传感器、全球定位系统(global positioning system，GPS)、激光扫描器等信息传感设备。
作为示例而非限定，在本申请实施例中，该终端设备还可以是可穿戴设备。可穿戴设备也可以称为穿戴式智能设备或智能穿戴式设备等，是应用穿戴式技术对日常穿戴进行智能化设计、开发出可以穿戴的设备的总称，如眼镜、手套、手表、服饰及鞋等。可穿戴设备即直接穿在身上，或是整合到用户的衣服或配件的一种便携式设备。可穿戴设备不仅仅是一种硬件设备，更是通过软件支持以及数据交互、云端交互来实现强大的功能。广义穿戴式智能设备包括功能全、尺寸大、可不依赖智能手机实现完整或者部分的功能，例如：智能手表或智能眼镜等，以及只专注于某一类应用功能，需要和其它设备如智能手机配合使用，如各类进行体征监测的智能手环、智能头盔、智能首饰等。
而如上介绍的各种终端设备，如果位于车辆上(例如放置在车辆内或安装在车辆内)，都可以认为是车载终端设备，车载终端设备例如也称为车载单元(on-board unit，OBU)。
本申请实施例中，终端设备还可以包括中继(relay)。或者理解为，能够与基站进行数据通信的都可以看作终端设备。
本申请实施例中，用于实现终端设备的功能的装置可以是终端设备，也可以是能够支持终端设备实现该功能的装置，例如芯片系统，该装置可以被安装在终端设备中。本申请实施例中，芯片系统可以由芯片构成，也可以包括芯片和其他分立器件。本申请实施例提供的技术方案中，以用于实现终端的功能的装置是终端设备为例，描述本申请实施例提供的技术方案。
2)网络设备，例如包括接入网(access network，AN)设备，例如基站(例如，接入点)，可以是指接入网中在空口通过一个或多个小区与无线终端设备通信的设备，或者例如，一种车到一切(vehicle-to-everything，V2X)技术中的网络设备为路侧单元(road side unit，RSU)。基站可用于将收到的空中帧与IP分组进行相互转换，作为终端设备与接入网的其余部分之间的路由器，其中接入网的其余部分可包括IP网络。RSU可以是支持V2X应用的固定基础设施实体，可以与支持V2X应用的其他实体交换消息。网络设备还可协调对空口的属性管理。例如，网络设备可以包括LTE系统或高级长期演进(long term evolution-advanced，LTE-A)中的演进型基站(NodeB或eNB或e-NodeB，evolutional Node B)，或者也可以包括5G NR系统(也简称为NR系统)中的下一代节点B(next generation node B，gNB)或者也可以包括云接入网(cloud radio access network，Cloud RAN)系统中的CU和DU，本申请实施例并不限定。
网络设备还可以包括核心网设备，核心网设备例如包括4G系统中的移动管理功能(mobility management entity，MME)，或包括5G系统中的访问和移动管理功能(access and mobility management function，AMF)或用户平面功能(user plane function，UPF)等。
本申请实施例中，用于实现网络设备的功能的装置可以是网络设备，也可以是能够支持网络设备实现该功能的装置，例如芯片系统，该装置可以被安装在网络设备中。在本申请实施例提供的技术方案中，以用于实现网络设备的功能的装置是网络设备为例，描述本申请实施例提供的技术方案。
3)本申请实施例中的术语“系统”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A,B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a,b,或c中的至少一项(个)，可以表示：a,b,c,a-b,a-c,b-c,或a-b-c，其中a,b,c可以是单个，也可以是多个。
以及，除非有相反的说明，本申请实施例提及“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的大小、内容、顺序、时序、优先级或者重要程度等。例如，第一密钥和第二密钥，只是为了区分不同的密钥，而并不是表示这两个密钥的数据量大小、内容、优先级或者重要程度等的不同。
前文介绍了本申请实施例所涉及到的一些名词概念，下面介绍本申请实施例涉及的技术特征。
无线通信的传输分为用户面传输和控制面传输，用户面传输主要是传输数据，而控制面传输主要是传输信令。在无线通信过程中，为了通信过程的安全性，发送端和接收端都要对数据和信令进行安全处理，例如发送端对数据进行加密，相应地接收端对数据进行解密，防止数据被第三方读取；发送端对数据进行完整性保护，相应地接收端对数据进行完整性验证，防止数据被第三方篡改。
在5G通信中，用户面传输和控制面传输可以分离，从而互不影响。
请参考图1，为终端设备和接入网设备用户面空口协议栈的示意图。以上行传输为例，数据或者信令首先到达终端设备的分组数据汇聚协议(packet data convergence protocol，PDCP)层，经过PDCP层的处理以后传输到无线链路控制(radio link control，RLC)层和 媒体接入控制(media access control，MAC)层，经过相应处理之后，从物理层(PHY)发送出去，到达接入网设备的物理层，接入网设备的物理层将接收的数据递交给接入网设备的MAC层，在MAC层经相应处理后到达接入网设备的RLC层，在RLC层经相应处理后再到达接入网设备的PDCP层。其中，一个PDCP和一个RLC组成的传输通道可以称为无线承载，对于每个无线承载上传输的数据，都需要经过各个层的处理，每个层都有相应的功能实体来执行相应的功能，例如PDCP层的PDCP实体或者RLC层的RLC实体。其中每个RLC实体对应一个逻辑信道，一个MAC实体对应多个逻辑信道，不同的逻辑信道中的数据在MAC层可以进行复用，即复用到同一个数据块中进行传输。另外一种用户面协议栈架构是在图1所示的协议栈的基础上，在终端设备和接入网设备的PDCP层之上还存在一个服务数据适配协议(service data adapation protocol，SDAP)层，用于处理服务质量(quality of service，QoS)流到数据无线承载(data radio bearer，DRB)的映射。除此之外，控制面的协议栈和用户面协议栈的不同之处在于，控制面的协议栈在图1所示的协议栈的基础上，在终端设备和接入网设备的PDCP层之上还存在一个无线资源控制(radio resource control，RRC)层，用于处理控制面信令。
CU-DU分离式基站架构是5G网络新引入的基站架构。在4G架构中，各个基站独立部署并分别与4G核心网连接；而在5G架构中，不同基站的DU部分独立部署，但是不同基站的CU部分可以集中部署，即多个基站可以共享一个CU，其中CU连接核心网，DU通过F1接口连接CU。但CU和DU是集中在一个设备中，该设备位于基站侧。如图2所示，从协议栈结构上看，在5G基站中，把原先4G基站的室内基带处理单元(building baseband unit，BBU)中的物理底层(low-PHY)下沉到有源天线单元(active antenna unit，AAU)中处理，另外AAU中还包括射频单元(radio frequency，RF)等，把对实时性要求高的物理层(例如称为物理高层(high-PHY))、MAC层以及RLC层等放在DU中处理，而把对实时性要求不高的PDCP层，SDAP层以及RRC层等放到CU中处理。
目前，接入层的安全处理是在PDCP层进行，即，发送端在PDCP层对数据或者信令进行安全处理(例如加密或完整性保护等)，接收端同样在PDCP层对数据或者信令进行相应的安全处理(例如解密或完整性验证等)。发送端和接收端进行安全处理时，需要使用相同的密钥进行处理。对于终端设备来说，该密钥是终端设备根据终端设备内置的根密钥推演而来；对于基站来说，该密钥是由核心网设备发送给基站的密钥推演而来，进而终端设备和基站可使用相同的密钥对数据和信令进行安全处理。
另外，本申请实施例还涉及到小区切换流程，下面介绍小区切换流程的过程。小区切换分为两种方式，一种方式是基于基站之间的Xn接口实现切换，另一种方式是基于基站与核心网设备之间的N2接口实现切换。如果基站之间没有Xn接口，则可以基于基站与核心网设备之间的N2接口实现切换；或者，如果基站之间有Xn接口，则可以基于基站之间的Xn接口实现切换，也可以基于基站与核心网设备之间的N2接口实现切换。下面分别介绍这两种切换过程。
基于基站之间的Xn接口的跨基站的小区切换过程是由源(source)基站发起的切换过程，其主要过程为：源基站根据终端设备上报的测量报告决定对终端设备进行小区切换，并向目标基站发起切换请求。源基站在接收到来自目标基站的肯定切换应答后，向终端设备发送切换命令。终端设备在接收到切换命令后，停止与源基站之间的上行数据或下行数据发送，终端设备开始向目标基站进行同步，并向目标基站发起随机接入过程。源基站在 向终端设备发送切换命令后，停止与终端设备之间的上行数据或下行数据传输，并将没有发送成功的数据发往目标基站。终端设备在成功接入目标基站之后，开始与目标基站进行上行数据或下行数据的传输。图3为该过程的流程图。
S301、源基站向终端设备发送上行调度信息，终端设备接收来自源基站的上行调度信息。
该上行调度信息可为终端设备调度相应的上行资源。
S302、在切换准备阶段，处于RRC连接态的终端设备根据基站配置的测量上报触发准则，通过S301中调度的上行资源发送测量报告(measurement report，MR)。
S303、源基站根据终端设备的测量报告和无线资源管理(radio resource management，RRM)算法，当终端设备满足切换条件时，为终端设备确定目标基站，或者说，为终端设备确定目标小区，或者说，确定将终端设备切换到目标小区(或，目标基站)。
S304、源基站向目标基站发送切换请求(handover request)消息，目标基站接收来自源基站的切换请求消息。
源基站可以将该终端设备的上下文(UE context)信息随切换请求消息发送给目标基站。
S305、目标基站向源基站发送切换请求确认(handover request ACK)消息，源基站接收来自目标基站的切换请求确认消息。
目标gNB为即将切换过来的终端设备做准备，同时为该终端设备分配小区无线网络临时标识(cell-radio network temporary identifier，C-RNTI)和其他参数。目标基站可在切换请求确认消息中将为终端设备分配的C-RNTI和其他参数等返回给源基站。
另外，在收到切换请求确认消息后，源基站准备将该终端设备的数据转发给目标基站。该终端设备的数据可包括待发送给该终端设备的下行数据，或接收的来自该终端设备的上行数据等。
S306、源基站向终端设备发送下行调度信息，终端设备接收来自源基站的下行调度信息。
该下行调度信息可为终端设备调度相应的下行资源。
S307、源基站向终端设备发送切换命令(handover command)，终端设备接收来自源基站的切换命令。
在切换命令中可包括以下信息：S305中所述的C-RNTI、目标基站的系统信息块(system information block，SIB)、终端设备的配置信息等。其中，目标基站的SIB例如包括终端设备在目标基站进行随机接入所使用的随机接入资源，以及还可以包括其他的一些配置信息。终端设备的配置信息例如包括该终端设备的MAC层配置、RLC配置、或PDCP配置等。
终端设备在接收切换命令后，停止与源基站的上行数据或下行数据传输，并向目标基站进行同步。
S308、源基站向目标基站发送序列号(sequence number，SN)状态信息，目标基站接收来自源基站的SN状态信息。
SN状态信息可包括上行SN状态信息，或包括下行SN状态信息，或包括上行SN状态信息和下行SN状态信息。上行SN状态信息例如为上行SN，该上行SN可以是源基站接收的来自终端设备的序列号最大的数据包的序列号，或者是源基站接收的来自终端设备的序列号最大的数据包的序列号加1。下行SN状态信息例如为下行SN，该下行SN可以 是源基站待发送给该终端设备的序列号最大的数据包的序列号，或者是源基站待发送给该终端设备的序列号最大的数据包的序列号加1。
可选的，源基站可以向目标基站进行数据前送(data forwarding)，即，源基站将缓存的来自终端设备的上行数据和/或来自核心网设备(例如UPF)的对应于该终端设备下行数据转发给目标基站，相应的，目标基站接收来自源基站的数据。该步骤不是必须执行的，用虚线表示。
S309、终端设备断开与源基站的数据传输后，启动与目标基站的下行同步过程，然后向目标基站发起随机接入过程来获取上行定时和上行资源等。
目标基站向终端设备发送上行时间提前量(time advanced，TA)，并向终端设备指示分配给终端设备的资源，这里所述的资源主要用于随机接入过程，例如终端设备可利用该资源向目标基站发送随机接入过程中的第三消息(Msg3)。目标基站发送给终端设备的信息，可用于终端设备向目标基站发送RRC连接重配置完成消息，以指示小区切换完成。
S310、终端设备向目标基站发送切换确认信息，目标基站接收来自终端设备的切换确认信息。切换确认信息用于指示切换完成。该切换确认信息例如可携带在所述的RRC连接重配置完成消息中。
S311、目标基站向源基站发送切换完成消息，源基站接收来自目标基站的切换完成消息。
源基站接收该切换完成消息后，可以释放该终端设备的上下文信息等。
同时，目标基站可执行S312，即，目标基站向核心网设备发送路径转换(path switch)消息，核心网设备接收来自目标基站的路径转换消息。路径转换消息用于通知核心网设备更新数据转发目的基站的信息，将对应于该终端设备的目的基站的地址从源基站的地址更换为该目标基站的地址。核心网设备接收路径转换消息后，可将对应于该终端设备的目的基站的地址从源基站的地址更换为该目标基站的地址，以便使核心网设备后续能够将该终端设备的数据发送给该目标基站。之后，核心网设备可执行S313，即，核心网设备向目标基站发送路径转换确认(path switch ACK)消息，目标基站接收来自核心网设备的路径转换确认消息，路径转换确认消息用于指示数据转发目的基站的信息已更新。
基于基站和核心网设备之间的N2接口的跨基站的小区切换过程也是由源基站发起的切换过程，该过程与基于基站之间的Xn接口的跨基站的小区切换流程的主要区别是，在该过程中，源基站和目标基站之间不能直接通信，而是需要通过核心网设备转发，其余步骤都与图3所示的流程相同，因此不再多赘述。
如上所述，无论是小区切换流程还是非小区切换流程，对于数据或信令的安全处理来说，都是在终端设备和基站的PDCP层进行。接入层的安全处理包括控制面信令的安全处理和用户面数据的安全处理，对于基站来说，目前接入层的安全处理均在RAN侧进行，两种安全处理过程无法相互隔离，使得整个安全处理过程存在风险。
鉴于此，提供本申请实施例的技术方案。在本申请实施例中，基于用户面与控制面分离的接入网设备架构，第一接入网设备的控制面实体和第一接入网设备的用户面实体是不同的网络实体，从而使得第一接入网设备的控制面处理过程和用户面处理过程可以相互隔离，以此降低安全处理过程的风险。具体来说，用于对控制面信令进行安全处理的第二密钥发送给控制面实体，而用于对用户面数据进行安全处理的第三密钥发送给用户面实体，这样，控制面实体和用户面实体将无法获得对方的密钥，从而无法破解对方的传输内容， 达到将第一接入网设备的控制面处理过程和用户面处理过程相隔离的效果，降低了整个系统的安全风险。
本申请实施例提供的技术方案可以应用于第四代移动通信技术(the 4th generation，4G)系统中，例如LTE系统，或可以应用于5G系统中，例如NR系统，或者还可以应用于下一代移动通信系统或其他类似的通信系统，只要存在一个实体可以对另一个实体发起寻呼即可，具体的不做限制。另外，本申请实施例在介绍过程中是以网络设备和终端设备之间的空口通信过程为例，实际上本申请实施例提供的技术方案也可以应用于侧行链路(sidelink，SL)，只要一个终端设备能够对另一个终端设备发起寻呼即可。例如，本申请实施例提供的技术方案可以应用于设备到设备(device-to-device，D2D)场景，可以是NR D2D场景也可以是LTE D2D场景等，或者可以应用于车到一切(vehicle to everything，V2X)场景，可以是NR V2X场景也可以是LTE V2X场景等，例如可应用于车联网，例如V2X、LTE-V、车与车(vehicle-to-vehicle，V2V)等，或可用于智能驾驶，智能网联车等领域。
请参见图4A、图4B或图4C，为本申请实施例的三种应用场景。在图4A、图4B或图4C中，接入网设备通过无线传输方式服务于终端设备。
图4A、图4B或图4C中的核心网设备例如包括UPF，当然可能还包括其他的核心网设备，例如AMF等，在此没有一一画出。另外图4A、图4B和图4C还给出了本申请实施例所提供的协议栈架构。其中，终端设备侧的协议栈可包括MAC层、RLC层、PDCP层、SDAP层和RRC层等；基站侧的DU可包括MAC层和RLC层，基站侧的CU可分为CU-控制面(control plane，CP)和CU-用户面(user plane，UP)。一种实施方式为，CU-CP位于基站侧，CU-UP挪到核心网侧，且CU-UP在核心网侧独立部署，如图4A所示。另一种实施方式为，CU-CP和CU-UP位于基站侧，在CU-UP中保留PDCP层的部分功能，而将CU-UP的PDCP层的另一部分功能(例如安全处理功能等)部署在核心网设备中，例如可部署在UPF中，可以认为，CU-UP还包括PDCP层，但PDCP层实现的功能有限，如图4B所示。另外在这种方式中，如果CU-UP中还包括SDAP层，则SDAP层可继续保留在基站侧的CU-UP中，或者也可以挪到UPF中。再一种实施方式为，CU-CP和CU-UP位于基站侧，将CU-UP的PDCP层的全部功能(例如包括安全处理功能等)部署在核心网设备中，例如可部署在UPF中，可以认为，CU-UP不再包括PDCP层，如图4C所示。另外，在图4B或图4C所示的实施方式中，如果CU-UP中还包括SDAP层，则SDAP层可继续保留在基站侧的CU-UP中，或者也可以改为部署到UPF中。无论采用哪种实施方式，都可以使得控制面和用户面的安全处理过程相互隔离开，以此降低安全处理的风险。
图4A、图4B或图4C中的接入网设备例如为基站。其中，基站在不同的系统对应不同的设备，例如在4G系统中可以对应4G中的基站，例如eNB，在5G系统中对应5G中的基站，例如gNB。当然本申请实施例所提供的技术方案也可以应用于未来的移动通信系统中，因此图4A、图4B或图4C中的接入网设备也可以对应未来的移动通信系统中的接入网设备。图4A、图4B或图4C以接入网设备是基站为例，实际上参考前文的介绍，接入网设备还可以是RSU等设备。另外，图4A、图4B或图4C中的终端设备以手机为例，实际上根据前文对于终端设备的介绍可知，本申请实施例的终端设备不限于手机。
下面结合附图介绍本申请实施例提供的方法。
本申请实施例提供第一种获取密钥的方法，请参见图5，为该方法的流程图。在下文的介绍过程中，以该方法应用于图4A、图4B或图4C所示的网络架构为例。
为了便于介绍，在下文中，以该方法由网络设备和终端设备执行为例。因为本实施例是以应用在图4A、图4B或图4C所示的网络架构为例，因此，下文中所述的第一核心网设备例如为图4A、图4B或图4C所示的网络架构中的AMF，或者也可以是除AMF和UPF之外的其他的核心网设备，下文中所述的第一接入网设备可以是图4A、图4B或图4C所示的网络架构中的接入网设备，下文中所述的终端设备可以是图4A、图4B或图4C所示的网络架构中的终端设备。
S501、第一核心网设备获得第一密钥。
第一密钥可用于推演得到第一接入网设备用于对接入层控制面信令进行安全处理的密钥，或用于推演得到第一接入网设备用于对接入层用户面数据进行安全处理的密钥，或用于推演得到第一接入网设备用于接入层控制面信令进行安全处理的密钥以及用于推演得到第一接入网设备用于对接入层用户面数据进行安全处理的密钥。
在本申请实施例中，对接入层控制面信令进行安全处理，可以包括如下的一种或多种处理方式：对接入层控制面信令进行完整性保护、完整性验证、加密、或解密。例如，第一接入网设备的控制面实体是信令的发送端，则第一接入网设备的控制面实体可以对该信令进行完整性保护，或者进行加密，或者进行完整性保护和加密。又例如，第一接入网设备的控制面实体是信令的接收端，则第一接入网设备的控制面实体可以对该信令进行完整性验证，或者进行解密，或者进行完整性验证和解密。
同理，在本申请实施例中，对接入层用户面数据进行安全处理，可以包括如下的一种或多种处理方式：对接入层用户面数据进行完整性保护、完整性验证、加密、或解密。例如，第一接入网设备的用户面实体是数据包的发送端，则第一接入网设备的用户面实体可以对该数据包进行完整性保护，或者进行加密，或者进行完整性保护和加密。又例如，第一接入网设备的用户面实体是数据包的接收端，则第一接入网设备的用户面实体可以对该数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密。
在一种实施方式中，第一密钥可以是第一接入网设备对应于所述终端设备的中间密钥。对此可以理解为，第一接入网设备在与不同的终端设备通信时可以基于不同的中间密钥进行推演得到对应于不同终端设备的，用于对接入层控制面信令和用户面数据进行安全处理的密钥。例如第一密钥可以包括K gnb和/或NH。
在核心网侧，可以预先每个存储终端设备对应的根密钥，然后至少一个核心网设备可以基于该根密钥进行一步步的推演过程，从而得到不同设备或者不同安全过程中所需用到的密钥。其中能够基于该根密钥推演得到自身所使用的密钥的核心网设备包括但不限于：身份验证凭据存储库和处理功能(authentication credential repository and processing function，ARPF)，身份验证服务器功能实体(authentication server function，AUSF)，或安全锚点功能实体(security anchor function，SEAF)中的一个或多个，当然还可以包括其他的核心网设备，例如AMF等。例如第一核心网设备能够获得该终端设备对应的根密钥，例如称为第一根密钥。第一核心网设备可以根据第一根密钥进行推演，或者，第一核心网设备可以根据由第一根密钥推演得到的密钥进行进一步推演，得到第一核心网设备所使用的密钥，例如称为第四密钥。例如第一核心网设备为AMF，则第四密钥可以表示为K AMF。第一核心网设备再根据第四密钥进行推演，可以得到第一密钥，也可以根据第四密钥进行推演得到其他密钥，例如得到用于非接入层通信过程中进行安全处理的密钥。
S502、第一核心网设备根据第一密钥进行推演，得到第二密钥和第三密钥。
在一种可选的实施方式中，第一核心网设备可以根据第一密钥进行一次或多次推演，得到第二密钥和第三密钥。在另一种可选的实施方式中，第一密钥可以包括第二密钥和第三密钥，即，第一核心网设备无需根据第一密钥进行推演，便可得到第二密钥和第三密钥。从这个意义上来说，S502也可以改为，第一核心网设备根据第一密钥确定第二密钥和第三密钥，其中一种确定方式是第一核心网设备根据第一密钥推演得到第二密钥或第三密钥，其中另一种确定方式是第一核心网设备得到第一密钥也就得到了第二密钥和第三密钥(第一密钥包括第二密钥和第三密钥)。其中，第二密钥用于对接入层的控制面信令进行安全处理，第三密钥用于对用户面数据进行安全处理。这里的推演过程可以理解为，由至少一个第一参数和安全算法进行特定运算，得到至少一个输出参数的过程。例如所述的第一参数为第一密钥，经过安全算法的运算，得到第二密钥和/或第三密钥。
作为一种实施方式，第二密钥可以包括第一子密钥，或包括第二子密钥，或包括第一子密钥和第二子密钥。第一子密钥例如表示为K RRCenc，可被接入网设备用于对控制面信令进行加密或者解密。第二子密钥例如表示为K RRCint，可被接入网设备用于对控制面信令进行完整性保护或者完整性验证。
在本申请所涉及的各个实施例中，完整性保护是指，数据包的发送端将密钥等信息作为入参，通过完整性保护算法对数据包进行运算处理得到第一数值，然后将第一数值与数据包一起传输，以实现对该数据包的保护。完整性验证是指，数据包的接收端将密钥等信息作为入参，通过完整性保护算法对数据包进行运算处理得到第二数值，接收端将第一数值与第二数值进行比较，如果第一数值与第二数值一致，则该数据包的完整性验证通过，如果第一数值与第二数值不一致，则该数据包的完整性验证失败。例如，第一数值为消息认证码(message authentication code，MAC)-I，第二数值为预期消息认证码(expected message authentication code，XMAC)-I，I代表完整性(integrity)。在后文介绍的其他实施例中，对这两个概念不再多赘述。
作为一种实施方式，第三密钥可以包括第三子密钥，或包括第四子密钥，或包括第三子密钥和第四子密钥。第三子密钥例如表示为K UPenc，可被接入网设备用于对用户面数据进行加密或者解密。第四子密钥例如表示为K UPint，可被接入网设备用于对用户面数据进行完整性保护或者完整性验证。
S503、第一核心网设备将第二密钥发送给第一接入网设备的控制面实体，以及，将第三密钥发送给第一接入网设备的用户面实体。
第一接入网设备的控制面实体负责接入层的控制面信令的通信处理，或者说，第一接入网设备的控制面实体可与终端设备进行控制面通信，或者，第一接入网设备的控制面实体可与终端设备进行信令通信，即，第一接入网设备在与终端设备进行控制面信令通信时，通过第一接入网设备的控制面实体来进行。第一接入网设备的控制面实体与终端设备进行控制面信令通信，可包括第一接入网设备的控制面实体向终端设备发送信令，还可包括终端设备向第一接入网设备的控制面实体发送信令。其中控制面信令包括信令无线承载(sigaling radio bearer，SRB)信令或RRC信令等。
第一接入网设备的用户面实体负责与终端设备进行用户面数据通信，或者说，第一接入网设备的用户面实体可与终端设备进行用户面通信，或者，第一接入网设备的控制面实体可与终端设备进行数据通信，即，第一接入网设备在与终端设备进行用户面数据通信时，通过第一接入网设备的用户面实体来进行。第一接入网设备的用户面实体与终端设备进行 用户面数据通信，可包括第一接入网设备的用户面实体向终端设备发送数据，还可包括终端设备向第一接入网设备的用户面实体发送数据。其中用户面数据包括上层来的IP包，以太包或者其他类型的数据包等。
第一接入网设备的控制面实体接收第二密钥后，可以使用第二密钥对该终端设备的控制面的信令进行安全处理。例如，对于第一接入网设备的控制面实体待发送给该终端设备的信令，第一接入网设备的控制面实体可使用第二密钥对该信令进行加密或完整性保护等；对于第一接入网设备的控制面实体接收的来自该终端设备的信令，第一接入网设备的控制面实体可使用第二密钥对该信令进行解密或完整性验证等。
同理，第一接入网设备的用户面实体接收第三密钥后，可以使用第三密钥对该终端设备的用户面的数据进行安全处理。例如，对于第一接入网设备的用户面实体待发送给该终端设备的数据，第一接入网设备的用户面实体可使用第三密钥对该数据进行加密或完整性保护等；对于第一接入网设备的用户面实体接收的来自该终端设备的数据，第一接入网设备的用户面实体可使用第三密钥对该数据进行解密或完整性验证等。
优选的，在本申请实施例中，第一接入网设备的控制面实体和第一接入网设备的用户面实体是不同的网络实体，从而能够将第一接入网设备的控制面处理过程和用户面处理过程相隔离。在本申请实施例中，由第一核心网设备推演第一接入网设备所使用的密钥，无需第一接入网设备自行推演。第一核心网设备在推演得到第二密钥和第三密钥后，可将第二密钥发送给第一接入网设备的控制面实体，以及将第三密钥发送给第一接入网设备的用户面实体，从而使得第一接入网设备的控制面实体无法获得第三密钥，即，第一接入网设备的控制面实体既不会感知用户面数据的处理，也不会接触到用户面的第三密钥，能够有效降低安全处理的风险。
另外，由于接入网设备由设备商提供，由运营商部署，一般部署在户外，所以如果接入网设备能够读取用户数据的话，会对数据安全造成一定的风险。按照如上的安全处理方式，用户面数据和控制面信令的安全处理虽然相互隔离，但是仍然都处于接入网侧，用户的数据依然会有安全风险。
因此，作为一种可选的实施方式，在本申请实施例中，第一接入网设备的控制面实体可位于接入网侧，第一接入网设备的用户面实体可位于核心网侧；或者，CU-CP和CU-UP继续位于第一接入网设备侧的CU中，在CU-UP中保留PDCP层的部分功能，而将CU-UP的PDCP层的另一部分功能(例如安全处理功能等)部署在核心网设备中，例如可部署在UPF中，如果是这种情况，则第一接入网设备的控制面实体例如为CU-CP，第一接入网设备的用户面实体例如为部署在核心网设备(例如UPF)中的PDCP层(即，能够实现CU-UP的PDCP层的另一部分功能)；或者，CU-CP和CU-UP都继续位于第一接入网设备侧的CU中，但是将CU-UP的PDCP层的全部功能(例如包括安全处理功能等)部署在核心网设备(例如UPF)中，如果是这种情况，则第一接入网设备的控制面实体例如为CU-CP，第一接入网设备的用户面实体例如为核心网设备(例如UPF)中的PDCP层(即，能够实现CU-UP的PDCP层的全部功能)。一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
以第一核心网设备是AMF、第一接入网设备的控制面实体是CU-CP、第一接入网设备的用户面实体是CU-UP为例，AMF可通过与CU-CP之间的接口将第二密钥发送给CU-CP；AMF将第三密钥发送给位于核心网侧的CU-UP，可以通过AMF和CU-UP的接口发送，或者也可以通过UPF或者其他核心网设备转发给CU-UP。
在前文介绍了，由于接入网设备由设备商提供，由运营商部署，一般部署在户外，所以如果接入网设备能够读取用户数据的话，会对数据安全造成一定的风险。因此在本申请实施例中，第一接入网设备的控制面实体可位于接入网侧，而第一接入网设备的用户面实体可位于核心网侧，一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
S504、第一核心网设备向终端设备发送下一跳链计数(next hop chaining counter，NCC)，终端设备接收来自第一核心网设备的NCC。
终端设备可以根据NCC确定所使用的密钥，来保证与网络侧所使用的密钥一致。NCC具有计数功能，不同的NCC值对应不同的密钥推演过程或者不同的密钥推演次数。例如，NCC可用于指示第一核心网设备推演第一密钥的推演次数，或者，NCC可用于指示第一核心网设备根据推演第一密钥的推演轨迹，或者说推演过程记录。终端设备内置有该终端设备的根密钥，例如称为第二根密钥，第二根密钥和第一根密钥可以是同一根密钥，或者也可以是不同的根密钥。终端设备能够根据第二根密钥采用与核心网设备相同的推演方式，推演得到终端设备所使用的密钥。其中，终端设备在获得NCC后，可依据NCC的指示，确定核心网设备的推演方式，使得终端设备和第一接入网设备所使用的密钥一致。例如，NCC指示推演次数为n，则终端设备推演n次得到第一密钥，n为正整数，终端设备可以进一步得到第二密钥和第三密钥；又例如，NCC指示推演轨迹或推演过程记录，则终端设备可按照相同的轨迹或相同的推演过程进行推演得到第一密钥，进一步得到第二密钥和第三密钥。
或者，第一核心网设备也可以不向终端设备发送NCC，例如第一核心网设备的推演次数(或，推演轨迹，或推演记录)是通过协议规定的，或者是第一核心网设备事先已告知终端设备的，则第一核心网设备可以不向终端设备发送NCC。因此，S504是可选的步骤，在图5中用虚线表示。
接入层的安全处理包括控制面信令的安全处理和用户面数据的安全处理，对于基站来说，目前接入层的安全处理均在RAN侧进行。以上行传输为例。数据在终端设备侧的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到接入网侧的CU-UP，在CU-UP的PDCP层进行相应的安全处理(例如解密或完整性验证)，然后再传输到核心网侧的UPF；而信令从终端设备的RRC层传输到终端设备的PDCP层，在终端设备的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到接入网侧的CU-CP，在CU-CP的PDCP层进行相应的安全处理(例如解密或完整性验证)后，递交给CU-CP的RRC层解析。其中，CU-CP和CU-UP位于一个实体中，该实体位于接入网设备侧。可见，对于基站来说，目前接入层的安全处理均在RAN侧进行，两种安全处理过程无法相互隔离，使得整个安全处理过程存在风险。而且，由于接入网设备由设备商提供，由运营商部署，一般部署在户外，所 以如果接入网设备能够读取用户数据的话，会对数据安全造成一定的风险。而目前，CU-CP和CU-UP都处于接入网侧，用户的数据依然会有安全风险。
而本申请实施例中，第一接入网设备的控制面实体和用户面实体为两个网络实体，且控制面实体位于接入网侧，用户面实体位于核心网侧，这样数据的安全处理会在核心网侧进行。以上行传输为例。数据在终端设备侧的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到核心网侧的用户面实体，在用户面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)，然后再传输到核心网侧的UPF；而信令从终端设备的RRC层传输到终端设备的PDCP层，在终端设备的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到接入网侧的控制面实体，在控制面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)后，递交给控制面实体的RRC层解析。可见，通过本申请实施例提供的方法，用户面数据的安全处理在用户面实体中进行，控制面信令的安全处理在控制面实体中进行，用户面实体和控制面实体位于不同的实体中，使得用户面数据和控制面信令的安全处理过程能够隔离，提高用户面数据的安全性。而且一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
图5所示的实施例涉及的是非小区切换流程，而在小区切换流程中，本申请实施例提供的方案也能提高数据的安全性。下面介绍本申请实施例提供的第二种获取密钥的方法，通过该方法，能够在小区切换的场景中提高数据的安全性。请参见图6，为该方法的流程图。在下文的介绍过程中，以该方法应用于图4A、图4B或图4C所示的网络架构为例。另外，本申请实施例所涉及的小区切换流程是基于基站之间的Xn接口的跨基站的小区切换流程。
为了便于介绍，在下文中，以该方法由网络设备和终端设备执行为例。因为本实施例是以应用在图4A、图4B或图4C所示的网络架构为例，因此，下文中所述的第一核心网设备例如为图4A、图4B或图4C所示的网络架构中的AMF，或者也可以是除AMF和UPF之外的其他的核心网设备，下文中所述的第一接入网设备可以是图4A、图4B或图4C所示的网络架构中的接入网设备，下文中所述的第二接入网设备在图4A、图4B或图4C中未画出，是该网络架构中第一核心网设备服务的另一个接入网设备，下文中所述的终端设备可以是图4A、图4B或图4C所示的网络架构中的终端设备。
S601、第二接入网设备向第一核心网设备发送输入参数，第一核心网设备接收来自第二接入网设备的输入参数，该输入参数可用于推演第一密钥(或者说，用于推演得到第一密钥，对此可理解为，第一核心网根据该输入参数进行推演，能够得到第一密钥)，或者说用于确定第一密钥。
例如，本申请实施例可以在原有切换流程中新增一条消息，例如称为第一消息，第一消息可以包括输入参数，也就是说，第二接入网设备可以通过第一消息将输入参数发送给第一核心网设备。第一消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。
第二接入网设备是终端设备在进行小区切换时的源接入网设备，或者说第二接入网设 备是终端设备在进行小区切换之前所接入的接入网设备。另外还有第一接入网设备，是终端设备在进行小区切换时的目标接入网设备，或者说第一接入网设备是终端设备在进行小区切换之后所接入的接入网设备。所述的输入参数与目标小区相关，可以理解为，切换以后第一接入网设备在与该终端设备通信时使用的密钥需要根据输入参数得到。
在小区切换过程中，终端设备从第二接入网设备的小区切换到第一接入网设备的小区进行通信，为了保护不同的接入网设备之间安全处理过程的独立性，第一接入网设备和第二接入网设备在与该终端设备通信时所使用的用于安全处理的密钥不能相同。例如，第一接入网设备在与该终端设备通信时使用的密钥，可以根据第二接入网设备对应于该终端设备的密钥进行推演。在本申请实施例中考虑到接入网设备侧潜在的安全风险，需要核心网设备进行密钥推演过程，因此第二接入网设备需要将推演第一接入网设备使用的密钥所需的输入参数发送给第一核心网设备，由第一核心网设备推演第一接入网设备使用的密钥，推演以后将第一接入网设备所使用的密钥发送给第一接入网设备。
因为本申请实施例是基于基站之间的Xn接口的跨基站的小区切换流程，则作为一种可选的实施方式，在S601之前，还可以执行S602，第二接入网设备向第一接入网设备发送切换请求消息，第一接入网设备接收来自第二接入网设备的切换请求消息，该切换请求消息用于请求将该终端设备切换到第一接入网设备。例如，第二接入网设备可以向第一接入网设备的控制面实体发送切换请求消息，第一接入网设备的控制面实体接收来自第二接入网设备的切换请求消息。关于S602，可参考图3流程中的S304。在执行S602后，可执行S601，第二接入网设备将输入参数发送给第一核心网设备。
例如，输入参数可以包括第一小区的物理小区标识(physical cell identity，PCI)，或包括第一小区的频率，或包括第一小区的PCI和第一小区的频率。或者输入参数还可以包括其他的信息，只要输入参数能够用于确定第一密钥即可。第一小区的频率例如为第一小区的绝对无线频道编号(absolute radio frequency channel number，ARFCN)。第一小区是终端设备的目标小区，或者说，第一小区是终端设备在进行小区切换时的目标小区。对此可以理解为，在本申请实施例中，终端设备进行小区切换，就是要切换到第一小区，因此第一小区就称为终端设备的目标小区。而第一小区是第一接入网设备提供的，因此第一接入网设备也称为终端设备的目标接入网设备。
S603、第一核心网设备获得第一密钥。
第一核心网设备获得了输入参数，可根据输入参数推演第一密钥，图6中的S602以此为例。可选的，第一核心网设备可以根据输入参数和第二接入网设备的密钥推演第一密钥，第二接入网设备的密钥例如为第二接入网设备对应于该终端设备的中间密钥，例如称为第五密钥，第一核心网设备可根据第五密钥和输入参数推演得到第一密钥。其中，第五密钥是第一核心网设备已知的，例如可参考图5所示的实施例，第一核心网设备可为第一接入网设备确定第二密钥和第三密钥，在确定第二密钥和第三密钥之前，第一核心网设备会先获得第一密钥，那么同理，第一核心网设备也可以获得第二接入网设备的第五密钥，则第二接入网设备无需将第五密钥发送给第一核心网设备，只需将输入参数发送给第一核心网设备即可，以节省信令开销。
关于第一密钥，可参考图5所示的实施例中的S501的相关介绍。
S604、第一核心网设备根据第一密钥进行推演，得到第二密钥和第三密钥。
关于S604的更多内容，可参考图5所示的实施例中的S502的相关介绍。
S605、第一核心网设备将第二密钥发送给第一接入网设备的控制面实体，以及，将第三密钥发送给第一接入网设备的用户面实体。
其中，如果第一接入网设备的用户面实体部署在除第一核心网设备之外的其他的核心网设备中，则第一核心网设备可以将第三密钥发送给第一接入网设备的用户面实体。例如，第一核心网设备是AMF，第一接入网设备的用户面实体部署在UPF中，或者第一接入网设备的用户面实体在核心网侧是独立的设备，则AMF可以将第三密钥发送给第一接入网设备的用户面实体。或者，如果第一接入网设备的用户面实体部署在第一核心网设备中，则第一核心网设备可以不必向第一接入网设备的用户面实体发送第三密钥，第一接入网设备的用户面实体可以获得第一核心网设备推演得到的第三密钥。
例如，本申请实施例可以在原有切换流程中新增一条消息，例如称为第二消息，第二消息可以包括第二密钥。也就是说，第一核心网设备可以通过第二消息将第二密钥发送给第一接入网设备的控制面实体。第二消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。
另外，本申请实施例还可以在原有切换流程中再新增一条消息，例如称为第三消息，如果第一核心网设备需要向第一接入网设备的用户面实体发送第三密钥，则第三消息可包括第三密钥。也就是说，第一核心网设备可以通过第三消息将第三密钥发送给第一接入网设备的用户面实体。第三消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。
如果第一核心网设备需要向第一接入网设备的用户面实体发送第三密钥，则第一核心网设备可以先发送第三消息后发送第二消息，或者可以先发送第二消息后发送第三消息，或者也可以同时发送第三消息和第二消息。
关于S605的更多内容，可参考图5所示的实施例中的S503的相关介绍。
S606、第一核心网设备向终端设备发送NCC，终端设备接收来自第一核心网设备的NCC。
例如，第一核心网设备可以将NCC发送给第二接入网设备，由第二接入网设备将NCC转发给终端设备；或者，第一核心网设备可以将NCC发送给第一接入网设备，第一接入网设备将NCC转发给第二接入网设备，再由第二接入网设备将NCC转发给终端设备。其中，如果第一核心网设备将NCC发送给第一接入网设备，则第一核心网设备可以将NCC发送给第一接入网设备的控制面实体，由第一接入网设备的控制面实体将NCC转发给第二接入网设备，再由第二接入网设备将NCC转发给终端设备。
关于NCC的更多内容，可参考图5所示的实施例中的S504的相关介绍。
S607、第一接入网设备向第二接入网设备发送切换请求确认消息，第二接入网设备接收来自第一接入网设备的切换请求确认消息。
因为本申请实施例的应用场景是基于基站之间的Xn接口的跨基站的小区切换流程，因此第一接入网设备还可以向第二接入网设备发送切换请求确认消息。例如，第一接入网设备的控制面实体向第二接入网设备发送切换请求确认消息，第二接入网设备接收来自第一接入网设备的控制面实体的切换请求确认消息。关于S607，可参考图3所示的流程中的S305。
S608、第二接入网设备向终端设备发送切换命令，终端设备接收来自第二接入网设备的切换命令。
关于S608，可参考图3所示的流程中的S307。
另外，在执行S608后，还可以继续执行如图3所示的流程中的S308～S313中的一个或多个步骤，即，还可执行有关小区切换的一个或多个步骤，本申请实施例不做限制。
其中，S602、S606～S608均为可选的步骤，不是必须执行的，在图6中用虚线表示。
在本申请实施例中，第一接入网设备的控制面实体和用户面实体为两个网络实体，且控制面实体位于接入网侧，用户面实体位于核心网侧，这样数据的安全处理会在核心网侧进行。以上行传输为例。数据在终端设备侧的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到核心网侧的用户面实体，在用户面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)，然后再传输到核心网侧的UPF；而信令从终端设备的RRC层传输到终端设备的PDCP层，在终端设备的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到接入网侧的控制面实体，在控制面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)后，递交给控制面实体的RRC层解析。可见，通过本申请实施例提供的方法，用户面数据的安全处理在用户面实体中进行，控制面信令的安全处理在控制面实体中进行，用户面实体和控制面实体位于不同的实体中，使得用户面数据和控制面信令的安全处理过程能够隔离，提高用户面数据的安全性。而且一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
图6所示的实施例的应用场景是基于基站之间的Xn接口的跨基站的小区切换流程，下面，本申请实施例提供第三种获取密钥的方法，该方法的应用场景是基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，通过该方法，同样能够提高数据的安全性。请参见图7，为该方法的流程图。在下文的介绍过程中，以该方法应用于图4A、图4B或图4C所示的网络架构为例。另外，本申请实施例所涉及的小区切换流程是基于基站之间的Xn接口的跨基站的小区切换流程。
为了便于介绍，在下文中，以该方法由网络设备和终端设备执行为例。因为本实施例是以应用在图4A、图4B或图4C所示的网络架构为例，因此，下文中所述的第一核心网设备例如为图4A、图4B或图4C所示的网络架构中的AMF，或者也可以是除AMF和UPF之外的其他的核心网设备，下文中所述的第一接入网设备可以是图4A、图4B或图4C所示的网络架构中的接入网设备，下文中所述的第二接入网设备在图4A、图4B或图4C中未画出，是该网络架构中第一核心网设备服务的另一个接入网设备，下文中所述的终端设备可以是图4A、图4B或图4C所示的网络架构中的终端设备。
S701、第二接入网设备向第一核心网设备发送输入参数，第一核心网设备接收来自第二接入网设备的输入参数，该输入参数可用于推演第一密钥，或者说用于确定第一密钥。
本申请实施例是基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，那么第二接入网设备在确定终端设备进行小区切换时，可以向第一核心网设备发送切换请求消息，以通过第一核心网设备将该切换请求消息转发给第一接入网设备。可选的，在第二接入网设备发送给第一核心网设备的切换请求消息中，可以包括所述的输入参数，可理解为，S701为第二接入网设备向第一核心网设备发送切换请求消息，例如称为第一切换请求 消息，第一核心网设备接收来自第二接入网设备的第一切换请求消息，第一切换请求消息包括输入参数，图7中的S701以此为例。也就是说，本申请实施例无需新增消息，而是可通过已有的切换请求消息将输入参数发送给第一核心网设备，更有利于与现有的方案兼容，且能够节省信令开销。
或者，本申请实施例也可以在原有切换流程中新增一条消息，例如称为第一消息，第一消息可以包括输入参数，也就是说，第二接入网设备可以通过第一消息将输入参数发送给第一核心网设备。第一消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。第二接入网设备可以先发送第一切换请求消息后发送第一消息，或者可以先发送第一消息后发送第一切换请求消息，或者也可以同时发送第一消息和第一切换请求消息。
关于第一接入网设备、第二接入网设备以及输入参数等更多内容，可参考图6所示的实施例中的S601的相关介绍。
S702、第一核心网设备获得第一密钥。
第一核心网设备获得了输入参数，可根据输入参数推演第一密钥，图7中的S702以此为例。可选的，第一核心网设备可以根据输入参数和第二接入网设备的密钥推演第一密钥，第二接入网设备的密钥例如为第二接入网设备对应于该终端设备的中间密钥，例如称为第五密钥，第一核心网设备可根据第五密钥和输入参数推演得到第一密钥。
关于第一密钥以及第五密钥等更多内容，可参考图6所示的实施例中的S603的相关介绍。
S703、第一核心网设备根据第一密钥进行推演，得到第二密钥和第三密钥。
关于S703的更多内容，可参考图5所示的实施例中的S502的相关介绍。
S704、第一核心网设备将第二密钥发送给第一接入网设备的控制面实体，以及，将第三密钥发送给第一接入网设备的用户面实体。
本申请实施例是基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，那么第一核心网设备在接收来自第二接入网设备的第一切换请求消息后，如果按照现有技术，则第一核心网设备会将第一切换请求消息转发给第一接入网设备。那么本申请实施例可以利用这个流程，例如第一核心网设备可以生成第二切换请求消息，第二切换请求消息包括第二密钥，第一核心网设备将第二切换请求消息发送给第一接入网设备，从而就将第二密钥发送给了第一接入网设备。例如，第一核心网设备可以在第一切换请求消息中添加第二密钥，得到第二切换请求消息，通过这种方式，不仅实现了将第一切换请求消息转发给第一接入网设备的目的，还将第二密钥也发送给了第一接入网设备，从而无需通过新增的消息将第二密钥发送给第一接入网设备，有助于与现有的方案兼容，且能够减小信令开销。其中，由于切换请求消息是控制面的信令，则第一核心网设备在转发切换请求消息时，可以将切换请求消息转发给第一接入网设备的控制面实体，因此本申请实施例可以将用于控制面安全处理的第二密钥添加到第一切换请求消息中，得到第二切换请求消息，第一核心网设备可以将第二切换请求消息发送给第一接入网设备的控制面实体。
或者，第一核心网设备发送第二密钥也可以不利用现有的消息，例如本申请实施例可以在原有切换流程中新增一条消息，例如称为第二消息，第二消息可以包括第二密钥。也就是说，第一核心网设备可以通过第二消息将第二密钥发送给第一接入网设备的控制面实体。第二消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。 如果是这种情况，则第一核心网设备还会将第一切换请求消息转发给第一接入网设备，那么第一核心网设备可以先转发第一切换请求消息后发送第二消息，或者可以先发送第二消息后转发第一切换请求消息，或者也可以同时发送第一切换请求消息和第二消息。
另外，如果第一接入网设备的用户面实体部署在除第一核心网设备之外的其他的核心网设备中，则第一核心网设备可以将第三密钥发送给第一接入网设备的用户面实体。例如，第一核心网设备是AMF，第一接入网设备的用户面实体部署在UPF中，或者第一接入网设备的用户面实体在核心网侧是独立的设备，则AMF可以将第三密钥发送给第一接入网设备的用户面实体。或者，如果第一接入网设备的用户面实体部署在第一核心网设备中，则第一核心网设备可以不必向第一接入网设备的用户面实体发送第三密钥，第一接入网设备的用户面实体可以获得第一核心网设备推演得到的第三密钥。
本申请实施例可以在原有切换流程中新增一条消息，例如称为第三消息，如果第一核心网设备需要向第一接入网设备的用户面实体发送第三密钥，则第三消息可包括第三密钥。也就是说，第一核心网设备可以通过第三消息将第三密钥发送给第一接入网设备的用户面实体。第三消息可以认为是与安全相关的消息，或者也可以认为是与小区切换相关的消息。
如果第一核心网设备需要向第一接入网设备的用户面实体发送第三密钥，则第一核心网设备可以先发送第三消息后发送第二消息，或者可以先发送第二消息后发送第三消息，或者也可以同时发送第三消息和第二消息。
关于S704的更多内容，可参考图5所示的实施例中的S503的相关介绍。
S705、第一核心网设备向终端设备发送NCC，终端设备接收来自第一核心网设备的NCC。
例如，第一核心网设备可以将NCC发送给第二接入网设备，由第二接入网设备将NCC转发给终端设备；或者，第一核心网设备可以将NCC发送给第一接入网设备，第一接入网设备将NCC转发给第二接入网设备，再由第二接入网设备将NCC转发给终端设备。其中，如果第一核心网设备将NCC发送给第一接入网设备，则第一核心网设备可以将NCC发送给第一接入网设备的控制面实体，由第一接入网设备的控制面实体将NCC转发给第二接入网设备，再由第二接入网设备将NCC转发给终端设备。
关于NCC的更多内容，可参考图5所示的实施例中的S504的相关介绍。
S706、第一接入网设备向第一核心网设备发送切换请求确认消息，第一核心网设备接收来自第一接入网设备的切换请求确认消息。
例如，第一接入网设备的控制面实体向第一核心网设备发送切换请求确认消息，第一核心网设备接收来自第一接入网设备的控制面实体的切换请求确认消息。
S707、第一核心网设备向第二接入网设备转发切换请求确认消息，第二接入网设备接收来自第一核心网设备的切换请求确认消息。
因为本申请实施例基于基站和核心网设备之间的N2接口的跨基站的小区切换过程，因此第一接入网设备向第二接入网设备发送切换请求确认消息，需要通过第一核心网设备转发。
S708、第二接入网设备向终端设备发送切换命令，终端设备接收来自第二接入网设备的切换命令。
关于S708，可参考图3所示的流程中的S307。其中，S705～S708均为可选的步骤，不是必须执行的，在图6中用虚线表示。
另外，在执行S708后，还可以继续执行如图3所示的流程中的S308～S313中的一个或多个步骤，即，还可执行有关小区切换的一个或多个步骤，当然在执行过程中，接入网设备之间不能直接通信，需要通过第一核心网设备转发。本申请实施例对于还需要执行与小区切换相关的哪些步骤不做限制。
在本申请实施例中，第一接入网设备的控制面实体和用户面实体为两个网络实体，且控制面实体位于接入网侧，用户面实体位于核心网侧，这样数据的安全处理会在核心网侧进行。以上行传输为例。数据在终端设备侧的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到核心网侧的用户面实体，在用户面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)，然后再传输到核心网侧的UPF；而信令从终端设备的RRC层传输到终端设备的PDCP层，在终端设备的PDCP进行安全处理(例如加密或完整性保护)以后，传输到接入网侧的DU，经过DU的处理后传输到接入网侧的控制面实体，在控制面实体的PDCP层进行相应的安全处理(例如解密或完整性验证)后，递交给控制面实体的RRC层解析。可见，通过本申请实施例提供的方法，用户面数据的安全处理在用户面实体中进行，控制面信令的安全处理在控制面实体中进行，用户面实体和控制面实体位于不同的实体中，使得用户面数据和控制面信令的安全处理过程能够隔离，提高用户面数据的安全性。而且一般来说，接入层的控制信令是为了辅助用户面数据传输的，用户真正关心的是用户面数据，所以将用户面数据的安全处理放在核心网侧，首先能够保证用户面数据处理的安全性，同时通过隔离用户面与控制面的安全处理过程，可以进一步保证接入网侧无法获取用户面数据安全处理的密钥，能够显著降低用户面数据的安全风险。
图5所示的实施例至图7所示的实施例中的每个实施例，都是使得接入网设备的控制面实体和用户面实体相分离，从而提高数据的安全性。接下来，本申请实施例提供一种发送、接收数据包的方法，在这种方法中，无需使得接入网设备的控制面实体和用户面实体相分离，也能提高数据的安全性。请参见图8，为该方法的流程图。在下文的介绍过程中，以该方法应用于图4A、图4B或图4C所示的网络架构为例。另外，本申请实施例所涉及的小区切换流程是基于基站之间的Xn接口的跨基站的小区切换流程。
为了便于介绍，在下文中，以该方法由第一设备和第二设备执行为例，其中第一设备为数据包发送端，第二设备为数据包接收端。例如第一设备为终端设备，第二设备为接入网设备；或者，第一设备为接入网设备，第二设备为终端设备。因为本申请实施例是以应用在图4A、图4B或图4C所示的网络架构为例，因此，本申请实施例所述的核心网设备例如为图4A、图4B或图4C所示的网络架构中的AMF，或者也可以是除AMF和UPF之外的其他的核心网设备，本申请实施例所述的接入网设备可以是图4A、图4B或图4C所示的网络架构中的接入网设备，本申请实施例所述的终端设备可以是图4A、图4B或图4C所示的网络架构中的终端设备。
S801、第一设备获得第一数据包。
例如，S801可以是第一设备的第一协议层获得第一数据包。第一协议层是本申请实施例新增的协议层，也可以称为安全层(security layer)，或者还可以有其他的名称。在第一设备内，第一协议层可位于PDCP层之上，以及位于IP层和工业媒体接入控制(media access control，MAC)层之下。其中，所述的工业MAC层不是空口协议栈中位于物理层之上的MAC层，工业MAC层是位于第一协议层之上的，第一协议层又位于空口协议栈的MAC 层之上。所述的工业MAC层和空口协议栈的MAC层的功能结构是不同的。
第一数据包例如为IP包或以太包。第一设备是第一数据包的发送端，那么，如果第一数据包为IP包，那么可以是第一设备的IP层生成第一数据包，并将第一数据包发送给第一设备的第一协议层。或者，如果第一数据包为以太包，则可以是第一设备的工业MAC层生成第一数据包，并将第一数据包发送给第一设备的第一协议层。
S802、第一设备在第一协议层使用第一密钥对第一数据包进行安全处理，得到第二数据包。
此处的安全处理，可以包括如下的一种或多种处理方式：完整性保护、完整性验证、加密、或解密。例如，第一设备是第一数据包的发送端，则第一设备可以在第一协议层对第一数据包进行完整性保护，或者进行加密，或者进行完整性保护和加密。又例如，第一设备是第一数据包的接收端，则第一设备可以在第一协议层对第一数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密。本申请实施例以第一设备是第一数据包的发送端为例。
第一设备在第一协议层使用第一密钥对第一数据包进行安全处理之前，首先需要获得第一密钥。如果第一设备为终端设备，对于终端设备来说，可以内置根密钥(例如为图5所示的实施例中的S504所介绍的第二根密钥)，终端设备可按照第一规则对该根密钥进行推演，得到第一密钥。或者，如果第一设备为核心网设备，对于核心网设备来说，也有对应于该终端设备的密钥，例如称为第三密钥，例如核心网设备为AMF，则核心网设备对应于该终端设备的密钥(即第三密钥)为K AMF，即如图5所示的实施例中的S501所述的第四密钥。其中，核心网设备对应于该终端设备的密钥，是指核心网设备在与该终端设备通信时所使用的密钥，或者是指，根据该密钥能够确定核心网设备在与该终端设备通信时所使用的密钥，对此可以理解为，核心网设备在与不同的终端设备通信时可以使用对应于相应终端设备的，用于对接入层控制面信令和用户面数据进行安全处理的密钥，进行安全处理。核心网设备可以根据第一规则对第三密钥进行推演，得到第一密钥。第一规则可以是核心网设备配置的，或者是终端设备与核心网设备协商确定的，或者是通过协议规定的。另外，可选的，终端设备可以与核心网设备进行交互，来保证双方所用的第一规则是一致的。
如果第一设备在第一协议层使用第一密钥对第一数据包进行完整性保护或完整性验证，则第一密钥可包括第一子密钥，第一子密钥用于在第一协议层对数据包进行完整性保护或完整性验证。如果第一设备在第一协议层使用第一密钥对第一数据包进行加密或解密，则第一密钥可包括第二子密钥，第二子密钥用于在第一协议层对数据包进行加密或解密。也就是说，第一密钥可包括第一子密钥，或包括第二子密钥，或包括第一子密钥和第二子密钥。或者，如果所述的安全处理还包括其他的安全处理过程，则第一密钥还可以包括其他的安全处理过程相应的密钥。
另外，以数据包是IP包或以太包为例。数据包的发送端在对一个数据包进行处理时，为了节省传输资源开销，数据包的发送端的PDCP层可以对该数据包的包头进行压缩，例如使用头压缩协议对IP包头或者以太包头进行压缩，压缩后的包头的长度缩短，可以节省传输资源开销。本申请实施例引入了第一协议层，这可能会导致一个问题：整个数据包在第一协议层进行安全处理，第一协议层将安全处理后的数据包递交到PDCP层后，PDCP层无法识别出该数据包的包头，从而无法对包头进行压缩，这样会影响压缩功能，可能造 成传输资源浪费甚至导致传输出错。
为此，本申请实施例提供几种解决方式，下面分别介绍。
解决方式一、
第一设备在第一协议层将第一数据包的包头移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在第一协议层使用第一密钥对第一数据包的负载进行安全处理，例如加密和/或完整性保护等，得到安全加密后的负载。第一设备在第一协议层再将第一数据包的包头与安全处理后的负载组合，将组合后的数据包称为第二数据包。那么，第二数据包的包头就是第一数据包的包头，第二数据包的负载是已经过安全处理的负载。之后，第一协议层可将第二数据包递交给第一设备的PDCP层。由于第二数据包的包头(即，第一数据包的包头)并未经过安全处理，因此第一设备的PDCP层能够对第二数据包的包头进行压缩。
解决方式二、
第一设备在第一协议层将第一数据包的包头移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在第一协议层将第一数据包的包头进行压缩，得到压缩包头。第一设备在第一协议层将压缩包头与第一数据包的负载组合，得到一个整体，对这个整体进行安全处理，例如加密和/或完整性保护等，得到第二数据包，即，第二数据包是经过安全处理的数据包。第一协议层再将第二数据包递交给第一设备的PDCP层，由于第二数据包是经过安全处理的，PDCP层无法对第二数据包进行解密或完整性验证等处理，因此PDCP层无需再进行压缩操作。但第一设备已在第一协议层对第一数据包的包头进行了压缩，因此同样能节省传输资源开销。
如上的两种解决方式只是示例，并不是对本申请实施例的限制。例如，第一设备也可以采用其他方式来节省传输资源开销，或者，在提高了安全性的基础上，第一设备也可以不考虑对数据包的包头进行压缩等。
S803、第一设备在PDCP层使用第二密钥对第二数据包进行安全处理，得到第三数据包。为了加以区分，可将S803中的安全处理称为第二安全处理，将S802中的安全处理称为第一安全处理，或者说，将PDCP层的安全处理称为第二安全处理，将第一协议层的安全处理称为第一安全处理。
同理，第二安全处理也可以包括如下的一种或多种处理方式：完整性保护、完整性验证、加密、或解密。如果第一设备是第一数据包的发送端，则第一设备可以在PDCP层对第一数据包进行完整性保护，或者进行加密，或者进行完整性保护和加密。或者，如果第一设备是第一数据包的接收端，则第一设备可以在PDCP层对第一数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密。本申请实施例以第一设备是第一数据包的发送端为例。
第一设备在PDCP层使用第二密钥对第二数据包进行第二安全处理之前，首先需要获得第二密钥。例如，第一设备为终端设备，对于终端设备来说，可以内置根密钥(例如为图5所示的实施例中的S504所介绍的第二根密钥)，终端设备根据该根密钥进行推演，得到第二密钥。或者，第一设备为核心网设备，对于核心网设备来说，也有对应于该终端设备的密钥，例如称为第三密钥，例如核心网设备为AMF，则核心网设备对应于该终端设备的密钥(即第三密钥)为K AMF，即如图5所示的实施例中的S501所述的第四密钥。核心网设备可以根据第三密钥进行推演，得到第二密钥。
如果第一设备在PDCP层使用第二密钥对第二数据包进行完整性保护或完整性验证，则第二密钥可包括第三子密钥，第三子密钥用于在PDCP层对数据包进行完整性保护或完整性验证。如果第一设备在PDCP层使用第二密钥对第二数据包进行加密或解密，则第二密钥可包括第四子密钥，第四子密钥用于在PDCP层对数据包进行加密或解密。也就是说，第二密钥可包括第三子密钥，或包括第四子密钥，或包括第三子密钥和第四子密钥。或者，如果所述的第二安全处理还包括其他的安全处理过程，则第二密钥还可以包括其他的安全处理过程相应的密钥。
另外，如果在S802中第一设备在第一协议层采用了所述的解决方式一，那么第一协议层递交给PDCP层的第二数据包是第一数据包的包头与安全处理后的负载组合得到的数据包。则第一设备可以在PDCP层将第二数据包的包头(即，第一数据包的包头)移除，或者理解为，将第一数据包的包头和负载分离。之后，第一设备在PDCP层对第一数据包的包头进行压缩，得到压缩包头，再将压缩包头和安全处理后的负载组合，得到一个整体，在PDCP层使用第二密钥对这个整体进行第二安全处理，得到第三数据包。通过这种方式，在PDCP层可以继续对数据包的包头进行压缩，从而能够节省传输资源开销。
或者，如果在S802中第一设备在第一协议层采用了所述的解决方式二，那么第一协议层递交给PDCP层的第二数据包是经过第一安全处理的数据包，PDCP层无法获得第一密钥，因此PDCP层无法对第二数据包进行解密或完整性验证等操作。因此第一设备不会在PDCP层再对第二数据包的包头再进行压缩等处理。对于这种情况，第一设备在PDCP层使用第二密钥对第二数据包进行第二安全处理得到第三数据包即可。通过这种方式，在第一协议层对数据包的包头进行了压缩，能够节省传输资源开销。
S804、第一设备发送第三数据包，相应的，第二设备接收来自第一设备的第三数据包。
第一设备得到第三数据包后，可以发送第三数据包，第二设备可接收来自第一设备的第三数据包。
S805、第二设备在PDCP层使用第二密钥对第三数据包进行第三安全处理，得到第二数据包。
第二设备接收第三数据包后，将第三数据包送达第二设备的PDCP层。则第二设备在PDCP层可使用第二密钥对第三数据包进行第三安全处理。第二设备是第三数据包的接收端，则例如，第二设备可以在PDCP层对第三数据包进行完整性验证，或者进行解密，或者进行完整性验证和解密等。也就是说，第三安全处理可包括完整性验证，或解密，或完整性验证和解密等。
第二设备在PDCP层对第三数据包进行第三安全处理后，可得到第二数据包。作为一种可选的实施方式，第二设备在PDCP层对第三数据包进行第三安全处理后，可得到压缩包头和安全处理后的负载。如果是这种情况，则第二设备可以在PDCP层将第二数据包的包头(即，第一数据包的包头)移除，或者理解为，将第一数据包的包头和安全处理后的负载分离。之后，第二设备在PDCP层将压缩包头进行解压缩，得到包头，该包头为第一数据包的包头。第二设备在PDCP层将该包头和安全处理后的负载进行组合，可得到第二数据包。
作为另一种可选的实施方式，第二设备在PDCP层对第三数据包进行第三安全处理后，可得到第二数据包，第二数据包整体是经过第一安全处理的，那么第二设备在PDCP层无需再对第二数据包进行其他处理。
其中，第二设备例如未设置第一协议层，且无法获得相应的密钥，因此第一设备无法对第二数据包进行解密或完整性保护等处理。
S806、第二设备将第二数据包发送给核心网设备，核心网设备接收来自第二设备的第二数据包。
S807、核心网设备在第一协议层使用第一密钥对第二数据包进行第四安全处理，得到第一数据包。
其中，如果第二数据包是第一数据包的包头和安全处理后的负载的组合，则核心网设备可在第一协议层将第一数据包的包头移除，或者理解为，将第一数据包的包头和安全处理后的负载分离。之后，核心网设备在第一协议层将安全处理后的负载进行第四安全处理，例如进行解密和/或完整性验证等，得到第一数据包的负载。核心网设备再在第一协议层将第一数据包的包头和第一数据包的负载组合，就得到了第一数据包，从而核心网设备可以获得第一数据包所包括的数据。
或者，如果第二数据包是整体经过安全处理的数据包，则核心网设备在第一协议层将第二数据包进行第四安全处理，例如进行解密和/或完整性验证等，得到第一数据包的负载和压缩包头。核心网设备可在第一协议层将压缩包头移除，或者理解为，将压缩包头和第一数据包负载分离。之后，核心网设备对该压缩包头进行解压缩，得到第一数据包的包头。核心网设备再在第一协议层将第一数据包的包头和第一数据包的负载组合，就得到了第一数据包，从而核心网设备可以获得第一数据包所包括的数据。
其中，第四安全处理所使用的密钥也是第一密钥。
图8中的S806和S807是以上行传输为例的，即，第一设备是终端设备，第二设备是接入网设备，第一数据包是终端设备发送的上行数据包，该上行数据包经过接入网设备处理后，会再发送给核心网设备。可以参考图9，数据包在终端设备侧首先经过第一协议层的第一安全处理后，传输到终端设备的PDCP层进行第二安全处理，然后再传输到接入网设备。此时接入网设备接收的数据包经过了第一协议层和PDCP层的两级安全处理，而接入网设备由于未设置第一协议层，只能解开终端设备在PDCP层的安全处理，因此接入网设备仍然无法读取到该数据包的内容，由此保证了数据在接入网设备侧的安全性。数据经过接入网设备的处理以后，传输到核心网设备(例如UPF)，核心网设备也设置了第一协议层，通过核心网设备的第一协议层进行与终端设备的第一协议层相对应的安全处理(例如第四安全处理)后，才能读取数据包的内容。
如果是下行传输过程，即，第一设备是核心网设备，第二设备是接入网设备，第一数据包是核心网设备发送的下行数据包，该下行数据包经过接入网设备处理后，会再发送给终端设备。即，如果是下行传输过程，那么S806为，第二设备将第二数据包发送给终端设备，终端设备接收来自第二设备的第二数据包。相应的，如果是下行传输过程，则S807为，终端设备在第一协议层对第二数据包进行第四安全处理，得到第一数据包。具体的，数据包在核心网设备侧首先经过第一协议层的第一安全处理后，传输到核心网设备的PDCP层进行第二安全处理，然后再传输到接入网设备。此时接入网设备接收的数据包经过了第一协议层和PDCP层的两级安全处理，而接入网设备由于未设置第一协议层，只能解开核心网设备在PDCP层的安全处理，因此接入网设备仍然无法读取到该数据包的内容，由此保证了数据在接入网设备侧的安全性。数据经过接入网设备的处理以后，传输到终端设备，终端设备也设置了第一协议层，通过终端设备的第一协议层进行与核心网设备的第 一协议层相对应的安全处理(例如第四安全处理)后，才能读取数据包的内容。
在本申请实施例中，对数据包设置了两级安全处理的机制，接入网设备只能进行其中的一级安全处理(即PDCP层的安全处理)，而无法进行第一协议层的安全处理。因此数据对于接入网设备来说是不可见的，接入网设备无法获取数据，从而保证了数据在接入网设备侧的安全性。
下面结合附图介绍本申请实施例中用来实现上述方法的装置。因此，上文中的内容均可以用于后续实施例中，重复的内容不再赘述。
图10为本申请实施例提供的通信装置1000的示意性框图。示例性地，通信装置1000例如为核心网设备1000。示例性地，核心网设备1000例如为图5所示的实施例至图7所示的实施例中的任一个实施例所述的第一核心网设备。
核心网设备1000包括处理模块1010和收发模块1020。示例性地，核心网设备1000可以是核心网设备，也可以是应用于核心网设备中的芯片或者其他具有上述核心网设备功能的组合器件、部件等。当核心网设备1000是核心网设备时，收发模块1020可以是收发器，收发器可以包括天线和射频电路等，处理模块1010可以是处理器(或者，处理电路)，例如基带处理器，基带处理器中可以包括一个或多个中央处理单元(central processing unit，CPU)。当核心网设备1000是具有上述核心网设备功能的部件时，收发模块1020可以是射频单元，处理模块1010可以是处理器(或者，处理电路)，例如基带处理器。当核心网设备1000是芯片系统时，收发模块1020可以是芯片(例如基带芯片)的输入输出接口、处理模块1010可以是芯片系统的处理器(或者，处理电路)，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1010可以由处理器或处理器相关电路组件(或者，处理电路)实现，收发模块1020可以由收发器或收发器相关电路组件实现。
例如，处理模块1010可以用于执行图5所示的实施例中由第一核心网设备所执行的除了收发操作之外的全部操作，例如S501和S502，和/或用于支持本文所描述的技术的其它过程。收发模块1020可以用于执行图5所示的实施例中由第一核心网设备所执行的全部收发操作，例如S503和S504，和/或用于支持本文所描述的技术的其它过程。
又例如，处理模块1010可以用于执行图6所示的实施例中由第一核心网设备所执行的除了收发操作之外的全部操作，例如S603和S604，和/或用于支持本文所描述的技术的其它过程。收发模块1020可以用于执行图6所示的实施例中由第一核心网设备所执行的全部收发操作，例如S601、S605和S606，和/或用于支持本文所描述的技术的其它过程。
再例如，处理模块1010可以用于执行图7所示的实施例中由第一核心网设备所执行的除了收发操作之外的全部操作，例如S702和S703，和/或用于支持本文所描述的技术的其它过程。收发模块1020可以用于执行图7所示的实施例中由第一核心网设备所执行的全部收发操作，例如S701、S704、S705、S706和S707，和/或用于支持本文所描述的技术的其它过程。
另外，收发模块1020可以是一个功能模块，该功能模块既能完成发送操作也能完成接收操作，例如收发模块1020可以用于执行图5所示的实施例至图7所示的实施例中的任一个实施例中由第一核心网设备所执行的全部发送操作和接收操作，例如，在执行发送操作时，可以认为收发模块1020是发送模块，而在执行接收操作时，可以认为收发模块1020是接收模块；或者，收发模块1020也可以是两个功能模块，收发模块1020可以视为这两个功能模块的统称，这两个功能模块分别为发送模块和接收模块，发送模块用于完成 发送操作，例如发送模块可以用于执行图5所示的实施例至图7所示的实施例中的任一个实施例中由第一核心网设备所执行的全部发送操作，接收模块用于完成接收操作，例如接收模块可以用于执行图5所示的实施例至图7所示的实施例中的任一个实施例中由第一核心网设备所执行的全部接收操作。
其中，处理模块1010，用于获得第一密钥；
处理模块1010，还用于根据所述第一密钥进行推演，得到第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理；
收发模块1020，用于将所述第二密钥发送给第一接入网设备的控制面实体，以及，将所述第三密钥发送给所述第一接入网设备的用户面实体，所述第一接入网设备的控制面实体与所述终端设备进行控制面信令通信，所述第一接入网设备的用户面实体与所述终端设备进行用户面数据通信。
作为一种可选的实施方式，所述第一接入网设备的控制面实体位于所述第一接入网设备侧，所述第一接入网设备的用户面实体位于核心网设备侧。
作为一种可选的实施方式，所述第一密钥为根据与所述终端设备对应的第一根密钥得到的，所述第一根密钥存储在核心网设备中。
作为一种可选的实施方式，收发模块1020，还用于接收来自第二接入网设备的输入参数，所述输入参数用于确定所述第一密钥，其中，所述第二接入网设备为所述终端设备在进行小区切换时的源接入网设备，所述第一接入网设备为所述终端设备在进行小区切换时的目标接入网设备。
作为一种可选的实施方式，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
作为一种可选的实施方式，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
作为一种可选的实施方式，所述第二密钥包括在第二切换请求消息中，所述第二切换请求消息用于请求将所述终端设备切换到所述第一小区。
作为一种可选的实施方式，收发模块1020，还用于向所述终端设备发送NCC，所述NCC用于确定所述第二密钥和/或所述第三密钥。
作为一种可选的实施方式，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于核心网设备1000所能实现的其他功能，可参考图5所示的实施例至图7所示的实施例中的任一个实施例的相关介绍，不多赘述。
图11为本申请实施例提供的通信装置1100的示意性框图。示例性地，通信装置1100例如为接入网设备1100。示例性地，接入网设备1100例如为图6所示的实施例或图7所示的实施例所述的第二接入网设备。
接入网设备1100包括处理模块1110。可选的，还可以包括收发模块1120。示例性地，接入网设备1100可以是接入网设备，也可以是应用于接入网设备中的芯片或者其他具有上述接入网设备功能的组合器件、部件等。当接入网设备1100是接入网设备时，收发模块1120可以是收发器，收发器可以包括天线和射频电路等，处理模块1110可以是处理器(或 者，处理电路)，例如基带处理器，基带处理器中可以包括一个或多个CPU。当接入网设备1100是具有上述接入网设备功能的部件时，收发模块1120可以是射频单元，处理模块1110可以是处理器(或者，处理电路)，例如基带处理器。当接入网设备1100是芯片系统时，收发模块1120可以是芯片(例如基带芯片)的输入输出接口、处理模块1110可以是芯片系统的处理器(或者，处理电路)，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1110可以由处理器或处理器相关电路组件(或者，称为处理电路)实现，收发模块1120可以由收发器或收发器相关电路组件实现。
例如，处理模块1110可以用于执行图6所示的实施例中由第二接入网设备所执行的除了收发操作之外的全部操作，例如确定将终端设备切换到第一接入网设备，和/或用于支持本文所描述的技术的其它过程。收发模块1120可以用于执行图6所示的实施例中由第二接入网设备所执行的全部收发操作，例如S601、S602、S607和S608，和/或用于支持本文所描述的技术的其它过程。
又例如，处理模块1110可以用于执行图7所示的实施例中由第二接入网设备所执行的除了收发操作之外的全部操作，例如确定将终端设备切换到第一接入网设备，和/或用于支持本文所描述的技术的其它过程。收发模块1120可以用于执行图7所示的实施例中由第二接入网设备所执行的全部收发操作，例如S701、S707和S708，和/或用于支持本文所描述的技术的其它过程。
另外，关于收发模块1120的实现方式，可参考对于收发模块1020的实现方式的介绍。
其中，处理模块1110，用于确定将终端设备从第二接入网设备切换到第一接入网设备；
收发模块1120，用于向第一核心网设备发送输入参数，所述输入参数用于确定第一密钥，所述第一密钥用于确定第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理。
作为一种可选的实施方式，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
作为一种可选的实施方式，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
关于接入网设备1100所能实现的其他功能，可参考图6所示的实施例或图7所示的实施例的相关介绍，不多赘述。
图12为本申请实施例提供的通信装置1200的示意性框图。示例性地，通信装置1200例如为第一设备1200。
第一设备1200包括处理模块1210。可选的，还可以包括收发模块1220。示例性地，第一设备1200可以是终端设备，也可以是应用于终端设备中的芯片或者其他具有上述终端设备功能的组合器件、部件等。当第一设备1200是终端设备时，收发模块1220可以是收发器，收发器可以包括天线和射频电路等，处理模块1210可以是处理器(或者，处理电路)，例如基带处理器，基带处理器中可以包括一个或多个CPU。当第一设备1200是具有上述终端设备功能的部件时，收发模块1220可以是射频单元，处理模块1210可以是处理器(或者，处理电路)，例如基带处理器。当第一设备1200是芯片系统时，收发模块1220可以是芯片(例如基带芯片)的输入输出接口、处理模块1210可以是芯片系统的处理器(或者，处理电路)，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处 理模块1210可以由处理器或处理器相关电路组件(或者，称为处理电路)实现，收发模块1220可以由收发器或收发器相关电路组件实现。
或者，示例性地，第一设备1200可以是网络设备，也可以是应用于网络设备中的芯片或者其他具有上述网络设备功能的组合器件、部件等。示例性地，所述网络设备为核心网设备。当第一设备1200是网络设备时，收发模块1220可以是收发器，收发器可以包括天线和射频电路等，处理模块1210可以是处理器(或者，处理电路)，例如基带处理器，基带处理器中可以包括一个或多个中央处理单元(central processing unit，CPU)。当第一设备1200是具有上述网络设备功能的部件时，收发模块1220可以是射频单元，处理模块1210可以是处理器(或者，处理电路)，例如基带处理器。当第一设备1200是芯片系统时，收发模块1220可以是芯片(例如基带芯片)的输入输出接口、处理模块1210可以是芯片系统的处理器(或者，处理电路)，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1210可以由处理器或处理器相关电路组件(或者，处理电路)实现，收发模块1220可以由收发器或收发器相关电路组件实现。
例如，处理模块1210可以用于执行图8所示的实施例中由第一设备所执行的除了收发操作之外的全部操作，例如S801～S803，和/或用于支持本文所描述的技术的其它过程。收发模块1220可以用于执行图8所示的实施例中由第一设备所执行的全部收发操作，例如S804，和/或用于支持本文所描述的技术的其它过程。
另外，关于收发模块1220的实现方式，可参考对于收发模块1020的实现方式的介绍。
其中，处理模块1210，用于获得第一数据包；
处理模块1210，还用于在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包；
处理模块1210，还用于在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包；
收发模块1220，用于发送所述第三数据包。
作为一种可选的实施方式，所述第一密钥为根据与终端设备对应的第一根密钥得到的。
作为一种可选的实施方式，处理模块1210用于通过如下方式在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包：
在所述第一协议层，使用第一密钥对所述第一数据包的负载进行所述安全处理，得到安全处理后的负载；
将所述第一数据包的包头与所述安全处理后的负载组合，得到所述第二数据包。
作为一种可选的实施方式，处理模块1210用于通过如下方式在PDCP层使用第二密钥对所述第二数据包进行加密，得到第三数据包：
在所述PDCP层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第二密钥对所述压缩包头与所述安全处理后的负载进行加密，得到所述第三数据包。
作为一种可选的实施方式，处理模块1210用于通过如下方式在第一协议层使用第一密钥对所述第一数据包进行安全处理，得到第二数据包：
在所述第一协议层，将所述第一数据包的包头进行压缩，得到压缩包头；
使用所述第一密钥对所述压缩包头与所述第一数据包的负载进行所述安全处理，得到所述第二数据包。
作为一种可选的实施方式，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于第一设备1200所能实现的其他功能，可参考图8所示的实施例的相关介绍，不多赘述。
图13为本申请实施例提供的通信装置1300的示意性框图。示例性地，通信装置1300例如为第二设备1300。
第二设备1300包括处理模块1310。可选的，还可以包括收发模块1320。示例性地，第二设备1300可以是接入网设备，也可以是应用于接入网设备中的芯片或者其他具有上述接入网设备功能的组合器件、部件等。当第二设备1300是接入网设备时，收发模块1320可以是收发器，收发器可以包括天线和射频电路等，处理模块1310可以是处理器(或者，处理电路)，例如基带处理器，基带处理器中可以包括一个或多个CPU。当第二设备1300是具有上述接入网设备功能的部件时，收发模块1320可以是射频单元，处理模块1310可以是处理器(或者，处理电路)，例如基带处理器。当第二设备1300是芯片系统时，收发模块1320可以是芯片(例如基带芯片)的输入输出接口、处理模块1310可以是芯片系统的处理器(或者，处理电路)，可以包括一个或多个中央处理单元。应理解，本申请实施例中的处理模块1310可以由处理器或处理器相关电路组件(或者，称为处理电路)实现，收发模块1320可以由收发器或收发器相关电路组件实现。
例如，处理模块1310可以用于执行图8所示的实施例中由第二设备所执行的除了收发操作之外的全部操作，例如S507，和/或用于支持本文所描述的技术的其它过程。收发模块1320可以用于执行图8所示的实施例中由第二设备所执行的全部收发操作，例如S501、S503、S506、S512和S513，和/或用于支持本文所描述的技术的其它过程。
另外，关于收发模块1320的实现方式，可参考对于收发模块1020的实现方式的介绍。
其中，收发模块1320，用于接收第三数据包；
处理模块1310，用于在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包，所述第二数据包为经过安全处理的数据包；
收发模块1320，还用于将所述第二数据包发送给核心网设备。
作为一种可选的实施方式，处理模块1310用于通过如下方式在PDCP层使用第二密钥解密所述第三数据包，得到第二数据包：
在所述PDCP层，使用第二密钥解密所述第三数据包，得到压缩包头和安全处理后的负载；
将所述压缩包头进行解压缩，得到包头；
将所述包头和所述安全处理后的负载组合，得到所述第二数据包。
作为一种可选的实施方式，所述安全处理包括以下一项或多项：完整性保护、完整性验证、加密、或解密。
关于第二设备1300所能实现的其他功能，可参考图8所示的实施例的相关介绍，不多赘述。
本申请实施例还提供一种通信装置，该通信装置可以是终端设备也可以是电路。该通信装置可以用于执行上述方法实施例中由终端设备(例如，第一设备可以是终端设备)所执行的动作。
当该通信装置为终端设备时，图14示出了一种简化的终端设备的结构示意图。便于 理解和图示方便，图14中，终端设备以手机作为例子。如图14所示，终端设备包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对终端设备进行控制，执行软件程序，处理软件程序的数据等。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当需要发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。为便于说明，图14中仅示出了一个存储器和处理器。在实际的终端设备产品中，可以存在一个或多个处理器和一个或多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
在本申请实施例中，可以将具有收发功能的天线和射频电路视为终端设备的收发单元(收发单元可以是一个功能单元，该功能单元能够实现发送功能和接收功能；或者，收发单元也可以包括两个功能单元，分别为能够实现接收功能的接收单元和能够实现发送功能的发送单元)，将具有处理功能的处理器视为终端设备的处理单元。如图14所示，终端设备包括收发单元1410和处理单元1420。收发单元也可以称为收发器、收发机、收发装置等。处理单元也可以称为处理器，处理单板，处理模块、处理装置等。可选的，可以将收发单元1410中用于实现接收功能的器件视为接收单元，将收发单元1410中用于实现发送功能的器件视为发送单元，即收发单元1410包括接收单元和发送单元。收发单元有时也可以称为收发机、收发器、或收发电路等。接收单元有时也可以称为接收机、接收器、或接收电路等。发送单元有时也可以称为发射机、发射器或者发射电路等。
应理解，如果上述图8所示的实施例中的第一设备为终端设备，则收发单元1410用于执行上述图8所示的实施例中第一设备侧的发送操作和接收操作，处理单元1420用于执行上述图8所示的实施例中第一设备上除了收发操作之外的其他操作。
当该通信装置为芯片类的装置或者电路时，该装置可以包括收发单元和处理单元。其中，所述收发单元可以是输入输出电路和/或通信接口；处理单元为集成的处理器或者微处理器或者集成电路。
本实施例中的通信装置为终端设备时，可以参照图15所示的设备。作为一个例子，该设备可以完成类似于图12中处理模块1210的功能。上述实施例中的处理模块1210可以是图15中的该处理器1510，并完成相应的功能；上述实施例中的收发模块1220可以是图15中的发送数据处理器1520，和/或接收数据处理器1530，并完成相应的功能。虽然图15中示出了信道编码器、信道解码器，但是可以理解这些模块并不对本实施例构成限制性说明，仅是示意性的。
图16示出本实施例的另一种形式。处理装置1600中包括调制子系统、中央处理子系统、周边子系统等模块。本实施例中的通信装置可以作为其中的调制子系统。具体的，该调制子系统可以包括处理器1603，接口1604。其中，处理器1603完成上述处理模块1210 的功能，接口1604完成上述收发模块1220的功能。作为另一种变形，该调制子系统包括存储器1606、处理器1603及存储在存储器1606上并可在处理器上运行的程序，该处理器1603执行该程序时实现上述方法实施例中终端设备侧的方法。需要注意的是，所述存储器1606可以是非易失性的，也可以是易失性的，其位置可以位于调制子系统内部，也可以位于处理装置1600中，只要该存储器1606可以连接到所述处理器1603即可。
请参考图17，为本申请实施例提供的又一种通信装置示意图，用于实现以上实施例中第一核心网设备、第二接入网设备、或第二设备的操作。该通信装置包括：处理器1730和通信接口1720，可选的，该通信装置还包括存储器1710。通信接口1720用于实现与其他设备进行通信。
以上实施例中，第一核心网设备、第二接入网设备、或第二设备执行的方法可以通过处理器1730调用存储器(可以是第一核心网设备、第二接入网设备、或第二设备中的存储器1710，也可以是外部存储器)中存储的程序来实现。即，用于第一核心网设备、第二接入网设备、或第二设备的装置可以包括处理器1730，该处理器1730通过调用存储器中的程序，以执行以上方法实施例中的第一核心网设备、第二接入网设备、或第二设备执行的方法。这里的处理器可以是一种具有信号的处理能力的集成电路，例如CPU。用于第一核心网设备、第二接入网设备、或第二设备的装置可以通过配置成实施以上方法的一个或多个集成电路来实现。例如：一个或多个ASIC，或，一个或多个微处理器DSP，或，一个或者多个FPGA等，或这些集成电路形式中至少两种的组合。或者，可以结合以上实现方式。
例如，图10中的处理模块1010的功能/实现过程可以通过图17所示的通信装置1700中的处理器1730调用存储器1710中存储的计算机可执行指令来实现，图10中的收发模块1020的功能/实现过程可以通过图17中所示的通信装置1700中的通信接口1720来实现。
又例如，图11中的处理模块1110的功能/实现过程可以通过图17所示的通信装置1700中的处理器1730调用存储器1710中存储的计算机执行指令来实现，图11中的收发模块1120的功能/实现过程可以通过图17中所示的通信装置1700中的通信接口1720来实现。
又例如，图12中的处理模块1210的功能/实现过程可以通过图17所示的通信装置1700中的处理器1730调用存储器1710中存储的计算机执行指令来实现，图12中的收发模块1220的功能/实现过程可以通过图17中所示的通信装置1700中的通信接口1720来实现。
再例如，图13中的处理模块1310的功能/实现过程可以通过图17所示的通信装置1700中的处理器1730调用存储器1710中存储的计算机执行指令来实现，图13中的收发模块1320的功能/实现过程可以通过图17中所示的通信装置1700中的通信接口1720来实现。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用 介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk，SSD))等。
本申请实施例中所描述的各种说明性的逻辑单元和电路可以通过通用处理器，数字信号处理器，专用集成电路(ASIC)，现场可编程门阵列(FPGA)或其它可编程逻辑装置，离散门或晶体管逻辑，离散硬件部件，或上述任何组合的设计来实现或操作所描述的功能。通用处理器可以为微处理器，可选地，该通用处理器也可以为任何传统的处理器、控制器、微控制器或状态机。处理器也可以通过计算装置的组合来实现，例如数字信号处理器和微处理器，多个微处理器，一个或多个微处理器联合一个数字信号处理器核，或任何其它类似的配置来实现。
本申请实施例中所描述的方法或算法的步骤可以直接嵌入硬件、处理器执行的软件单元、或者这两者的结合。软件单元可以存储于随机存取存储器(random access memory，RAM)、闪存、只读存储器(read-only memory，ROM)、EPROM存储器、EEPROM存储器、寄存器、硬盘、可移动磁盘、CD-ROM或本领域中其它任意形式的存储媒介中。示例性地，存储媒介可以与处理器连接，以使得处理器可以从存储媒介中读取信息，并可以向存储媒介存写信息。可选地，存储媒介还可以集成到处理器中。处理器和存储媒介可以设置于ASIC中。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个或多个示例性的设计中，本申请实施例所描述的上述功能可以在硬件、软件、固件或这三者的任意组合来实现。如果在软件中实现，这些功能可以存储与电脑可读的媒介上，或以一个或多个指令或代码形式传输于电脑可读的媒介上。电脑可读媒介包括电脑存储媒介和便于使得让电脑程序从一个地方转移到其它地方的通信媒介。存储媒介可以是任何通用或特殊电脑可以接入访问的可用媒体。例如，这样的电脑可读媒体可以包括但不限于RAM、ROM、EEPROM、CD-ROM或其它光盘存储、磁盘存储或其它磁性存储装置，或其它任何可以用于承载或存储以指令或数据结构和其它可被通用或特殊电脑、或通用或特殊处理器读取形式的程序代码的媒介。此外，任何连接都可以被适当地定义为电脑可读媒介，例如，如果软件是从一个网站站点、服务器或其它远程资源通过一个同轴电缆、光纤电脑、双绞线、数字用户线(DSL)或以例如红外、无线和微波等无线方式传输的也被包含在所定义的电脑可读媒介中。所述的碟片(disk)和磁盘(disc)包括压缩磁盘、镭射盘、光盘、数字通用光盘(digital versatile disc，DVD)、软盘和蓝光光盘，磁盘通常以磁性复制数据，而碟片通常以激光进行光学复制数据。上述的组合也可以包含在电脑可读媒介中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请实施例所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取 的任何可用介质。
以上所述的具体实施方式，对本申请实施例的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请实施例的具体实施方式而已，并不用于限定本申请实施例的保护范围，凡在本申请实施例的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请实施例的保护范围之内。本申请说明书的上述描述可以使得本领域技术任何可以利用或实现本申请实施例的内容，任何基于所公开内容的修改都应该被认为是本领域显而易见的，本申请实施例所描述的基本原则可以应用到其它变形中而不偏离本申请的发明本质和范围。因此，本申请实施例所公开的内容不仅仅局限于所描述的实施例和设计，还可以扩展到与本申请原则和所公开的新特征一致的最大范围。
尽管结合具体特征及其实施例对本申请进行了描述，显而易见的，在不脱离本申请实施例的精神和范围的情况下，可对其进行各种修改和组合。相应地，本说明书和附图仅仅是所附权利要求所界定的本申请的示例性说明，且视为已覆盖本申请范围内的任意和所有修改、变化、组合或等同物。显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请实施例也意图包括这些改动和变型在内。

Claims (26)

  1. 一种获取密钥的方法，其特征在于，包括：
    第一核心网设备获得第一密钥；
    所述第一核心网设备根据所述第一密钥进行推演，得到第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理；
    所述第一核心网设备将所述第二密钥发送给第一接入网设备的控制面实体，以及，将所述第三密钥发送给所述第一接入网设备的用户面实体，所述第一接入网设备的控制面实体与所述终端设备进行控制面信令通信，所述第一接入网设备的用户面实体与所述终端设备进行用户面数据通信。
  2. 根据权利要求1所述的方法，其特征在于，所述第一接入网设备的控制面实体位于所述第一接入网设备侧，所述第一接入网设备的用户面实体位于核心网设备侧。
  3. 根据权利要求1或2所述的方法，其特征在于，所述第一密钥为根据与所述终端设备对应的第一根密钥得到的，所述第一根密钥存储在核心网设备中。
  4. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备接收来自第二接入网设备的输入参数，所述输入参数用于确定所述第一密钥，其中，所述第二接入网设备为所述终端设备在进行小区切换时的源接入网设备，所述第一接入网设备为所述终端设备在进行小区切换时的目标接入网设备。
  5. 根据权利要求4所述的方法，其特征在于，所述输入参数包括第一小区的物理小区标识PCI和/或所述第一小区的绝对无线频道编号ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  6. 根据权利要求4或5所述的方法，其特征在于，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  7. 根据权利要求6所述的方法，其特征在于，所述第二密钥包括在第二切换请求消息中，所述第二切换请求消息用于请求将所述终端设备切换到所述第一小区。
  8. 根据权利要求1～7任一项所述的方法，其特征在于，所述方法还包括：
    所述第一核心网设备向所述终端设备发送下一跳链计数NCC，所述NCC用于确定所述第二密钥和/或所述第三密钥。
  9. 一种获取密钥的方法，其特征在于，包括：
    第二接入网设备确定将终端设备从第二接入网设备切换到第一接入网设备；
    所述第二接入网设备向第一核心网设备发送输入参数，所述输入参数用于确定第一密钥，所述第一密钥用于确定第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理。
  10. 根据权利要求9所述的方法，其特征在于，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  11. 根据权利要求9或10所述的方法，其特征在于，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  12. 一种通信装置，其特征在于，包括：
    处理模块，用于获得第一密钥；
    所述处理模块，还用于根据所述第一密钥进行推演，得到第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理；
    收发模块，用于将所述第二密钥发送给第一接入网设备的控制面实体，以及，将所述第三密钥发送给所述第一接入网设备的用户面实体，所述第一接入网设备的控制面实体与所述终端设备进行控制面信令通信，所述第一接入网设备的用户面实体与所述终端设备进行用户面数据通信。
  13. 根据权利要求12所述的通信装置，其特征在于，所述第一接入网设备的控制面实体位于所述第一接入网设备侧，所述第一接入网设备的用户面实体位于核心网设备侧。
  14. 根据权利要求12或13所述的通信装置，其特征在于，所述第一密钥为根据与所述终端设备对应的第一根密钥得到的，所述第一根密钥存储在核心网设备中。
  15. 根据权利要求12或13所述的通信装置，其特征在于，所述收发模块，还用于接收来自第二接入网设备的输入参数，所述输入参数用于确定所述第一密钥，其中，所述第二接入网设备为所述终端设备在进行小区切换时的源接入网设备，所述第一接入网设备为所述终端设备在进行小区切换时的目标接入网设备。
  16. 根据权利要求15所述的通信装置，其特征在于，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  17. 根据权利要求15或16所述的通信装置，其特征在于，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  18. 根据权利要求17所述的通信装置，其特征在于，所述第二密钥包括在第二切换请求消息中，所述第二切换请求消息用于请求将所述终端设备切换到所述第一小区。
  19. 根据权利要求12～18任一项所述的通信装置，其特征在于，所述收发模块，还用于向所述终端设备发送NCC，所述NCC用于确定所述第二密钥和/或所述第三密钥。
  20. 一种通信装置，其特征在于，包括：
    处理模块，用于确定将终端设备从第二接入网设备切换到第一接入网设备；
    收发模块，用于向第一核心网设备发送输入参数，所述输入参数用于确定第一密钥，所述第一密钥用于确定第二密钥和第三密钥，所述第二密钥用于对终端设备的控制面信令进行安全处理，所述第三密钥用于对所述终端设备的用户面数据进行安全处理。
  21. 根据权利要求20所述的通信装置，其特征在于，所述输入参数包括第一小区的PCI和/或所述第一小区的ARFCN，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  22. 根据权利要求20或21所述的通信装置，其特征在于，所述输入参数包括在第一切换请求消息中，所述第一切换请求消息用于请求将所述终端设备切换到第一小区，所述第一小区为所述终端设备在进行小区切换时的目标小区。
  23. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1～8中任意 一项所述的方法，或者使得所述计算机执行如权利要求9～11中任意一项所述的方法。
  24. 一种芯片，其特征在于，包括处理器和通信接口，所述处理器用于读取指令以执行如权利要求1～8中任意一项所述的方法，或者执行如权利要求9～11中任意一项所述的方法。
  25. 一种网络装置，其特征在于，包括处理器，所述处理器与存储器相连，所述存储器用于存储计算机程序，所述处理器用于执行所述存储器中存储的计算机程序，以使得所述装置执行如权利要求1～8中任意一项所述的方法，或者执行如权利要求9～11中任意一项所述的方法。
  26. 一种通信系统，其特征在于，包括权利要求12～19任意一项所述的通信装置、以及包括权利要求20～22任意一项所述的通信装置。
PCT/CN2021/095315 2020-05-26 2021-05-21 一种获取密钥的方法及装置 WO2021238813A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21812373.5A EP4145760A4 (en) 2020-05-26 2021-05-21 METHOD AND APPARATUS FOR OBTAINING KEY
US17/994,050 US20230092744A1 (en) 2020-05-26 2022-11-25 Ckey obtaining method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010454178.9 2020-05-26
CN202010454178.9A CN113795024A (zh) 2020-05-26 2020-05-26 一种获取密钥的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/994,050 Continuation US20230092744A1 (en) 2020-05-26 2022-11-25 Ckey obtaining method and apparatus

Publications (1)

Publication Number Publication Date
WO2021238813A1 true WO2021238813A1 (zh) 2021-12-02

Family

ID=78745619

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/095315 WO2021238813A1 (zh) 2020-05-26 2021-05-21 一种获取密钥的方法及装置

Country Status (4)

Country Link
US (1) US20230092744A1 (zh)
EP (1) EP4145760A4 (zh)
CN (1) CN113795024A (zh)
WO (1) WO2021238813A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117793831A (zh) * 2022-09-28 2024-03-29 华为技术有限公司 小区切换的方法和装置

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104185177A (zh) * 2013-05-27 2014-12-03 中兴通讯股份有限公司 一种安全密钥管理方法、装置和系统
US20190208411A1 (en) * 2018-03-16 2019-07-04 Intel Corporation Security framework for msg3 and msg4 in early data transmission

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010124474A1 (zh) * 2009-04-30 2010-11-04 华为技术有限公司 空口链路安全机制建立的方法、设备
CN101841810B (zh) * 2010-06-07 2016-01-20 中兴通讯股份有限公司 空中接口密钥的更新方法、核心网节点及无线接入系统
CN109586900B (zh) * 2017-09-29 2020-08-07 华为技术有限公司 数据安全处理方法及装置
CN110035431A (zh) * 2018-01-12 2019-07-19 中国移动通信有限公司研究院 信息处理方法及装置、网络实体及存储介质

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104185177A (zh) * 2013-05-27 2014-12-03 中兴通讯股份有限公司 一种安全密钥管理方法、装置和系统
US20190208411A1 (en) * 2018-03-16 2019-07-04 Intel Corporation Security framework for msg3 and msg4 in early data transmission

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4145760A4 *

Also Published As

Publication number Publication date
CN113795024A (zh) 2021-12-14
EP4145760A1 (en) 2023-03-08
US20230092744A1 (en) 2023-03-23
EP4145760A4 (en) 2023-10-18

Similar Documents

Publication Publication Date Title
KR101583231B1 (ko) Ｌｔｅ 모바일 유닛에서의 비접속 계층(ｎａｓ) 보안을 가능하게 하는 방법 및 장치
WO2019153994A1 (zh) 安全协商方法及装置
WO2016119243A1 (zh) 通信方法、网络设备、用户设备和通信系统
WO2018202165A1 (zh) 一种失败处理方法、切换方法及终端设备、网络设备
EP2946582A1 (en) Communication of security key information
US20220330018A1 (en) Security Verification when Resuming an RRC Connection
KR20220151001A (ko) 이용되는 보안 키들에 영향을 주는 연결 재구성의 일부로서 베어러 특정 변경들을 구현하기 위한 방법 및 장치
WO2018227638A1 (zh) 通信方法和装置
WO2020221048A1 (zh) 一种通信方法及装置
US10880737B2 (en) Method and apparatus for refreshing the security keys of a subset of configured radio bearers
WO2017219365A1 (zh) 数据传输的方法和装置
WO2021238813A1 (zh) 一种获取密钥的方法及装置
WO2021023088A1 (zh) 数据传输的方法和装置
US20220345883A1 (en) Security key updates in dual connectivity
CN111132186B (zh) 一种重置mac层、数据传输方法及装置
US11616768B2 (en) Method and apparatus for handling security keys for individual bearers
WO2022252867A1 (zh) 通信方法及通信装置
WO2022206362A1 (zh) 一种通信的方法及装置
WO2022133912A1 (zh) 侧行链路通信方法、装置和系统
WO2021155540A1 (zh) 一种密钥管理方法、通信装置
WO2020164510A1 (zh) 通信方法、通信装置和计算机可读存储介质
WO2018228444A1 (zh) 连接管理方法、终端及无线接入网设备
WO2023050373A1 (zh) 一种通信方法、装置及系统
WO2022227919A1 (zh) 切换场景下的安全配置方法和通信装置
WO2014111049A1 (zh) 小区优化方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21812373

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021812373

Country of ref document: EP

Effective date: 20221202

NENP Non-entry into the national phase

Ref country code: DE