WO2022021198A1

WO2022021198A1 - Communication method and apparatus

Info

Publication number: WO2022021198A1
Application number: PCT/CN2020/105761
Authority: WO
Inventors: 张博
Original assignee: 华为技术有限公司
Priority date: 2020-07-30
Filing date: 2020-07-30
Publication date: 2022-02-03

Abstract

Embodiments of the present application provide a communication method and apparatus. The method comprises: a first terminal device acquires a first parameter, the first parameter being used for indicating security information of communication between a second terminal device and a first access network device; and the first terminal device selects the second terminal device according to the first parameter. By implementing the solution provided in the present invention, the first terminal can select, according to the first parameter, the second terminal that provides a relay service for the first terminal device and the first access network device, so as to satisfy the requirement of the first terminal for communicating with the network by means of the second terminal.

Description

Communication method and device therefor

technical field

The present application relates to the field of communication technologies, and in particular, to a communication method and device thereof.

Background technique

In short-range service communication, a user equipment (user equipment, UE1) communicates with the network through UE2, that is, the UE2 provides a relay service for UE1. UE1 needs to select a suitable UE2 and communicate with the network through the UE2. How to select UE2 is an urgent problem to be solved at present.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a communication method and a device thereof, which are used by a first terminal device to select a second terminal device according to a first parameter, so as to meet the security requirements of communication between the first terminal device and the network.

A first aspect of the embodiments of the present application provides a communication method, the method includes:

The first terminal device receives a first message, where the first message carries a first parameter, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device; then, the first terminal device A second terminal device is selected according to the first parameter, where the second terminal device is configured to provide a relay service for the communication between the first terminal device and the first access network device.

In this embodiment, since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the first terminal device can select the second terminal device according to the first The parameter selects a second terminal device that matches the security requirements of the first terminal device, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network.

In a possible implementation manner, the first parameter includes at least one of the following: a first security protection mode supported by a first protocol data unit (protocol data unit, PDU) session, the type of the first access network device, the first security protection mode supported by the first protocol data unit (protocol data unit, PDU) session an indication information, a second indication information, a digital signature, the identification of the second terminal device, the network identification ID of the second terminal device to which the second terminal device belongs or serves, the first data network name (DNN), or, the first All slice information; wherein, the first PDU session is an established PDU session on the second terminal device, the first indication information is the indication information of whether the first access network device supports the on-demand security protection mode, the The second indication information is used to indicate that the first access network device has the capability to support integrity protection, and the digital signature is generated by the second terminal device through the private key of the second terminal device or the root certificate of the second terminal device Yes, the first DNN supports the DNN that provides the relay service for the second terminal device, and the first slice information is the information of the slice that the second terminal device supports to provide the relay service.

In this possible implementation manner, the first parameter is used to indicate security information for communication between the second terminal device and the first access network device. Specifically, it may be the security protection method supported by the PDU session established by the second terminal device; or, the type of the first access network device connected to the second terminal device, or the second terminal device supports the relay service. Slice information for DNN or slice. It can be seen from this implementation that the parameters used to sign the security information for communication between the second terminal device and the first access network device are diversified, which can help the first terminal device to select a suitable second terminal device to meet the requirements of the first terminal device. The security requirements for communication between the device and the network improve the achievability and practicability of the solution.

In another possible implementation manner, before the first terminal device selects the second terminal device according to the first parameter, the method further includes: the first terminal device determines a first security policy, where the first security policy is the the security policy corresponding to the service to be used by the first terminal device determined by the first terminal device;

The first terminal device selects the second terminal device according to the first parameter, including:

The first terminal device selects the second terminal device according to the first security policy and the first parameter.

In this possible implementation manner, the first terminal device may first determine the corresponding first security policy through the service to be used by the first terminal device, and select the second terminal device in combination with the first security policy and the first parameter , thereby further enabling the first terminal device to select a suitable second terminal device to provide relay services for the first terminal device.

In another possible implementation manner, the first security policy indicates that integrity protection is required or tends to be preferred; the first terminal device selects the second terminal device according to the first security policy and the first parameter, include:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the first terminal device selects the second terminal device; or,

If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the ability to support enabling integrity protection, the first terminal device selects the the second terminal device; or,

If the first parameter includes the first indication information, and the first indication information indicates that the first access network device supports the on-demand protection mode, the first terminal device selects the second terminal device; or,

If the first parameter includes the second indication information, the first terminal device selects the second terminal device.

In this possible implementation, it is shown that when the first security policy indicates that integrity protection is required or tends to be preferred, the first terminal device selects the second terminal according to certain information carried by the first parameter The multiple possible implementation manners of the terminal device improve the achievability and diversity of the solution.

In another possible implementation manner, the first security policy indicates that encryption protection is required or preferred; the first terminal device selects the second terminal device according to the first security policy and the first parameter, include:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable encryption protection, the first terminal device selects the second terminal device; or,

In this possible implementation, it is shown that the first terminal device selects the second terminal according to certain information carried by the first parameter when the first security policy indicates that the encryption protection is required or is inclined to be preferred. Multiple possible implementations of the device improve the achievability and diversity of the solution.

In another possible implementation manner, the first terminal device selects the second terminal device according to the first security policy and the first parameter, including: if the first security policy is consistent with the second security policy, the first A terminal device selects the second terminal device, and the second security policy is a security policy associated with the first DNN and/or the first slice information.

In this possible implementation manner, since each DNN and slice are configured with a corresponding security policy, the first terminal device can determine the corresponding first terminal device through the first DNN and/or the first slice information carried by the first parameter. Two security policies, and then select the second terminal device in combination with the first security policy and the second security policy.

In another possible implementation manner, the method further includes: the first terminal device receives a second message, where the second message carries a second parameter, where the second parameter is used to indicate the connection between the third terminal device and the second access network Security information of communication between devices; selecting the second terminal device by the first terminal device according to the first parameter includes: selecting the second terminal device by the first terminal device according to the first parameter and the second parameter.

In this possible implementation manner, when the first terminal device receives multiple parameters that can be sent by terminal devices that can act as relay nodes, the first terminal device may select the second terminal device in combination with the multiple received parameters.

In another possible implementation manner, the first terminal device selects the second terminal device according to the first parameter and the second parameter, including:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the second parameter includes the second security protection mode supported by the second PDU session, and the The second security protection method is that integrity protection is not enabled, the first terminal device selects the second terminal device, the first PDU session is an established PDU session on the second terminal device, and the second PDU session is the first PDU session. Three established PDU sessions on end devices; or,

If the first parameter includes the first indication information and the first indication information indicates that the first access network device supports the on-demand protection mode, the second parameter includes third indication information and the third indication information indicates the second If the access network device does not support the on-demand protection mode, the first terminal device selects the second terminal device.

In this implementation manner, multiple possible selection manners in which the first terminal device selects the second terminal device according to the received parameters sent by the multiple terminal devices are shown.

In another possible implementation manner, the method further includes: the first terminal device sends a second message to the second terminal device, where the second message carries the first security policy.

In this possible implementation, the first terminal device sends the first security policy to the second terminal device, so that the second terminal device determines the first security protection mode between the first terminal device and the second terminal device.

In another possible implementation manner, the method further includes: the first terminal device sends a third message to the second terminal device, where the third message carries any one of the following: first service information, first protection indication, second DNN, second slice information, the first service information is service information corresponding to the service to be used by the first terminal device, and the first protection indication is used to indicate the first terminal device and the first terminal device expected by the first terminal device. A protection mechanism implemented during data communication between access network devices; then, the first terminal device receives a second protection instruction sent by the second terminal device, where the second protection instruction is used to instruct the first terminal device to communicate with The protection mechanism executed during data communication between the first access network devices.

In this possible implementation manner, the first terminal device and the second terminal device determine, through negotiation, a protection mechanism to be executed during data communication between the first terminal device and the first access network device.

In another possible implementation manner, the first security policy includes protection requirements for encryption protection and protection requirements for integrity protection; the first terminal device selects the second terminal device according to the first security policy and the first parameter , including: when the first terminal device determines through the first parameter that both the second terminal device meets the protection requirements of encryption protection and the protection requirements of integrity protection, the first terminal device selects the second terminal device.

In this possible implementation manner, when selecting the second terminal device, the first terminal device should select a second terminal device that satisfies both the encryption protection requirement and the integrity protection requirement of the first terminal device.

In another possible implementation manner, the method further includes: the first terminal device verifies the digital signature; if the verification is successful, the first terminal device executes that the first terminal device selects the digital signature according to the first security policy and the first parameter. The steps of the second terminal device.

In this possible implementation, the first terminal device verifies the digital signature carried in the first message, and if the verification is successful, the first terminal device selects the second terminal device according to the first parameter and the first security policy carried in the first message, In order to avoid that the first parameter is tampered with during the transmission process, which affects the selection of an appropriate second terminal device by the first terminal device.

In another possible implementation manner, the first message also carries the identifier of the second terminal device; the verification of the digital signature by the first terminal device includes: the first terminal device determines the second terminal according to the identifier of the second terminal device The public key corresponding to the private key of the device; then, the first terminal device verifies the digital signature through the public key.

In this possible implementation manner, a specific manner for the first terminal device to verify the digital signature is provided.

In another possible implementation manner, the first message also carries the network identification ID that the second terminal device belongs to or serves; the first terminal device verifying the digital signature includes: the first terminal device determines the network identification ID according to the network identification ID. the root certificate corresponding to the second terminal device; then, the first terminal device verifies the digital signature through the root certificate.

In this possible implementation manner, another specific manner for the first terminal device to verify the digital signature is provided.

A second aspect of the embodiments of the present application provides a communication method, the method comprising:

The second terminal device determines a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device; Then, the second terminal device sends a first message, where the first message carries the first parameter.

In this possible implementation manner, the second terminal device sends the first parameter to the first terminal device, so that when the first terminal device selects the second terminal device, it can select the security with the first terminal device according to the first parameter The second terminal device that matches the requirements, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network.

In a possible implementation manner, the first parameter includes at least one of the following: a first security protection mode supported by the first PDU session, a type of the first access network device, first indication information, second indication information, digital signature, the identifier of the second terminal device, the network identification ID of the second terminal device to which the second terminal device belongs or serves, the first DNN, or the first slice information; wherein, the first PDU session is the second terminal device The first indication information is the indication information of whether the first access network device supports the on-demand security protection mode, and the second indication information is used to indicate that the first access network device has support integrity The protection capability, the digital signature is generated by the second terminal device through the private key of the second terminal device or the root certificate of the second terminal device, and the first DNN supports the relay service for the second terminal device. DNN, the first slice information is information of a slice that the second terminal device supports to provide a relay service.

In another possible implementation manner, the method further includes: receiving, by the second terminal device, a second message sent by the first terminal device, where the second message carries a first security policy, and the first security policy is the first security policy. The terminal device determines the security policy corresponding to the service to be used by the first terminal device; the second terminal device determines a first security protection mode according to the first security policy; the second terminal device uses the first security protection mode as the The security protection mode adopted for data communication between the first terminal device and the second terminal device; the second terminal device sends the first security protection mode to the first terminal device.

In this possible implementation manner, the second terminal device may determine a first security protection mode in combination with a first security policy sent by the first terminal device, and use the first security protection mode as the first terminal device and the second terminal The security protection mode adopted for data communication between devices, thereby determining the security protection mode between the first terminal device and the second terminal device. In this way, it is convenient for the second terminal device and the first access network device to negotiate the security protection mode between the second terminal device and the first access network device, so as to realize the security protection mode between the first terminal device and the second terminal device, And the security protection mode is negotiated between the second terminal device and the first access network device.

In another possible implementation manner, the method further includes: receiving, by the second terminal device, a second message sent by the first terminal device, where the second message carries a first security policy, and the first security policy is the first security policy. the security policy determined by the terminal device corresponding to the service to be used by the first terminal device; the second terminal device determines a third security protection mode according to the first security policy and the second security policy, and the second security policy is the second security policy The security policy determined by the terminal device corresponding to the service to be used by the first terminal device; the second terminal device uses the third security protection mode as the data communication method between the second terminal device and the first access network device. The adopted security protection mode; the second terminal device sends the third security protection mode to the first terminal device.

In this possible implementation manner, the second terminal device may determine a third security protection mode in combination with the third security policy and the first security policy sent by the first terminal device, and use the third security protection mode as the second terminal device The security protection mode adopted for the data communication with the first access network device, so as to determine the security protection mode between the second terminal device and the first access network device. In this way, it is convenient for the second terminal device and the first terminal device to negotiate the security protection mode between the first terminal device and the second terminal device, thereby realizing the security protection mode between the first terminal device and the second terminal device, and the second terminal device. A security protection mode is negotiated between the device and the first access network device.

In another possible implementation manner, the first security protection manner is consistent with the second security protection manner, and the second security protection manner is an established first security protection manner between the second terminal device and the first access network device Two security protection methods supported by PDU sessions.

In this possible implementation, when the second terminal device determines the first security protection mode, it may consider the situation of the PDU session established by the second terminal device, and preferentially select a PDU session that supports the first security protection mode to use to provide services for the first terminal device.

In another possible implementation manner, the first security protection manner is consistent with the second security protection manner, including:

If the first security policy indicates that encryption protection is required, and the second security protection mode supported by the second PDU session is to enable encryption protection, the second terminal device supports the second security protection mode of the second PDU session. as the first security protection method; or,

If the first security policy indicates that integrity protection is required, and the second security protection mode supported by the second PDU session is to enable integrity protection, the second terminal device will use the second security protection method supported by the second PDU session. The protection method is used as the first security protection method; or,

If the first security policy indicates that the encryption protection is not needed, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device will use the second PDU session to support the second security protection mode. The security protection method is used as the first security protection method; or,

If the first security policy indicates that the integrity protection is not needed, and the second security protection mode supported by the second PDU session is not to enable integrity protection, the second terminal device supports the second PDU session. The second security protection method is used as the first security protection method; or,

If the first security policy indicates that encryption protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode; or,

If the first security policy indicates that integrity protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode.

In this possible implementation manner, the second terminal device selects a second PDU session on the second terminal device, and the second security protection mode supported by the second PDU session is consistent with the first security protection mode.

In another possible implementation manner, the method further includes: if the first security protection manner is inconsistent with the second security protection manner, the second terminal device sends the first security protection method to a session management function (session management function, SMF) network element request message; wherein the first request message is used to request to modify the second PDU session or to request to establish a third PDU session, the first request message carries a third parameter, and the third parameter is used to indicate the first terminal device The security information of the data communication with the second terminal device, the second security protection mode is the security protection mode supported by the established second PDU session between the second terminal device and the first access network device ; the second terminal device receives the fourth security protection mode sent by the first access network device, and the fourth security protection mode is used for data communication between the second terminal device and the first access network device. Security protection mode, the fourth security protection mode is consistent with the first security protection mode.

In this possible implementation, when the second security protection mode supported by the second PDU session is inconsistent with the first security protection mode, the second terminal device sends a first request message to the SMF network element to request to modify the second PDU session Or create a third PDU session, and then receive the fourth security protection mode sent by the first access network device, so that the fourth security protection mode between the second terminal device and the first access network device is the same as the first security protection mode the same way.

In another possible implementation manner, the first security protection manner is inconsistent with the second security protection manner, including: if the first security policy indicates that the encryption protection is preferred, and the second PDU session supports the second security protection If the security protection mode is not to enable encryption protection, the second terminal device determines that the first security protection mode corresponding to the first security policy is inconsistent with the second security protection mode; or,

If the first security policy indicates that integrity protection tends to be preferred, and the second security protection mode is not to enable integrity protection, the second terminal device determines the first security protection mode corresponding to the first security policy inconsistent with the second security protection method; or,

If the encryption protection of the second security protection mode does not match the encryption protection indicated by the first security policy and the integrity protection of the second security protection mode does not match the integrity protection of the first security policy The second terminal device determines that the first security protection mode corresponding to the first security policy is inconsistent with the second security protection mode.

In this possible implementation manner, a plurality of possible situations in which the first security protection manner and the second security protection manner are inconsistent are shown, and some corresponding determination manners are provided.

In another possible implementation manner, the third parameter includes at least one of the following:

the first service information, the second DNN, the second slice information, the first security policy, and the first security protection mode;

The first service information is service information corresponding to the service to be used by the first terminal device, the second DNN is the DNN to be accessed by the first terminal device, and the second slice information is the first terminal device to access the service information. Information about the slices being accessed.

In this possible implementation manner, the third parameter is used to indicate the security information of the data communication between the first terminal device and the second terminal device. The parameters of the security information of the data communication between the second terminal devices, so that the SMF network element determines the third security policy, and the first access network device determines the fourth security protection mode, so that the fourth security protection mode and the first security protection mode are determined The protection method is the same.

In another possible implementation manner, the method further includes: receiving, by the second terminal device, a third message sent by the first terminal device; wherein the third message carries at least one of the following information: first service information, first Two DNN, second slice information and first protection indication, the first service information is service information corresponding to the service to be used by the first terminal device, the second DNN is the DNN to be accessed by the first terminal device, the The second slice information is information of the slice to be accessed by the first terminal device, and the first protection indication is used to indicate that the first terminal device expects data to be performed between the first terminal device and the first access network device A protection mechanism executed during communication; the method further includes: the second terminal device determines a second protection indication according to the third message, where the second protection indication is used to indicate the relationship between the first terminal device and the first access network device The protection mechanism executed when data communication is performed between the two terminals; the second terminal device sends the second protection indication to the first terminal device.

In this possible implementation manner, a protection mechanism executed when a first terminal device, a second terminal device and a third terminal device negotiate data communication between the first terminal device and the first access network device is shown way of implementation.

In another possible implementation manner, the method further includes: if the second terminal device does not receive the protection indication sent by the first terminal device, the second terminal device determines a second protection indication, where the second protection indication is used for Instruct the protection mechanism to be executed during data communication between the first terminal device and the first access network device; then, the second terminal device sends the second protection instruction to the first terminal device.

In this possible implementation manner, another protection performed when the first terminal device, the second terminal device and the third terminal device negotiate the data communication between the first terminal device and the first access network device is shown How the mechanism is implemented.

A third aspect of the embodiments of the present application provides a communication method, the method comprising:

The SMF network element receives the first request message sent by the second terminal device. The first request message is used to request to modify the second PDU session or to request to establish the third PDU session. The first request message carries the third parameter, and the first request message The three parameters are used to indicate the security information of the data communication between the first terminal device and the second terminal device; then, the SMF network element determines a third security policy according to the third parameter, and the third security policy is the SMF network The security policy corresponding to the service to be used by the first terminal device determined by the element; the SMF network element sends a fourth message to the first access network device, where the fourth message carries the third security policy.

In this possible implementation manner, when the first security protection manner is inconsistent with the second security protection manner, or when no PDU session is established on the second terminal device, the SMF network element may A request message determines the third security policy, and sends the third security policy to the first access network device, so that the first access network device determines the fourth security protection mode according to the third security policy, so that the fourth security protection The mode is consistent with the first security protection mode, so as to realize the negotiation of the first security protection mode between the first terminal device and the second terminal device and the fourth security protection mode between the second terminal device and the first access network device Consistent.

In a possible implementation manner, the third parameter includes at least one of the following:

In another possible implementation manner, the SMF network element determines the third security policy according to the third parameter, including: the SMF network element sends at least one of the following information to a unified data management (unified data management, UDM) network element Item: the first service information, the second DNN and the second slice information; the SMF network element receives the subscription security policy sent by the UDM network element; the SMF network element uses the subscription security policy as the third security policy, Alternatively, the SMF network element determines the third security policy according to the subscription security policy and the first security policy, or the SMF network element determines the third security policy according to the subscription security policy and the first security protection mode.

In this possible implementation, the specific process of determining the third security policy by the SMF network element according to at least one item of the first service information, the second DNN and the second slice information is shown, which improves the solution's performance. achievability.

In another possible implementation manner, the SMF network element determining the third security policy according to the third parameter includes: the SMF network element determining according to at least one item of information in the first security policy and the first security protection manner The third security policy.

In this possible implementation manner, the manner in which the SMF network element is based on the first security policy carried by the third parameter and the third security policy of at least one piece of information in the first security protection manner is shown, which improves the variety of solutions. sex.

In another possible implementation manner, the fourth message further carries at least one of the following: the first security policy and the first security protection manner.

A fourth aspect of the embodiments of the present application provides a communication method. The method includes: a first access network device receives a second message sent by an SMF network element, where the second message carries a third security policy, and the third security policy is the The security policy corresponding to the service to be used by the first terminal device determined by the SMF network element; then, the first access network device determines a fourth security protection mode according to the third security policy, and the fourth security protection mode is used for The security protection mode used for data communication between the second terminal device and the first access network device; the first access network device sends the fourth security protection mode to the second terminal device.

In this possible implementation manner, the first access network device determines a fourth security protection mode according to the third security policy sent by the SMF network element, and sends the fourth security protection mode to the second terminal device, the fourth security protection mode is The protection mode is a security protection mode used for data communication between the second terminal device and the first access network device, so that the negotiation of the first security protection mode and the fourth security protection mode is achieved.

In a possible implementation manner, the second message further carries at least one of the following: the first security policy, the first security protection mode; the first access network device determines the fourth security protection according to the third security policy ways, including:

The first access network device determines the fourth security protection mode according to the third security policy and the first security protection mode; or,

The first access network device determines a fourth security protection manner according to the third security policy and the first security policy; or,

The first access network device determines a fourth security protection manner according to the third security policy, the first security protection manner and the first security policy.

In this possible implementation manner, multiple possible implementation manners in which the first access network device determines the fourth security protection manner according to the parameters carried in the second message are shown, which improves the implementability and diversity of the solution.

A fifth aspect of the embodiments of the present application provides a first terminal device, where the first terminal device includes:

a transceiver module, configured to receive a first message, where the first message carries a first parameter, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device;

The processing module is configured to select the second terminal device according to the first parameter, and the second terminal device is configured to provide a relay service for the communication between the first terminal device and the first access network device.

In a possible implementation manner, the first parameter includes at least one of the following:

The first security protection mode supported by the first PDU session, the type of the first access network device, the first indication information, the second indication information, the digital signature, the identifier of the second terminal device, the belonging of the second terminal device Or the network identification ID of the service, the first data network name DNN, or, the first slice information;

The first PDU session is an established PDU session on the second terminal device, the first indication information is the indication information of whether the first access network device supports the on-demand security protection mode, and the second indication information is used for In order to indicate that the first access network device has the ability to support integrity protection, the digital signature is generated by the second terminal device through the private key of the second terminal device or the root certificate of the second terminal device, the first The DNN supports the DNN that provides the relay service for the second terminal device, and the first slice information is information of the slice that the second terminal device supports to provide the relay service.

In another possible implementation, the processing module is also used to:

determining a first security policy, where the first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device;

This processing module is specifically used for:

The second terminal device is selected according to the first security policy and the first parameter.

In another possible implementation manner, the first security policy indicates that integrity protection is required or tends to be preferred; the processing module is specifically used for:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, then select the second terminal device; or,

If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the ability to support enabling integrity protection, select the second terminal device ;or,

If the first parameter includes the first indication information, and the first indication information indicates that the first access network device supports the on-demand protection mode, select the second terminal device; or,

If the first parameter includes the second indication information, the second terminal device is selected.

In another possible implementation manner, the first security policy indicates that encryption protection is required or tends to be preferred; the processing module is specifically used for:

If the first parameter includes a first security protection mode supported by the first PDU session, and the first security protection mode is to enable encryption protection, the second terminal device is selected.

In another possible implementation manner, the processing module is specifically used for:

If the first security policy is consistent with the second security policy, the second terminal device is selected, and the second security policy is the security policy associated with the first DNN and/or the first slice information.

In another possible implementation manner, the transceiver module is also used for:

receiving a second message, where the second message carries a second parameter, where the second parameter is used to indicate the security information of the communication between the third terminal device and the second access network device;

This processing module is specifically used for:

The second terminal device is selected according to the first parameter and the second parameter.

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the second parameter includes the second security protection mode supported by the second PDU session, and the The second security protection mode is to not enable integrity protection, then select the second terminal device, the first PDU session is an established PDU session on the second terminal device, and the second PDU session is on the third terminal device. an established PDU session; or,

If the first parameter includes the first indication information and the first indication information indicates that the first access network device supports the on-demand protection mode, the second parameter includes third indication information and the third indication information indicates the second If the access network device does not support the on-demand protection mode, the second terminal device is selected.

Send a second message to the second terminal device, where the second message carries the first security policy.

Send a third message to the second terminal device, where the third message carries any of the following: first service information, first protection indication, second DNN, and second slice information, where the first service information is the first terminal Service information corresponding to the service to be used by the device, and the first protection indication is used to indicate the protection mechanism that the first terminal device expects to execute when performing data communication between the first terminal device and the first access network device;

A second protection indication sent by the second terminal device is received, where the second protection indication is used to indicate a protection mechanism executed during data communication between the first terminal device and the first access network device.

A sixth aspect of the embodiments of the present application provides a second terminal device, where the second terminal device includes:

a processing module, configured to determine a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to indicate the security of communication between the second terminal device and the first access network device information;

A transceiver module, configured to send a first message, where the first message carries the first parameter.

The first PDU session is an established PDU session on the second terminal device, the first indication information is the indication information that the first access network device supports the on-demand security protection mode, and the second indication information is used for Indicates that the first access network device has the ability to support integrity protection, the digital signature is generated by the second terminal device through the private key of the second terminal device or the root certificate of the second terminal device, the first DNN The second terminal device supports the DNN that provides the relay service, and the first slice information is information of the slice that the second terminal device supports to provide the relay service.

receiving a second message sent by the first terminal device, where the second message carries a first security policy, where the first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device;

This processing module is also used to:

determining a first security protection mode according to the first security policy;

Using the first security protection mode as the security protection mode adopted for data communication between the first terminal device and the second terminal device;

The transceiver module is also used to:

Send the first security protection mode to the first terminal device.

This processing module is also used to:

Determine a third security protection mode according to the first security policy and the second security policy, where the second security policy is a security policy determined by the second terminal device corresponding to the service to be used by the first terminal device;

Using the third security protection mode as the security protection mode adopted for the data communication between the second terminal device and the first access network device;

The transceiver module is also used to:

Send the third security protection mode to the first terminal device.

If the first security protection mode is inconsistent with the second security protection mode, send a first request message to the SMF network element;

Wherein, the first request message is used to request to modify the second PDU session or to request to establish a third PDU session, the first request message carries a third parameter, and the third parameter is used to indicate that the first terminal device communicates with the third PDU session. The security information of the data communication between the two terminal devices, the second security protection mode is the security protection mode supported by the established second PDU session between the second terminal device and the first access network device;

receiving a fourth security protection mode sent by the first access network device, where the fourth security protection mode is used for the security protection mode adopted for data communication between the second terminal device and the first access network device, the The fourth security protection mode is consistent with the first security protection mode.

In another possible implementation manner, the first security protection manner is inconsistent with the second security protection manner, including:

If the first security policy indicates that encryption protection tends to be preferred, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device determines the first security policy corresponding to the first security policy. One security protection method is inconsistent with the second security protection method; or,

receiving a third message sent by the first terminal device;

Wherein, the third message carries at least one of the following information: first service information, second DNN, second slice information and first protection indication, and the first service information is a service corresponding to a service to be used by the first terminal device information, the second DNN is the DNN to be accessed by the first terminal device, the second slice information is the information of the slice to be accessed by the first terminal device, and the first protection indication is used to indicate the first terminal device the desired protection mechanism to be executed when data communication is performed between the first terminal device and the first access network device;

This processing module is also used to:

determining a second protection indication according to the third message, where the second protection indication is used to indicate a protection mechanism to be executed during data communication between the first terminal device and the first access network device;

The transceiver module is also used to:

Send the second protection indication to the first terminal device.

In another possible implementation, the processing module is also used to:

If the second terminal device does not receive the protection indication sent by the first terminal device, determine a second protection indication, where the second protection indication is used to instruct the first terminal device and the first access network device to perform data communication between the first terminal device and the first access network device. the protection mechanisms implemented when communicating;

The transceiver module is also used to:

Send the second protection indication to the first terminal device.

A seventh aspect of the embodiments of the present application provides an SMF network element, where the SMF network element includes:

a transceiver module, configured to receive a first request message sent by the second terminal device, where the first request message is used to request to modify the second PDU session or to request to establish a third PDU session, the first request message carries a third parameter, The third parameter is used to indicate the security information of the data communication between the first terminal device and the second terminal device;

a processing module, configured to determine a third security policy according to the third parameter, where the third security policy is a security policy corresponding to the service to be used by the first terminal device determined by the SMF network element;

The transceiver module is configured to send a fourth message to the first access network device, where the fourth message carries the third security policy.

Send at least one of the following information to the UDM network element: the first service information, the second DNN and the second slice information; the SMF network element receives the subscription security policy sent by the UDM network element;

Use the contracted security policy as the third security policy, or determine the third security policy according to the contracted security policy and the first security policy, or determine the third security policy according to the contracted security policy and the first security protection mode security strategy.

The third security policy is determined according to at least one item of information in the first security policy and the first security protection manner.

An eighth aspect of the embodiments of the present application provides a first access network device, where the first access network device includes:

A transceiver module, configured to receive a second message sent by the SMF network element, where the second message carries a third security policy, where the third security policy is a security policy determined by the SMF network element and corresponding to the service to be used by the first terminal device ;

a processing module, configured to determine a fourth security protection mode according to the third security policy, where the fourth security protection mode is a security protection mode used for data communication between the second terminal device and the first access network device ;

The transceiver module is configured to send the fourth security protection mode to the second terminal device.

In a possible implementation manner, the second message also carries at least one of the following: the first security policy, the first security protection mode; the processing module is specifically used for:

The fourth security protection mode is determined according to the third security policy and the first security protection mode; or,

A fourth security protection mode is determined according to the third security policy and the first security policy; or,

The fourth security protection mode is determined according to the third security policy, the first security protection mode and the first security policy.

A ninth aspect of an embodiment of the present application provides a first terminal device, where the first terminal device includes: a processor and a memory; a computer program is stored in the memory; the processor is further configured to call and run a computer stored in the memory The program enables the processor to implement any one of the implementation manners of the first aspect.

Optionally, the first terminal device includes a transceiver; the processor is configured to control the transceiver to send and receive signals.

A tenth aspect of an embodiment of the present application provides a second terminal device, where the first terminal device includes: a processor and a memory; a computer program is stored in the memory; the processor is further configured to call and run a computer stored in the memory The program enables the processor to implement any one of the implementation manners of the second aspect.

Optionally, the second terminal device includes a transceiver; the processor is configured to control the transceiver to send and receive signals.

An eleventh aspect of an embodiment of the present application provides an SMF network element, where the SMF network element includes: a processor and a memory; a computer program is stored in the memory; the processor is further configured to call and run the computer program stored in the memory , so that the processor implements any one of the implementation manners of the third aspect.

Optionally, the SMF network element includes a transceiver; the processor is configured to control the transceiver to send and receive signals.

A twelfth aspect of an embodiment of the present application provides a first access network device, where the first access network device includes: a processor and a memory; the memory stores a computer program; the processor is further configured to call and run the The computer program stored in the memory enables the processor to implement any one of the implementation manners of the fourth aspect.

Optionally, the first access network device includes a transceiver; the processor is configured to control the transceiver to send and receive signals.

A thirteenth aspect of the embodiments of the present application provides a computer program product including instructions, characterized in that, when the computer program product is run on a computer, the computer is caused to perform the implementation of any one of the first to fourth aspects.

A fourteenth aspect of the embodiments of the present application provides a computer-readable storage medium, including computer instructions, which, when the computer instructions are executed on a computer, cause the computer to execute any one of the implementations of the first to fourth aspects.

A fifteenth aspect of an embodiment of the present application provides a chip device, including a processor, which is connected to a memory and calls a program stored in the memory, so that the processor executes any one of the first to fourth aspects above an implementation.

A sixteenth aspect of an embodiment of the present application provides a communication system, where the communication system includes the first terminal device of the first aspect and the second terminal device of the second aspect.

Optionally, the communication system further includes the SMF network element of the third aspect and the first access network device of the fourth aspect.

In this embodiment of the present application, the first terminal device receives a first message, where the first message carries a first parameter, where the first parameter is used to indicate security information for communication between the second terminal device and the first access network device; Then, the first terminal device selects the second terminal device according to the first parameter. It can be seen from this that since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the first terminal device can select the second terminal device according to the first parameter when selecting the second terminal device. The second terminal device that matches the security requirements of the first terminal device is selected, so that the second terminal device can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network.

Description of drawings

1A is a schematic structural diagram of a communication system according to an embodiment of the present application;

1B is a schematic diagram of a network system according to an embodiment of the present application;

1C is another schematic diagram of a network system according to an embodiment of the present application;

FIG. 2 is a schematic diagram of an embodiment of a communication method according to an embodiment of the present application;

FIG. 3 is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application;

FIG. 4 is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application;

FIG. 5 is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application;

FIG. 6 is a schematic structural diagram of a first terminal device according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a second terminal device according to an embodiment of the present application;

FIG. 8 is a schematic structural diagram of an SMF network element according to an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a first access network device according to an embodiment of the present application;

FIG. 10 is another schematic structural diagram of a first terminal device according to an embodiment of the present application;

11 is another schematic structural diagram of an SMF network element according to an embodiment of the present application;

FIG. 12 is another schematic structural diagram of a first access network device according to an embodiment of the present application;

FIG. 13 is a schematic diagram of a communication system according to an embodiment of the present application.

detailed description

In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described below with reference to the accompanying drawings. Reference herein to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the present application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor a separate or alternative embodiment that is mutually exclusive of other embodiments. Those skilled in the art will understand, both explicitly and implicitly, that the embodiments described herein may be combined with other embodiments.

The communication system applied in this application is introduced as follows:

The technical solutions provided in this application can be applied to various communication systems. In a communication system, the part operated by the operator may be referred to as a public land mobile network (PLMN) (also referred to as an operator network, etc.). PLMN is a network established and operated by the government or its approved operators for the purpose of providing land mobile communication services to the public, mainly a public mobile network operator (MNO) that provides mobile broadband access services to users. The internet. The PLMN described in this application may specifically be a network that meets the requirements of the 3rd generation partnership project (3GPP) standard, which is referred to as a 3GPP network for short. 3GPP networks generally include, but are not limited to, a fifth-generation (5th-generation, 5G) network (referred to as a 5G network), a fourth-generation (4th-generation, 4G) network (referred to as a 4G network), and the like.

For the convenience of description, a PLMN is used as an example for description in this embodiment of the present application. Alternatively, the technical solutions provided in this application can also be applied to long term evolution (long term evolution, LTE) systems, LTE frequency division duplex (frequency division duplex, FDD) systems, LTE time division duplex (time division duplex, TDD), general Mobile communication system (universal mobile telecommunication system, UMTS), worldwide interoperability for microwave access (WiMAX) communication system, fifth generation (5th generation, 5G) communication system, device to device (device to device, D2D) ) communication system, vehicle to everything (V2X) communication system, new radio (NR) or other communication systems in the future, such as 6G communication systems.

With the expansion of mobile bandwidth access services, mobile networks will also develop to better support diversified business models, meet the needs of more diverse application services and more industries. For example, in order to provide better and more complete services to more industries, the 5G network has made network architecture adjustments compared to the 4G network. For example, the 5G network splits the mobility management entity (MME) in the 4G network into two parts including the access and mobility management function (AMF) and the session management function (session management function). , SMF) and other network functions.

FIG. 1A is a schematic diagram of a network architecture according to an embodiment of the present application, which takes a 5G network architecture based on a service-oriented architecture in a non-roaming scenario defined in the 3GPP standardization process as an example. The network architecture can include three parts, namely the terminal equipment part, the PLMN and the data network (DN).

The terminal equipment part may include a terminal equipment 110, which may also be referred to as user equipment (user equipment, UE). The terminal device 110 in this application is a device with a wireless transceiver function, which can communicate with an access network device (or also referred to as an access device) in a radio access network (RAN) 140 with one or more A plurality of core network (core network, CN) devices (or may also be referred to as core devices) communicate. Terminal equipment 110 may also be referred to as an access terminal, terminal, subscriber unit, subscriber station, mobile station, mobile station, remote station, remote terminal, mobile device, user terminal, user agent, user device, or the like. The terminal device 110 can be deployed on land, including indoor or outdoor, handheld or vehicle; can also be deployed on water (such as ships, etc.); and can also be deployed in the air (such as planes, balloons, satellites, etc.). The terminal device 110 may be a cellular phone (cellular phone), a cordless phone, a session initiation protocol (SIP) phone, a smart phone (smart phone), a mobile phone (mobile phone), a wireless local loop (WLL) ) station, personal digital assistant (personal digital assistant, PDA), etc. Alternatively, the terminal device 110 may also be a handheld device with a wireless communication function, a computing device or other device connected to a wireless modem, a vehicle-mounted device, a wearable device, a drone device or a terminal in the Internet of Things, the Internet of Vehicles, a 5G network And any form of terminal in the future network, relay user equipment or terminal in the future evolved PLMN, etc. The relay user equipment may be, for example, a 5G home gateway (residential gateway, RG). For example, the terminal device 110 may be a virtual reality (VR) terminal, an augmented reality (AR) terminal, a wireless terminal in industrial control, a wireless terminal in self driving, a remote terminal Wireless terminal in medical (remote medical), wireless terminal in smart grid (smart grid), wireless terminal in transportation safety (transportation safety), wireless terminal in smart city, wireless terminal in smart home (smart home) wireless terminals, etc. This embodiment of the present application does not limit the type or type of the terminal device.

PLMN can include: network exposure function (NEF) 131, network storage function (network function repository function, NRF) 132, policy control function (policy control function, PCF) 133, UDM 134, application function (application function, AF) ) 135, authentication server function (AUSF) 136, access and mobility management function (AMF) 137, SMF 138, user plane function (UPF) 139 and (wireless) Access network ((radio) access network, (R)AN) 140, etc. In the above-mentioned PLMN, the part other than the (radio) access network 140 part may be referred to as a core network (core network, CN) part or a core network part.

The data network DN 120, which may also be referred to as a packet data network (PDN), is usually a network located outside the PLMN, such as a third-party network. Exemplarily, the PLMN can access multiple data networks DN 120, and multiple services can be deployed on the data network DN 120, so as to provide the terminal device 110 with services such as data and/or voice. For example, the data network DN 120 can be a private network of a smart factory, the sensors installed in the workshop of the smart factory can be the terminal equipment 110, and the control server of the sensor is deployed in the data network DN 120, and the control server can provide services for the sensors. The sensor can communicate with the control server, obtain the instruction of the control server, and transmit the collected sensor data to the control server according to the instruction. For another example, the data network DN 120 may be an internal office network of a company, and the mobile phones or computers of employees of the company may be terminal devices 110, and the mobile phones or computers of the employees can access information, data resources, etc. on the internal office network of the company. The terminal device 110 may establish a connection with the PLMN through an interface provided by the PLMN (for example, the N1 interface in FIG. 1A , etc.), and use services such as data and/or voice provided by the PLMN. The terminal device 110 can also access the data network DN 120 through the PLMN, and use the operator services deployed on the data network DN 120, and/or services provided by third parties. The above-mentioned third party may be a service party other than the PLMN and the terminal device 110 , and may provide other data and/or voice services for the terminal device 110 . Wherein, the specific expression form of the above third party can be specifically determined according to the actual application scenario, and is not limited here.

Exemplarily, the following briefly introduces the network functions in the PLMN.

The (R)AN 140 is a sub-network of the PLMN and is the implementation system between the service nodes (or network functions) and the terminal equipment 110 in the PLMN. To access the PLMN, the terminal device 110 first passes through the (R)AN 140, and then connects with the service node in the PLMN through the (R)AN 140. The access network device in the embodiment of the present application is a device that provides a wireless communication function for the terminal device 110, and may also be referred to as an access device, a (R)AN device, or a network device. For example, the access device includes but is not limited to: next generation node basestation (gNB) in 5G system, evolved node B (eNB) in LTE system, radio network controller (radio network controller, RNC), node B (node B, NB), base station controller (BSC), base transceiver station (base transceiver station, BTS), home base station (home evolved nodeB, or home node B, HNB), baseband unit (base band unit, BBU), transmitting and receiving point (TRP), transmitting point (transmitting point, TP), small base station equipment (pico), mobile switching center, or network equipment in future networks, etc. It is understandable that the present application does not limit the specific type of the access network device. In systems using different wireless access technologies, the names of devices with access network device functions may be different.

Optionally, in some deployments of the access device, the access device may include a centralized unit (centralized unit, CU), a distributed unit (distributed unit, DU), and the like. In other deployments of the access device, the CU can also be divided into CU-control plane (CP) and CU-user plan (UP), etc. In some other deployments of the access device, the access device may also be an open radio access network (open radio access network, ORAN) architecture, etc. This application does not limit the specific deployment method of the access device.

The network open function NEF (also referred to as NEF network function or NEF network function entity) 131 is a control plane function provided by the operator. The NEF network opening function 131 opens the external interface of the PLMN to a third party in a secure manner. When the SMF network function 138 needs to communicate with a third-party network function, the NEF network open function 131 can act as a relay for the SMF network function 138 to communicate with a third-party network entity. When the NEF network opening function 131 acts as a relay, it can be used as a translation of the identification information of the subscriber and translation of the identification information of a third-party network function. For example, when the NEF network opening function 131 sends the subscriber permanent identifier (SUPI) of the subscriber from the PLMN to the third party, the SUPI can be translated into its corresponding external identity (identity, ID). Conversely, when the NEF network opening function 131 sends the external ID (the third party's network entity ID) to the PLMN, it can be translated into SUPI.

Network storage function NRF 132, which can be used to maintain real-time information of all network function services in the network.

The policy control function PCF 133 is a control plane function provided by the operator for providing the session management function SMF 138 with policies for PDU sessions. The policies may include charging-related policies, QoS-related policies, authorization-related policies, and the like.

The unified data management UDM 134 is a control plane function provided by the operator, and is responsible for storing information such as subscriber permanent identifier (SUPI), security context (security context), and subscription data of subscribers in the PLMN. The above-mentioned PLMN subscribers may specifically be users who use services provided by the PLMN, such as users who use the terminal equipment core card of China Telecom, or users who use the terminal equipment core card of China Mobile. Exemplarily, the SUPI of the subscriber may be the number of the core card of the terminal device, or the like. The above-mentioned security context may be data (cookie) or token (token) stored on a local terminal device (for example, a mobile phone). The contract data of the above-mentioned contract user may be the supporting services of the terminal device chip card, such as the data package of the mobile phone chip card, and the like.

The application function AF 135 is used to perform data routing affected by the application, access the network opening function, and interact with the policy framework for policy control, etc.

The authentication server function AUSF 136 is a control plane function provided by the operator, and is usually used for first-level authentication, that is, the authentication between the terminal device 110 (subscriber) and the PLMN.

Access and Mobility Management Function AMF 137 is a control plane network function provided by the PLMN, responsible for the access control and mobility management of the terminal device 110 accessing the PLMN, including, for example, mobility status management, assignment of user temporary identities, authentication and authorization user functions.

The session management function SMF 138 is a control plane network function provided by the PLMN, and is responsible for managing the protocol data unit (protocol data unit, PDU) session of the terminal device 110. The PDU session is a channel for transmitting PDUs, and the terminal device needs to transmit PDUs to and from the DN 120 through the PDU session. PDU sessions may be established, maintained, deleted, etc. by the SMF 138. SMF 138 includes session management (such as session establishment, modification and release, including tunnel maintenance between UPF 139 and (R)AN 140, etc.), selection and control of UPF 139, service and session continuity (SSC) ) mode selection, roaming and other session-related functions.

The user plane function UPF 139 is a gateway provided by the operator and is the gateway for the PLMN to communicate with the DN 120. UPF 139 includes user plane-related functions such as packet routing and transmission, packet detection, service usage reporting, quality of service (QoS) processing, legal interception, upstream packet detection, and downstream packet storage.

The network function in the PLMN shown in FIG. 1A may also include a network slice selection function (NSSF) (not shown in FIG. 1 ), which is responsible for determining the network slice instance, selecting the AMF network function 137, and the like. The network function in the PLMN shown in FIG. 1A may also include a unified data repository (unified data repository, UDR), etc. The embodiment of the present application does not limit other network functions included in the PLMN.

In FIG. 1A , Nnef, Nausf, Nnrf, Npcf, Nudm, Naf, Namf, Nsmf, N1, N2, N3, N4, and N6 are interface serial numbers. Exemplarily, for the meaning of the above-mentioned interface serial number, reference may be made to the meaning defined in the 3GPP standard protocol, and this application does not limit the meaning of the above-mentioned interface serial number. It should be noted that, in FIG. 1A , only the terminal device 110 is used as an example for the UE, and the interface names between various network functions in FIG. 1A are only an example. In the specific implementation, the interface names of the system architecture Other names may also be used, which are not limited in this application.

The mobility management network function in this application may be the AMF 137 shown in FIG. 1A , or may be other network functions having the above-mentioned access and mobility management function AMF 137 in the future communication system. Alternatively, the mobility management network function in this application may also be a mobility management entity (mobility management entity, MME) or the like in the LTE system.

For the convenience of description, in this embodiment of the present application, the session management function SMF138 is abbreviated as SMF network element, and the unified data management UDM134 is abbreviated as UDM network element. Function, UDM network elements can be replaced by unified data management, and UE can be replaced by terminal equipment. It should be understood that other network functions not shown are equally applicable to this alternative method.

The network architecture (eg, 5G network architecture) shown in FIG. 1A adopts a service-based architecture and common interfaces, and traditional network element functions are divided into several self-contained and self-managed based on network function virtualization (NFV) technology. , Reusable network function service module, by flexibly defining the service module set, customized network function reconstruction can be realized, and the external business process can be formed through a unified service invocation interface. The schematic diagram of the network architecture shown in FIG. 1A can be understood as a schematic diagram of a service-based 5G network architecture in a non-roaming scenario. In this architecture, according to the needs of specific scenarios, different network functions can be combined in an orderly manner on demand, which can realize the customization of network capabilities and services, so as to deploy dedicated networks for different services and realize 5G network slicing. Network slicing technology can enable operators to respond more flexibly and quickly to customer needs and support flexible allocation of network resources.

Please refer to FIG. 1B , which is a schematic diagram of a network system according to an embodiment of the present application. The network system includes UE1, UE2, UE3 and RAN1. Among them, UE1 and UE2 are connected through a proximity communication 5 (prose communication 5, PC5) interface, and UE2 and RAN1 are connected through a direct wireless interface (the radio interface between UTRAN and the user equipment, Uu) interface of the user equipment.

UE1 selects UE2 and communicates with the network through UE2. UE2 plays the role of a UE-to-network relay. The PC5 interface between UE1 and UE2 and the Uu interface between UE2 and RAN1 have corresponding security definitions (on demand security). That is, the security protection mode corresponding to the PC5 interface between UE1 and UE2 and the security protection mode corresponding to the Uu interface between UE2 and RAN1 are determined based on the security policy and can be determined through negotiation.

Among them, the security policy includes the security policy of the control plane and the security policy of the user plane, and each security policy includes two characteristics of encryption protection and integrity protection. The encryption protection requirements of each security policy are divided into three levels: encryption protection is required for encryption protection, encryption protection is desired or preferred, and encryption protection is not needed. The integrity protection requirements of each security policy are divided into three levels, namely: integrity protection is required for integrity protection, integrity protection is desired or is inclined to use integrity protection preferred, and integrity protection is not needed. The security protection methods include enabling encryption protection or not enabling encryption protection, and enabling integrity protection or not enabling integrity protection.

The UE1 sends data or signaling to the RAN1 through the UE2, and the data is sent as an example for description here. If encryption protection is used for data between UE1 and UE2, but encryption protection is not used between UE2 and RAN1. Then an attacker can tamper or eavesdrop on the data sent by UE1 to RAN1 by eavesdropping on the Uu interface between UE2 and RAN1. Although the data between UE1 and UE2 is protected by encryption, the data of UE1 is still leaked during the transmission process between UE2 and RAN1.

Therefore, in order to ensure that the security protection mode between UE1 and UE2 is consistent with the security protection mode between UE2 and RAN, the embodiments of this application are directed to the security protection mode between UE1 and UE2 and the security protection mode between UE2 and RAN A corresponding negotiation solution is proposed in the negotiation of

In the foregoing FIG. 1B , UE1 and UE3 may be remote UEs (remote UEs) or common UEs. However, the common UE can complete the communication with the network through the UE relay. The UE in FIG. 1B is a terminal device. For the related introduction of the terminal device and the access network device, please refer to the related introduction in the aforementioned FIG. 1A , which will not be repeated here.

Please refer to FIG. 1C , which is another schematic diagram of a network system according to an embodiment of the present application. The network system includes UE1, UE2, UE4, gNB and eNB. FIG. 1C shows a scenario in which UE1 selects a UE to enable communication with the network. Among them, UE3 is connected to the gNB, which is the 5G base station of the 5G communication system, and the gNB supports encryption protection and integrity protection. As a relay node, UE3 can provide relay services for UE1 to realize the connection between UE1 and the gNB in the 5G network. The UE4 is connected to the eNB. The eNB is a 4G base station of the 4G communication system. The eNB supports encryption protection but does not support integrity protection. As a relay node, UE4 can provide relay service for UE1, so as to realize the connection between UE1 and the gNB in the 4G network. Regarding how UE1 selects an appropriate UE to communicate with the network, the embodiment of the present application proposes the technical solution of the embodiment shown in FIG. 2 , and for details, refer to the technical solution of the embodiment shown in FIG. 2 later.

1B and FIG. 1C above are only to illustrate the applicable scenarios of the technical solutions of the embodiments of the present application. FIG. 1B and FIG. 1C may also include more UEs, base stations, etc., which are not specifically limited in the present application. Second, FIG. 1B shows a scenario in which UE4 is connected to a long-term evolution node eNB. In practical applications, UE4 can also be connected to the next generation evolved Node B (ng-eNB), and ng-NB is an LTE base station connected to the 5G core network. Both eNB and ng-NB support encryption protection but Neither supports integrity protection.

It should be noted that the short-range service communication scenario shown in FIG. 1B and the short-range service communication scenario shown in FIG. 1C are only application scenarios shown to illustrate the technical solutions of the embodiments of the present application, except for the above-mentioned FIG. 1B and FIG. 1C . In the UE-to-network relay scenario shown in FIG. 1C , the technical solutions of the embodiments of the present application are also applicable to the selection of relay nodes and the negotiation of security protection modes in any other relay scenarios.

Please refer to FIG. 2 , which is a schematic diagram of an embodiment of a communication method according to an embodiment of the present application. In Figure 2, the communication method includes:

201. The second terminal device determines a first parameter.

The second terminal device supports the function of providing a relay service, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device.

For example, as shown in FIG. 1B , the second terminal device is UE2, the first access network device is RAN1, and UE2 can provide relay services for remote UEs (eg, UE1 and UE3 in FIG. 1A ), so as to realize remote Communication between the end UE and the network.

The first parameter includes at least one of the following:

1. The first security protection mode supported by the first PDU session (PDU session1), where the first PDU session is a PDU session established on the second terminal device to be used to provide services for a remote UE or a common UE.

The first security protection mode supported by the first PDU session may also be referred to as the first security protection mode of the air interface corresponding to the first PDU session, or the first security protection mode of the bearer of the air interface corresponding to the first PDU session Way. The first security protection manner includes whether to enable encryption protection and whether to enable integrity protection.

Specifically, a first PDU session for transmitting data for the remote UE has been established on the second terminal device, and the first PDU session has a corresponding first security protection mode. The first PDU session has activated data protection between the second terminal device and the base station. For example, encryption protection is enabled by default, or encryption protection is not enabled by default. Optionally, integrity protection may be enabled by default or not enabled by default.

It should be noted that, when multiple PDU sessions for transmitting data for remote UEs or common UEs have been established on the second terminal device, optionally, the first parameter further includes the PDU sessions supported by the multiple PDU sessions. The security protection mode, or the intersection of the security protection modes supported by the multiple PDU sessions. For example, if PDU session1 supports encryption protection, but PDU session2 does not support encryption protection, the first parameter includes a security protection mode that supports enabling encryption protection.

It should be noted that, optionally, if each PDU session is related to DNN and/or (network slice selection assistance information, NSSAI), the first parameter may include the DNN and/or NSSAI related to each PDU session, and The security protection methods supported by each PDU session.

2. The type of the first access network device, for example, as shown in FIG. 1C, UE3 is connected to gNB, and UE4 is connected to eNB; if the second terminal device is UE3, then the first access network device is gNB, Then the type of the first access network device is a gNB base station or a 5G base station. If the second terminal device is UE4, the first access network device is an eNB, and the type of the first access network device is an eNB base station or a 4G base station. If the second terminal device is UE5, the first access network device is an ng-eNB, and the type of the first access network device is an ng-eNB base station or an evolved 4G base station. There are no restrictions on other base station types here.

3. First indication information, where the first indication information is indication information of whether the first access network device supports the on-demand protection mode.

Specifically, as shown in FIG. 1B , if the RAN1 connected to the UE2 supports the on-demand protection mode (it can be understood that the RAN1 supports flexibly enabling encryption protection and flexibly enabling integrity protection), the first indication information indicates that the first The access network device supports the on-demand protection mode; if the RAN1 to which the UE2 is connected does not support the on-demand protection mode, the first indication information indicates that the first access network device does not support the on-demand protection mode.

4. Second indication information, where the second indication information is used to indicate that the first access network device has the capability of supporting integrity protection. For example, as shown in FIG. 1C , if the second terminal device is UE3, and the gNB connected to UE3 supports integrity protection, the first parameter includes the second indication information.

5. A digital signature, the digital signature is calculated by the second terminal device through the private key of the second terminal device and/or the certificate of the second terminal device, and the content of the digital signature includes the second terminal device and the first terminal device. Security information between access network devices.

Specifically, when the digital signature is calculated by the second terminal device through the certificate of the second terminal device, the first parameter also carries the certificate of the second terminal device, and the root certificate of the second terminal device carries the certificate of the second terminal device. The public key corresponding to the private key of the second terminal device.

The process for the second terminal device to obtain the private key of the second terminal device is as follows: in the registration process of the second terminal device, the UE obtains the private key of the second terminal device from the PCF network element, the UDM network element, and the unified data repository (unified data repository, UDR network element). , key management entities, or network devices such as proximity-based services functions (prose functions). Here, the configuration process of the private key of the second terminal device and/or the root certificate of the second terminal device is introduced by taking the PCF network element as an example. The PCF network element sends first configuration information to the AMF network element, where the first configuration information carries the private key of the second terminal device and/or the certificate of the second terminal device. Then, the AMF network element sends the private key of the second terminal device and/or the certificate of the second terminal device to the second terminal device through a non-access stratum (non access stratum, NAS) message.

6. The identity of the second terminal device, that is, the user equipment identity (user equipment identity, UE ID) of the second terminal device. For example, subscriber permanent identifier (SUPI), publicly available subscription identifier (generic public subscription identifier, GPSI), etc.

7. The network identification ID that the second terminal device belongs to or serves. For example, PLMN ID, non-public network identity (NPN ID), PLMN ID||NPN ID. Where "||" represents the concatenation of two identities.

8. The name of the first data network (data network name, DNN), the first DNN supports the DNN that provides the relay service for the second terminal device, and is used to indicate that the second terminal device supports providing services for the first DNN. Relay service.

9. First slice information, where the first slice information is information of a slice that the second terminal device supports to provide a relay service.

The first slice information is used to indicate that the second terminal device supports providing a relay service for the service corresponding to the slice. For example, the first slice information is single network slice selection assistance information (single network slice selection assistance information, S-NSSAI).

The above-mentioned first parameter can be understood as the current protection status of the second terminal device and the first access network device or the security protection mode that can be executed in the future, so that the first terminal device can determine whether to select this parameter according to the security requirements of the first terminal device. second terminal equipment.

202. The second terminal device sends a first message to the first terminal device.

The first message carries the first parameter. For the related introduction of the first parameter, please refer to the related introduction of the foregoing step 201, which will not be repeated here.

It should be noted that the first message carries the identity information of the second terminal device as the UE relay. On this basis, the first parameter is added to the first message in this embodiment.

Specifically, the first terminal device is configured to communicate with the network through the UE relay, and the second terminal device is configured to perform the role of the UE relay. The specific configuration manner is not limited in this application.

The following is an example of a possible configuration method: in the registration process of the first terminal device, the first terminal device is configured from a PCF network element (it may also be a UDM network element, a UDR network element, a key management entity or a network device such as a prose function) Obtain second configuration information. The second configuration information includes the capability of the first terminal device to use UE relay. In the registration process of the second terminal device, the second terminal device obtains the third configuration information from a PCF network element (which may also be a network device such as a UDM network element, a UDR network element, a key management entity, or a prose function). The third configuration information includes that the second terminal device can perform the function of UE relay.

The following describes the configuration process by taking the process of acquiring the second configuration information by the first terminal device and taking the PCF network element as an example. The PCF network element sends the second configuration information to the AMF network element, and the AMF network element sends the second configuration information to the first terminal device through a NAS message.

Optionally, the first message is a broadcast message or a multicast message of the second terminal device, or is a response message sent by the second terminal device to the first terminal device.

If the first message is a response message sent by the second terminal device to the first terminal device, this embodiment further includes step 202 a , and step 202 a is performed before step 202 .

Step 202a: The first terminal device sends a second request message.

The second request message is used to indicate that the first terminal device needs UE-to-network relay; or, the second request message is used to request a service.

In this implementation manner, after the second terminal device receives the second request message, the second terminal device sends a response message to the first terminal device. The response message carries the first parameter and the identity information of the second terminal device as the UE relay.

203. The first terminal device selects the first terminal device according to the first parameter.

Specifically, after receiving the first message, the first terminal device determines whether to select the second terminal device as a relay node for subsequent connection to the network through the first parameter. For example, as shown in FIG. 1B , UE1 determines whether to select UE2 as a relay node connecting to RAN1.

Optionally, this embodiment further includes step 203 a, and this step 203 a is performed before step 203 .

Step 203a: The first terminal device determines a first security policy.

The first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device. The first security policy includes protection requirements for encryption protection and protection requirements for integrity protection.

The service to be used by the first terminal device may be characterized by at least one of the following pieces of information: first service information, second DNN, and second slice information.

The first service information is service information corresponding to a service to be used by the first terminal device. The second DNN is the DNN corresponding to the service to be used by the first terminal device. The second slice information is slice information corresponding to the service to be used by the first terminal device.

The first service information is used to identify service information. Optionally, the first service information includes at least one of the following: service type, service identifier, application type, and application identifier.

Specifically, the first terminal device determines the first security policy by at least one item of information among the first service information, the second DNN and the second slice information, that is, the first terminal device determines its security requirements. For example, the first security policy includes encryption protection as required and integrity protection as preferred.

On the basis of step 203a, step 203 specifically includes:

For the convenience and clarity of description, the following descriptions are made from the perspective of encryption protection or integrity protection.

Step 203 is described below with reference to the specific content of the first security policy.

1. If the first security policy indicates that integrity protection is required or tends to be preferred, the first terminal device performs at least one of the following operations:

a. If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the first terminal device selects the second terminal device.

Since there is already a suitable PDU session1 on the second terminal device at this time that can provide integrity protection, the first terminal device can select the second terminal device.

In this embodiment, if the first terminal device receives multiple messages broadcast by terminal devices that can be used as UE relays, and the multiple terminal devices have established PDU sessions, the first terminal device can select the message that has established the PDU session. The second terminal device and the PDU session supports enabling integrity protection.

It should be noted that, if the first terminal device receives the security protection mode supported by multiple PDU sessions broadcast by the second terminal device, the first terminal device may select a PDU session that supports enabling integrity protection to provide the first terminal device. Serve.

b. If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the ability to support enabling integrity protection, the first terminal device selects the first access network device. Two terminal equipment.

For example, as shown in Figure 1C, when UE1 selects UE relay, since UE3 is connected to gNB, gNB supports integrity protection. The UE4 is connected to the eNB, and the eNB does not support integrity protection. Therefore, UE1 selects the UE3 as the UE relay according to the indication information carried in the message broadcast by UE3, and the indication information indicates that the gNB supports integrity protection. That is, the UE1 communicates with the network through the UE3.

c. If the first parameter includes first indication information, and the first indication information indicates that the first access network device supports the on-demand protection mode, the first terminal device selects the second terminal device.

As shown in FIG. 1C , if the gNB connected to the UE3 supports the on-demand protection mode, it can be understood that the gNB supports flexibly turning on encryption protection and flexibly turning on integrity protection, and then UE1 selects UE3.

d. If the first parameter includes the second indication information, the first terminal device selects the second terminal device.

For example, as shown in FIG. 1C , if the second terminal device is UE3, and the gNB connected to UE3 supports integrity protection, the first parameter includes the second indication information. When the first parameter carries the second indication information, the first terminal device selects the second terminal device, so that the gNB can provide the integrity protection service subsequently.

The above only illustrates some possible implementations of the first terminal device when the first security policy indicates that the integrity protection is required or preferred.

It should be noted that, when the first security policy indicates that the integrity protection is preferred, since the preferred means that the integrity protection can be enabled, the integrity protection may not be enabled. Therefore, when the first terminal device selects the second terminal device, there is no restriction on whether the second terminal device can provide integrity protection. For example, regardless of whether the second terminal device is connected to a 5G base station or a 4G base station, the first terminal device can select the second terminal device.

2. If the first security policy indicates that encryption protection is required or tends to be preferred, the first terminal device performs at least one of the following operations:

a. If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable encryption protection, the first terminal device selects the second terminal device.

Since there is already a suitable PDU session1 on the second terminal device at this time that can provide encryption protection, the first terminal device can select the second terminal device.

It should be noted that if the first terminal device receives multiple messages broadcast by terminal devices that can be used as UE relays, and PDU sessions are established on the multiple terminal devices, the first terminal device can select the second terminal device, and The PDU session on the second terminal device supports enabling encryption protection.

b. If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the ability to support enabling encryption protection, the first terminal device selects the second terminal equipment.

Specifically, as shown in FIG. 1C , if the gNB connected to UE3 supports on-demand protection, it can be understood that the gNB supports flexibly enabling encryption protection and flexibly enabling integrity protection, and UE1 selects UE3.

d. If the first parameter includes indication information of the capability of the first access network device to support encryption protection, the first terminal device selects the second terminal device.

The above only shows some possible implementations of the first terminal device when the first security policy indicates that the encryption protection is required or preferred.

It should be noted that, when the first security policy indicates that the encryption protection is preferred, the preferred means that the encryption protection can be enabled, or the encryption protection may not be enabled. Therefore, when the first terminal device selects the second terminal device, it does not limit whether the second terminal device is capable of providing encryption protection. For example, regardless of whether the established PDU session on the second terminal device supports encryption protection, the first terminal device can select the second terminal device. When the first security policy indicates that encryption protection is required, other capabilities of the second terminal device are not limited except that the first terminal device selects a PDU session that supports encryption protection when selecting an established PDU session. Because no matter what type of base station the second terminal device is connected to, encryption protection is supported.

3. If the first security policy indicates that encryption protection or integrity protection is not needed, because not needed means that encryption protection and integrity protection are not turned on, when the first terminal device selects the second terminal device, the second terminal device is not required. ability is not limited. Of course, the first terminal device preferentially selects the second terminal device that has established a PDU session, and the encryption protection or integrity protection of the PDU session is not enabled.

4. If the first parameter includes a first DNN and the first DNN is consistent with the second DNN to be accessed by the first terminal device, and/or, if the first parameter includes first slice information and the first When the slice information is consistent with the second slice information of the slice to be accessed by the first terminal device, the first terminal device selects the second terminal device.

Consistency of the first DNN and the second DNN includes: the first DNN is the same as the second DNN, or the first DNN includes (covers) the second DNN.

The first slice information being consistent with the second slice information includes: the first slice information is the same as the second slice information, or the first slice information includes (covers) the second slice information.

5. If the first parameter includes the first DNN and/or the first slice information, and the second security policy associated with the first DNN and/or the first slice information is consistent with the first security policy, the first terminal device Select the second terminal device.

Wherein, that the first security policy is consistent with the second security policy can be understood as the security policy corresponding to the second DNN and/or the second slice information to be accessed by the first terminal device can be provided by the second security policy.

For example, if the first security policy indicates that encryption protection is required, then the encryption protection in the second security policy must be required. The first security policy indicates that the encryption protection is preferred, then the encryption protection in the second security policy is required or preferred. The same is true for the integrity protection indicated by the first security policy, and details are not repeated here. The first security policy indicates that the encryption protection is not needed, then there is no restriction on the second security policy. If the first security policy indicates that the integrity protection is not needed, there is no restriction on the second security policy.

It should be noted that the above shows the process of selecting the second terminal device by the first terminal device according to certain information carried by the first parameter. In practical applications, the first terminal device may select the second terminal device according to one or more parameters in the first parameters, that is, the first terminal device performs the above-mentioned multiple processes of selecting the second terminal device by the first terminal device .

Specifically, the first terminal device determines through the first parameter that both the second terminal device meets the protection requirements of the encryption protection and the protection requirements of the integrity protection of the first security policy, and the first terminal device selects the second terminal device .

In addition, the scenario where relay is selected in this embodiment is applicable to the hop-by-hop protection mechanism and the end-to-end protection mechanism. For example, for the end-to-end protection mechanism, it can be understood that the first terminal device selects the second terminal device according to the type of the base station connected to the second terminal device, or whether the base station supports integrity protection, or whether the base station supports on-demand protection and other parameters. terminal device; then, the first terminal device implements end-to-end security protection between the first terminal device and the base station through the second terminal device.

Optionally, the first parameter includes a digital signature. Before the first terminal device selects the second terminal device, the first terminal device verifies the correctness of the digital signature, if the verification is correct, the first terminal device performs the step of selecting the second terminal device; if the verification is incorrect , the first terminal device determines that the first message is an illegal message, and discards the first message.

Two possible implementations for the first terminal device to verify the digital signature are shown below.

1. The first terminal device verifies the digital signature by using the public key corresponding to the private key of the second terminal device.

In this manner, the first terminal device obtains the public key of the second terminal device. Specifically, the first terminal device obtains the public key of the second terminal device in the following manner: the first message also carries the identifier of the second terminal device, and the first terminal device determines the first terminal device through the identifier of the second terminal device. 2. The public key of the terminal device.

2. The first terminal device verifies the digital signature through the certificate of the second terminal device.

In this manner, the first message carries the certificate of the second terminal device and the digital signature. The first terminal device verifies the certificate of the second terminal device, and when the verification is successful, the first terminal device uses the certificate of the second terminal device to verify the digital signature. Specifically, the first terminal device may verify the certificate of the second terminal device received by the first terminal device by using the root certificate of the second terminal device.

The first terminal device obtains the root certificate in the following manner. The first message also carries a network identifier (for example, PLMN ID and/or NPN ID) to which the second terminal device belongs, and the first terminal device determines the root certificate of the second terminal device according to the network identifier.

Optionally, when the first terminal device receives multiple messages broadcast by terminal devices serving as UE relays, if multiple terminal devices meet the security requirements of the first terminal device, the first terminal device will The priority of the broadcast parameters selects the second terminal device.

For example, if multiple terminal devices broadcast the security protection mode supported by the established PDU sessions on the multiple terminal devices, the PDU session that supports enabling integrity protection has a higher priority. When multiple terminal devices broadcast the types of access network devices to which the multiple terminal devices are connected, the type of access network devices capable of supporting integrity protection has a higher priority.

In the following, the process of selecting the second terminal device by the first terminal device is performed by taking the first terminal device receiving two messages broadcast by the terminal device serving as the UE relay as an example. This embodiment further includes step 203b, and step 203b is performed before step 203.

Step 203b: The first terminal device receives the second message.

Wherein, the second message carries a second parameter, and the second parameter is used to indicate the security information of the communication between the third terminal device and the second access network device.

For example, as shown in FIG. 1C , UE1 receives the first message broadcasted by UE3, where the first message carries the first parameter. UE1 receives the second message broadcasted by UE4, where the second message carries the second parameter.

The above step 203 specifically includes: the first terminal device selects the second terminal device according to the first parameter and the second parameter.

Specifically, the first terminal device may select the second terminal device according to the first security policy, the first parameter and the second parameter. Two possible options are shown below:

1. If the first parameter includes the first security protection mode supported by the first PDU session and the first security protection mode is to enable integrity protection, and the second parameter includes the second security protection mode supported by the second PDU session, and the The second security protection mode is that integrity protection is not enabled, and the first terminal device selects the second terminal device.

The first PDU session is an established PDU session on the second terminal device, and the second PDU session is an established PDU session on the third terminal device.

It can be seen from the above that the first security protection mode supports turning on integrity protection, but the second security protection mode does not support turning on integrity protection, it can be understood that the priority of the first security protection mode is higher, and the first terminal device can select the first security protection mode. Two terminal equipment.

2. If the first parameter includes first indication information and the first indication information indicates that the first access network device supports on-demand protection, the second parameter includes third indication information and the third indication information indicates that the second access network device does not support For protection on demand, the first terminal device selects the second terminal device.

It can be seen from the above that the priority of the first indication information is higher than the priority of the third indication information, so the first terminal device selects the second terminal device.

It should be noted that the first terminal device may also select the second terminal device according to other parameters. For example, the first terminal device selects the second terminal device according to the types of access network devices to which the multiple terminal devices are connected. The 5G base station supports integrity protection, while the 4G base station does not support integrity protection, so the first terminal device preferentially selects the second terminal device connected to the 5G base station.

The above shows a solution in which the first terminal device selects the second terminal device from the plurality of terminal devices according to the priority of a parameter broadcast by the plurality of terminal devices. In practical applications, the first terminal device comprehensively selects the second terminal device according to the priorities of multiple parameters.

204. The first terminal device sends a fifth message to the second terminal device.

Specifically, after the first terminal device selects the second terminal device, the first terminal device may send a message to the second terminal device to facilitate communication with the network.

In this embodiment of the present application, the first terminal device receives a first message, where the first message carries a first parameter, where the first parameter is used to indicate security information for communication between the second terminal device and the first access network device; Then, the first terminal device selects the second terminal device according to the first parameter. It can be seen from this that since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the first terminal device can select the second terminal device according to the first parameter when selecting the second terminal device. A second terminal device that matches the security requirements of the first terminal device is selected, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network.

Please refer to FIG. 3 , which is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application. In Figure 3, the communication method includes:

301. The first terminal device sends a second message to the second terminal device.

The second message carries a first security policy, where the first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device. For the related introduction of the first security policy, please refer to the related introduction to the first security policy in step 203a in the above-mentioned embodiment shown in FIG. 2 , and details are not repeated here.

The first terminal device is configured to implement communication with the network through the UE relay, while the second terminal device is configured to perform the role of the UE relay. For the relevant introduction of the specific configuration method, please refer to the steps in the embodiment shown in the aforementioned FIG. 2 The relevant introduction in 202 will not be repeated here.

It should be noted that this embodiment may be implemented on the basis of the embodiment shown in FIG. 2 , that is, the first terminal device selects the second terminal device as the UE relay through the method of the embodiment shown in FIG. 2 .

Optionally, the first security policy is a user plane (user plane, UP) security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device.

302. The second terminal device determines a first security protection mode according to the first security policy.

For example, if the first security policy is that encryption protection is required and integrity protection is required, the second terminal device may determine that the first security protection mode is to enable encryption protection and enable integrity protection.

It should be noted that, when the second terminal device determines the first security protection mode, the second terminal device may determine the first security protection mode in combination with the established PDU session of the second terminal device, so as to solve the problem between the second terminal device and the established PDU session. The problem is that the security protection mode adopted in the data communication between the first access network devices and the first security protection mode are negotiated.

1. For a PDU session already established on the second terminal device, there are two possible situations of the first security protection mode and the second security protection mode.

Case a: The following shows multiple possible implementations in which the first security protection mode is consistent with the second security protection mode supported by the second PDU session.

Wherein, the second PDU session is a PDU session that has been established on the second terminal device and is used to provide services for a remote UE or a common UE.

Implementation mode 1. If the first security policy indicates that encryption protection is required, and the second security protection mode supported by the second PDU session is to enable encryption protection, the second terminal device will use the second security protection mode supported by the second PDU session. The encryption protection mode in the first security protection mode is used as the encryption protection mode in the first security protection mode.

Since the first security policy indicates that encryption protection is required, the second terminal device determines that the encryption protection requirement in the first security protection mode should be to enable encryption protection, and the second security protection mode supported by the second PDU session is to enable encryption protection. From the perspective of encryption protection, the second PDU session can provide services for the first terminal device, so the second terminal device can use the encryption protection mode in the second security protection mode as the encryption protection mode in the first security protection mode, That is, the encryption protection mode in the first security protection mode is consistent with the encryption protection mode in the second security protection mode. And, the second terminal device determines to provide a service for the first terminal device through the second PDU session, so as to transmit the data of the second terminal device for the first terminal device.

Implementation mode 2: If the first security policy indicates that integrity protection is required, and the second security protection mode supported by the second PDU session is to enable integrity protection, the second terminal device will use the second security protection mode supported by the second PDU session to be enabled. The integrity protection mode in the protection mode is used as the integrity protection mode in the first security protection mode.

Since the first security policy indicates that integrity protection is required, the second terminal device determines that the integrity protection requirement in the first security protection mode should be to enable integrity protection, and the second security protection mode supported by the second PDU session is enabled Integrity protection. From the perspective of integrity protection, the second PDU session can provide services for the first terminal device, so the second terminal device can use the integrity protection mode in the second security protection mode as the integrity protection mode in the first security protection mode The security protection mode, that is, the integrity protection mode in the first security protection mode is consistent with the integrity protection mode in the second security protection mode. And, the second terminal device determines to provide a service for the first terminal device through the second PDU session, so as to transmit the data of the first terminal device for the first terminal device.

Implementation mode 3: If the first security policy indicates that encryption protection is not needed, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device will use the second security protection mode supported by the second PDU session. The encryption protection mode in the security protection mode is used as the encryption protection mode in the first security protection mode.

Since the first security policy indicates that the encryption protection is not needed, the second terminal device determines that the encryption protection requirement in the first security protection mode may be not to enable encryption protection. From the perspective of encryption protection, the second PDU session can provide services for the first terminal device, so the second terminal device can use the encryption protection mode in the second security protection mode supported by the second PDU session as the first security protection The encryption protection mode in the mode, that is, the encryption protection mode in the first security protection mode is consistent with the encryption protection mode in the second security protection mode. And, the second terminal device determines to provide a service for the first terminal device through the second PDU session, so as to transmit the data of the first terminal device for the first terminal device.

Implementation mode 4: If the first security policy indicates that the integrity protection is not needed, and the second security protection mode supported by the second PDU session is not to enable integrity protection, the second terminal device supports the second PDU session. The integrity protection mode in the second security protection mode is used as the integrity protection mode in the first security protection mode.

Since the first security policy indicates that the integrity protection is not needed, the second terminal device determines that the integrity protection requirement in the first security protection mode may be not to enable integrity protection. From the perspective of integrity protection, the second PDU session can provide services for the first terminal device, so the second terminal device can use the integrity protection mode in the second security protection mode supported by the second PDU session as the first security mode Integrity protection mode in protection mode. And, the second terminal device determines to provide a service for the first terminal device through the second PDU session, so as to transmit the data of the first terminal device for the first terminal device.

Implementation mode 5: If the first security policy indicates that the encryption protection is inclined to be preferred, the second terminal device uses the encryption protection mode in the second security protection mode supported by the second PDU session as the encryption protection mode in the first security protection mode. Encryption protection method.

Since the first security policy indicates that the encryption protection tends to be preferred, the second terminal device determines that the encryption protection in the first security protection mode can be enabled or disabled. Therefore, from the perspective of encryption protection, the second PDU session can provide services for the first terminal device regardless of whether the second security protection mode is to enable encryption protection or not to enable encryption protection. Therefore, the second terminal device uses the encryption protection mode in the second security protection mode supported by the second PDU session as the encryption protection mode in the first security protection mode. And, the second terminal device determines to provide services for the first terminal device through the second PDU session.

Implementation mode 6: If the first security policy indicates that the integrity protection is inclined to be preferred, the second terminal device uses the integrity protection mode in the second security protection mode supported by the second PDU session as the first security protection mode Integrity protection method in .

Since the first security policy indicates that the integrity protection tends to be preferred, the second terminal device determines that the integrity protection in the first security protection manner may be to enable integrity protection or not to enable integrity protection. Therefore, from the perspective of integrity protection, regardless of whether the second security protection mode is to enable integrity protection or not to enable integrity protection, the second PDU session can provide services for the first terminal device. Therefore, the second terminal device uses the integrity protection mode in the second security protection mode supported by the second PDU session as the integrity protection mode in the first security protection mode. And, the second terminal device determines to provide services for the first terminal device through the second PDU session.

It should be noted that, if multiple PDU sessions on the second terminal device all meet the security protection requirements of any one of the foregoing implementation manners 1 to 6, the second terminal equipment may combine the multiple PDU sessions with the security protection requirements. Corresponding quality of service (QoS) and slice information, etc., select the second PDU session from the plurality of PDU sessions.

The foregoing implementation manners 1 to 6 only illustrate the process of determining the first security protection manner by the second terminal device from the perspective of encryption protection or integrity protection. In practical applications, when the second terminal device chooses to provide services for the first terminal device through the PDU session, it should select a PDU session whose encryption protection and integrity protection both meet the encryption protection requirements and integrity protection requirements of the first terminal device. That is, the second security protection mode supported by the second PDU session meets the encryption protection requirements and integrity protection requirements of the first terminal device.

Case b: The following shows various possible implementations in which the first security protection mode is inconsistent with the second security protection mode supported by the second PDU session.

Implementation mode 1. If the first security policy indicates that encryption protection is inclined to be preferred, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device determines the first security policy corresponding to the first security policy. The security protection method is inconsistent with the second security protection method.

Since the preferred is to enable encryption protection, if the second security protection mode supported by the second PDU session established by the second terminal device is not to enable encryption protection, then the second terminal device determines the first security protection corresponding to the first security policy. The method is inconsistent with the second security protection method. The second terminal device may request to modify the second PDU session or request to establish a new third PDU session.

Implementation mode 2: If the first security policy indicates that the integrity protection is inclined to be preferred, and the second security protection mode supported by the second PDU session is not to enable integrity protection, the second terminal device determines the corresponding first security policy. The first security protection mode is inconsistent with the second security protection mode.

The implementation mode 2 is similar to the implementation mode 1. For details, please refer to the related introduction of the implementation mode 1.

Implementation mode 3: If the encryption protection of the second security protection mode does not match the encryption protection indicated by the first security policy, and/or, the integrity protection of the second security protection mode does not match the integrity protection indicated by the first security policy , the second terminal device determines that the first security protection mode is inconsistent with the second security protection mode.

The encryption protection of the second security protection mode does not match the encryption protection indicated by the first security policy, including many possible forms. The following examples are introduced:

1. The second security protection mode is not to enable encryption protection, and the first security policy indicates that encryption protection is required;

2. The second security protection method is to enable encryption protection, and the first security policy indicates that the encryption protection is not needed.

The integrity protection of the second security protection does not match the integrity protection indicated by the first security policy, including multiple possible forms. The following examples are introduced:

1. The second security protection mode is not to enable integrity protection, and the first security policy indicates that integrity protection is required;

2. The second security protection method is to enable integrity protection, and the first security policy indicates that integrity protection is not needed.

The second terminal device determines that the first security protection mode is inconsistent with the second security protection mode, and the second terminal device may request to modify the second PDU session or request to establish a new third PDU session.

2. A PDU session is not established on the second terminal device.

Since no PDU session is established on the second terminal device, after the second terminal device determines the first security protection mode, the second terminal device may request to establish a new third PDU session for providing services to the first terminal device.

303. The second terminal device uses the first security protection mode as a security protection mode used for data communication between the first terminal device and the second terminal device.

304. The second terminal device sends the first security protection mode to the first terminal device.

In this embodiment of the present application, the first terminal device sends a second message to the second terminal device, where the second message carries the first security policy; then, the second terminal device determines the first security protection mode according to the first security policy, The first security protection mode is used as the security protection mode used for data communication between the first terminal device and the second terminal device, and the first security protection mode is sent to the first terminal device. In this way, the first terminal device can determine the first security protection mode between the first terminal device and the second terminal device, and then use the first security protection mode to determine the relationship between the second terminal device and the first access network device The security protection mode is consistent with the security protection mode between the first terminal device and the second terminal device and the security protection mode between the second terminal device and the first access network device, so as to improve the security of data transmission.

It should be noted that, what is shown in the foregoing step 302 is an implementation manner in which the second terminal device considers the establishment of a PDU session when determining the first security protection manner.

This embodiment of the present application also provides another embodiment, which is similar to the embodiment shown in FIG. 3 , except that step 302 is replaced with: the second terminal device according to the fourth security policy and/or the second terminal device The received first security policy determines the first security protection mode. The fourth security policy is a security policy determined by the second terminal device and corresponding to the service to be used by the first terminal device. Then, the second terminal device compares the first security protection mode with the second security protection mode supported by the established second PDU session. If they are inconsistent, the second terminal device can modify the second PDU session or create a new PDU session, the modified second PDU session or the newly created third PDU session is obtained; or, if no PDU session is established on the second terminal device, then the second terminal device creates the third PDU session. That is, the second terminal device first determines the first security protection mode, and then selects a corresponding PDU session in combination with the establishment of the PDU session on the second terminal device to provide services for the first terminal device.

The fourth security protection mode supported by the modified second PDU session is the same as the first security protection mode; or, the fourth security protection mode supported by the third PDU session is the same as the first security protection mode.

Optionally, based on the above situation b or the situation that no PDU session is established on the second terminal device, this embodiment further includes steps 305 to 309 , and steps 305 to 309 are executed after step 303 .

305. The second terminal device sends the first request message to the SMF network element.

Wherein, the first request message is used for requesting to modify the second PDU session or for requesting to establish a third PDU session. The first request message carries a third parameter, and the third parameter is used to indicate the security information of the data communication between the first terminal device and the second terminal device.

From the above situation b or the situation that no PDU session is established on the second terminal device, the second terminal device may request the SMF network element to modify the second PDU session or request to establish a new third PDU session. In this way, the second terminal device may provide services for the first terminal device through the modified second PDU session; or, the second terminal device may provide services for the first terminal device through the third PDU session.

The third parameter includes at least one of the following:

1. First service information, where the first service information is service information corresponding to a service to be used by the first terminal device. For example, business ID, business type, etc.

2. A second DNN, where the second DNN is a DNN to be accessed by the first terminal device.

3. Second slice information, where the second slice information is slice information of the slice to be accessed by the first terminal device.

4. The first security policy.

5. The first security protection method.

6. First indication information, where the first indication information is used to indicate that the first request message is a request message for a PDU session for providing a relay service.

7. A first protection indication, where the first protection indication is used to indicate a protection mechanism that the first terminal device expects to execute during data communication between the first terminal device and the first access network device.

For example, the first protection indication is used to indicate that the first terminal device expects to use the E2E protection mechanism or the hop-by-hop protection mechanism.

Optionally, the first request message sent by the second terminal device to the SMF network element may be: the second terminal device sends the first request message to the SMF network element through the first access device and the AMF network element, and the first access device sends the first request message to the SMF network element. The network access device and the AMF network element play a relay role for the first request message. For example, for the above third parameter, the second terminal device first sends the third parameter to the AMF network element, and then the AMF network element sends the third parameter to the SMF network element. Step 305 is only described as the information received by the final SMF network element, and there is no restriction on the transmission mode of the information.

306. The SMF network element determines a third security policy according to the third parameter.

Wherein, the third security policy is the security policy determined by the SMF network element and corresponding to the service to be used by the first terminal device. The third security policy is similar to the first security policy. Specifically, the third security policy may be understood by referring to the relevant introduction of the first security policy in the embodiment shown in FIG. 2 .

The following describes the manner in which the SMF network element determines the third security policy in combination with the above-mentioned third parameter.

Manner 1: The third parameter carries the first security policy, and the above step 306 specifically includes:

The SMF network element determines the third security policy according to the first security policy.

The SMF network element sets the third security policy so that the third security policy is the same as the first security policy; or, the SMF network element directly uses the first security policy as the third security policy.

Mode 2: The third parameter carries the first security protection mode, and the above step 306 specifically includes:

The SMF network element determines the third security policy according to the first security protection manner.

Specifically, the SMF network element determines the first security policy according to the first security protection manner, and then the SMF network element sets the third security policy to be the same as the first security policy.

For example, the first security protection mode is to enable encryption protection and not to enable integrity protection, the SMF network element determines according to the first security protection mode that the encryption protection indicated by the first security policy is required, and the integrity protection indicated by the first security policy is not needed. Then, the SMF network element sets the third security policy, and the third security policy is the same as the first security policy, that is, the encryption protection indicated by the third security policy is required, and the integrity protection indicated by the first security policy is not needed.

Mode 3. Mode 3 is described below in combination with steps 1 to 3. In manner 3, the third parameter includes at least one item of information: first service information, second DNN, and second slice information.

Step 1: The SMF network element sends at least one of the following information to the UDM network element: first service information, second DNN and second slice information.

When the third parameter includes at least one item of information among the first service information, the second DNN, and the second slice information, the SMF network element sends the at least one item of information to the UDM network element.

Step 2: The SMF network element receives the subscription security policy sent by the UDM network element.

The UDM network element acquires the subscription security policy corresponding to the at least one piece of information, and sends the subscription security policy to the SMF network element.

Step 3: the SMF network element takes the signed security policy as the third security policy; or, the SMF network element determines the third security policy according to the signed security policy and the first security policy; or, the SMF network element determines the third security policy according to the signed security policy and the first security protection way to determine the third security policy.

When the third parameter further includes the first security policy, the SMF network element may determine the third security policy according to the subscription security policy and the first security policy.

For example, if the subscribed security policy is the same as the first security policy, the SMF network element may use the subscribed security policy as the third security policy. Or, except that the encryption protection indicated by the subscription security policy does not match the encryption protection indicated by the first security policy, and/or the integrity protection indicated by the subscription security policy does not match the integrity protection indicated by the first security policy In other cases than the above-mentioned situation, the SMF network element may use the subscription security policy as the third security policy. For example, the encryption protection indicated by the subscription security policy is required and the integrity protection indicated by the subscription security policy is not needed, the encryption protection indicated by the first security policy is required and the integrity protection indicated by the first security policy is preferred, and the SMF network element The contracted security policy may be used as the third security policy.

The encryption protection indicated by the subscription security policy does not match the encryption protection indicated by the first security policy instruction, including multiple possible forms. The following examples illustrate:

1. The encryption protection indicated by the contract security policy is required, and the encryption protection indicated by the first security policy instruction is not needed;

2. The encryption protection indicated by the contract security policy is not needed, and the encryption protection indicated by the first security policy instruction is required.

The integrity protection indicated by the subscription security policy does not match the integrity protection indicated by the first security policy instruction, including multiple possible forms, and the following examples illustrate:

1. The integrity protection indicated by the contract security policy is required, and the integrity protection indicated by the first security policy instruction is not needed;

2. The integrity protection indicated by the contract security policy is not needed, and the integrity protection indicated by the first security policy indication is required.

It should be noted that, optionally, the encryption protection indicated by the subscription security policy does not match the encryption protection indicated by the first security policy indication, and/or the integrity protection indicated by the subscription security policy is the same as that indicated by the first security policy indication. In the case where the indicated integrity protection does not match, the SMF network element releases the session establishment process or the session modification process, and sends a reject message to the first access network device, and then the first access network device sends a reject message to the second terminal device .

When the third parameter further includes the first security protection mode, the SMF network element may determine the third security policy according to the subscription security policy and the first security protection mode. Specifically, the SMF network element determines the first security policy according to the first security protection mode, and the SMF network element performs the determination of whether the first security policy and the subscription security policy match; if they match, the SMF network element sets the third security policy, Make the third security policy the same as the first security policy.

Mode 4: the third parameter further includes a first security protection mode; the above step 306 specifically includes: the SMF network element determines a third security policy according to the first security policy and the first security protection mode.

For example, the first security protection mode is to enable encryption protection and disable integrity protection. The first security policy indicates that encryption protection is required, and the first security policy indicates that integrity protection is preferred. Then the SMF network element can set the third security policy, for example, the third security policy indicates that encryption protection is required, and the first security policy indicates that integrity protection is preferred; or, the third security policy indicates that encryption protection is required, and the first security policy Indicates that integrity protection is not needed.

It should be noted that, when the third parameter includes the first indication information, the SMF network element may also determine that the PDU session is to be established for the first terminal device according to the first indication information. When the third parameter includes at least one item of information among the first protection indication, the first service information, the second DNN, and the second slice information, the SMF network element determines the second protection indication according to the at least one item of information, and transmits the information through the AMF network The element sends the second protection indication to the second terminal device. The second protection instruction is the protection mechanism executed by the SMF network element when determining the data communication between the first terminal device and the first access network device.

307. The SMF network element sends a fourth message to the first access network device.

Wherein, the fourth message carries the third security policy.

Optionally, the fourth message further carries at least one of the following information: a first security protection mode and a first security policy.

It should be noted that if the SMF network element has already referred to the first security protection mode and the first security policy when determining the third security policy, the fourth message may not carry the first security protection mode or the first security policy.

308. The first access network device determines a fourth security protection manner according to the third security policy.

For example, if the third security policy indicates that encryption protection is required, and the first security policy indicates that integrity protection is likely to be preferred, then the first access network device determines that the fourth security protection mode is to enable encryption protection and not enable integrity protection .

Optionally, the second message further carries at least one of the following: a first security policy and a first security protection mode.

Multiple possible implementation manners for the first access network device to determine the fourth security protection manner are shown below.

1. The first access network device determines a fourth security protection mode according to the third security policy and the first security protection mode.

Optionally, if the third security policy indicates that encryption protection is preferred, the encryption protection mode of the fourth security protection mode determined by the first access network device should also be the same as the encryption protection mode in the first security protection mode. The same is true for the third security policy indicating that the integrity protection is preferred, which will not be described one by one here.

If the third security policy protection indicates that encryption protection is required and the first security protection mode is not to enable encryption protection, the first access network device sends a sixth message to the SMF network element, where the sixth message is a failure message or a PDU session Release request message. For the case where the third security policy indicates that integrity protection is required and the first security protection mode does not enable integrity protection, the third security policy indicates that encryption protection is not needed and the first security protection mode is to enable encryption protection The situation is similar to the situation where the third security policy indicates that the integrity protection is not needed and the first security protection mode is to enable the integrity protection, and will not be described one by one here.

Optionally, the failure message also carries a rejection reason, where the rejection reason is that the third security policy does not match the first security protection mode. The first access network device sends the sixth message to the second terminal device.

2. The first access network device determines the fourth security protection mode according to the third security policy and the first security policy.

Specifically, the first access network device determines the fourth security protection mode according to the third security policy, the first security policy and the local policy, where the local policy is determined by the first access network device to be used by the first terminal device The security policy corresponding to the business.

Except that the encryption protection indicated by the third security policy does not match the encryption protection indicated by the first security policy, and/or the integrity protection indicated by the first security policy does not match the integrity protection indicated by the first security policy In other cases, the first access network device may determine the fourth security protection mode, that is, the security protection mode between the second terminal device and the first access network device.

The mismatch between the encryption protection indicated by the third security policy and the encryption protection indicated by the first security policy includes multiple possible forms. The following examples illustrate:

1. The encryption protection indicated by the third security policy is required, and the encryption protection indicated by the first security policy instruction is not needed;

2. The encryption protection indicated by the third security policy is not needed, and the encryption protection indicated by the first security policy is required.

The integrity protection indicated by the third security policy does not match the integrity protection indicated by the first security policy. There are many possible forms. The following examples illustrate:

1. The integrity protection indicated by the third security policy is required, and the integrity protection indicated by the first security policy is not needed;

2. The integrity protection indicated by the third security policy is not needed, and the integrity protection indicated by the first security policy is required.

For the situation that the encryption protection indicated by the third security policy does not match the encryption protection indicated by the first security policy, and/or the integrity protection indicated by the first security policy does not match the integrity protection indicated by the first security policy, the first An access network device sends a seventh message to the SMF network element, where the seventh message is a failure message or a PDU session release request message.

Optionally, the failure message carries a rejection reason, and the rejection reason is that the third security policy is inconsistent with the first security policy. The first access network device also sends the seventh message to the second terminal device.

It should be noted that, in addition to the above two possible implementation manners, the first access network device may also determine the fourth security protection manner only according to the first security policy, or determine the fourth security protection manner only according to the first security protection manner. Four safety protection methods to ensure that the fourth safety protection method is consistent with the first safety protection method.

309. The first access network device sends a fourth security protection mode to the second terminal device.

The fourth security protection mode is the same as the first security protection mode, and the fourth security protection mode is a security protection mode used during data communication between the second terminal device and the first access network device.

It should be noted that, after the second terminal device receives the fourth security protection mode, if the first security protection mode has not been sent to the first terminal device or the first security protection mode has not been determined before then, the second terminal device The fourth security protection mode may be used as the first security protection mode, and the first security protection mode is sent to the first terminal device. The above-mentioned step 304 may be performed after step 309, that is, the second terminal device may send the first security protection mode to the first terminal device after the establishment of the third PDU session or the modification of the second PDU session is completed.

In this embodiment, the second terminal device determines the first security protection mode and the fourth security protection mode, so as to realize the first security protection mode between the first terminal device and the second terminal device and the connection between the second terminal device and the first terminal device. A fourth security protection method is agreed between the network access devices (encryption protection is enabled or encryption protection is enabled at all, and integrity protection is enabled or integrity protection is enabled at all).

In this embodiment, the above shows the process of negotiating consensus between the first security protection mode and the fourth security protection mode. Further, optionally, the second terminal device may negotiate the encryption algorithm and the integrity algorithm corresponding to the first security protection mode and the encryption algorithm and the integrity algorithm corresponding to the fourth security protection mode.

It should be noted that the above shows the process of negotiating consensus between the first security protection mode and the fourth security protection mode on the user plane. In practical applications, on the control plane, the negotiation of the control plane security protection mode between the first terminal device and the second terminal device and the control plane protection mode between the second terminal device and the first access network device can also be implemented through this application. The negotiation method of the technical solution of the example is negotiated.

This embodiment of the present application also provides an embodiment, which is similar to the embodiment shown in FIG. 3 , except that in the embodiment shown in FIG. 3 , steps 301 to 304 are not executed, and the first step of step 305 is not executed. The request message is used to request the third security policy, that is, the first security policy is not carried in the first parameter. The third security policy is the security policy determined by the SMF network element and corresponding to the service to be used by the first terminal device. Then, the first access network device determines a fourth security protection mode according to the third security policy, and sends it to the second terminal device. The second terminal device uses the fourth security protection mode as the first security protection mode.

This embodiment of the present application further provides an embodiment, which is similar to the embodiment shown in FIG. 3, except that in step 305, the second terminal device sends the first security policy to the first access network device And/or the first security protection manner, the second terminal device sends at least one item of information among the first service information, the first DNN and the second slice information to the SMF network element. The first access network device stores the first security policy and/or the first security protection manner. In step 307, the first access network device receives the third security policy from the SMF network element; in step 308, the first terminal device according to at least one of the first security policy, the first security protection mode and the third security policy The item information determines the fourth security protection method. The specific determination method is similar in step 308 in the embodiment shown in FIG. 3 above to determine the fourth security protection method by the first terminal device. For details, please refer to the related introduction of step 308 in the embodiment shown in FIG.

Optionally, the embodiment shown in FIG. 3 further includes steps 310 to 312 . Furthermore, steps 310 to 312 and steps 301 to 309 in the aforementioned embodiment shown in FIG. 3 do not have a fixed execution order. For example, steps 310 to 312 may be performed before step 301, or may be performed between steps 301 to 309, or performed after step 309, which is not specifically limited in this application.

310. The first terminal device sends a third message to the second terminal device.

The third message carries the first protection indication. Optionally, the third message further carries at least one item of information: first service information, second DNN, and second slice information.

For a related introduction to the information carried in the third message, please refer to the related introduction in the embodiment shown in FIG. 3 , which will not be repeated here.

If the embodiment shown in FIG. 2 is the basis of this embodiment, the third message can be understood as the fifth message of step 204 in the embodiment shown in FIG. 2 .

311. The second terminal device determines a second protection indication according to the third message.

The second protection indication is used to instruct a protection mechanism to be executed during data communication between the first terminal device and the first access network device.

Specifically, the second terminal device determines which protection mechanism to execute according to the received first protection instruction, and generates a second protection instruction.

Optionally, the second terminal device determines the second protection instruction according to the first protection instruction and the local security policy determined by the second terminal device and corresponding to the service to be used by the first terminal device. For example, the second terminal device determines a protection mechanism according to at least one item of information in the first service information, the second DNN, and the second slice information, and determines which protection mechanism is the main protection mechanism together with the protection mechanism indicated by the first protection instruction , and then generate the corresponding protection indication.

312. The second terminal device sends a second protection indication to the first terminal device.

It should be noted that if the second terminal device does not receive the first protection instruction sent by the second terminal device, the second terminal device determines the local security corresponding to the service to be used by the first terminal device determined by the second terminal device. The policy determines the second protection indication, and sends the second protection indication to the first terminal device.

The above-mentioned embodiment shown in FIG. 3 shows that the second terminal device first determines the security protection mode between the first terminal device and the second terminal device according to the first security policy, and then determines the second terminal device and the first access network device. The security protection mode between the first terminal device and the second terminal device and the security protection mode between the second terminal device and the first access network device are negotiated and agreed.

In practical applications, the second terminal device may first determine a third security protection mode according to the first security policy and the fourth security policy, and use the third security protection mode as the second terminal device and the first access network device The security protection method used for data communication between them. Wherein, the fourth security policy is a security policy determined by the second terminal device corresponding to the service to be used by the first terminal device. Then, the second terminal device determines the security protection mode between the first terminal device and the second terminal device, so as to realize the security protection mode between the first terminal device and the second terminal device and the security protection mode between the second terminal device and the first terminal device. The security protection mode between access network devices is negotiated.

It should be noted that the above-mentioned embodiment shown in FIG. 3 shows a technical solution in which the first security protection mode is determined by the second terminal device. In practical applications, the first security protection mode may also be determined by the first terminal device, and the first security protection mode may be sent by the first terminal device to the second terminal device, so as to realize the connection between the first terminal device and the second terminal device. The security protection mode between them is consistent with the negotiation of the security protection mode between the second terminal device and the first access network device.

The following describes the technical solutions of the embodiments of the present application in combination with the existing interaction flow between the first terminal device, the second terminal device, and the first access network device. That is, in the existing interaction process, the negotiation of the security protection mode between the first terminal device and the second terminal device and the security protection mode between the second terminal device and the first access network device is achieved. The following description will be given in conjunction with the embodiment shown in FIG. 4 and the embodiment shown in FIG. 5 respectively.

Please refer to FIG. 4 , which is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application. In Figure 4, the method includes:

401. The second terminal device sends a broadcast message to the first terminal device.

The broadcast message carries the first parameter. For the related introduction of the first parameter, please refer to the related introduction of the first parameter in step 201 in the embodiment shown in FIG. 2 , which will not be repeated here.

The broadcast message can be understood as a possible implementation of the first message in step 202 in the embodiment shown in FIG. 2. For the understanding of the broadcast message, please refer to the first message in step 202 in the embodiment shown in FIG. 2. An introduction to the news.

402. The first terminal device selects the second terminal device according to the first parameter.

For the related introduction of step 402 and step 203 in the embodiment shown in FIG. 2, please refer to the related introduction of step 203 in the embodiment shown in FIG. 2, which will not be repeated here.

403. The first terminal device sends a communication request (communication request) message to the second terminal device.

Optionally, the communication request message also carries at least one of the following information: first protection indication, security capability of the first terminal device, first service information, second DNN, second slice information, first security policy, relay indication .

The security capability of the first terminal device refers to an encryption algorithm and an integrity protection algorithm supported by the first terminal device. The relay indication is used to instruct the second terminal device to forward data as the UE relay, or, used to indicate that the communication request message is a message sent to the UE relay. For other parameters, please refer to the related introduction of step 305 in the embodiment shown in FIG. 3 , which will not be repeated here.

Optionally, the communication request message may be understood as a specific implementation manner of the third message in the embodiment shown in FIG. 3 .

It should be noted that, the first service information, the second DNN and the second slice information may also be sent to the second terminal device in the DSM Complete message in the subsequent step 405.

404. Optionally, the second terminal device determines the second protection indication according to the communication request message.

It should be noted that step 404 is optional, and the protection mechanism between the first terminal device and the first access network device may be pre-configured or specified through a communication protocol.

Step 404 is described below in two possible cases.

1. The communication request message carries the first protection indication.

In this case, the second terminal device determines which protection mechanism to execute according to the first protection instruction, and generates the second protection instruction. Optionally, the second terminal device determines a second protection indication according to at least one item of information in the second service information, the first DNN, and the first slice information of the service supported by the second terminal device, and associates it with the first protection indication. Together the protection indications determine which protection indication is ultimately selected as the target protection indication. For example, the second protection indication is used as the finalized protection indication.

2. The communication request message does not carry the first protection indication.

In this case, the second terminal device determines the second protection indication according to at least one item of information among the second service information, the first DNN and the first slice information. Or, the communication request message carries at least one item of information among the first service information, the second DNN, and the second slice information, and the second terminal device according to the first service information, the second DNN, and the second slice information. At least one item of information determines the second protection indication.

Optionally, the communication request message may be understood as a specific implementation manner of the third message in step 310 in the embodiment shown in FIG. 3 .

After the second terminal device receives the communication request message, the second terminal device further performs the following operations:

1. The communication request message also carries the security capability of the first terminal device. The second terminal device determines the first encryption algorithm and the first integrity protection algorithm according to the security capability of the first terminal device and the security capability of the second terminal device.

The first encryption algorithm can be used for signaling communication between the first terminal device and the first access network device, and the first integrity protection algorithm can be used for the communication between the first terminal device and the first access network device. signaling communication.

2. The communication request message also carries at least one item of information among the first service information, the second DNN, and the second slice information. The second terminal device determines whether the second terminal device can provide the service for the first terminal device through the at least one item of information. If the second terminal device can provide the service, the second terminal device performs step 404; The second terminal device sends a rejection message to the first terminal device.

405. The second terminal device sends a direct security mode command (direct security mode command, DSM Command) message to the first terminal device.

Wherein, the DSM Command message carries the first encryption algorithm and the first integrity protection algorithm.

Optionally, the DSM Command message also carries a first protection indication, for the first terminal device to verify whether the first protection indication in the DSM Command message is consistent with the first protection indication in the communication request message in step 403. Specifically, the second terminal device performs integrity protection on the DSM Command message through the shared key between the first terminal device and the second terminal device.

406. The first terminal device sends a direct security mode complete (direct security mode complete, DSM Complete) message to the second terminal device.

Wherein, the DSM Complete message carries the first security policy.

The first terminal device receives the second protection instruction carried in the DSM Command message, and determines a corresponding protection mechanism according to the second protection instruction. Optionally, before the first terminal device performs step 406, the first terminal device verifies the integrity of the DSM Command message, and if the verification succeeds, the first terminal device performs step 406; if the verification fails, the first terminal device The device sends a rejection message to the second terminal device. The first terminal device can perform integrity verification on the first protection indication carried in the DSM Command message through the shared key between the first terminal device and the second terminal device.

Optionally, the first security policy may also be carried in the communication request message in step 403 . If the first security policy is carried in the communication request message in step 403, the DSM Complete message in step 406 may not carry the first security policy. If the first security policy is carried in step 403 , step 407 may be performed before step 405 .

407. The second terminal device determines the first security protection mode according to the first security policy, and uses the first security protection mode as the security protection mode used for the communication between the first terminal device and the second terminal device.

Step 407 is similar to step 302 and step 303 in the aforementioned embodiment shown in FIG. 3 . For details, please refer to the related introduction of step 302 and step 303 in the aforementioned embodiment shown in FIG. 3 , which will not be repeated here. It should be noted that, in this embodiment, the first security protection mode is an UP security protection mode between the first terminal device and the second terminal device.

408. The second terminal device determines whether the second terminal device has a second security protection mode supported by the PDU session that is consistent with the first security protection mode, and if so, executes step 409; if not, executes step 410.

Step 408 is similar to the description of the two possible situations of the first security protection mode and the second security protection mode in step 302 in the embodiment shown in FIG. 3. For details, please refer to step 302 in the embodiment shown in FIG. 3. The related introduction of the two possible situations of the first security protection mode and the second security protection mode will not be repeated here.

409. The second terminal device sends the first security protection mode to the first terminal device.

410. The second terminal device sends a first request message to the SMF network element.

411. The SMF network element determines a third security policy according to the second parameter.

412. The SMF network element sends a fourth message to the first access network device.

413. The first access network device determines a fourth security protection mode according to the third security policy.

414. The first access network device sends a fourth security protection mode to the second terminal device.

Steps 409 to 414 are similar to steps 304 to 309 in the aforementioned embodiment shown in FIG. 3 . For details, please refer to the related introductions similar to steps 304 to 309 in the aforementioned embodiment shown in FIG. 3 , which will not be repeated here. .

415. The second terminal device sends the first security protection mode to the first terminal device.

It should be noted that, step 415 may also be performed before step 410, that is, performed after the second terminal device completes the establishment of the third PDU session or after the modification of the second PDU session is completed.

In this embodiment of the present application, the first terminal device receives a broadcast message sent by the second terminal device, where the broadcast message carries the first parameter; then, the first terminal device selects the second terminal device according to the first parameter. It can be seen from this that since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the first terminal device can select the second terminal device according to the first parameter when selecting the second terminal device. A second terminal device that matches the security requirements of the first terminal device is selected, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network. And, the first terminal device sends the first security policy to the second terminal device; then, the second terminal device determines the first security protection mode according to the first security policy, and uses the first security protection mode as the first terminal The security protection mode used in the data communication between the device and the second terminal device, and then send the first security protection mode to the first terminal device. In this way, the first terminal device can determine the first security protection mode between the first terminal device and the second terminal device, and then use the first security protection mode to determine the relationship between the second terminal device and the first access network device The security protection mode of the first terminal device and the second terminal device is consistent with the security protection mode between the second terminal device and the first access network device, so as to improve the security of data transmission.

Please refer to FIG. 5 , which is a schematic diagram of another embodiment of the communication method according to the embodiment of the present application. In Figure 5, the communication method includes:

501. The second terminal device sends a broadcast message to the first terminal device.

502. The first terminal device selects the second terminal device according to the first parameter.

503. The first terminal device sends a communication request message to the second terminal device.

504. The second terminal device determines a second protection indication according to the communication request message.

505. The second terminal device sends a DSM Command message to the first terminal device.

506. The first terminal device sends a DSM Complete message to the second terminal device.

507. The second terminal device determines a first security protection mode according to the first security policy, and uses the first security protection mode as a security protection mode adopted for the communication between the first terminal device and the second terminal device.

508. The second terminal device determines whether the second terminal device has a second security protection mode supported by the PDU session that is consistent with the first security protection mode, and if so, executes step 509; if not, executes step 510.

509. The second terminal device sends the first security protection mode to the first terminal device.

Steps 501 to 509 are similar to steps 401 to 409 in the embodiment shown in FIG. 4 . For details, please refer to the related introductions of steps 401 to 409 in the embodiment shown in FIG. 4 , which will not be repeated here.

510. The second terminal device sends a third request message to the first access network device.

The third request message is similar to the first request message in step 305 in the embodiment shown in FIG. 3. For details, please refer to the relevant introduction of the first request message in step 305 in the embodiment shown in FIG. 3. I won't go into details here.

511. The first access network device sends a fourth request message to the SMF network element.

The fourth request message carries the first service information, the second DNN and the second slice information.

Specifically, in this embodiment, after receiving the third request message, the first access network device determines the first security policy, the first security protection mode, the first service information, the second DNN and the third request message carried in the third request message. Two slice information. Then, the first access network device sends a fourth request message to the SMF network element, where the fourth request message carries the first service information, the second DNN and the second slice information, but does not carry the first security policy and the first security way of protection.

512. The SMF network element determines a third security policy according to the first service information.

Specifically, the SMF network element sends at least one of the following information to the UDM network element: first service information, second DNN and second slice information. The UDM network element acquires the corresponding subscription security policy through the at least one piece of information, and sends the subscription security policy to the SMF network element. The SMF network element uses the subscription security policy as the third security policy.

513. The first access network device receives the eighth message sent by the SMF network element.

Wherein, the eighth message carries the third security policy.

514. The first access network device determines a fourth security protection mode according to the third security policy.

The third request message in step 510 also carries at least one item of information of the first security policy, the first security protection mode, and the third security policy. The first access network device determines a fourth security protection mode according to at least one item of information of the first security policy, the third security policy, the first security protection mode, and the third security policy. The specific determination method is similar to the determination method of the fourth security protection by the first access device in the embodiment shown in FIG. 3. For details, please refer to the determination of the fourth security protection by the first access device in the embodiment shown in FIG. 3. The relevant introduction of the protection method will not be repeated here.

515. The first access network device sends a fourth security protection mode to the second terminal device.

Steps 514 to 515 are similar to steps 308 to 309 in the aforementioned embodiment shown in FIG. 3 . For details, please refer to the related introductions of steps 308 to 309 in the aforementioned embodiment shown in FIG. 3 , which will not be repeated here.

516. The second terminal device sends the first security protection mode to the first terminal device.

It should be noted that, step 516 may also be performed before step 510, that is, performed after the second terminal device completes the establishment of the third PDU session or after the modification of the second PDU session is completed.

In the embodiment of the present application, the first terminal device receives a broadcast message sent by the second terminal device, and the broadcast message carries the first parameter; then, the first terminal device selects the second terminal device according to the first parameter. It can be seen from this that since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the first terminal device can select the second terminal device according to the first parameter when selecting the second terminal device. A second terminal device that matches the security requirements of the first terminal device is selected, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network. And, the first terminal device sends the first security policy to the second terminal device; then, the second terminal device determines the first security protection mode according to the first security policy, and uses the first security protection mode as the first terminal The security protection mode used in the data communication between the device and the second terminal device, and then send the first security protection mode to the first terminal device. In this way, the first terminal device can determine the first security protection mode between the first terminal device and the second terminal device, and then use the first security protection mode to determine the relationship between the second terminal device and the first access network device The security protection mode of the first terminal device and the second terminal device is consistent with the security protection mode between the second terminal device and the first access network device, so as to improve the security protection mode between the first terminal device and the second terminal device. Security of data transmission between devices in an access network.

The first terminal device provided by the embodiment of the present application is described below. Please refer to FIG. 6 , which is a schematic structural diagram of a first terminal device according to an embodiment of the present application. The first terminal device may be configured to perform the steps performed by the first terminal device in the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 , and reference may be made to the relevant descriptions in the foregoing method embodiments.

The first terminal device includes a transceiver module 601 and a processing module 602;

A transceiver module 601, configured to receive a first message, where the first message carries a first parameter, where the first parameter is used to indicate security information for communication between the second terminal device and the first access network device;

The processing module 602 is configured to select the second terminal device according to the first parameter, where the second terminal device is configured to provide a relay service for the communication between the first terminal device and the first access network device.

The first PDU session is an established PDU session on the second terminal device, the first indication information is the indication information of whether the first access network device supports the on-demand security protection mode, and the second indication information is used for To indicate that the first access network device has the ability to support integrity protection, the digital signature is generated by the second terminal device through the private key of the second terminal device or the root certificate of the second terminal device, the first The DNN supports the DNN that provides the relay service for the second terminal device, and the first slice information is information of the slice that the second terminal device supports to provide the relay service.

In another possible implementation manner, the processing module 602 is further configured to:

The processing module 602 is specifically used for:

In another possible implementation manner, the first security policy indicates that integrity protection is required or tends to be preferred; the processing module 602 is specifically configured to:

In another possible implementation manner, the first security policy indicates that encryption protection is required or tends to be preferred; the processing module 602 is specifically configured to:

In another possible implementation manner, the processing module 602 is specifically used for:

In another possible implementation manner, the transceiver module 601 is further used for:

The processing module 602 is specifically used for:

In this embodiment of the present application, the transceiver module 601 receives a first message, where the first message carries a first parameter, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device; then , the processing module 602 selects the second terminal device according to the first parameter. It can be seen from this that since the first parameter is used to indicate the security information for communication between the second terminal device and the first access network device, the processing module 602 can select the second terminal device according to the first parameter when selecting the second terminal device. A second terminal device that matches the security requirements of the first terminal device, so that a certain program can meet the security requirements corresponding to the subsequent communication between the first terminal device and the network.

The second terminal device provided by the embodiment of the present application is described below. Please refer to FIG. 7 , which is a schematic structural diagram of a second terminal device according to an embodiment of the present application. The second terminal device may be configured to perform the steps performed by the second terminal device in the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 , and reference may be made to the relevant descriptions in the foregoing method embodiments.

The second terminal device includes a processing module 701 and a transceiver module 702 .

The processing module 701 is configured to determine a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to indicate the communication between the second terminal device and the first access network device. Security Information;

The transceiver module 702 is configured to send a first message, where the first message carries the first parameter.

In another possible implementation manner, the transceiver module 702 is further configured to:

The processing module 701 is also used for:

The transceiver module 702 is also used for:

Send the first security protection mode to the first terminal device.

The processing module 701 is also used for:

Using the third security protection mode as the security protection mode adopted for data communication between the second terminal device and the first access network device;

The transceiver module 702 is also used for:

Send the third security protection mode to the first terminal device.

receiving a third message sent by the first terminal device;

The processing module 701 is also used for:

The transceiver module 702 is also used for:

Send the second protection indication to the first terminal device.

In another possible implementation manner, the processing module 701 is further used for:

The transceiver module 702 is also used for:

Send the second protection indication to the first terminal device.

In this embodiment of the present application, the processing module 701 determines a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to indicate the relationship between the second terminal device and the first access network device Security information for communication; the transceiver module 702 sends a first message, where the first message carries the first parameter. In this way, the first terminal device can determine the first security protection mode between the first terminal device and the second terminal device, and then use the first security protection mode to determine the relationship between the second terminal device and the first access network device The security protection mode is consistent with the security protection mode between the first terminal device and the second terminal device and the security protection mode between the second terminal device and the first access network device, so as to improve the security of data transmission.

The following describes the SMF network element provided by the embodiment of the present application. Please refer to FIG. 8 , which is a schematic structural diagram of an SMF network element according to an embodiment of the present application. The SMF network element may be used to perform all or part of the steps performed by the SMF network element in the embodiments shown in FIG. 3 , FIG. 4 , and FIG. 5 , and reference may be made to the relevant descriptions in the foregoing method embodiments.

The SMF network element includes a transceiver module 801 and a processing module 802 .

A transceiver module 801, configured to receive a first request message sent by a second terminal device, where the first request message is used to request to modify the second PDU session or to request the establishment of a third PDU session, and the first request message carries a third parameter , the third parameter is used to indicate the security information of the data communication between the first terminal device and the second terminal device;

A processing module 802, configured to determine a third security policy according to the third parameter, where the third security policy is a security policy corresponding to the service to be used by the first terminal device determined by the SMF network element;

The transceiver module 801 is configured to send a fourth message to the first access network device, where the fourth message carries the third security policy.

In another possible implementation manner, the processing module 802 is specifically used for:

In this embodiment of the present application, when the first security protection mode is inconsistent with the second security protection mode, or when no PDU session is established on the second terminal device, the transceiver module 801 receives the first request message sent by the second terminal device , the processing module 802 determines a third security policy according to the first request message sent by the second terminal device, and sends the third security policy to the first access network device, so that the first access network device can follow the third security policy Determine the fourth security protection mode, so that the fourth security protection mode is consistent with the first security protection mode, so as to realize the first security protection mode between the first terminal device and the second terminal device and the second terminal device and the first access The fourth security protection mode between network devices is negotiated.

The first access network device provided by the embodiment of the present application is described below. Please refer to FIG. 9 , which is a schematic structural diagram of a first access network device according to an embodiment of the present application. The first access network device may be configured to perform the steps performed by the first access network device in the embodiments shown in FIG. 3 , FIG. 4 , and FIG. 5 , and reference may be made to the relevant descriptions in the foregoing method embodiments.

The first access network device includes a transceiver module 901 and a processing module 902 .

The transceiver module 901 is configured to receive a second message sent by the SMF network element, where the second message carries a third security policy, and the third security policy is the security corresponding to the service to be used by the first terminal device determined by the SMF network element Strategy;

A processing module 902, configured to determine a fourth security protection mode according to the third security policy, where the fourth security protection mode is the security protection adopted for data communication between the second terminal device and the first access network device Way;

The transceiver module 901 is configured to send the fourth security protection mode to the second terminal device.

In a possible implementation manner, the second message also carries at least one of the following: the first security policy, the first security protection mode; the processing module 902 is specifically configured to:

A fourth security protection mode is determined according to the third security policy, the first security protection mode and the first security policy

In this embodiment of the present application, the transceiver module 901 receives a second message sent by an SMF network element, where the second message carries a third security policy, and the third security policy is a service determined by the SMF network element to be used by the first terminal device Corresponding security policy; the processing module 902 determines a fourth security protection mode according to the third security policy, where the fourth security protection mode is used for data communication between the second terminal device and the first access network device Security protection mode; the transceiver module 901 sends the fourth security protection mode to the second terminal device. The fourth security protection mode is a security protection mode used for data communication between the second terminal device and the first access network device, so that the negotiation of the first security protection mode and the fourth security protection mode is achieved.

A possible schematic structural diagram of the first terminal device is shown below through FIG. 10 .

FIG. 10 shows a schematic structural diagram of a simplified first terminal device. For ease of understanding and illustration, in FIG. 10 , the first terminal device takes a mobile phone as an example. As shown in FIG. 10 , the first terminal device includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device. The processor is mainly used to process communication protocols and communication data, control terminal equipment, execute software programs, and process data of software programs. The memory is mainly used to store software programs and data. The radio frequency circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal. Antennas are mainly used to send and receive radio frequency signals in the form of electromagnetic waves. Input and output devices, such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users. It should be noted that some types of first terminal devices may not have input and output devices.

When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit. The radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal through the antenna in the form of electromagnetic waves. When data is sent to the first terminal device, the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data. deal with. For ease of illustration, only one memory and processor are shown in FIG. 10 . In an actual end device product, there may be one or more processors and one or more memories. The memory may also be referred to as a storage medium or a storage device or the like. The memory may be set independently of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.

In this embodiment of the present application, the antenna and radio frequency circuit with a transceiver function can be regarded as a transceiver unit of the first terminal device, and the processor with a processing function can be regarded as a processing unit of the first terminal device. As shown in FIG. 10 , the first terminal device includes a transceiver unit 1010 and a processing unit 1020 . The transceiving unit may also be referred to as a transceiver, a transceiver, a transceiving device, or the like. The processing unit may also be referred to as a processor, a processing single board, a processing module, a processing device, and the like. Optionally, the device for implementing the receiving function in the transceiver unit 1010 may be regarded as a receiving unit, and the device for implementing the transmitting function in the transceiver unit 1010 may be regarded as a transmitting unit, that is, the transceiver unit 1010 includes a receiving unit and a transmitting unit. The transceiver unit may also sometimes be referred to as a transceiver, a transceiver, or a transceiver circuit. The receiving unit may also sometimes be referred to as a receiver, receiver, or receiving circuit, or the like. The transmitting unit may also sometimes be referred to as a transmitter, a transmitter, or a transmitting circuit, or the like.

It should be understood that the transceiving unit 1010 is configured to perform the sending and receiving operations of the first terminal device in the above method embodiments, and the processing unit 1020 is configured to perform other operations on the first terminal device in the above method embodiments except the transceiving operations.

For example, in a possible implementation manner, the transceiver unit 1010 is configured to perform the transceiver operation of the first terminal device in step 202 in FIG. 2 , and/or the transceiver unit 1010 is further configured to execute the first terminal device in this embodiment of the present application. other sending and receiving steps.

When the terminal device is a chip, the chip includes a transceiver unit and a processing unit. Wherein, the transceiver unit may be an input/output circuit or a communication interface; the processing unit may be a processor or a microprocessor or an integrated circuit or a logic circuit integrated on the chip.

Fig. 10 is multiplexed, and Fig. 10 may also be used to perform all or part of the steps performed by the second terminal device in the foregoing method embodiments, and reference may be made to the relevant descriptions in the foregoing method embodiments.

The present application also provides an SMF network element. Please refer to FIG. 11 , which is another schematic structural diagram of the SMF network element in the embodiment of the present application. For the steps performed by the SMF network element, reference may be made to the relevant descriptions in the foregoing method embodiments.

The SMF network element includes: a processor 1101 and a memory 1102 . Optionally, the SMF network element further includes a transceiver 1103 .

In a possible implementation manner, the processor 1101, the memory 1102 and the transceiver 1103 are respectively connected through a bus, and the memory stores computer instructions.

The processing module 802 in the foregoing embodiment may specifically be the processor 1101 in this embodiment, so the specific implementation of the processor 1101 will not be described again. The transceiver module 801 in the foregoing embodiment may specifically be the transceiver 1103 in this embodiment, so the specific implementation of the transceiver 1103 will not be described again.

The present application also provides a first access network device. Please refer to FIG. 12 , which is another schematic structural diagram of the first access network device in the embodiment of the present application. For the steps performed by the first access network device in the embodiments shown in FIG. 4 and FIG. 5 , reference may be made to the relevant descriptions in the foregoing method embodiments.

The first access network device includes: a processor 1201 and a memory 1202 . Optionally, the first access network device further includes a transceiver 1203 .

In a possible implementation manner, the processor 1201, the memory 1202 and the transceiver 1203 are respectively connected through a bus, and the memory stores computer instructions.

The processing module 902 in the foregoing embodiment may specifically be the processor 1201 in this embodiment, so the specific implementation of the processor 1201 will not be described again. The transceiver module 901 in the foregoing embodiment may specifically be the transceiver 1203 in this embodiment, so the specific implementation of the transceiver 1203 will not be described again.

Referring to FIG. 13 , an embodiment of the present application further provides a communication system, where the communication system includes a first terminal device as shown in FIG. 6 and a second terminal device as shown in FIG. 7 . The first terminal device shown in FIG. 6 is used to perform all or part of the steps performed by the first terminal device in the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 and FIG. 5 , and the second terminal device shown in FIG. 7 The device is configured to perform all or part of the steps performed by the second terminal device in the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 and FIG. 5 .

Optionally, the communication system further includes the SMF network element shown in FIG. 8 and the first access network device shown in FIG. 9 . The SMF network element shown in FIG. 8 is used to perform all or part of the steps performed by the SMF network element in the embodiments shown in FIG. 3 , FIG. 4 and FIG. 5 , and the first access network device shown in FIG. 9 is used for Perform all or part of the steps performed by the first access network device in the embodiments shown in FIG. 3 , FIG. 4 and FIG. 5 .

Embodiments of the present application also provide a computer program product including instructions, which, when executed on a computer, cause the computer to execute the communication methods of the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 .

Embodiments of the present application further provide a computer-readable storage medium, including computer instructions, when the computer instructions are executed on a computer, the computer can execute the embodiments shown in FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 . communication method.

An embodiment of the present application further provides a chip device, which includes a processor, which is connected to a memory and calls a program stored in the memory, so that the processor executes the above-mentioned steps shown in FIG. 2 , FIG. 3 , FIG. 4 , and FIG. 5 . The communication method of an embodiment.

Wherein, the processor mentioned in any of the above can be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more of the above-mentioned Fig. 2, An integrated circuit for executing the program of the communication method of the embodiment shown in FIG. 3 , FIG. 4 and FIG. 5 . The memory mentioned in any one of the above can be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM), and the like.

The term "and/or" that appears in this application can be an association relationship to describe associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, and A and B exist at the same time , there are three cases of B alone. In addition, the character "/" in this application generally indicates that the related objects are an "or" relationship.

The terms "comprising" and "having" and any variations thereof in the description and claims of this application are intended to cover non-exclusive inclusion, eg, a process, method, system, product or device comprising a series of steps or modules It is not necessary to be limited to those steps or modules expressly listed, but may include other steps or modules not expressly listed or inherent to the process, method, product or apparatus.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a removable hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk and other media that can store program codes.

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: The technical solutions described in the embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions scope of the embodiments of the present application.

Claims

A communication method, characterized in that the method comprises:

The first terminal device receives a first message, where the first message carries a first parameter, where the first parameter is used to indicate security information for communication between the second terminal device and the first access network device;

The first terminal device selects the second terminal device according to the first parameter, and the second terminal device is used to provide a medium for communication between the first terminal device and the first access network device. continue service.
The method according to claim 1, wherein the first parameter comprises at least one of the following:

The first security protection mode supported by the first protocol data unit PDU session, the type of the first access network device, the first indication information, the second indication information, the digital signature, the identifier of the second terminal device, the The network identifier ID, the first data network name DNN, or the first slice information to which the second terminal device belongs or serves;

The first PDU session is an established PDU session on the second terminal device, the first indication information is indication information of whether the first access network device supports an on-demand security protection mode, and the The second indication information is used to indicate that the first access network device has the ability to support integrity protection, and the digital signature is the second terminal device using the private key of the second terminal device or the second terminal The root certificate of the device is generated, the first DNN is the DNN that the second terminal device supports to provide relay services, and the first slice information is the information of the slice that the second terminal device supports to provide relay services .
The method according to claim 2, wherein before the first terminal device selects the second terminal device according to the first parameter, the method further comprises:

determining, by the first terminal device, a first security policy, where the first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device;

The first terminal device selects the second terminal device according to the first parameter, including:

The first terminal device selects the second terminal device according to the first security policy and the first parameter.
The method according to claim 3, wherein the first security policy indicates that integrity protection is required or tends to be preferred; the first terminal device is based on the first security policy and the first The parameter selection of the second terminal device includes:

If the first parameter includes a first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the first terminal device selects the second terminal device;

or,

If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the capability to support enabling integrity protection, the the first terminal device selects the second terminal device;

or,

If the first parameter includes the first indication information, and the first indication information indicates that the first access network device supports the on-demand protection mode, the first terminal device selects the second terminal device ;

or,

If the first parameter includes the second indication information, the first terminal device selects the second terminal device.
The method according to claim 3, wherein the first security policy indicates that encryption protection is required or is inclined to be preferred; the first terminal device is based on the first security policy and the first The parameter selection of the second terminal device includes:

If the first parameter includes a first security protection mode supported by the first PDU session, and the first security protection mode is to enable encryption protection, the first terminal device selects the second terminal device.
The method according to claim 3, wherein the first terminal device selects the second terminal device according to the first security policy and the first parameter, comprising:

If the first security policy is consistent with the second security policy, the first terminal device selects the second terminal device, and the second security policy is the first DNN and/or the first security policy The security policy associated with the slice information.
The method according to claim 1, wherein the method further comprises:

the first terminal device receives a second message, where the second message carries a second parameter, and the second parameter is used to indicate security information for communication between the third terminal device and the second access network device;

The first terminal device selects the second terminal device according to the first parameter, including:

The first terminal device selects the second terminal device according to the first parameter and the second parameter.
The method according to claim 7, wherein the selecting, by the first terminal device, the second terminal device according to the first parameter and the second parameter comprises:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the second parameter includes the second security protection mode supported by the second PDU session , and the second security protection mode is not to enable integrity protection, then the first terminal device selects the second terminal device, and the first PDU session is an established PDU session on the second terminal device , the second PDU session is an established PDU session on the third terminal device;

or,

If the first parameter includes the first indication information and the first indication information indicates that the first access network device supports an on-demand protection mode, the second parameter includes third indication information and the third indication information The indication information indicates that the second access network device does not support the on-demand protection mode, and the first terminal device selects the second terminal device.
The method according to any one of claims 1 to 8, wherein the method further comprises:

The first terminal device sends a second message to the second terminal device, where the second message carries the first security policy.
The method according to any one of claims 1 to 8, wherein the method further comprises:

The first terminal device sends a third message to the second terminal device, where the third message carries any one of the following: first service information, first protection indication, second DNN, and second slice information, the The first service information is service information corresponding to a service to be used by the first terminal device, and the first protection indication is used to indicate that the first terminal device desired by the first terminal device and the first access The protection mechanism implemented during data communication between network devices;

The first terminal device receives a second protection indication sent by the second terminal device, where the second protection indication is used to indicate that when data communication is performed between the first terminal device and the first access network device Implemented protection mechanisms.
A communication method, characterized in that the method comprises:

The second terminal device determines a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to instruct the second terminal device to communicate with the first access network device safety information;

The second terminal device sends a first message, where the first message carries the first parameter.
The method according to claim 11, wherein the first parameter comprises at least one of the following:

The first security protection mode supported by the first protocol data unit PDU session, the type of the first access network device, the first indication information, the second indication information, the digital signature, the identifier of the second terminal device, the The network identifier ID, the first data network name DNN, or the first slice information to which the second terminal device belongs or serves;

The first PDU session is an established PDU session on the second terminal device, the first indication information is indication information that the first access network device supports an on-demand security protection mode, and the first The second indication information is used to indicate that the first access network device has the ability to support integrity protection, and the digital signature is the second terminal device using the private key of the second terminal device or the second terminal device. The first DNN is the DNN that the second terminal device supports to provide the relay service, and the first slice information is the information of the slice that the second terminal device supports to provide the relay service.
The method according to claim 11 or 12, wherein the method further comprises:

The second terminal device receives a second message sent by the first terminal device, where the second message carries a first security policy, and the first security policy is the first terminal determined by the first terminal device The security policy corresponding to the service that the device will use;

determining, by the second terminal device, a first security protection mode according to the first security policy;

The second terminal device uses the first security protection mode as a security protection mode adopted for data communication between the first terminal device and the second terminal device;

The second terminal device sends the first security protection mode to the first terminal device.
The method according to claim 11 or 12, wherein the method further comprises:

The second terminal device receives a second message sent by the first terminal device, where the second message carries a first security policy, and the first security policy is the first terminal determined by the first terminal device The security policy corresponding to the service that the device will use;

The second terminal device determines a third security protection mode according to the first security policy and the second security policy, where the second security policy is a service determined by the second terminal device to be used by the first terminal device the corresponding security policy;

The second terminal device uses the third security protection mode as a security protection mode used for data communication between the second terminal device and the first access network device;

The second terminal device sends the third security protection mode to the first terminal device.
The method according to claim 13, wherein the first security protection mode is consistent with a second security protection mode, and the second security protection mode is the second terminal device and the first access network The security protection mode supported by the established second PDU session between devices.
The method according to claim 15, wherein the first security protection mode is consistent with the second security protection mode, comprising:

If the first security policy indicates that encryption protection is required, and the second security protection mode supported by the second PDU session is to enable encryption protection, the second terminal device converts the first security protection mode supported by the second PDU session to 2. The safety protection method is used as the first safety protection method;

or,

If the first security policy indicates that integrity protection is required, and the second security protection mode supported by the second PDU session is to enable integrity protection, the second terminal device supports the second PDU session The second security protection mode is used as the first security protection mode;

or,

If the first security policy indicates that encryption protection is not needed, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device sends the second PDU session to the The supported second security protection mode is used as the first security protection mode;

or,

If the first security policy indicates that integrity protection is not needed, and the second security protection mode supported by the second PDU session is not to enable integrity protection, the second terminal device will The second security protection mode supported by the PDU session is used as the first security protection mode;

or,

If the first security policy indicates that encryption protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode;

or,

If the first security policy indicates that integrity protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode.
The method of claim 13, wherein the method further comprises:

If the first security protection mode is inconsistent with the second security protection mode, the second terminal device sends a first request message to the session management function SMF network element;

The first request message is used to request to modify the second PDU session or to request to establish a third PDU session, the first request message carries a third parameter, and the third parameter is used to indicate the first terminal Security information for data communication between the device and the second terminal device, where the second security protection mode is the established second PDU session between the second terminal device and the first access network device Supported security protection methods;

The second terminal device receives a fourth security protection mode sent by the first access network device, where the fourth security protection mode is used for communication between the second terminal device and the first access network device. The security protection mode adopted for data communication, the fourth security protection mode is consistent with the first security protection mode.
The method according to claim 17, wherein the first security protection mode is inconsistent with the second security protection mode, comprising:

If the first security policy indicates that encryption protection is likely to be preferred, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device determines the first security policy The corresponding first security protection mode is inconsistent with the second security protection mode;

or,

If the first security policy indicates that integrity protection is likely to be preferred, and the second security protection mode is not to enable integrity protection, the second terminal device determines that the first security policy corresponds to the The first security protection mode is inconsistent with the second security protection mode;

or,

If the encryption protection of the second security protection mode does not match the encryption protection indicated by the first security policy and the integrity protection of the second security protection mode does not match the integrity protection of the first security policy , the second terminal device determines that the first security protection mode corresponding to the first security policy is inconsistent with the second security protection mode.
The method according to claim 17 or 18, wherein the third parameter includes at least one of the following:

the first service information, the second DNN, the second slice information, the first security policy, and the first security protection mode;

The first service information is service information corresponding to the service to be used by the first terminal device, the second DNN is the DNN to be accessed by the first terminal device, and the second slice information is the information about the slice to be accessed by the first terminal device.
The method according to any one of claims 13 to 19, wherein the method further comprises:

receiving, by the second terminal device, a third message sent by the first terminal device;

Wherein, the third message carries at least one of the following information: first service information, second DNN, second slice information and first protection indication, and the first service information is a service to be used by the first terminal device Corresponding service information, the second DNN is the DNN to be accessed by the first terminal device, the second slice information is the information of the slice to be accessed by the first terminal device, and the first protection indication a protection mechanism for instructing the first terminal device to perform data communication between the first terminal device and the first access network device expected by the first terminal device;

The method also includes:

The second terminal device determines a second protection indication according to the third message, where the second protection indication is used to instruct the first terminal device to perform data communication with the first access network device. protection mechanism;

The second terminal device sends the second protection indication to the first terminal device.
The method according to any one of claims 13 to 19, wherein the method further comprises:

If the second terminal device does not receive the protection indication sent by the first terminal device, the second terminal device determines a second protection indication, where the second protection indication is used to instruct the first terminal device to communicate with the Describe the protection mechanism performed during data communication between the first access network devices;

The second terminal device sends the second protection indication to the first terminal device.
A first terminal device, characterized in that the first terminal device comprises:

a transceiver module, configured to receive a first message, where the first message carries a first parameter, and the first parameter is used to indicate security information for communication between the second terminal device and the first access network device;

a processing module, configured to select the second terminal device according to the first parameter, and the second terminal device is configured to provide a relay for communication between the first terminal device and the first access network device Serve.
The first terminal device according to claim 22, wherein the first parameter includes at least one of the following:

The first security protection mode supported by the first protocol data unit PDU session, the type of the first access network device, the first indication information, the second indication information, the digital signature, the identifier of the second terminal device, the The network identifier ID, the first data network name DNN, or the first slice information to which the second terminal device belongs or serves;

The first PDU session is an established PDU session on the second terminal device, the first indication information is indication information of whether the first access network device supports an on-demand security protection mode, and the The second indication information is used to indicate that the first access network device has the ability to support integrity protection, and the digital signature is the second terminal device using the private key of the second terminal device or the second terminal The root certificate of the device is generated, the first DNN is the DNN that the second terminal device supports to provide relay services, and the first slice information is the information of the slice that the second terminal device supports to provide relay services .
The first terminal device according to claim 23, wherein the processing module is further configured to:

determining a first security policy, where the first security policy is a security policy determined by the first terminal device and corresponding to a service to be used by the first terminal device;

The processing module is specifically used for:

The second terminal device is selected according to the first security policy and the first parameter.
The first terminal device according to claim 24, wherein the first security policy indicates that integrity protection is required or tends to be preferred; and the processing module is specifically configured to:

If the first parameter includes a first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, selecting the second terminal device;

or,

If the first parameter includes the type of the first access network device, and the type of the first access network device indicates that the first access network device has the ability to support enabling integrity protection, select the the second terminal device;

or,

If the first parameter includes the first indication information, and the first indication information indicates that the first access network device supports an on-demand protection mode, selecting the second terminal device;

or,

If the first parameter includes the second indication information, the second terminal device is selected.
The first terminal device according to claim 24, wherein the first security policy indicates that encryption protection is required or tends to be preferred; and the processing module is specifically configured to:

If the first parameter includes a first security protection mode supported by the first PDU session, and the first security protection mode is to enable encryption protection, the second terminal device is selected.
The first terminal device according to claim 24, wherein the processing module is specifically configured to:

If the first security policy is consistent with the second security policy, the second terminal device is selected, and the second security policy is the security policy associated with the first DNN and/or the first slice information .
The first terminal device according to claim 22, wherein the transceiver module is further configured to:

receiving a second message, where the second message carries a second parameter, where the second parameter is used to indicate the security information of the communication between the third terminal device and the second access network device;

The processing module is specifically used for:

The second terminal device is selected according to the first parameter and the second parameter.
The first terminal device according to claim 28, wherein the processing module is specifically configured to:

If the first parameter includes the first security protection mode supported by the first PDU session, and the first security protection mode is to enable integrity protection, the second parameter includes the second security protection mode supported by the second PDU session , and the second security protection mode is not to enable integrity protection, select the second terminal device, the first PDU session is an established PDU session on the second terminal device, and the second PDU The session is an established PDU session on the third terminal device;

or,

If the first parameter includes the first indication information and the first indication information indicates that the first access network device supports an on-demand protection mode, the second parameter includes third indication information and the third indication information The indication information indicates that the second access network device does not support the on-demand protection mode, and the second terminal device is selected.
The first terminal device according to any one of claims 22 to 29, wherein the transceiver module is further configured to:

Send a second message to the second terminal device, where the second message carries the first security policy.
The first terminal device according to any one of claims 22 to 29, wherein the transceiver module is further configured to:

Send a third message to the second terminal device, where the third message carries any of the following: first service information, first protection indication, second DNN, and second slice information, where the first service information is all the service information corresponding to the service to be used by the first terminal device, and the first protection indication is used to indicate that the first terminal device expects data to be performed between the first terminal device and the first access network device the protection mechanisms implemented when communicating;

A second protection indication sent by the second terminal device is received, where the second protection indication is used to indicate a protection mechanism executed during data communication between the first terminal device and the first access network device.
A second terminal device, characterized in that the second terminal device comprises:

A processing module, configured to determine a first parameter, wherein the second terminal device supports the function of providing a relay service, and the first parameter is used to instruct the second terminal device to perform communication between the second terminal device and the first access network device security information for communications;

A transceiver module, configured to send a first message, where the first message carries the first parameter.
The second terminal device according to claim 32, wherein the first parameter comprises at least one of the following:

The first security protection mode supported by the first protocol data unit PDU session, the type of the first access network device, the first indication information, the second indication information, the digital signature, the identifier of the second terminal device, the The network identifier ID, the first data network name DNN, or the first slice information to which the second terminal device belongs or serves;

The first PDU session is an established PDU session on the second terminal device, the first indication information is indication information that the first access network device supports an on-demand security protection mode, and the first The second indication information is used to indicate that the first access network device has the ability to support integrity protection, and the digital signature is the second terminal device using the private key of the second terminal device or the second terminal device. The first DNN is the DNN that the second terminal device supports to provide the relay service, and the first slice information is the information of the slice that the second terminal device supports to provide the relay service.
The second terminal device according to claim 32 or 33, wherein the transceiver module is further configured to:

Receive a second message sent by the first terminal device, where the second message carries a first security policy, where the first security policy corresponds to a service determined by the first terminal device to be used by the first terminal device security policy;

The processing module is also used for:

determining a first security protection mode according to the first security policy;

using the first security protection mode as the security protection mode adopted for the data communication between the first terminal device and the second terminal device;

The transceiver module is also used for:

Send the first security protection mode to the first terminal device.
The second terminal device according to claim 32 or 33, wherein the transceiver module is further configured to:

Receive a second message sent by the first terminal device, where the second message carries a first security policy, where the first security policy corresponds to a service determined by the first terminal device to be used by the first terminal device security policy;

The processing module is also used for:

Determine a third security protection mode according to the first security policy and the second security policy, where the second security policy is a security policy determined by the second terminal device corresponding to the service to be used by the first terminal device;

using the third security protection mode as the security protection mode adopted for the data communication between the second terminal device and the first access network device;

The transceiver module is also used for:

Send the third security protection mode to the first terminal device.
The second terminal device according to claim 34, wherein the first security protection mode is consistent with a second security protection mode, and the second security protection mode is the second terminal device and the first security protection mode. The security protection mode supported by the established second PDU session between the access network devices.
The second terminal device according to claim 36, wherein the first security protection mode is consistent with the second security protection mode, comprising:

If the first security policy indicates that encryption protection is required, and the second security protection mode supported by the second PDU session is to enable encryption protection, the second terminal device converts the first security protection mode supported by the second PDU session to 2. The safety protection method is used as the first safety protection method;

or,

If the first security policy indicates that integrity protection is required, and the second security protection mode supported by the second PDU session is to enable integrity protection, the second terminal device supports the second PDU session The second security protection mode is used as the first security protection mode;

or,

If the first security policy indicates that encryption protection is not needed, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device sends the second PDU session to the The supported second security protection mode is used as the first security protection mode;

or,

If the first security policy indicates that integrity protection is not needed, and the second security protection mode supported by the second PDU session is not to enable integrity protection, the second terminal device will The second security protection mode supported by the PDU session is used as the first security protection mode;

or,

If the first security policy indicates that encryption protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode;

or,

If the first security policy indicates that integrity protection tends to be preferred, the second terminal device uses the second security protection mode supported by the second PDU session as the first security protection mode.
The second terminal device according to claim 34, wherein the transceiver module is further configured to:

If the first security protection mode is inconsistent with the second security protection mode, send a first request message to the SMF network element;

The first request message is used to request to modify the second PDU session or to request to establish a third PDU session, the first request message carries a third parameter, and the third parameter is used to indicate the first terminal Security information for data communication between the device and the second terminal device, where the second security protection mode is the established second PDU session between the second terminal device and the first access network device Supported security protection methods;

Receive a fourth security protection mode sent by the first access network device, where the fourth security protection mode is used for security adopted in data communication between the second terminal device and the first access network device protection mode, the fourth security protection mode is consistent with the first security protection mode.
The second terminal device according to claim 38, wherein the first security protection mode is inconsistent with the second security protection mode, comprising:

If the first security policy indicates that encryption protection is likely to be preferred, and the second security protection mode supported by the second PDU session is not to enable encryption protection, the second terminal device determines the first security policy The corresponding first security protection mode is inconsistent with the second security protection mode;

or,

If the first security policy indicates that integrity protection is likely to be preferred, and the second security protection mode is not to enable integrity protection, the second terminal device determines that the first security policy corresponds to the The first security protection mode is inconsistent with the second security protection mode;

or,

If the encryption protection of the second security protection mode does not match the encryption protection indicated by the first security policy and the integrity protection of the second security protection mode does not match the integrity protection of the first security policy , the second terminal device determines that the first security protection mode corresponding to the first security policy is inconsistent with the second security protection mode.
The second terminal device according to claim 38 or 39, wherein the third parameter includes at least one of the following:

the first service information, the second DNN, the second slice information, the first security policy, and the first security protection mode;

The first service information is service information corresponding to the service to be used by the first terminal device, the second DNN is the DNN to be accessed by the first terminal device, and the second slice information is the information about the slice to be accessed by the first terminal device.
The second terminal device according to any one of claims 34 to 40, wherein the transceiver module is also used for:

receiving a third message sent by the first terminal device;

Wherein, the third message carries at least one of the following information: first service information, second DNN, second slice information and first protection indication, and the first service information is a service to be used by the first terminal device Corresponding service information, the second DNN is the DNN to be accessed by the first terminal device, the second slice information is the information of the slice to be accessed by the first terminal device, and the first protection indication a protection mechanism for instructing the first terminal device to perform data communication between the first terminal device and the first access network device expected by the first terminal device;

The processing module is also used for:

determining a second protection indication according to the third message, where the second protection indication is used to indicate a protection mechanism to be executed during data communication between the first terminal device and the first access network device;

The transceiver module is also used for:

Sending the second protection indication to the first terminal device.
The second terminal device according to any one of claims 34 to 40, wherein the processing module is further configured to:

If the second terminal device does not receive the protection indication sent by the first terminal device, determine a second protection indication, where the second protection indication is used to instruct the first terminal device to communicate with the first access network Protection mechanisms implemented during data communication between devices;

The transceiver module is also used for:

Sending the second protection indication to the first terminal device.