WO2022027696A1 - 一种安全信息的配置方法和装置 - Google Patents

一种安全信息的配置方法和装置 Download PDF

Info

Publication number
WO2022027696A1
WO2022027696A1 PCT/CN2020/108022 CN2020108022W WO2022027696A1 WO 2022027696 A1 WO2022027696 A1 WO 2022027696A1 CN 2020108022 W CN2020108022 W CN 2020108022W WO 2022027696 A1 WO2022027696 A1 WO 2022027696A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
security information
protection
function
multicast group
Prior art date
Application number
PCT/CN2020/108022
Other languages
English (en)
French (fr)
Inventor
张博
邓娟
贾建鑫
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2020/108022 priority Critical patent/WO2022027696A1/zh
Priority to CN202080104217.0A priority patent/CN116134841A/zh
Priority to EP20947824.7A priority patent/EP4187937A4/en
Publication of WO2022027696A1 publication Critical patent/WO2022027696A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/106—Packet or message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H04W12/76—Group identity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/06—Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a method and device for configuring security information.
  • the fifth generation (5G) network introduces user plane security information for user plane protection.
  • the security information may include both confidentiality protection and integrity protection properties.
  • the implementation method can be as follows: a session management function (session management function, SMF) determines the security information and sends it to a radio access network (radio access network, RAN).
  • the RAN can determine the protection requirements for confidentiality protection and integrity protection based on the security information.
  • the fifth generation (5G) multicast-broadcast service (MBS) architecture is proposed in the 3rd Generation Partnership Project (3GPP) research project report, although under this architecture, the RAN can
  • the data under 5G MBS is transmitted in multicast or unicast mode, but the multicast mode cannot perform data protection at the packet data convergence protocol (PDCP) layer like the unicast mode, and the multicast mode requires a higher layer of User plane data protection, such as end-to-end (E2E) protection between terminal equipment and application function (AF) network elements, or end-to-end (5g core network, 5GC) protection between terminal equipment and 5G core network (5GC) ) between E2E protection.
  • E2E end-to-end
  • AF application function
  • 5g core network, 5GC 5g core network
  • 5GC 5G core network
  • the UE establishes a connection with the multimedia broadcast multicast service center (BM-SC).
  • the BM-SC can issue the key of the broadcast multicast data through the hypertext transfer protocol (http) protocol.
  • http hypertext transfer protocol
  • the key issuance process in LTE cannot be fully applied to the 5G MBS architecture. This is because in the 5G MBS architecture, the functions of BM-SC have been split into multiple network entities in 5G, such as session management function (SMF) and policy control function (PCF) Wait. Therefore, how to reuse the configuration process of 5GC and complete the configuration of security information on the terminal device and the network side under the 5G MBS architecture is an urgent problem to be solved.
  • SMF session management function
  • PCF policy control function
  • the embodiments of the present application provide a method and apparatus for configuring security information, which can realize the configuration of security information on the terminal device and the network side under the 5G MBS architecture, and ensure the security of user plane data under the 5G MBS architecture.
  • a method for configuring security information is provided, the method is applied to a system including a multicast-broadcast service MBS architecture, the system includes a first network function network element and a second network function network element, and the method includes: a first A network function network element receives the identifier of the multicast group, and determines the security information corresponding to the identifier of the multicast group.
  • the security information is used for encryption protection and/or integrity protection of the user plane data of the multicast group. key and encryption algorithm, and/or, integrity protection key and integrity protection algorithm; the first network function network element sends security information to the second network function network element, and the second network function network element includes users of the multicast service function One of a plane function (e.g.
  • the MSF-U network element
  • a control plane function e.g. MSF-C
  • MSF-C control plane function
  • a network opening function e.g. NEF
  • a session management function e.g. SMF
  • the first network function network element may include a unified data repository (eg UDR) network element, a network opening function (eg NEF), a session management function (eg SMF) or a control plane function (eg, a multicast service function) MSF-C) one or more of the network elements.
  • UDR unified data repository
  • NEF network opening function
  • SMF session management function
  • MSF-C multicast service function
  • the configuration of security information can be completed through the network elements in the 5G system to ensure the security of user plane data under the 5G MBS architecture.
  • the UDR network element may determine the security information corresponding to the identifier of the multicast group according to the security policy. Therefore, when the UE requests the network side to obtain the security information, it can obtain the security information from the UDR network element on the network side, so as to decrypt the user plane data of the MBS according to the security information.
  • the security information further includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • the security information also includes a protection mode; receiving the identifier of the multicast group, and determining the security information corresponding to the identifier of the multicast group includes: receiving the control plane function from the network open function network element or the multicast service function The identification and security policy of the multicast group of the network element; the protection method is determined according to the security policy; or, the identification and protection method of the multicast group received from the network open function network element or the control plane function network element of the multicast service function; according to The protection method generates security information.
  • the network element in the MBS can generate security information according to the received security policy, or generate security information according to the received protection mode, so that the network element on the network side can protect the user plane data of the MBS according to the security information.
  • the UDR network element receives the identifier and security policy of the multicast group from the NEF network element or the MSF-C network element, the UDR network element determines the protection mode according to the security policy, and then generates security information according to the protection mode.
  • the UDR network element receives the identification and protection method of the multicast group from the NEF network element or the MSF-C network element, and the UDR network element generates security information according to the protection method.
  • sending the security information to the second network function network element includes: sending the security information to the network open function network element or the control plane function network element of the multicast service function. That is, after the network element on the network side generates the security information, the security information can be sent to other network elements for storage.
  • the UDR network element sends the security information to the NEF network element or the MSF-C network element for storage. In this way, when the UE requests the security information, the network side network element can obtain the multicast group from the NEF network element or the MSF-C network element. The identity of the corresponding security information.
  • the first network function network element includes a unified data storage library (eg UDR) network element; after generating the security information according to the protection mode, the method further includes: the unified data storage library network element determines the security information Correspondence with the identifier of the multicast group; receiving the identifier of the multicast group, and determining the security information corresponding to the identifier of the multicast group also includes: the unified data repository network element receives the request message from the session management function network element, and the request message Including the identifier of the multicast group; the unified data storage network element determines the security information corresponding to the identifier of the multicast group according to the corresponding relationship; sending the security information to the second network function network element includes: the unified data storage network element to the session management The functional network element sends security information.
  • UDR unified data storage library
  • the unified database network element stores the corresponding relationship between the identifier of the multicast group and the security information. If a request message from the UE is subsequently received to request the security information corresponding to the identifier of the multicast group, the unified database network element may respond to the security information to the UE through the second network function network element according to the corresponding relationship. For example, the UDR network element stores the corresponding relationship. When the UDR network element receives the request message sent by the SMF network element, the UDR network element sends the security information to the SMF network element, so that the SMF network element sends the security information to the UE.
  • the corresponding relationship stored in the unified database network element may be generated and saved by itself, or may be a corresponding relationship received from other network elements such as the network open function network element or the control plane function network element of the multicast service function.
  • the first network function network element includes a network open function network element or a control plane function network element of a multicast service function, and the security information also includes a protection method; the identifier of the multicast group is received, and the multicast group is determined.
  • the corresponding security information of the identifier includes: the network opening function network element or the control plane function network element of the multicast service function receives the identifier and security policy of the multicast group from the application function network element; the network opening function network element or the multicast service function The network element of the control plane function determines the protection method according to the security policy; the network element of the network opening function or the network element of the control plane function of the multicast service function generates security information according to the protection method; sending the security information to the network element of the second network function includes: The functional network element or the control plane functional network element of the multicast service function sends security information to the unified data repository network element.
  • the security information configured on the network side can be generated by the network open function network element or the control plane function network element of the multicast service function, and the generated security information and the identifier of the multicast group are sent to the unified data repository
  • the network element is saved.
  • the NEF network element or the MSF-C network element receives the identifier and security policy of the multicast group sent by the AF network element, and the NEF network element or the MSF-C network element determines the security information according to the security policy, and the NEF network element or the MSF-C network element determines the security information according to the security policy.
  • the C network element sends the security information to the UDR network element for storage. In this way, when the UE requests the security information, the network element on the network side can obtain the security information corresponding to the identifier of the multicast group from the UDR network element and issue it to the UE.
  • generating the security information according to the protection mode includes: if the protection mode instructs to perform encryption protection on the user plane data, generating an encryption key and an encryption algorithm; if the protection mode instructs to perform integrity protection on the user plane data, Then an integrity protection key and an integrity protection algorithm are generated. If the protection mode indicates not to perform encryption protection on user plane data and not to perform integrity protection on user plane data, the network element on the network side can also generate encryption keys, encryption algorithms, integrity protection keys and integrity protection algorithms, but the encryption algorithm and the integrity protection algorithm are both null algorithms.
  • the first network function network element includes a network open function network element or a control plane function network element of a multicast service function; after receiving the identifier of the multicast group, the security information corresponding to the identifier of the multicast group is determined to include: : The network opening function network element or the control plane function network element of the multicast service function receives the identification and security policy of the multicast group from the application function network element; the network opening function network element or the control plane function network element of the multicast service function sends the The unified data repository network element sends the security policy and the identifier of the multicast group. The unified data repository network element can generate security information according to the received security policy. The unified data repository network element then combines the security information with the multicast group.
  • the identity of the network open function network element or the control plane function network element of the multicast service function is sent to the network open function network element or the control plane function network element of the multicast service function;
  • the repository network element sends the protection method and the identifier of the multicast group;
  • the unified data repository network element can generate security information according to the received protection method, and the unified data repository network element then sends the security information and the identifier of the multicast group
  • the network opening function network element or the control plane function network element of the multicast service function that is, the network opening function network element or the control plane function network element of the multicast service function, receives the security information from the unified data repository network element.
  • the network element of the network opening function or the control plane function of the multicast service function when it receives the security policy, it can send the security policy to the unified data storage network element, so that the unified data storage network element can
  • the security policy generates security information and feeds it back to the network open function network element or the control plane function network element of the multicast service function.
  • the network opening function network element or the control plane function network element of the multicast service function may first generate the protection mode according to the security policy, and send the protection mode to the unified data storage network element, so that the unified data storage network element
  • the security information is generated according to the protection mode and fed back to the network open function network element or the control plane function network element of the multicast service function.
  • the NEF network element or the MSF-C network element when it receives the identifier and security policy of the multicast group, it can send the identifier and security policy of the multicast group to the UDR network element. After the UDR network element generates the security information according to the security policy Feedback to NEF network element or MSF-C network element. Alternatively, the NEF network element or the MSF-C network element may first generate the protection mode according to the security policy, and send the protection mode to the UDR network element, so that the UDR network element generates the security information according to the protection mode and feeds it back to the NEF network element or the MSF-C network element. C network element.
  • sending the security information to the second network function network element includes: sending the security information to the user plane function network element or the session management function network element of the multicast service function.
  • the NEF network element or the MSF-C network element when the NEF network element or the MSF-C network element receives the identification and security information of the multicast group from the UDR network element, the NEF network element can also send the identification and security information of the multicast group to the SMF network element.
  • the UE when the UE obtains the security information, it can obtain the security information from the SMF network element; or, the MSF-C network element can also send the security information to the MSF-U network element, and when the UE obtains the security information, it can obtain the security information from the MSF-U network element Obtain safety information.
  • a method for configuring security information is provided, the method is applied to a terminal device, where the network where the terminal device is located includes a session management function network element, the method includes: sending a multicast group identifier to the session management function network element to Request to join a multicast group; receive security information from the session management function network element, the security information is used for encryption protection and/or integrity protection of the user plane data of the multicast group, the security information includes encryption keys and encryption algorithms, and /or, the integrity protection key and integrity protection algorithm, the security information also includes the security policy and/or protection method of the user plane data; the security policy indicates the protection requirements of the user plane data, the protection requirements include encryption protection requirements, and/or , integrity protection requirements; the protection mode indicates whether to perform encryption protection on the user plane data, and/or whether to perform integrity protection on the user plane data; decrypt the received user plane data according to the security information.
  • the terminal device may be a UE.
  • the security information is configured in the 5G MBS
  • the UE can request the session management function (such as SMF) network element to obtain the security information.
  • the session management function such as SMF
  • the session management function network element saves the security information
  • the security information can be directly delivered to the UE; if the network element of the session management function does not save the security information corresponding to the identifier of the multicast group, the network element of the session management function can obtain the security information from other networks.
  • Element such as a unified data repository network element, requests to obtain security information and then sends it to the UE.
  • the UE can also decrypt the data according to the security information obtained by the request, which ensures the user plane data in the MBS architecture. safety.
  • a method for configuring security information is provided.
  • the method is applied to a system including a multicast-broadcast service MBS architecture.
  • the system includes a unified data repository network element, a network open function network element, and a multicast service function. Control plane functional network elements, session management functional network elements, and terminal equipment.
  • the unified data repository network element receives the identification and security policy of the multicast group from the network open function network element or the control plane function network element of the multicast service function; the unified data repository network element is based on the The security policy determines the protection method; the unified data repository network element generates security information according to the protection method;
  • the network opening function network element or the control plane function network element of the multicast service function receives the identification and security policy of the multicast group, and the network opening function network element or the control plane function network element of the multicast service function determines the protection method according to the security policy , the network opening function network element or the control plane function network element of the multicast service function sends the identification and protection mode of the multicast group to the unified data storage network element, and the unified data storage network element generates security information according to the protection method.
  • the unified data repository network element may send the security information and the identifier of the multicast group to the network opening function network element or the control plane function network element of the multicast service function.
  • the security information may also include a protection method.
  • the unified data repository network element can determine the correspondence between the security information and the identity of the multicast group.
  • the request message includes the identifier of the multicast group; the unified data repository network element can determine the security information corresponding to the identifier of the multicast group according to the corresponding relationship , the unified data repository network element sends security information to the session management function network element.
  • the network open function network element or the control plane function network element of the multicast service function receives the identification and security policy of the multicast group from the application function network element, and the network open function network element or the multicast service function
  • the control plane function network element of the network determines the protection method according to the security policy
  • the network open function network element or the control plane function network element of the multicast service function generates security information according to the protection method, the network open function network element or the control plane function of the multicast service function.
  • the network element sends security information to the unified data repository network element;
  • the network opening function network element or the control plane function network element of the multicast service function receives the identification and security policy of the multicast group from the application function network element, the network opening function network element or the control plane function network element of the multicast service function.
  • Send the security policy and multicast group identifier to the unified data storage network element the unified data storage network element can generate security information according to the received security policy, and the unified data storage network element then sends the security information to the multicast group.
  • the identifier of the group is sent to the network open function network element or the control plane function network element of the multicast service function.
  • the network open function network element can also send security information to the session management function network element.
  • the control plane function network element of the multicast service function also can send security information to the user plane function network elements of the multicast service function;
  • the network opening function network element or the control plane function network element of the multicast service function receives the identification and security policy of the multicast group from the application function network element, the network opening function network element or the control plane function network element of the multicast service function. It is also possible to first generate the protection method according to the security policy, and send the protection method to the unified data storage network element, so that the unified data storage network element generates security information according to the protection method and then feeds it back to the network open function network element or multicast service.
  • Functional control plane functional network element may also send security information to the session management function network element, and the control plane function network element of the multicast service function may also send security information to the user plane function network element of the multicast service function.
  • the terminal device may send the identifier of the multicast group to the session management function network element to request to join the multicast group.
  • the session management function network element saves the security information corresponding to the identifier of the multicast group, it can directly deliver the security information to the terminal device; if the session management function network element does not save the security information corresponding to the identifier of the multicast group, the session The management function network element may request to obtain security information from other network elements, such as a unified data storage network element, and then deliver it to the terminal device.
  • the security policy indicates the protection requirements of user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements; the protection mode indicates whether to perform encryption protection on user plane data, and/or whether to perform encryption protection on user plane data. Integrity protection.
  • the network element on the network side that receives the security information can protect the user plane data according to the security information, or can also protect the user plane data according to the security policy or the protection method.
  • a method for configuring security information is provided, the method is applied to a system including a multicast-broadcast service MBS architecture, and the system includes a unified data repository network element, a network opening function network element, and a session management function network element .
  • the unified data repository network element can receive the identification and security policy of the multicast group from the network open function network element, the unified data repository network element determines the protection method according to the security policy, and generates security information according to the protection method.
  • the unified data repository network element sends the security information to the network open function network element.
  • the unified data repository network element can also determine the correspondence between the security information and the identifier of the multicast group.
  • the unified data repository network element receives a request message from the session management function network element, the request message includes the identifier of the multicast group.
  • the unified data storage network element can determine the security information corresponding to the identifier of the multicast group according to the corresponding relationship, and the unified data storage network element sends the security information to the session management function network element.
  • the network opening function network element receives the identification and security policy of the multicast group from the application function network element, the network opening function network element determines the protection method according to the security policy, and the network opening function network element generates security information according to the protection method.
  • the network open function network element can also send security information to the unified data repository network element.
  • the network opening function network element may also send security information to the session management function network element.
  • the network opening function network element receives the identification and security policy of the multicast group from the application function network element, the network opening function network element determines the protection method according to the security policy, and the network opening function network element sends the protection method to the unified data storage network element.
  • the unified data storage network element can generate security information according to the received protection method, and the unified data storage network element then sends the security information and the identification of the multicast group to the network open function network element .
  • the network opening function network element may also send security information to the session management function network element.
  • the security information further includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • a fifth aspect provides a method for configuring security information, which is applied to a system including a multicast-broadcast service MBS architecture, the system including a control plane function network element of the multicast service function and a user plane function of the multicast service function network element.
  • the control plane function network element of the multicast service function receives the identification and security policy of the multicast group from the application function network element, and the control plane function network element of the multicast service function can send the multicast group information to the unified data repository network element. Identification and security policy, so that the unified data repository network element can determine security information according to the security policy; or, the control plane function network element of the multicast service function can send the identification and protection method of the multicast group to the unified data repository network element , so that the unified data repository network element can determine the security information according to the protection method.
  • the network element of the control plane function of the multicast service function may also determine the protection method according to the security policy, generate security information according to the protection method, and send the identifier and security information of the multicast group to the network element of the user plane function of the multicast service function, So that the user plane function network element of the multicast service function can protect the data according to the security information.
  • control plane function network element of the multicast service function may also receive the identification and security information of the multicast group.
  • the network element of the control plane function of the multicast service function can also send the identification and security information of the multicast group to the network element of the user plane function of the multicast service function, so that the network element of the user plane function of the multicast service function can perform data processing according to the security information.
  • the security information further includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • a method for configuring security information is provided.
  • the method is applied to a system including a multicast-broadcast service MBS architecture, and the system includes a unified data repository network element and a session management function network element.
  • the unified data storage network element When the unified data storage network element receives the identifier and security policy of the multicast group, it can determine the security information according to the identifier and security policy of the multicast group and send it to the network element with the session management function.
  • the security information can be determined according to the identification and protection mode of the multicast group and then sent to the network element with the session management function.
  • the unified data repository network element can determine the correspondence between the security information and the identity of the multicast group.
  • the unified data repository network element receives the request message from the session management function network element, and the request message includes the identifier of the multicast group, the unified data repository network element can determine the security information corresponding to the identifier of the multicast group according to the corresponding relationship , and send security information to the session management function network element.
  • the security information further includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • a seventh aspect provides a network function network element, the network function network element is a first network function network element, and the first network function network element is applied to a multicast-broadcast service architecture system, the system includes the first network function network element and The second network function network element, the first network function network element includes: a transceiver for receiving the identifier of the multicast group; a processor for determining the security information corresponding to the identifier of the multicast group, and the security information is used for the multicast group.
  • the user plane data of the group is encrypted and/or integrity protected, and the security information includes an encryption key and an encryption algorithm, and/or an integrity protection key and an integrity protection algorithm; the transceiver is also used to send data to the second network
  • the functional network element sends the security information, and the second network functional network element includes one of the user plane function network element of the multicast service function, the control plane function network element of the multicast service function, the network open function network element or the session management function network element or more.
  • the security information further includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • the security information further includes a protection method; a transceiver for receiving the identification and security policy of the multicast group from the network open function network element or the control plane function network element of the multicast service function, and the processor , used to determine the protection method according to the security policy; or, the transceiver, used for the identification and protection method of the multicast group from the network open function network element or the control plane function network element of the multicast service function; the processor, used for according to the The protection method generates security information.
  • the transceiver is configured to send security information to the network open function network element or the control plane function network element of the multicast service function.
  • the first network function network element includes a unified data storage library network element; the processor is further configured to determine the correspondence between the security information and the identifier of the multicast group; the transceiver is further configured to receive data from a request message from the session management function network element, the request message includes the identifier of the multicast group; the processor is further configured to determine the security information corresponding to the identifier of the multicast group according to the corresponding relationship; the transceiver is further configured to send the session management function network element Send secure messages.
  • the first network function network element includes a network open function network element or a control plane function network element with a multicast service function
  • the security information also includes a protection method
  • the transceiver is used for receiving data from the application function network element.
  • the identifier and security policy of the multicast group the processor is used to determine the protection mode according to the security policy; the processor is used to generate security information according to the protection mode; the transceiver is used to send the security information to the unified data repository network element .
  • the processor is configured to: if the protection mode indicates to perform encryption protection on the user plane data, generate an encryption key and an encryption algorithm; if the protection mode indicates to perform integrity protection on the user plane data, generate Integrity Protection Key and Integrity Protection Algorithm.
  • the first network function network element includes a network open function network element or a control plane function network element of a multicast service function; a transceiver, configured to receive an identifier of the multicast group from the application function network element and security policy; a transceiver, used to send the security policy and the identifier of the multicast group to the unified data storage network element; or, a processor, used to determine the protection mode according to the security policy, and the transceiver, used to send the unified data storage
  • the library network element sends the protection mode and the identifier of the multicast group; the transceiver is used to receive the security information from the unified data storage library network element.
  • the transceiver is configured to: send the security information to the user plane function network element or the session management function network element of the multicast service function.
  • a terminal device where the network where the terminal device is located includes a session management function network element, and the terminal device includes: a transceiver configured to send an identifier of a multicast group to the session management function network element to request to join the multicast group
  • the transceiver is also used to receive the security information from the network element of the session management function, the security information is used for encryption protection and/or integrity protection of the user plane data of the multicast group, and the security information includes encryption keys and encryption algorithms, And/or, the integrity protection key and integrity protection algorithm, the security information also includes the security policy and/or protection method of the user plane data;
  • the security policy indicates the protection requirements of the user plane data, and the protection requirements include encryption protection requirements, and/or Or, integrity protection requirements;
  • the protection method indicates whether to perform encryption protection on the user plane data, and/or whether to perform integrity protection on the user plane data;
  • the processor is used to perform the received user plane data according to the security information. decrypt.
  • an embodiment of the present application provides a computer-readable storage medium, including computer instructions, when the computer instructions are executed on an electronic device, the electronic device is made to perform the first aspect and any one of the possible possibilities of the first aspect.
  • the configuration method of the security information in the implementation is not limited to:
  • an embodiment of the present application provides a computer-readable storage medium, including computer instructions, when the computer instructions are executed on an electronic device, the electronic device is made to execute the method for configuring security information in the second possible implementation manner. .
  • an embodiment of the present application provides a computer program product, which, when the computer program product runs on a computer, enables an electronic device to perform the security in the first aspect and any possible implementation manner of the first aspect. How to configure the information.
  • an embodiment of the present application provides a computer program product that, when the computer program product runs on a computer, enables an electronic device to execute the method for configuring security information in the possible implementation manner of the second aspect.
  • FIG. 1 is a schematic diagram of the basic architecture of a 5G MBS provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of the basic architecture of a 5G MBS provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of the basic architecture of a 5G MBS provided by an embodiment of the present application.
  • FIG. 4 is a schematic main flow diagram of a user plane security policy configuration provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application
  • FIG. 6 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 12 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of a method for configuring security information according to an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a network function network element provided by an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a network function network element according to an embodiment of the present application.
  • the embodiments of the present application can be applied to the 5G MBS architecture, how to configure security information on the network side equipment, so that the terminal equipment joining the multicast broadcast service can decrypt the user plane data according to the security information, and improve the security of the user plane data under the 5G MBS architecture.
  • An architecture 1 of 5G MBS can be shown in Figure 1, which is based on the existing 5G network architecture and functional enhancement of some network function (NF) network elements in the 5G network architecture.
  • the architecture 1 may include: an AF network element, a network exposure function (NEF) network element, a Policy Control Function (PCF) network element, a session management function (SMF) network element, a user A user plane function (UPF) network element, a next generation-radio access network (NG-RAN) network element, and a terminal device (for example, user equipment (UE)), etc. in:
  • the AF network element can be the source of multicast and/or broadcast data, call the MBS provided by the 5G system, and send multicast and/or multicast data to multiple UEs through 5G.
  • the NEF network element can realize the 5G open function; communicate with the AF network element. AF network elements can access some functional network elements in the 5G network through NEF network elements. In addition, the NEF network element can also negotiate 5G MBS with the AF network element. The content of the negotiation includes quality of service (QoS) and 5G MBS service domain.
  • QoS quality of service
  • 5G MBS service domain The content of the negotiation includes quality of service (QoS) and 5G MBS service domain.
  • the PCF network element can support 5G MBS; provide MBS session related policy messages to the SMF network element; directly or indirectly (through NEF) receive MBS service information from the AF network element;
  • the SMF network element can control the MBS transmission based on the MBS policy received from the PCF network element; configure the MBS flow and point-to-point or point-to-multipoint transmission on the UPF network element; configure the MBS flow and QoS information on the RAN network element; Configure session management for MBS flow on the UE.
  • UPF network element supports packet filtering of MBS flow, and can transmit MBS flow to RAN network element in a point-to-point or point-to-multipoint manner; receive MBS configuration from SMF network element; check the Internet group management protocol , IGMP) packet, and notify the SMF network element of the IGMP packet; receive AF's unicast or multicast flow, etc.
  • IGMP Internet group management protocol
  • the NG-RAN network element can receive the MBS stream sent by the UPF network element, switch and transmit the MBS stream in multicast and unicast, etc.
  • UE can support MBS policy configuration; support session management of MBS flow; support joining MBS flow; support MBS of the access layer and so on.
  • the AF network element can use the MBS provided by the 5G system through the MSF network element.
  • the MSF network element may request the MBS through the NEF network element or the PCF network element.
  • the MSF network element can be used as the entry point of control plane signaling and user plane data.
  • the MSF network element may include an MSF control plane function (MSF control plane, MSF-C) network element and an MSF network element user plane function (MSF iser plane, MSF-U) network element.
  • MSF control plane function MSF control plane, MSF-C
  • MSF MSF network element user plane function
  • MSF-U MSF network element
  • the MSF-C network element is used for signaling processing and receiving signaling, for example, for multicast service configuration and MBS bearer activation.
  • the MSF-U network element is used for user plane data transmission and user plane data encoding.
  • FIG. 3 Another 5G MBS architecture 3 can be shown in Figure 3.
  • This architecture 3 introduces a new NF on the existing 5G system architecture, and enhances the functions of the existing UE and NG-RAN network elements to support 5G MBS.
  • This architecture 3 can include:
  • the AMF network element after enhancement of UE, NG-RAN and access and mobility management function (AMF) can be called M-AMF network element;
  • Multicast broadcast session management function multicast/broadcast session management function, MB-SMF
  • multicast broadcast user plane function multicast/broadcast user plane function, MB-UPF
  • MB-SMF can be used for MBS session management, etc.
  • MB-UPF can be used for transmitting multicast and broadcast data
  • the MB-SMF network element here is equivalent to the MSF-C network element mentioned in this application.
  • Multicast and broadcast service function (multicast/broadcast service function, MBSF) network element, used to process signaling and provide interfaces to AF;
  • the multicast/broadcast service user plane function (MBSU) network element can be used to transmit multicast and broadcast data, etc.
  • the MBSU network element is equivalent to the MSF-U network element mentioned in this application.
  • the 5G network introduces a user plane security policy configuration process for user plane protection, this process does not support the negotiation mechanism of security information in 5G MBS for the above architectures 1, 2 and 3.
  • the UE sends a non-access stratum (non-access stratum, NAS) message to the AMF network element, and the message may include a network slice identifier (single network slice selection). assistance information, S-NSSAI), data network name (data network name, DNN) and other parameters;
  • NAS non-access stratum
  • the AMF network element sends a request to create an SMF network element context (creat SMF context request) or a request to update the SMF network element context (update SMF context request) to the SMF network element.
  • the request can carry a subscription permanent identifier (SUPI) , S-NSSAI and DNN, etc.
  • the SMF network element determines the user plane security policy, and the specific manner may include: the SMF network element sends a request to a unified data management function (unified data management, UDM) network element, and the request carries SUPI, DNN and/or S-NSSAI, So that the UDM network element determines the subscribed user plane security policy according to the DNN and/or the S-NSSAI, and sends the subscribed user plane security policy to the SMF network element.
  • UDM unified data management function
  • UDM unified data management function
  • S-NSSAI subscribed user plane security policy
  • the SMF network element may also locally store the configured user plane security policy. If the SMF network element obtains the subscribed user plane security policy from the UDM network element, the subscribed user plane security policy is used as the final user plane security policy; The security policy of the plane is used as the final security policy of the user plane.
  • the user plane security policy here includes the requirements for confidentiality protection and integrity protection. in:
  • Confidentiality protection needs can include:
  • Integrity protection requirements can include:
  • the SMF network element sends the user plane security policy to the base station through the AMF network element.
  • the base station determines the protection method of the end user plane according to the local capability (for example, whether the integrity protection rate is supported, etc.).
  • the base station must perform protection, and if it cannot be implemented, it sends a rejection indication to the SMF network element.
  • the protection mode is optional, and the base station decides whether to perform protection.
  • the base station does not perform protection.
  • the protection here includes confidentiality protection and integrity protection.
  • the base station sends a confidentiality protection indication and/or an integrity protection indication, where the confidentiality protection indication is used to indicate whether confidentiality protection is required, and the integrity protection indication is used to indicate whether integrity protection is required.
  • the UE performs subsequent user plane data protection according to the confidentiality protection instruction and/or the integrity protection instruction.
  • an embodiment of the present application provides a method for configuring security information, and the method can be applied to the foregoing architecture 1 or architecture 2 or architecture 3.
  • the user plane data distribution process may be as follows: after the UPF receives the user plane data that needs to be distributed from the AF network element, the UPF network element sends the user plane data to the corresponding RAN node (base station); Then the RAN node sends the user plane data to the UE.
  • a service layer is introduced.
  • the service layer includes MSF-C network elements and MSF-U network elements.
  • MSF-C network elements mainly process control plane data; MSF-U network elements It mainly deals with user plane data.
  • the delivery process of the user plane data can be as follows: after the MSF-U network element receives the user plane data from the AF network element, it first sends the user plane data to the UPF network element, and then the UPF network element sends the user plane data to the corresponding base station; then the base station sends the user plane data to the corresponding base station; Broadcast user plane data to the corresponding UE.
  • one method may include: Network element for storing data: Unified Data Repository (UDR) network element, which can store data of multiple network elements, such as NEF network element, PCF network element, SMF network element and AMF network element and other network element data. Therefore, in this application, the UDR network element can obtain the identifier of the multicast group, determine the security information corresponding to the identifier of the multicast group, and save the security information.
  • the security information is used for encryption protection and/or integrity protection of the user plane data of the multicast group, and the security information includes encryption keys and encryption algorithms, and/or integrity protection keys and integrity protection algorithms.
  • the UDR network element can determine the corresponding security information according to the identifier of the multicast group, and can also receive other network elements, for example, receive and save the security information determined by the NEF network element or the MSF-C network element according to the identifier of the multicast group.
  • another method for configuring security information may include: the NEF network element or the MSF-C network element receives the identifier and security policy of the multicast group sent by the AF network element, and the NEF network element or the MSF-C network element according to the security policy Determine the security information, and then send the security information to the UDR network element.
  • the NEF network element or the MSF-C network element receives the identifier and security policy of the multicast group sent by the AF network element, and sends the identifier and security policy of the multicast group to the UDR, or sends the NEF network element or the MSF network element to the UDR network element.
  • the C network element determines the protection mode and multicast group identifier according to the security policy. After the UDR network element determines the security information, the NEF network element or the MSF-C network element receives the security information sent by the UDR network element.
  • the UE When the UE joins the multicast group, it can request security information from a core network element, such as an SMF network element, and the SMF network element can obtain the security information from the UDR network element and send it to the UE.
  • a core network element such as an SMF network element
  • the SMF network element can obtain the security information from the UDR network element and send it to the UE.
  • the UE receives the user plane data sent downlink, it can decrypt the user plane data according to the security information.
  • An embodiment of the present application provides a method for configuring security information.
  • the method can be applied to a system including an MBS.
  • the system includes a first network function network element and a second network function network element.
  • the method may include:
  • the first network function network element receives the identifier of the multicast group, and determines the security information corresponding to the identifier of the multicast group.
  • the security information is used for encryption protection and/or integrity protection of user plane data of the multicast group, and the security information includes encryption.
  • the key and encryption algorithm, and/or, the integrity protection key and the integrity protection algorithm; wherein, the identifier of the multicast group may also be replaced by the identifier of the broadcast group. That is, the present application can be applied to protect the user plane data of the multicast service, and can also be applied to protect the user plane data of the broadcast service.
  • the first network function network element sends security information to the second network function network element
  • the second network function network element includes a user plane function network element of the multicast service function, a control plane function network element of the multicast service function, and a network open function network element. element or one or more of the session management function network elements.
  • the first network function network element may include one or more of a unified data repository network element, a network opening function network element, and a control plane function network element of the multicast service function.
  • These first network function network elements and second network function network elements are network elements under the 5G MBS architecture. Therefore, the security information configuration method provided in the embodiment of the present application can be applied to the user plane data under the 5G MBS architecture. Protect.
  • the security information may further include security policies and/or protection methods of user plane data
  • the security policy indicates the protection requirements of user plane data, and the protection requirements include encryption protection requirements and/or integrity protection requirements;
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • the unified data repository network element can receive the identification and security policy of the multicast group from the network open function network element or the control plane function network element of the multicast service function, and the unified data repository network element can receive the security policy according to the security policy.
  • the protection mode is determined; or, the unified data repository network element directly receives the identification and protection mode of the multicast group from the network open function network element or the control plane function network element of the multicast service function. Further, the unified data repository network element generates security information according to the protection method.
  • sending the security information to the second network function network element includes sending the security information to the network open function network element or the control plane function network element of the multicast service function.
  • the unified data storage network element can send the security information to the network open function network element or the control plane function network element of the multicast service function, and the network open function network element or the multicast service function network element can send the security information.
  • the functional control plane of the functional network element stores security information. Subsequently, if the terminal device requests the security information, the security information may be obtained from the network opening function network element or the control plane function network element of the multicast service function.
  • the first network function network element includes a unified data repository network element; after generating the security information according to the protection mode, the method further includes: the unified data repository network element determines the security information and the identifier of the multicast group corresponding relationship. That is to say, the corresponding relationship is stored by the unified data repository network element.
  • the above-mentioned receiving the identifier of the multicast group, and determining the security information corresponding to the identifier of the multicast group may further include:
  • the unified data repository network element receives the request message from the session management function network element, and the request message includes the identifier of the multicast group; the unified data repository network element determines the security information corresponding to the identifier of the multicast group according to the corresponding relationship. Therefore, the above-mentioned sending the security information to the second network function network element may include: the unified data repository network element sends the security information to the session management function network element.
  • the session management function network element can obtain the security information from the unified data storage network element and deliver it to the terminal device.
  • the corresponding relationship stored in the network element of the unified data repository can also be obtained in other ways, such as the implementations described in the following embodiments.
  • the first network function network element includes a network open function network element or a control plane function network element of a multicast service function
  • the security information further includes a protection mode.
  • the above-mentioned receiving the identifier of the multicast group, and determining the security information corresponding to the identifier of the multicast group may include: the network opening function network element or the control plane function network element of the multicast service function receives the identifier of the multicast group from the application function network element and Security policy; the network opening function network element or the control plane function network element of the multicast service function determines the protection method according to the security policy; the network opening function network element or the control plane function network element of the multicast service function generates security information according to the protection method. Therefore, the above-mentioned sending the security information to the second network function network element may include: the network opening function network element or the control plane function network element of the multicast service function sends the security information to the unified data repository network element.
  • generating the security information according to the protection mode may include: if the protection mode indicates to perform encryption protection on the user plane data, generating an encryption key and an encryption algorithm; if the protection mode indicates to perform integrity protection on the user plane data, Then an integrity protection key and an integrity protection algorithm are generated.
  • the first network function network element comprises a network openness function network element or a multicast service function control plane function network element.
  • the above-mentioned receiving the identifier of the multicast group, and determining the security information corresponding to the identifier of the multicast group includes: the network opening function network element or the control plane function network element of the multicast service function receives the identifier and security information of the multicast group from the application function network element. Strategy.
  • the network opening function network element or the control plane function network element of the multicast service function sends the security policy and the identifier of the multicast group to the unified data repository network element, and the unified data repository network element generates security information according to the security policy; or, The network open function network element or the control plane function network element of the multicast service function determines the protection method according to the security policy, and sends the protection method and the identifier of the multicast group to the unified data storage network element. way to generate a security policy.
  • the network opening function network element or the control plane function network element of the multicast service function can receive security information from the unified data repository network element.
  • sending the security information to the second network function network element includes sending the security information to the user plane function network element or the session management function network element of the multicast service function.
  • the network opening function network element may send security information to the session management function network element, and the session management function network element stores the correspondence between the security information and the identifier of the multicast group.
  • the network element of the control plane function of the multicast service function may send the security information to the network element of the user plane function of the multicast service function, and the network element of the user plane function of the multicast service function saves the correspondence between the security information and the identifier of the multicast group. relation.
  • the terminal device when the terminal device joins the multicast service corresponding to the identifier of the multicast group, it can obtain the security information from the network function network element on the network side, so that according to the security information, the terminal device can obtain the security information from the network side
  • the received user plane data is decrypted.
  • an embodiment of the present application also provides a method for configuring security information, the method is applied to a terminal device, and the network where the terminal device is located includes a session management function network element, the method may include: sending a multicast group to the session management function network element to request to join the multicast group; receive the security information from the network element of the session management function, the security information is used for encryption protection and/or integrity protection of the user plane data of the multicast group, and the security information includes the encryption key and Encryption algorithm, and/or integrity protection key and integrity protection algorithm, the security information also includes the security policy and/or protection method of user plane data; the security policy indicates the protection requirements of user plane data, and the protection requirements include encryption protection requirements , and/or, integrity protection requirements; protection mode indicates whether to perform encryption protection on user plane data, and/or whether to perform integrity protection on user plane data; decrypt the received user plane data according to the security information.
  • the terminal device can decrypt the ciphertext issued by the network side according to the requested security information to obtain the decrypted user plane data.
  • the unified data repository network element is the UDR network element
  • the network opening function network element is the NEF network element
  • the user plane function network element of the multicast service function is the MSF-U network element
  • the multicast service function network element is the MSF-U network element.
  • the control plane function network element is an MSF-C network element
  • the session management function network element is an SMF network element as an example for description.
  • an embodiment of the present application provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the NEF network element.
  • the identifier of the multicast group may be a multicast group ID (identity), or the identifier of the multicast group may be replaced by a multicast context identifier (multicast context ID).
  • the identifier of the multicast group may be used to identify the multicast service, and may also be referred to as a multicast identifier or a multicast service identifier.
  • the following embodiments all take the identifier of the multicast group as an example for description.
  • the broadcast service is similar to the multicast service, for example, the identifier of the multicast group here can also be replaced with the identifier of the broadcast group.
  • the identifier of the multicast group may include an IP multicast address
  • the identifier of the multicast group may also include information used to identify the application or service, such as the identifier of the application or service, or the identifier of the network where the application or service is located, or the identifier of the access network. Point ID, or access network ID, or ID of the data network where the AF is located, etc.
  • the multicast group identity may include a temporary mobile group identity (temporary mobile group identity, TMGI).
  • the AF network element may also send a security policy to the NEF network element.
  • the security policy indicates the protection requirement of the user plane data of the multicast group, or in other words, the security policy is used to identify the protection requirement corresponding to the identifier of the multicast group.
  • the protection requirements may include encryption protection requirements, and/or integrity protection requirements.
  • the cryptographic protection requirements may include, for example, the above-mentioned required, preferred, or not needed. Integrity protection requirements may also include, for example, required, preferred or not needed as mentioned above.
  • Encryption protection can be understood as encrypting data through an encryption algorithm and an encryption key to obtain an encrypted ciphertext.
  • the device that receives the data can use the decryption key and the decryption algorithm to decrypt the ciphertext to obtain the data.
  • Integrity protection can be understood as performing integrity protection on data through an integrity protection algorithm and an integrity protection key, and outputting integrity protection verification parameters.
  • the device that receives the data and the integrity protection verification parameters can verify the data and the integrity protection verification parameters through the integrity protection verification key and the integrity protection algorithm to verify the integrity of the data. If it is deleted or added, the data will not pass the verification.
  • the AF network element may send the identification and security policy of the multicast group to the NEF network element through a multicast session request message.
  • the NEF network element determines security information according to the identifier of the multicast group.
  • the NEF network element determines the protection method according to the identity of the multicast group and the security policy.
  • the NEF network element may first determine whether to authorize to provide the service for the identity of the multicast group.
  • the NEF network element can determine whether to provide services for the identification of the multicast group according to the local policy of the NEF network element;
  • the NEF network element can send the identifier of the multicast group to other network elements (such as the UDM network element, the UDR network element, the PCF network element or the MSF-C network element, etc.) to obtain the corresponding identification of the multicast group from other network elements.
  • the NEF network element determines whether to authorize to provide services for the identity of the multicast group according to the subscription data.
  • the subscription data may further include a security policy corresponding to the multicast group identifier.
  • the NEF network element can send the identifier of the multicast group to other network elements (such as UDM network element, UDR network element, PCF network element or MSF-C network element, etc.) After determining whether to provide the service for the identity of the multicast group, an indication is sent to the NEF network element to indicate whether it is authorized to provide the service for the identity of the multicast group.
  • network elements such as UDM network element, UDR network element, PCF network element or MSF-C network element, etc.
  • the NEF network element may continue to determine the protection mode according to the security policy corresponding to the identifier of the multicast group.
  • the protection mode indicates whether encryption protection is performed on user plane data, and/or whether integrity protection is performed on user plane data.
  • the security policy here can also be obtained from the AF network element, or obtained from the above request from other network elements, or the security policy can be determined according to the identifier of the multicast group and the local policy.
  • the NEF network element determines the protection mode and instructs to perform encryption protection on user plane data. However, if the capability of the NEF network element does not support performing encryption protection, the NEF network element sends a notification to the AF network element to notify the AF network element that the encryption protection cannot be performed, and reject the multicast session establishment request of the AF network element.
  • the NEF network element can determine whether to enable encryption protection for user plane data or disable encryption protection for user plane data according to local policies. If the NEF network element determines to enable the encryption protection for the user plane data, the protection mode is determined to indicate that the encryption protection is performed on the user plane data; if the NEF network element determines that the encryption protection for the user plane data is disabled, the protection mode is determined to indicate that the user plane data is not to be encrypted and protected. Encryption protection is performed. Optionally, the NEF network element sends a notification to the AF network element to notify the AF whether encryption protection is enabled.
  • the NEF network element determines the protection mode and indicates that encryption protection is not performed on user plane data.
  • the processing of the integrity protection requirement for the security policy is similar to the processing of the encryption protection requirement, and will not be repeated one by one.
  • the NEF network element can continue to generate security information according to the protection mode.
  • the security information is used for encryption protection and/or integrity protection of user plane data of the multicast group, and the security information includes encryption key k1 and encryption algorithm a1, and/or integrity protection key k2 and the integrity protection algorithm a2.
  • the NEF network element determines k1 and a1; if the protection mode indicates that encryption protection is not performed on the user plane data, the NEF network element does not need to determine k1 and a1;
  • the NEF network element determines k2 and a2; if the protection mode indicates that integrity protection is not performed on the user plane data, the NEF network element does not need to determine k2 and a2.
  • the NEF network element may generate k1 and k2 in multiple manners according to the protection manner.
  • the NEF network element can directly generate k1 and k2 according to the protection method, or the NEF network element can also request other network elements to generate k1 and k2 according to the protection method and return them to the NEF network element, which is not limited in this application.
  • the NEF network element may generate a1 and a2 in multiple ways according to the protection mode.
  • the NEF network element can directly generate a1 and a2 according to the protection method, or the NEF network element can also request other network elements to generate a1 and a2 according to the protection method and return them to the NEF network element, which is not limited in this application.
  • a1 may be a null algorithm
  • a2 may be a null algorithm.
  • the NEF network element may also generate a1, a2, k1, and k2, but both a1 and a2 are null algorithms .
  • the NEF network element may also select the SMF, and the selection manner of the SMF is not limited.
  • the SMF here may be an SMF functional network element dedicated to multicast or broadcast services.
  • the NEF network element sends the identifier and security information of the multicast group to the UDR network element.
  • the security information sent in step 503 includes the above-mentioned a1, a2, k1 and k2;
  • the security information sent in step 503 may include the above k1 and a1, but not include k2 and/or a2, even if k2 or a2 are included, k2 and a2 are empty;
  • the security information sent in step 503 may include the above k2 and a2, but not include k1 and/or a1, k1 and a1 are empty even if k1 or a2 are included.
  • the security information may also include protection methods.
  • the security information may also include security policies.
  • the security information may further include an SMF ID, where the SMF ID is the ID of the SMF selected by the NEF network element.
  • the NEF network element may send the identification and security information of the multicast group to the UDR network element or other NF network elements through a multicast session request message. The following steps are described by taking the UDR network element receiving the multicast session request message as an example.
  • the UDR network element determines and saves the correspondence between the security information and the identifier of the multicast group.
  • the UDR network element when the security information received by the UDR network element further includes the ID of the SMF, the UDR network element may also store the ID of the SMF. The UDR network element may also send a multicast session response (multicast session response) message to the NEF network element to indicate that the security information and the identity of the multicast group are received.
  • multicast session response multicast session response
  • the NEF network element sends the identification and security information of the multicast group to the SMF network element.
  • the NEF network element may send the identification and security information of the multicast group through a multicast distribution request message.
  • the NEF network element may also send a policy authorization request to the PCF network element, and the PCF network element sends a policy authorization response to the NEF network element.
  • the SMF network element determines and saves the correspondence between the security information and the identifier of the multicast group.
  • the SMF network element when the SMF network element receives the corresponding relationship, it can send a multicast configuration session response (multicast distribution session response) message to the NEF network element, and the message may also carry the ingress address (ingress address) of the UPF network element.
  • multicast configuration session response multicast distribution session response
  • the NEF network element may also send a multicast session response message to the AF network element, where the message may carry the ingress address of the NEF network element, and may also carry a protection method.
  • the AF network element can save the protection mode. If the AF network element determines that the protection mode needs to be updated, the security policy may also be adjusted according to the protection mode, and the method process of this embodiment may be re-initiated according to the adjusted security policy.
  • the SMF network element may also send an MBS policy negotiation request (policy association request) message to the PCF network element, and the PCF network element then sends an MBS policy negotiation response (MBS policy association response) message to the SMF network element.
  • MBS policy negotiation request policy association request
  • MBS policy negotiation response MBS policy association response
  • the SMF network element sends the corresponding relationship between the security information and the identifier of the multicast group to the UPF network element.
  • the SMF network element may send the corresponding relationship to the UPF network element through a session request message, and accordingly, the UPF network element may feed back a session response (session response) message to the SMF network element to indicate the reception to the corresponding relationship.
  • the session response here may include the entry address of the UPF network element.
  • the UPF network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • the UPF network element Since the AF network element directly sends the user plane data to the UPF network element when the subsequent AF network element sends the downlink user plane data, when the UPF network element stores the security information, the UPF network element can determine the security information according to the security information. How to encrypt and protect user plane data. Then, the UPF network element may send the user plane data protected by encryption and integrity to the UE through the RAN network element.
  • the UPF network element performs encryption protection on the received user plane data according to k1 and a1;
  • the UPF network element performs integrity protection on the received user plane data according to k2 and a2;
  • the security information does not include k1 and a1, or the protection mode indicates that the user plane data does not need to be encrypted and protected; the UPF network element does not perform encryption protection on the received user plane data;
  • the security information does not include the k2 and a2 methods, or the protection mode indicates that integrity protection of the user plane data is not required; the UPF network element does not perform integrity protection on the user plane data;
  • the UPF network element performs encryption protection on user plane data according to k1; if the security information includes k2 and k2 is not an empty algorithm, the UPF network element performs encryption protection on the user plane data according to k2 face data integrity protection;
  • the UPF network element does not perform encryption protection on the user plane data; if the security information includes k2 and k2 is an empty algorithm, the UPF network element does not perform integrity protection on the user plane data.
  • the UPF network element if the protection mode indicates that encryption protection or integrity protection needs to be performed, and the UPF network element does not currently support enabling encryption protection, the UPF network element sends a reject message to the SMF network element.
  • the SMF network element may reject the establishment of the multicast session and send a rejection message to the NEF network element, and the NEF network element may send a reject message to the AF network element, the rejection message indicating rejection of the establishment of the multicast session.
  • the SMF network element may re-select the UPF network element, and execute from step 507 again.
  • the UE may request the security information from the SMF network element through the RAN network element and the AMF network element, or the UE may request the security information through the RAN network element.
  • the UPF network element requests the security information from the SMF network element. If the SMF network element saves the above corresponding relationship, it can send the security information to the UE.
  • the PCF network element requests the security information and sends it to the UE, so that the UE can decrypt the received user plane data according to the security information.
  • the NEF network element is not sure of the protection mode, and the NEF network element sends the algorithm and key to the UDR network element after determining the algorithm and key from other network elements.
  • the NEF network element can also send the security policy to the SMF network element, and the SMF network element can determine the protection method according to the security policy, or the SMF network element sends the security policy to the UPF network element, and the UPF network element determines the protection method and sends it to the SMF network element Yuan.
  • the SMF network element can also send the protection method to the NEF network element, and then the NEF network element saves the protection method in the UDR network element.
  • the advantage of the above method is that whether to enable encryption protection or integrity protection is determined by the UPF network element that finally performs encryption protection and integrity protection.
  • the above-mentioned security information configuration process does not require processing actions of security policies and protection methods, and only includes NEF network elements determining encryption keys and encryption algorithms, integrity protection keys and integrity protection algorithms, and subsequent encryption keys. Storage and delivery actions for keys and encryption algorithms.
  • the method flow provided by the embodiment of the present application can be applied to the configuration flow of the security information under the 5G MBS service.
  • the above embodiments mainly describe that the security information is determined by the NEF network element and stored in the UDR network element.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the NEF network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the NEF network element.
  • step 601 For the implementation of step 601, reference may be made to the implementation of step 501 above.
  • the NEF network element sends the identifier of the multicast group to the UDR network element.
  • the NEF network element may also send the security policy to the UDR network element.
  • the UDR network element determines a protection mode corresponding to the identifier of the multicast group according to the security policy, and generates security information corresponding to the identifier of the multicast group according to the protection mode.
  • the security policy in step 603 may be received by the UDR network element from other network elements (eg, NEF network element), or may be locally determined by the UDR network element according to the identifier of the multicast group.
  • other network elements eg, NEF network element
  • the UDR network element may also send the security policy to other network elements, and after the other network element generates the security information according to the security policy, the security information is sent to the UDR network element.
  • the UDR network element sends the identifier and security information of the multicast group to the NEF network element.
  • the NEF network element sends the identification and security information of the multicast group to the SMF network element.
  • the SMF network element sends the identifier and security information of the multicast group to the UPF network element.
  • the UPF network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • the UPF network element can perform encryption protection and/or integrity protection on the user plane data of the multicast group according to the security information. For details, refer to the implementation of step 508 .
  • the UE that newly joins the multicast group can request the security information from the SMF network element. If the SMF network element saves the above correspondence, it can send the security information to the UE. If the SMF network element does not save the above correspondence , the SMF network element can request the security information from the UDR network element or the PCF network element and then send it to the UE, so that the UE can decrypt the received user plane data according to the security information.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the NEF network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the NEF network element.
  • step 701 For the implementation of step 701, reference may be made to the implementation of step 501 above.
  • the NEF network element determines a protection mode corresponding to the identifier of the multicast group according to the identifier of the multicast group.
  • the security policy in step 702 may be received by the NEF network element from other network elements (for example, the AF network element), or may be locally determined by the NEF network element according to the identifier of the multicast group.
  • step 702 For the implementation of step 702, reference may be made to the implementation of step 502 above.
  • the NEF network element sends the identifier and protection mode of the multicast group to the UDR network element.
  • the UDR network element generates security information corresponding to the identifier of the multicast group according to the protection mode.
  • the UDR network element sends the identifier and security information of the multicast group to the NEF network element.
  • the NEF network element sends the identification and security information of the multicast group to the SMF network element.
  • the SMF network element sends the identifier and security information of the multicast group to the UPF network element.
  • the UPF network element performs protection of user plane data corresponding to the identifier of the multicast group according to the security information.
  • step 708 For the implementation of step 708, reference may be made to the implementation of step 508 above.
  • the NEF network element determines the protection method, and the UDR network element generates security information according to the protection method and sends it to other NF network elements to perform the protection of the user plane data of the MBS, so as to ensure the security of the user plane data of the 5G MBS.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the NEF network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the NEF network element.
  • step 801 For the implementation of step 801, reference may be made to the implementation of step 501 above.
  • the NEF network element sends the identifier of the multicast group to the SMF network element.
  • the NEF network element may also send the security policy corresponding to the identifier of the multicast group to the SMF network element.
  • the SMF network element determines security information corresponding to the identifier of the multicast group according to the security policy.
  • the security policy in step 803 may be received by the SMF network element from the NEF network element, or locally generated by the SMF network element according to the identifier of the multicast group.
  • the SMF network element may generate a protection mode according to the security policy, send the protection mode and the identifier of the multicast group to the NEF network element, and the NEF network element generates security information according to the protection mode and feeds it back to the SMF network element.
  • the SMF network element sends the identifier and security information of the multicast group to the UDR network element.
  • the SMF network element may also send the identification and security information of the multicast group to the PCF network element.
  • the SMF network element sends the identifier and security information of the multicast group to the UPF network element.
  • the UPF network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • step 806 reference may be made to the implementation of step 508 above.
  • the security information can be generated by the SMF network element and sent to other NF network elements to perform the protection of the user plane data of the MBS, so as to ensure the security of the user plane data of the 5G MBS.
  • an embodiment of the present application further provides a method for configuring security information, the method includes:
  • the AF network element sends the identifier of the multicast group to the NEF network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the NEF network element.
  • step 801 For the implementation of step 801, reference may be made to the implementation of step 501 above.
  • the NEF network element determines a protection mode corresponding to the identifier of the multicast group according to the security policy.
  • the security policy in step 902 may be received by the NEF network element from the AF network element, or locally generated by the NEF network element according to the identifier of the multicast group.
  • the NEF network element sends the identification and protection mode of the multicast group to the SMF network element.
  • the SMF network element generates security information corresponding to the identifier of the multicast group according to the protection mode.
  • the SMF network element sends the identifier and security information of the multicast group to the UDR network element.
  • the SMF network element may also send the identification and security information of the multicast group to the PCF network element.
  • the SMF network element sends the identifier and security information of the multicast group to the UPF network element.
  • the UPF network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • step 907 For the implementation of step 907, reference may be made to the implementation of step 508 above.
  • the protection mode can be determined by the NEF network element, and the SMF network element generates security information according to the protection mode and sends it to other NF network elements to perform the protection of the user plane data of the MBS, so as to ensure the security of the user plane data of the 5G MBS. .
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the MSF-C network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the MSF-C network element.
  • step 101 For the implementation manner of step 101, reference may be made to the implementation manner of the AF network element sending the identifier of the multicast group and the security policy to the NEF network element in the foregoing step 501.
  • the MSF-C network element sends the identifier of the multicast group to the UDR network element.
  • the MSF-C network element may also send the security policy corresponding to the identifier of the multicast group to the UDR network element.
  • the UDR network element determines security information corresponding to the identifier of the multicast group according to the security policy.
  • the security policy in step 103 may be received by the UDR network element from the MSF-C network element, or locally generated by the UDR network element according to the identifier of the multicast group.
  • step 103 For the implementation of step 103, reference may be made to the implementation of the NEF determining the security information in the foregoing step 502.
  • the UDR network element sends the identifier and security information of the multicast group to the MSF-C network element.
  • the MSF-C network element sends the identifier and security information of the multicast group to the MSF-U network element.
  • the MSF-U network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • step 106 For the implementation manner of step 106, reference may be made to the implementation manner of the UPF network element in the foregoing step 508.
  • the MSF-U network element receives the user plane data of the multicast group sent by the AF network element, it can protect the user plane data and send it to the UPF2 network element, and the UPF2 network element sends the user plane data to the UE through the RAN network element.
  • the UE can decrypt the user plane data according to the security information requested from the UDR network element.
  • the MSF-C network element may also send the protection mode to the AF network element.
  • the UDR network element can generate security information according to the security policy received from the MSF-C network element, and send it to other NF network elements to perform the protection of the user plane data of the MBS, so as to ensure the user of 5G MBS. data security.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the MSF-C network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the MSF-C network element.
  • step 101 For the implementation of step 101, reference may be made to the implementation of the AF network element sending the identifier of the multicast group and the security policy to the NEF network element in the foregoing step 501.
  • the MSF-C network element determines the protection mode corresponding to the identifier of the multicast group.
  • the security policy in step 112 may be received by the MSF-C network element from the AF network element, or locally generated by the MSF-C network element according to the identifier of the multicast group.
  • step 112 For the implementation manner of step 112, reference may be made to the implementation manner of the NEF network element determining the protection manner in the foregoing step 502.
  • the MSF-C network element sends the identification and protection mode of the multicast group to the UDR network element.
  • the UDR network element determines the security information corresponding to the identifier of the multicast group according to the protection mode.
  • step 114 For the implementation manner of step 114, reference may be made to the implementation manner of the NEF network element determining the security information in the foregoing step 502.
  • the UDR network element sends the identifier and security information of the multicast group to the MSF-C network element.
  • the MSF-C network element sends the identifier and security information of the multicast group to the MSF-U network element.
  • the MSF-U network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • the MSF-C network element may determine the protection mode corresponding to the identifier of the multicast group, and the UDR network element generates security information according to the protection mode received from the MSF-C network element, and sends it to other NFs.
  • the network element performs the protection of the user plane data of the MBS to ensure the security of the user plane data of the 5G MBS.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element sends the identifier of the multicast group to the MSF-C network element.
  • the AF network element may also send the security policy corresponding to the identifier of the multicast group to the MSF-C network element.
  • step 101 For the implementation manner of step 101, reference may be made to the implementation manner of the AF network element sending the identifier of the multicast group and the security policy to the NEF network element in the foregoing step 501.
  • the MSF-C network element determines the security information corresponding to the identifier of the multicast group according to the security policy.
  • the security policy in step 122 may be received by the MSF-C network element from the AF network element, or locally generated by the MSF-C network element according to the identifier of the multicast group.
  • step 122 For the implementation manner of step 122, reference may be made to the implementation manner of the NEF network element determining the security information in the foregoing step 502.
  • the MSF-C network element sends the identifier and security information of the multicast group to the UDR network element.
  • the MSF-C network element sends the identifier and security information of the multicast group to the MSF-U network element.
  • the MSF-U network element performs protection of the user plane data corresponding to the identifier of the multicast group according to the security information.
  • MSF-U network element is optional. If the MSF-C network element determines not to perform protection, the MSF-C network element may not select MSF-U.
  • the MSF-C network element can determine the security information corresponding to the identifier of the multicast group, and send it to other NF network elements to perform the protection of the user plane data of the MBS, so as to ensure the protection of the user plane data of the 5G MBS. Safety.
  • the MSF-C network element can also send the identification and security information of the multicast group to the SMF network element or the PCF network element, and the SMF network element or the PCF network element stores the security information, and the subsequent UE requests to obtain the information.
  • security information can be requested from the SMF network element or the PCF network element.
  • security information can also be requested from the UDR network element.
  • the ninth embodiment will describe the various possible implementations of acquiring security information when the UE joins the service process corresponding to the identifier of the multicast group.
  • an embodiment of the present application further provides a method for configuring security information, and the method includes:
  • the AF network element executes the security configuration process of the multicast group.
  • this step 131 is optional, that is, the network side has completed the security configuration process, for example, the UDR network element saves the correspondence between the identifier of the multicast group and the security information; or, the network has not completed the process.
  • the security configuration process that is, the configuration process in the above-mentioned embodiment is not performed.
  • the AF network element may also be replaced with a context provider (content provider, CP) network element.
  • a context provider content provider, CP
  • the UE completes the registration process with the network.
  • the UE may complete the session establishment procedure with the network.
  • the network side completes the multicast service announcement, so that the UE perceives the multicast service.
  • Step 133 is optional.
  • the UE accesses the service corresponding to the identifier of the multicast group in a user plane manner or a control plane manner.
  • step 134 the SMF1 network element will determine the identity of the multicast group that the UE wishes to access, specifically according to the multicast group information sent by the UE in the user plane mode, such as the Internet Group Management Protocol (internet group management protocol, IGMP). ) message, or the multicast address, or the network identifier where the multicast service or application is located, or the multicast service/application identifier, or the multicast group identifier, etc., or the multicast group sent by the UE in the mode of the control plane Information, such as the multicast address, or the network identifier where the multicast service or application is located, or the multicast service/application identifier, or the multicast group identifier, etc. are determined.
  • the multicast group information sent by the UE in the user plane mode such as the Internet Group Management Protocol (internet group management protocol, IGMP).
  • IGMP Internet Group Management Protocol
  • IGMP Internet Group Management Protocol
  • the manner in which the SMF1 determines the multicast group information, such as the multicast group identifier, is not limited. Assuming that the SMF1 network element determines the identifier of the multicast group that the UE wishes to access, the method further includes:
  • the SMF1 network element requests to obtain the security information corresponding to the identifier of the multicast group.
  • SMF1 may send a multicast request message to the UDR network element, and the message carries the identifier of the multicast group, so as to request to obtain the security information corresponding to the identifier of the multicast group.
  • the UDR network element stores the security information, it can send the security information to the SMF1 network element through the multicast response message.
  • the SMF1 network element may also request the PCF network element to obtain the security information.
  • the SMF network element can determine information such as the address of the multicast group, and send the address information of the multicast group to the UDR network element, and the UDR network element determines whether there is corresponding security information according to the address information.
  • the multicast group information sent by the UE here may be the identifier or address of the multicast group
  • the multicast group information determined by the SMF may be the identifier or address of the multicast group, which is the same as the AF in Embodiment 1.
  • the identities of the multicast groups sent can be different, but they are related.
  • the multicast address or network identifier in the multicast group information may be consistent with the multicast group identifier or the network identifier in the multicast group identifier sent by the AF. There is no restriction on the way of association here.
  • the UDR can determine whether the multicast group identifier previously received from the NEF matches according to the multicast group information sent by the SMF.
  • the SMF1 network element sends the identification and security information of the multicast group to the AMF network element.
  • the SMF1 network element may send the identification and security information of the multicast group to the AMF network element through the Namf_Communication_N1N2Message Transfer message.
  • SMF1 may only send security information to the AMF.
  • the AMF network element sends the identity and security information of the multicast group to the RAN network element.
  • the AMF network element may send the identity and security information of the multicast group to the RAN network element through the N2 session request message.
  • the AMF network element may only send security information to the RAN network element.
  • the RAN network element sends the identity and security information of the multicast group to the UE.
  • the RAN network element may send the identity and security information of the multicast group to the UE through a PDU session modification/accept (PDU session modification/accept) message.
  • PDU session modification/accept PDU session modification/accept
  • the RAN network element may only send security information to the UE.
  • the PDU session modification/accept message may also be a message sent by the SMF1 network element to the UE through the AMF network element and the RAN network element.
  • the message is encapsulated in the Namf_Communication_N1N2Message Transfer_N2 session request and the RRC message and sent to the UE .
  • the RAN network element may further modify the access network resources according to the identity and security information of the multicast group.
  • the UE when receiving the user plane data of the service corresponding to the identifier of the multicast group, the UE can decrypt the received user plane data according to the security information.
  • the RAN network element sends an N2 session response message to the AMF network element, where the message is used to instruct to send user plane data to the UE in a multicast manner. Then, step 140 or step 142 can be continued.
  • the AMF network element sends an N11 session response message to the SMF1 network element, where the message is used to instruct the user plane data to be sent in a multicast manner.
  • the method further includes:
  • the SMF1 network element sends the identification and security information of the multicast group to the SMF2 network element, and the SMF2 network element sends the identification and security information of the multicast group to the UPF2 network element, and the UPF2 network element executes the user plane data of the multicast group.
  • the SMF1 network element sends the identification and security information of the multicast group to the SMF2 network element, and the SMF2 network element sends the identification and security information of the multicast group to the MSF-U network element, and the MSF-U network element executes the Protection of user plane data for multicast groups (not shown in Figure 13).
  • the AMF network element sends the identification and security information of the multicast group to the SMF2 network element, and the SMF2 network element sends the identification and security information of the multicast group to the UPF2 or MSF-U network element, and the UPF2 network element or the MSF-U network element sends the identification and security information of the multicast group.
  • the identification and security information of the multicast group is performed by the MSF-U network element to protect the user plane data of the multicast group (not shown in FIG. 13 ).
  • the RAN network element sends an N2 session response message to the AMF network element, where the message is used to instruct to send user plane data to the UE in a unicast manner.
  • the AMF network element sends an N11 session response message to the SMF1 network element, where the message is used to instruct the user plane data to be sent in a unicast manner.
  • the SMF1 network element sends the identification and security information of the multicast group to the SMF2 network element, and the SMF2 network element sends the identification and security information of the multicast group to the UPF2 network element or the MSF-U network element, and the UPF2 network element or the MSF-U network element sends the identification and security information of the multicast group.
  • the network element performs protection of the unicast user plane data; or, the SMF1 network element sends the identity and security information of the multicast group to the MSF-C network element, and the MSF-C network element sends the multicast group to the MSF-U network element
  • the identification and security information of the unicast is performed by the MSF-U network element to protect the unicast user plane data.
  • step 135 may be the security information obtained by the SMF1 network element requesting the UDR network element when the UDR network element saves the security information. Actions after the process. However, if step 131 is not performed, that is, when the security configuration process is not completed, the implementation of step 135 can be replaced by (the replacement step of step 135 is not shown in FIG. 13 ):
  • the SMF1 network element determines the security information corresponding to the identifier of the multicast group, sends the security information to the UDR network element, and the UDR stores the corresponding relationship between the identifier of the multicast group and the security information.
  • the SMF1 network element can still obtain the security information from the UDR network element and send it to the UE.
  • the SMF1 network element sends the identifier of the multicast group to the UDR network element, so as to request to obtain security information. After the UDR network element determines the security information, it sends the security information to the SMF1 network element.
  • the UDR network element feeds back an indication that the security information is not stored to the SMF1 network element.
  • the SMF1 network element needs to determine the identifier of the multicast group by itself. corresponding safety information.
  • the SMF1 network element sends the identifier of the multicast group to the SMF2 network element to request to obtain security information. After the SMF2 network element determines the security information, the security information is sent to the UPF2 network element, and the UPF2 network element performs the protection of the user plane data. And, the SMF2 network element sends security information to the SMF1 network element.
  • the SMF1 network element sends the identifier of the multicast group to the MSF-C network element, so as to request to obtain the security information. After the MSF-C network element determines the security information, the security information is sent to the MSF-U network element, and the MSF-U network element performs the protection of the user plane data. And, the MSF-C network element sends security information to the SMF1 network element.
  • the present application can ensure the security of user plane data delivery in 5G MBS by adding the configuration process of security information in the process of UE registration to the network including 5G MBS.
  • Embodiment 10 will describe an implementation manner in which only the security policy of the multicast group is obtained from the network side when the UE joins the service process corresponding to the identifier of the multicast group, which can realize the security of the UE that has not signed with the network side to obtain the signed UE. Policy to ensure data security of unsubscribed UEs.
  • an embodiment of the present application provides a method for configuring a security policy, the method comprising:
  • the AF network element sends a multicast session request to the NEF network element, where the request carries the identifier of the multicast group and the security policy.
  • the multicast session request is a multicast session request
  • the multicast session request carries an identifier of a multicast group, a quality of service (quality of service, QoS) request and a security policy.
  • QoS quality of service
  • the SMF2 network element is selected.
  • the NEF network element sends a multicast session request message to the UDR network element, where the request message carries the identifier of the multicast group, the SMF 2ID and the security policy.
  • the UDR network element determines and saves the correspondence between the identifier of the multicast group and the security policy.
  • the UDR network element sends a multicast session response message to the NEF network element.
  • the NEF network element sends a multicast configuration session request (multicast distribution session request) message to the SMF2 network element, where the message carries the identifier of the multicast group.
  • multicast configuration session request multicast distribution session request
  • the SMF2 network element sends an MBS policy association request (policy association request) message to the PCF network element, where the message carries the identifier of the multicast group.
  • policy association request policy association request
  • the PCF network element sends an MBS policy negotiation response (policy association response) message to the SMF2 network element.
  • MBS policy negotiation response policy association response
  • the SMF2 network element sends a session request message to the UPF2 network element.
  • the UPF2 network element sends a session response message to the SMF2 network element, where the message carries the ingress address of the UPF2.
  • the SMF2 network element sends a multicast configuration session response message to the NEF network element, where the message carries the ingress address of the SMF2.
  • the NEF network element sends a multicast session response message to the AF network element, where the message carries the ingress address of the NEF network element.
  • step 151 The focus of this embodiment is step 151 , step 152 , step 154 and step 155 . Other steps may be optional.
  • the SMF2 network element can send the multicast group identifier to the UDR network element according to the determined multicast group identifier to request the security policy.
  • the UDR network element determines the saved security policy according to the multicast group identifier, it sends the security policy to the SMF2 network element, and the SMF2 network element can send the security policy to the RAN network element, so that the RAN network element determines the relationship between it and the UE according to the security policy. and send the air interface protection mode to the UE.
  • the RAN network element completes the customization of UE multicast data protection based on the security policy sent by the AF network element to the network, and ensures the data security of the UE.
  • actions such as negotiation and transmission of removing security policies and protection methods may also be included.
  • the solution of the present application may only include determining the key (encryption key and complete security keys) and protection algorithms (encryption algorithms and integrity protection algorithms).
  • the embodiments of the present application can focus on realizing the sharing of keys and protection algorithms.
  • the solution of the present application may also support a mechanism of performing only encryption protection, or only integrity protection, or performing encryption protection and integrity protection simultaneously according to a default policy.
  • the generation of the key and/or the protection algorithm can be completed independently by NEF network elements/UDR network elements/SMF network elements, etc., or by calling other NF network elements.
  • the NEF network element sends the protection method to a certain key management network element, and requests the key management network element to generate the corresponding encryption key and/or integrity protection key according to the protection method. Afterwards, the key management network element returns the encryption key and/or the integrity protection key to the NEF network element.
  • the selection of the protection algorithm is similar to the key, and can also be completed by other NF network elements.
  • the key and the algorithm may be completed by other entities and fed back to the NEF network element. This kind of processing method can better determine the security information based on the call, and simplify the functions of entities such as the NEF network element/UDR network element/SMF network element.
  • the actions of the UDR network elements may also be performed by UDM network elements, etc., which are not limited in the embodiments of the present application.
  • the network function network element includes corresponding hardware and/or software modules for executing each function.
  • the present application can be implemented in hardware or in the form of a combination of hardware and computer software in conjunction with the algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functionality for each particular application in conjunction with the embodiments, but such implementations should not be considered beyond the scope of this application.
  • the network function network element can be divided into functional modules according to the above method examples.
  • each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
  • the network function network element may be a unified data repository (eg UDR) network element, a network opening function (eg, NEF) network element, a session management function (eg, SMF) network element, and a multicast service function control plane function (MSF- C) network element, etc.
  • UDR unified data repository
  • NEF network opening function
  • SMF session management function
  • MSF- C multicast service function control plane function
  • FIG. 15 shows a possible schematic diagram of the composition of the network function network element 150 involved in the above embodiment.
  • the network function network element 150 may It includes: a receiving unit 1501 , a determining unit 1502 and a sending unit 1503 .
  • the receiving unit 1501 may be configured to support the network element 150 to perform the above steps 503, 602, 703, 804, 905, 113, 123, 135a, 135b, 153, etc., and/or Additional procedures for the techniques described herein.
  • Determining unit 1502 may be used to support network function network element 150 to perform steps 504, 603, 704, 103, 114, 154, etc. described above, and/or other processes for the techniques described herein.
  • the sending unit 1503 may be used to support the network function network element 150 to perform the above-described steps 604, 705, 104, 115, 155, etc., and/or other processes for the techniques described herein.
  • the network function network element 150 provided in this embodiment is configured to execute the above-mentioned method for configuring security information, and thus can achieve the same effect as the above-mentioned implementation method.
  • the network function network element 150 may include a processing module, a storage module and a communication module.
  • the processing module may be used to control and manage the actions of the network function network element 150, for example, may be used to support the network function network element 150 to perform the steps performed by the above determining unit 1502.
  • the storage module may be used to support the network function network element 150 to store program codes, data, and the like.
  • the communication module can be used to support the communication between the network function network element 150 and other devices, such as communication with other network function network elements, and can support the network function network element 150 to perform the steps performed by the receiving unit 1501 and the sending unit 1503.
  • the processing module may be a processor or a controller. It may implement or execute the various exemplary logical blocks, modules and circuits described in connection with this disclosure.
  • the processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and the like.
  • the storage module may be a memory.
  • the communication module may specifically be a device that interacts with other network function network elements, such as a radio frequency circuit, a Bluetooth chip, and a Wi-Fi chip.
  • the network function network element involved in this embodiment may be the network function network element 160 having the structure shown in FIG. 16 .
  • the embodiments of the present application further provide a network function network element, including one or more processors and one or more memories.
  • the one or more memories are coupled to the one or more processors for storing computer program code, the computer program code comprising computer instructions that, when executed by the one or more processors, cause the electronic device to perform
  • the above-mentioned relevant method steps implement the method for configuring the security information in the above-mentioned embodiment.
  • Embodiments of the present application also provide a computer-readable storage medium, where computer instructions are stored in the computer storage medium, and when the computer instructions are executed on a network function network element, the network function network element executes the above-mentioned related method steps to achieve the above-mentioned The configuration method of the security information in the embodiment.
  • Embodiments of the present application also provide a computer program product, which, when running on a computer, causes the computer to execute the above-mentioned relevant steps, so as to implement the method for configuring the security information executed by the network function network element in the above-mentioned embodiment.
  • the embodiments of the present application also provide an apparatus, which may specifically be a chip, a component or a module, and the apparatus may include a connected processor and a memory; wherein, the memory is used for storing computer execution instructions, and when the apparatus is running, The processor can execute the computer-executed instructions stored in the memory, so that the chip executes the method for configuring the security information executed by the network function network element in the foregoing method embodiments.
  • the network function network element, computer storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding method provided above. Therefore, the beneficial effects that can be achieved may refer to the above provided. The beneficial effects in the corresponding method will not be repeated here.
  • Another embodiment of the present application provides a system that may include a unified data repository (eg, UDR) network element, a network open function (eg, NEF) network element, a session management function (eg, SMF) network element, and a multicast
  • a unified data repository eg, UDR
  • NEF network open function
  • SMF session management function
  • MMF-C control plane function
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are only illustrative.
  • the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be Incorporation may either be integrated into another device, or some features may be omitted, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or may be distributed to multiple different places . Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a readable storage medium.
  • the technical solutions of the embodiments of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, which are stored in a storage medium , including several instructions to make a device (may be a single chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (random access memory, RAM), magnetic disk or optical disk and other media that can store program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种安全信息的配置方法和装置，涉及通信技术领域，能够实现5G MBS架构下终端设备与网络侧的安全信息的配置，保证5G MBS架构下用户面数据的安全性。该方法应用于包括多播-广播服务MBS架构的系统，该系统包括第一网络功能网元和第二网络功能网元，该方法包括：第一网络功能网元接收多播组的标识，确定多播组的标识对应的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，第一网络功能网元向第二网络功能网元发送安全信息。本申请实施例用于多播业务或广播业务的安全下发。

Description

一种安全信息的配置方法和装置 技术领域
本申请涉及通信技术领域，尤其涉及一种安全信息的配置方法和装置。
背景技术
第五代(fifth generation，5G)网络针对用户面保护引入了用户面安全信息。该安全信息可以包括机密性保护和完整性保护两个特性。其实现方式可以为：会话管理功能(session management function，SMF)确定安全信息，并发送给无线接入网络(radio access network，RAN)。RAN根据安全信息可以确定机密性保护和完整性保护的保护需求。
第三代合作伙伴计划(3rd Generation Partnership Project，3GPP)研究项目报告中提出第五代(fifth generation，5G)多播-广播服务(multicast-broadcast service，MBS)架构，虽然该架构下，RAN可以采用多播或者单播方式传输5G MBS下的数据，但是多播方式不能如单播方式一样可以在分组数据汇聚协议(packet data convergence protocol，PDCP)层进行数据保护，多播方式需要更高层的用户面数据防护，例如需要终端设备与应用功能(application function，AF)网元之间端到端(end-to-end，E2E)的保护，或者终端设备与5G核心网(5g core network，5GC)之间E2E的保护。
虽然现有的长期演进(long term evolution，LTE)网络的多媒体广播多播功能(multimedia broadcast multicast service，MBMS)中，UE与多媒体的广播多播服务(broadcast multicast service center，BM-SC)建立连接后，BM-SC可以通过超文本传输协议(hypertext transfer protocol，http)协议下发广播多播数据的密钥。但是LTE中密钥下发的流程不能完全适用于5G MBS架构。这是由于在5G MBS架构中，BM-SC的功能已经被拆分至5G的多个网络实体中，例如，会话管理功能(session management function，SMF)和策略控制功能(policy control function，PCF)等。因此，如何复用5GC的配置流程，完成5G MBS架构下终端设备与网络侧的安全信息的配置是一个亟待解决的问题。
发明内容
本申请实施例提供一种安全信息的配置方法和装置，能够实现5G MBS架构下终端设备与网络侧的安全信息的配置，保证5G MBS架构下用户面数据的安全性。
为达到上述目的，本申请实施例采用如下技术方案。
第一方面，提供一种安全信息的配置方法，该方法应用于包括多播-广播服务MBS架构的系统，该系统包括第一网络功能网元和第二网络功能网元，该方法包括：第一网络功能网元接收多播组的标识，确定多播组的标识对应的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法；第一网络功能网元向第二网络功能网元发送安全信息，第二网络功能网元包括多播服务功能的用户面功能(例如MSF-U) 网元、多播服务功能的控制面功能(例如MSF-C)网元、网络开放功能(例如NEF)网元或会话管理功能(例如SMF)网元中的一个或多个；第一网络功能网元可以包括统一的数据存储库(例如UDR)网元、网络开放功能(例如NEF)、会话管理功能(例如SMF)或多播服务功能的控制面功能(例如MSF-C)网元中的一个或多个。
由此，在5G MBS架构中，可以通过5G系统中的网元完成安全信息的配置，保证5G MBS架构下用户面数据的安全性。例如UDR网元可以根据安全策略确定多播组的标识对应的安全信息。于是当，UE向网络侧请求获得安全信息时，可以从网络侧的UDR网元中获取安全信息，以根据安全信息对MBS的用户面数据进行解密。
在一种可能的设计中，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。这样，接收到安全信息的网络侧网元可以根据安全信息对用户面数据进行保护，或者还可以根据安全策略或保护方式对用户面数据进行保护。
在一种可能的设计中，安全信息还包括保护方式；接收多播组的标识，确定多播组的标识对应的安全信息包括：接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和安全策略；根据安全策略确定保护方式；或者，接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和保护方式；根据保护方式生成安全信息。
也就是说，MBS中的网元可以根据接收到的安全策略生成安全信息，或者根据接收到的保护方式生成安全信息，以便在网络侧网元根据安全信息对MBS的用户面数据进行保护。例如，UDR网元接收来自NEF网元或MSF-C网元的多播组的标识和安全策略，UDR网元根据安全策略确定保护方式，再根据保护方式生成安全信息。或者，UDR网元接收来自NEF网元或MSF-C网元的多播组的标识和保护方式，UDR网元根据保护方式生成安全信息。
在一种可能的设计中，向第二网络功能网元发送安全信息包括:向网络开放功能网元或多播服务功能的控制面功能网元发送安全信息。也即，当网络侧的网元生成安全信息后，可以将安全信息发送给其他网元进行保存。例如，UDR网元将安全信息发送给NEF网元或MSF-C网元进行保存，这样，UE在请求安全信息时，网络侧网元可以从NEF网元或MSF-C网元获取多播组的标识对应的安全信息。
在一种可能的设计中，第一网络功能网元包括统一的数据存储库(例如UDR)网元；根据保护方式生成安全信息之后，该方法还包括：统一的数据存储库网元确定安全信息与多播组的标识的对应关系；接收多播组的标识，确定多播组的标识对应的安全信息还包括：统一的数据存储库网元接收来自会话管理功能网元的请求消息，请求消息包括多播组的标识；统一的数据存储库网元根据对应关系确定多播组的标识对应的安全信息；向第二网络功能网元发送安全信息包括：统一的数据存储库网元向会话管理功能网元发送安全信息。
可以理解为，统一的数据库网元中存储有多播组的标识和安全信息的对应关系。如果后续接收到来自UE的请求消息，请求获得多播组的标识对应的安全信息时，统一的数据库网元可以根据该对应关系并通过第二网络功能网元向UE响应该安全信息。 例如，UDR网元存储有该对应关系，当UDR网元接收到SMF网元发送的请求消息时，UDR网元向SMF网元发送该安全信息，以便SMF网元将该安全信息发送给UE。
其中，统一的数据库网元存储的对应关系可以是自己生成并保存的，也可能是从网络开放功能网元或多播服务功能的控制面功能网元等其他网元接收到的对应关系。
在一种可能的设计中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元，安全信息还包括保护方式；接收多播组的标识，确定多播组的标识对应的安全信息包括：网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略；网络开放功能网元或多播服务功能的控制面功能网元根据安全策略确定保护方式；网络开放功能网元或多播服务功能的控制面功能网元根据保护方式生成安全信息；向第二网络功能网元发送安全信息包括：网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全信息。
也就是说，网络侧配置的安全信息可以是网络开放功能网元或多播服务功能的控制面功能网元生成的，并将生成的安全信息和多播组的标识发送给统一的数据存储库网元进行保存。示例性的，NEF网元或MSF-C网元接收AF网元发送的多播组的标识和安全策略，NEF网元或MSF-C网元根据安全策略确定安全信息，NEF网元或MSF-C网元将安全信息发送给UDR网元进行存储。这样，UE在请求安全信息时，网络侧网元可以从UDR网元获取多播组的标识对应的安全信息下发给UE。
在一种可能的设计中，根据保护方式生成安全信息包括：若保护方式指示对用户面数据执行加密保护，则生成加密密钥和加密算法；若保护方式指示对用户面数据执行完整性保护，则生成完整性保护密钥和完整性保护算法。如果保护方式指示不对用户面数据执行加密保护，以及不对用户面数据执行完整性保护，网络侧网元也可以生成加密密钥、加密算法、完整性保护密钥和完整性保护算法，但是加密算法和完整性保护算法均为空算法。
在一种可能的设计中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元；接收多播组的标识，确定多播组的标识对应的安全信息包括：网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略；网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全策略和多播组的标识，统一的数据存储库网元可以根据接收到的安全策略生成安全信息，统一的数据存储库网元再将安全信息和多播组的标识发送给网络开放功能网元或多播服务功能的控制面功能网元；或者，网络开放功能网元或多播服务功能的控制面功能网元根据安全策略确定保护方式，向统一的数据存储库网元发送保护方式和多播组的标识；统一的数据存储库网元可以根据接收到的保护方式生成安全信息，统一的数据存储库网元再将安全信息和多播组的标识发送给网络开放功能网元或多播服务功能的控制面功能网元，即网络开放功能网元或多播服务功能的控制面功能网元接收来自统一的数据存储库网元的安全信息。
也就是说，网络开放功能网元或多播服务功能的控制面功能网元在接收到安全策略时，可以将安全策略发送给统一的数据存储库网元，使得统一的数据存储库网元根据安全策略生成安全信息后反馈给网络开放功能网元或多播服务功能的控制面功能网 元。或者，网络开放功能网元或多播服务功能的控制面功能网元也可以先自己根据安全策略生成保护方式，将保护方式发送给统一的数据存储库网元，使得统一的数据存储库网元根据保护方式生成安全信息后反馈给网络开放功能网元或多播服务功能的控制面功能网元。
例如，NEF网元或MSF-C网元在接收到多播组的标识和安全策略时，可以将多播组的标识和安全策略发送给UDR网元，UDR网元根据安全策略生成安全信息后反馈给NEF网元或MSF-C网元。或者，NEF网元或MSF-C网元也可以先自己根据安全策略生成保护方式，将保护方式发送给UDR网元，使得UDR网元根据保护方式生成安全信息后反馈给NEF网元或MSF-C网元。
在一种可能的设计中，向第二网络功能网元发送安全信息包括：向多播服务功能的用户面功能网元或会话管理功能网元发送安全信息。
可以理解为，NEF网元或MSF-C网元在接收到来自UDR网元的多播组的标识和安全信息时，NEF网元还可以向SMF网元发送该多播组的标识和安全信息，UE在获取安全信息时，可以从SMF网元获取安全信息；或者，MSF-C网元还可以向MSF-U网元发送安全信息，UE在获取安全信息时，可以从MSF-U网元获取安全信息。
第二方面，提供一种安全信息的配置方法，该方法应用于终端设备，终端设备所在的网络包括会话管理功能网元，该方法包括：向会话管理功能网元发送多播组的标识，以请求加入多播组；接收来自会话管理功能网元的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护；根据安全信息进行对接收到的用户面数据进行解密。
其中，终端设备可以为UE。在5G MBS中配置有安全信息时，如果UE要加入该多播组，请求获取安全信息时，UE可以向会话管理功能(例如SMF)网元请求获取安全信息，会话管理功能网元如果保存有该多播组的标识对应的安全信息时，可以直接向UE下发安全信息；会话管理功能网元如果没有保存该多播组的标识对应的安全信息时，会话管理功能网元可以从其他网元，例如统一的数据存储库网元请求获取安全信息后下发给UE。这样，MBS架构中的网络侧网元可以根据安全信息对多播组的数据进行保护的情况下，UE还可以根据请求得到的安全信息对数据进行解密，保证了MBS架构下的用户面数据的安全性。
第三方面，提供一种安全信息的配置方法，该方法应用于包括多播-广播服务MBS架构的系统，该系统包括统一的数据存储库网元、网络开放功能网元、多播服务功能的控制面功能网元、会话管理功能网元和终端设备。
一种可能的设计中，统一的数据存储库网元接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和安全策略；统一的数据存储库网元根据安全策略确定保护方式；统一的数据存储库网元根据保护方式生成安全信息；
或者，网络开放功能网元或多播服务功能的控制面功能网元接收多播组的标识和安全策略，网络开放功能网元或多播服务功能的控制面功能网元根据安全策略确定保 护方式，网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送多播组的标识和保护方式，统一的数据存储库网元根据保护方式生成安全信息。
进而，统一的数据存储库网元可以向络开放功能网元或多播服务功能的控制面功能网元发送该安全信息和多播组的标识。其中，安全信息还可以包括保护方式。
统一的数据存储库网元可以确定安全信息与多播组的标识的对应关系。当统一的数据存储库网元接收到来自会话管理功能网元的请求消息，请求消息包括多播组的标识；统一的数据存储库网元可以根据对应关系确定多播组的标识对应的安全信息，统一的数据存储库网元向会话管理功能网元发送安全信息。
另一种可能的设计中，网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略，网络开放功能网元或多播服务功能的控制面功能网元根据安全策略确定保护方式，网络开放功能网元或多播服务功能的控制面功能网元根据保护方式生成安全信息，网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全信息；
或者，网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略，网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全策略和多播组的标识，统一的数据存储库网元可以根据接收到的安全策略生成安全信息，统一的数据存储库网元再将安全信息和多播组的标识发送给网络开放功能网元或多播服务功能的控制面功能网元，网络开放功能网元还可以向会话管理功能网元发送安全信息，多播服务功能的控制面功能网元还可以向多播服务功能的用户面功能网元发送安全信息；
或者，网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略，网络开放功能网元或多播服务功能的控制面功能网元也可以先自己根据安全策略生成保护方式，将保护方式发送给统一的数据存储库网元，使得统一的数据存储库网元根据保护方式生成安全信息后反馈给网络开放功能网元或多播服务功能的控制面功能网元。网络开放功能网元还可以向会话管理功能网元发送安全信息，多播服务功能的控制面功能网元还可以向多播服务功能的用户面功能网元发送安全信息。
当终端设备确定加入多播组时，终端设备可以向会话管理功能网元发送多播组的标识，以请求加入多播组。会话管理功能网元保存有该多播组的标识对应的安全信息时，可以直接向终端设备下发安全信息；会话管理功能网元如果没有保存该多播组的标识对应的安全信息时，会话管理功能网元可以从其他网元，例如统一的数据存储库网元请求获取安全信息后下发给终端设备。
其中，安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。这样，接收到安全信息的网络侧网元可以根据安全信息对用户面数据进行保护，或者还可以根据安全策略或保护方式对用户面数据进行保护。
第四方面，提供一种安全信息的配置方法，该方法应用于包括多播-广播服务MBS架构的系统，该系统包括统一的数据存储库网元、网络开放功能网元以及会话管理功能网元。
统一的数据存储库网元可以接收来自网络开放功能网元的多播组的标识和安全策略，统一的数据存储库网元根据安全策略确定保护方式，根据保护方式生成安全信息。统一的数据存储库网元向网络开放功能网元发送该安全信息。统一的数据存储库网元还可以确定安全信息与多播组的标识的对应关系，当统一的数据存储库网元接收来自会话管理功能网元的请求消息，请求消息包括多播组的标识时，统一的数据存储库网元可以根据对应关系确定多播组的标识对应的安全信息，统一的数据存储库网元向会话管理功能网元发送安全信息。
或者，网络开放功能网元接收来自应用功能网元的多播组的标识和安全策略，网络开放功能网元根据安全策略确定保护方式，网络开放功能网元根据保护方式生成安全信息。网络开放功能网元还可以向统一的数据存储库网元发送安全信息。网络开放功能网元还可以向会话管理功能网元发送安全信息。
或者，网络开放功能网元接收来自应用功能网元的多播组的标识和安全策略，网络开放功能网元根据安全策略确定保护方式，网络开放功能网元向统一的数据存储库网元发送保护方式和多播组的标识，统一的数据存储库网元可以根据接收到的保护方式生成安全信息，统一的数据存储库网元再将安全信息和多播组的标识发送给网络开放功能网元。网络开放功能网元还可以向会话管理功能网元发送安全信息。
在一种可能的设计中，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
第五方面，提供一种安全信息的配置方法，该方法应用于包括多播-广播服务MBS架构的系统，该系统包括多播服务功能的控制面功能网元和多播服务功能的用户面功能网元。
多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略，多播服务功能的控制面功能网元可以向统一的数据存储库网元发送多播组的标识和安全策略，以便统一的数据存储库网元根据安全策略确定安全信息；或者，多播服务功能的控制面功能网元可以向统一的数据存储库网元发送多播组的标识和保护方式，以便统一的数据存储库网元根据保护方式确定安全信息。
或者，多播服务功能的控制面功能网元还可以根据安全策略确定保护方式，根据保护方式生成安全信息，并向多播服务功能的用户面功能网元发送多播组的标识和安全信息，以便多播服务功能的用户面功能网元根据安全信息对数据进行保护。
或者，多播服务功能的控制面功能网元还可以接收多播组的标识和安全信息。多播服务功能的控制面功能网元还可以向多播服务功能的用户面功能网元发送多播组的标识和安全信息，以便多播服务功能的用户面功能网元根据安全信息对数据进行保护。
在一种可能的设计中，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
第六方面，提供一种安全信息的配置方法，该方法应用于包括多播-广播服务MBS 架构的系统，该系统包括统一的数据存储库网元和会话管理功能网元。
统一的数据存储库网元在接收到多播组的标识和安全策略时，可以根据多播组的标识和安全策略确定安全信息后发送给会话管理功能网元。
或者，统一的数据存储库网元在接收到多播组的标识和保护方式时，可以根据多播组的标识和保护方式确定安全信息后发送给会话管理功能网元。
统一的数据存储库网元可以确定安全信息与多播组的标识的对应关系。当统一的数据存储库网元接收来自会话管理功能网元的请求消息，请求消息包括多播组的标识时，统一的数据存储库网元可以根据对应关系确定多播组的标识对应的安全信息，并向会话管理功能网元发送安全信息。
在一种可能的设计中，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
第七方面，提供一种网络功能网元，网络功能网元为第一网络功能网元，第一网络功能网元应用于多播-广播服务架构的系统，系统包括第一网络功能网元和第二网络功能网元，第一网络功能网元包括：收发器，用于接收多播组的标识；处理器，用于确定多播组的标识对应的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法；收发器，还用于向第二网络功能网元发送安全信息，第二网络功能网元包括多播服务功能的用户面功能网元、多播服务功能的控制面功能网元、网络开放功能网元或会话管理功能网元中的一个或多个。
在一种可能的设计中，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
在一种可能的设计中，安全信息还包括保护方式；收发器，用于接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和安全策略，处理器，用于根据安全策略确定保护方式；或者，收发器，用于来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和保护方式；处理器，用于根据保护方式生成安全信息。
在一种可能的设计中，收发器，用于向网络开放功能网元或多播服务功能的控制面功能网元发送安全信息。
在一种可能的设计中，第一网络功能网元包括统一的数据存储库网元；处理器，还用于确定安全信息与多播组的标识的对应关系；收发器，还用于接收来自会话管理功能网元的请求消息，请求消息包括多播组的标识；处理器，还用于根据对应关系确定多播组的标识对应的安全信息；收发器，还用于向会话管理功能网元发送安全信息。
在一种可能的设计中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元，安全信息还包括保护方式；收发器，用于接收来自应用功能网元的多播组的标识和安全策略；处理器，用于根据安全策略确定保护方式；处理器，用 于根据保护方式生成安全信息；收发器，用于向统一的数据存储库网元发送安全信息。
在一种可能的设计中，处理器，用于：若保护方式指示对用户面数据执行加密保护，则生成加密密钥和加密算法；若保护方式指示对用户面数据执行完整性保护，则生成完整性保护密钥和完整性保护算法。
在一种可能的设计中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元；收发器，用于接收来自应用功能网元的多播组的标识和安全策略；收发器，用于向统一的数据存储库网元发送安全策略和多播组的标识；或者，处理器，用于根据安全策略确定保护方式，收发器，用于向统一的数据存储库网元发送保护方式和多播组的标识；收发器，用于接收来自统一的数据存储库网元的安全信息。
在一种可能的设计中，收发器，用于：向多播服务功能的用户面功能网元或会话管理功能网元发送安全信息。
第八方面，提供一种终端设备，终端设备所在的网络包括会话管理功能网元，终端设备包括：收发器，用于向会话管理功能网元发送多播组的标识，以请求加入多播组；收发器，还用于接收来自会话管理功能网元的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护；处理器，用于根据安全信息进行对接收到的用户面数据进行解密。
第九方面，本申请实施例提供了一种计算机可读存储介质，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述第一方面及第一方面的任一项可能的实现方式中的安全信息的配置方法。
第十方面，本申请实施例提供了一种计算机可读存储介质，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述第二可能的实现方式中的安全信息的配置方法。
第十一方面，本申请实施例提供了一种计算机程序产品，当计算机程序产品在计算机上运行时，使得电子设备执行上述第一方面及第一方面的任一项可能的实现方式中的安全信息的配置方法。
第十二方面，本申请实施例提供了一种计算机程序产品，当计算机程序产品在计算机上运行时，使得电子设备执行上述第二方面可能的实现方式中的安全信息的配置方法。
附图说明
图1为本申请实施例提供的一种5G MBS的基本架构示意图；
图2为本申请实施例提供的一种5G MBS的基本架构示意图；
图3为本申请实施例提供的一种5G MBS的基本架构示意图；
图4为本申请实施例提供的一种用户面安全策略配置的主要流程示意图；
图5为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图6为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图7为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图8为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图9为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图10为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图11为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图12为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图13为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图14为本申请实施例提供的一种安全信息的配置方法的流程示意图；
图15为本申请实施例提供的一种网络功能网元的结构示意图；
图16为本申请实施例提供的一种网络功能网元的结构示意图。
具体实施方式
本申请实施例可以应用于5G MBS架构中，网络侧设备如何配置安全信息，以便加入多播广播服务的终端设备可以根据安全信息对用户面数据进行解密，提升5G MBS架构下用户面数据的安全。
首先介绍下3GPP提出的5G MBS的基本架构。
5G MBS的一种架构1可以如图1所示，是基于现有的5G网络架构，并对5G网络架构中的一些网络功能(network function，NF)网元进行功能增强得到的。该架构1可以包括：AF网元、网络开放功能(network exposure function，NEF)网元、策略控制功能(Policy Control Function，PCF)网元、会话管理功能(session management function，SMF)网元、用户平面功能(user plane function，UPF)网元、下一代无线接入网络(next generation-radio access network，NG-RAN)网元以及终端设备(例如可以是用户设备(user equipment，UE))等。其中：
AF网元，可以为多播和/或广播的数据来源，调用5G系统提供的MBS，通过5G向多个UE发送多播和/或组播数据。
NEF网元，可以实现5G开放功能；与AF网元进行通信。AF网元通过NEF网元可以访问5G网络中的部分功能网元。另外，NEF网元也可以与AF网元进行网元协商5G MBS，协商的内容包括服务质量(quality of service，QoS)和5G MBS服务域等。
PCF网元，可以支持5G MBS；提供MBS会话相关策略消息给SMF网元；直接地或间接地(通过NEF)从AF网元处接收MBS服务信息；
SMF网元，可以基于从PCF网元处接收的MBS策略控制MBS传输；在UPF网元上配置MBS流以及点到点或者点到多点传输；在RAN网元上配置MBS流和QoS信息；在UE上配置MBS流的会话管理。
UPF网元，支持对MBS流的包过滤，可以通过点对点或点对多点的方式向RAN网元传输MBS流；从SMF网元处接收MBS配置；检查互联网群组管理协议(internet group management protocol，IGMP)包，并向SMF网元通知IGMP包；接收AF的单播或者多播流等。
NG-RAN网元，可以接收UPF网元发送的MBS流，在多播和单播中切换传输MBS流等。
UE，可以支持MBS策略配置；支持MBS流的会话管理；支持加入MBS流；支 持接入层的MBS等。
与架构1对应的，如图2所示，还有一种在架构1的基础上增加有多播服务功能(multicast service function，MSF)网元的5G MBS架构2。该架构2中，AF网元可以通过MSF网元使用5G系统提供的MBS。MSF网元可以通过NEF网元或者PCF网元请求MBS。其中，MSF网元可以作为控制面信令和用户面数据的入口点。MSF网元可以包括MSF控制面功能(MSF control plane，MSF-C)网元和MSF网元用户面功能(MSF iser plane，MSF-U)网元。MSF-C网元用于信令处理和接收信令，该信令例如为用于组播服务配置和MBS承载激活等。MSF-U网元用于用户面数据传输和用户面数据编码等。
另一种5G MBS的架构3可以如图3所示。该架构3在现有的5G系统架构上，引入了新的NF，并对现有UE和NG-RAN网元等进行功能增强，以支持5G MBS。该架构3中可以包括：
对UE、NG-RAN和接入移动管理功能(access and mobility management function，AMF)进行增强后的AMF网元，可以称为M-AMF网元；
多播广播会话管理功能(multicast/broadcast session management function，MB-SMF)网元和多播广播用户面功能(multicast/broadcast user plane function，MB-UPF)网元。其中，MB-SMF可以用于MBS会话管理等，MB-UPF可以用于传输多播和广播数据；这里的MB-SMF网元相当于本申请提及的MSF-C网元。
多播和广播服务功能(multicast/broadcast service function，MBSF)网元，用于处理信令和向AF提供接口等；
多播和广播服务用户面功能(multicast/broadcast service user plane function，MBSU)网元，可以用于传输多播和广播数据等；MBSU网元相当于本申请提及的MSF-U网元。
目前，虽然5G网络针对用户面保护引入了用户面安全策略配置流程，但是该流程对以上架构1、架构2和架构3来说，均不支持5G MBS中安全信息的协商机制。
目前的用户面安全策略配置的主要流程如图4所示，包括：
41、在协议数据单元(protocol data unit，PDU)会话建立流程中，UE发送非接入层(non-access stratum，NAS)消息至AMF网元，消息中可以包括网络切片标识(single network slice selection assistance information，S-NSSAI)，数据网络名称(data network name，DNN)等参数；
42、AMF网元发送创建SMF网元上下文请求(creat SMF context request)或者更新SMF网元上下文请求(update SMF context request)至SMF网元，请求中可以携带订阅永久标识(subscription permanent identifier，SUPI)，S-NSSAI和DNN等。
43、SMF网元确定用户面安全策略，具体方式可以包括:SMF网元发送请求至统一的数据管理功能(unified data management，UDM)网元，请求中携带SUPI、DNN和/或S-NSSAI，以使UDM网元根据DNN和/或S-NSSAI确定签约的用户面安全策略，并发送签约的用户面安全策略至SMF网元。这里的SMF网元能否从UDM网元得到签约的用户面安全策略是可选的，这是由于SMF网元本地也可能存储有配置的用户面安全策略。如果SMF网元从UDM网元得到签约的用户面安全策略，就将签约的用户面安全策略作为最终的用户面安全策略；否则SMF网元将本地配置的DNN和/或 S-NSSAI对应的用户面安全策略作为最终的用户面安全策略。
这里用户面安全策略包括机密性保护和完整性保护的需求。其中：
机密性保护需求可以包括：
A.required，需要机密性保护。
B.preferred，希望使用机密性保护。
C.not needed，不需要机密性保护。
完整性保护需求可以包括：
A.required，需要完整性保护。
B.preferred，希望使用完整性保护。
C.not needed，不需要完整性保护。
44、SMF网元通过AMF网元发送用户面安全策略至基站。
45、基站根据本地能力(例如是否支持完整性保护速率等)，确实最终用户面的保护方法。
如果保护需求是required，则基站必须进行保护，若不能执行，则发送拒绝指示至SMF网元。
如果保护需求是preferred，则保护方式是可选的，由基站来决定是否进行保护。
如果保护需求是not needed，则基站不执行保护。
这里的保护包括机密性保护和完整性保护。
46、基站发送机密性保护指示和/或完整性保护指示，机密性保护指示用于指示是否需要机密性保护，完整性保护指示用于指示是否需要完整性保护。
47、UE根据机密性保护指示和/或完整性保护指示执行后续用户面数据的保护。
可以看出，现有的5G网络针对用户面保护引入的用户面安全策略配置流程，并未针对5G MBS，因此，如何在5G MBS中引入用户面安全策略配置是本申请要解决的技术问题。
为此，本申请实施例提供一种安全信息的配置方法，该方法可以应用于上述架构1或架构2或架构3。例如在架构1中，其用户面数据的下发流程可以为：UPF从AF网元接收到需要下发的用户面数据后，UPF网元将用户面数据发送给对应的RAN node(基站)；再由RAN node发送用户面数据至UE。例如在架构2或架构3中，引入了服务层(service layer)，该服务层包括MSF-C网元和MSF-U网元，MSF-C网元主要处理控制面数据；MSF-U网元主要处理用户面数据。其用户面数据的下发流程可以为：MSF-U网元从AF网元接收到用户面数据后，先发送至UPF网元，再由UPF网元发送用户面数据给对应的基站；之后基站广播用户面数据给对应的UE。
为了保证架构1、架构2和架构3下，5G MBS的用户面数据下发的安全，本申请提供了多种安全信息配置方法，例如，一种方法可以包括：作为架构1和架构2中可以用于存储数据的网元：统一的数据存储库(Unified Data Repository，UDR)网元，其可以保存多个网元的数据，例如保存NEF网元、PCF网元、SMF网元和AMF网元等网元的数据。因此，本申请中，UDR网元可以获取多播组的标识，确定多播组的标识对应的安全信息，并保存安全信息。安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和 完整性保护算法。该UDR网元可以自身根据多播组的标识确定对应的安全信息，也可以接收其他网元，例如接收NEF网元或MSF-C网元根据多播组的标识确定的安全信息并保存。
再例如，另一种安全信息的配置方法可以包括：NEF网元或MSF-C网元接收AF网元发送的多播组的标识和安全策略，NEF网元或MSF-C网元根据安全策略确定安全信息，将安全信息再发送给UDR网元。或者，NEF网元或MSF-C网元接收AF网元发送的多播组的标识和安全策略，并向UDR发送多播组的标识和安全策略，或向UDR网元发送NEF网元或MSF-C网元根据安全策略确定的保护方式和多播组的标识，当UDR网元确定了安全信息后，NEF网元或MSF-C网元接收UDR网元发送的安全信息。
当UE加入该多播组时，可以向核心网网元，例如SMF网元请求安全信息，SMF网元可以从UDR网元中获取安全信息后发送给UE。当UE接收到下行发送的用户面数据时，可以根据安全信息对用户面数据进行解密。
本申请安全信息的配置流程并不局限于上述两种方法，具体的多种实现方式将在下面的实施例中说明。
本申请实施例提供一种安全信息的配置方法，该方法可以应用于包括MBS的系统，系统包括第一网络功能网元和第二网络功能网元，该方法可以包括：
第一网络功能网元接收多播组的标识，确定多播组的标识对应的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法；其中，多播组的标识也可以替换为广播组的标识。即本申请可以适用于对多播业务的用户面数据执行保护，也可以适用于对广播业务的用户面数据执行保护。
第一网络功能网元向第二网络功能网元发送安全信息，第二网络功能网元包括多播服务功能的用户面功能网元、多播服务功能的控制面功能网元、网络开放功能网元或会话管理功能网元中的一个或多个。第一网络功能网元可以包括统一的数据存储库网元、网络开放功能网元和多播服务功能的控制面功能网元中的一个或多个。
这些第一网络功能网元和第二网络功能网元均为5G MBS架构下的网元，因此，本申请实施例提供的安全信息的配置方法可以适用于对5G MBS架构下的用户面数据的保护。
在一些实施例中，安全信息还可以包括用户面数据的安全策略和/或保护方式；
安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；
保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
在一些实施例中，安全信息还包括保护方式；上述接收多播组的标识，确定多播组的标识对应的安全信息可以包括：接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和安全策略，根据安全策略确定保护方式；或者，接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和保护方式。根据保护方式生成安全信息。
示例性的，统一的数据存储库网元可以接收来自网络开放功能网元或多播服务功 能的控制面功能网元的多播组的标识和安全策略，统一的数据存储库网元根据安全策略确定保护方式；或者，统一的数据存储库网元直接接收来自网络开放功能网元或多播服务功能的控制面功能网元的多播组的标识和保护方式。进而，统一的数据存储库网元根据保护方式生成安全信息。
在一些实施例中，向第二网络功能网元发送安全信息包括:向网络开放功能网元或多播服务功能的控制面功能网元发送安全信息。
示例性的，统一的数据存储库网元在得到安全信息后，可以将安全信息发送给网络开放功能网元或多播服务功能的控制面功能网元，由网络开放功能网元或多播服务功能的控制面功能网元保存安全信息。后续如果终端设备请求安全信息时，可以从网络开放功能网元或多播服务功能的控制面功能网元得到该安全信息。
在一些实施例中，第一网络功能网元包括统一的数据存储库网元；根据保护方式生成安全信息之后，该方法还包括：统一的数据存储库网元确定安全信息与多播组的标识的对应关系。也就是说，由统一的数据存储库网元保存该对应关系。
基于此，上述接收多播组的标识，确定多播组的标识对应的安全信息还可以包括：
统一的数据存储库网元接收来自会话管理功能网元的请求消息，请求消息包括多播组的标识；统一的数据存储库网元根据对应关系确定多播组的标识对应的安全信息。由此，上述向第二网络功能网元发送安全信息可以包括：统一的数据存储库网元向会话管理功能网元发送安全信息。
这样，当终端设备向会话管理功能网元请求得到该安全信息时，会话管理功能网元可以从统一的数据存储库网元中获取该安全信息后下发给终端设备。
需要说明的是，统一的数据存储库网元中存储的对应关系还可以通过其他方式得到，例如下述实施例中说明的实施方式。
在一些实施例中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元，安全信息还包括保护方式。上述接收多播组的标识，确定多播组的标识对应的安全信息可以包括：网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略；网络开放功能网元或多播服务功能的控制面功能网元根据安全策略确定保护方式；网络开放功能网元或多播服务功能的控制面功能网元根据保护方式生成安全信息。由此，上述向第二网络功能网元发送安全信息可以包括：网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全信息。
在一些实施例中，上述根据保护方式生成安全信息可以包括：若保护方式指示对用户面数据执行加密保护，则生成加密密钥和加密算法；若保护方式指示对用户面数据执行完整性保护，则生成完整性保护密钥和完整性保护算法。
在一些实施例中，第一网络功能网元包括网络开放功能网元或多播服务功能的控制面功能网元。上述接收多播组的标识，确定多播组的标识对应的安全信息包括：网络开放功能网元或多播服务功能的控制面功能网元接收来自应用功能网元的多播组的标识和安全策略。网络开放功能网元或多播服务功能的控制面功能网元向统一的数据存储库网元发送安全策略和多播组的标识，统一的数据存储库网元根据安全策略生成安全信息；或者，网络开放功能网元或多播服务功能的控制面功能网元根据安全策略 确定保护方式，向统一的数据存储库网元发送保护方式和多播组的标识，统一的数据存储库网元根据保护方式生成安全策略。
这样，网络开放功能网元或多播服务功能的控制面功能网元可以接收来自统一的数据存储库网元的安全信息。
在一些实施例中，向第二网络功能网元发送安全信息包括：向多播服务功能的用户面功能网元或会话管理功能网元发送安全信息。
示例性的，网络开放功能网元可以向会话管理功能网元发送安全信息，由会话管理功能网元保存该安全信息和多播组的标识的对应关系。或者，多播服务功能的控制面功能网元可以向多播服务功能的用户面功能网元发送安全信息，由多播服务功能的用户面功能网元保存安全信息与多播组的标识的对应关系。
在对MBS架构完整安全信息的配置流程之后，终端设备在加入多播组的标识对应的多播业务时，可以从网络侧的网络功能网元中获取安全信息，以便根据安全信息对从网络侧接收到的用户面数据进行解密。
因此，本申请实施例还提供一种安全信息的配置方法，该方法应用于终端设备，终端设备所在的网络包括会话管理功能网元，该方法可以包括：向会话管理功能网元发送多播组的标识，以请求加入多播组；接收来自会话管理功能网元的安全信息，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，安全信息还包括用户面数据的安全策略和/或保护方式；安全策略指示用户面数据的保护需求，保护需求包括加密保护需求，和/或，完整性保护需求；保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护；根据安全信息进行对接收到的用户面数据进行解密。
这样，在MBS中的网络功能网元对用户面数据根据安全信息执行保护后，终端设备可以根据请求得到的安全信息对网络侧下发的密文进行解密，得到解密后的用户面数据。
下面的实施例将以统一的数据存储库网元为UDR网元，网络开放功能网元为NEF网元，多播服务功能的用户面功能网元为MSF-U网元，多播服务功能的控制面功能网元为MSF-C网元，会话管理功能网元为SMF网元为例进行说明。
实施例一
如图5所示，本申请实施例提供一种安全信息的配置方法，该方法包括：
501、AF网元向NEF网元发送多播组的标识。
其中，多播组的标识可以为multicast group ID(identity)，或者多播组的标识还可替换为多播上下文标识(multicast context ID)。其中，多播组的标识可以用于标识多播业务，也可称之为多播标识或者多播服务标识等。以下实施例均以多播组的标识为例进行说明。另外，广播业务与多播业务类似，例如这里的多播组的标识也可以替换为广播组的标识。即以下对多播组的标识的操作，同样适用广播组的标识，即对于多播业务的保护和协商流程同样适用于广播业务。这里多播组的标识可能包括IP多播地址，多播组的标识还可能包括用来标识应用或服务的信息，例如应用或服务的标识，或者，应用或服务所在网络的标识，或者接入点标识，或者接入网络标识，或者AF 所在数据网络的标识等。本申请实施例中，多播组标识可能包括临时移动组标识(temporary mobile group identity，TMGI)。
在一些实施例中，AF网元还可以向NEF网元发送安全策略。安全策略指示多播组的用户面数据的保护需求，或者说，安全策略用于标识多播组的标识对应的保护需求。该保护需求可以包括加密保护需求，和/或，完整性保护需求。加密保护需求例如可以包括上文提及的required、preferred或者not needed。完整性保护需求例如也可以包括上文提及的required、preferred或者not needed。
加密保护可以理解为对数据通过加密算法和加密密钥进行加密，得到加密后的密文。接收到数据的设备可以采用解密密钥和解密算法对密文进行解密得到数据。完整性保护可以理解为通过完整性保护算法和完整性保护密钥，对数据进行完整性保护，并输出完整性保护校验参数。接收到数据和完整性保护校验参数的设备可以通过完整性保护验证密钥和完整性保护算法对数据和完整性保护校验参数进行校验，以校验数据的完整性，例如数据被进行过删除或增加等，数据将校验不通过。
在一些实施例中，AF网元可以通过多播会话请求(multicast session request)消息向NEF网元发送该多播组的标识和安全策略。
502、NEF网元根据多播组的标识确定安全信息。
在一些实施例中，NEF网元根据多播组的标识和安全策略确定保护方式。
在一些实施例中，当NEF网元接收到多播组的标识和安全策略之后，可以先确定是否授权为该多播组的标识提供服务。
例如，1)NEF网元可以根据NEF网元的本地策略，确定是否为多播组的标识提供服务；
2)NEF网元可以向其他网元(例如UDM网元，UDR网元，PCF网元或MSF-C网元等)发送多播组的标识，以从其他网元获取多播组的标识对应的签约数据，NEF网元再根据签约数据确定是否授权为多播组的标识提供服务。可选的，该签约数据还可以包括多播组标识对应的安全策略。
3)NEF网元可以向其他网元(例如UDM网元，UDR网元，PCF网元或MSF-C网元等)发送多播组的标识，其他网元根据多播组的标识以及本地策略确定是否为多播组的标识提供服务后，向NEF网元发送指示，以指示是否授权为多播组的标识提供服务。
如果NEF网元确定为多播组的标识提供服务，那么NEF网元可以继续根据多播组的标识对应的安全策略确定保护方式。该保护方式指示是否对用户面数据执行加密保护，和/或，是否对用户面数据执行完整性保护。
可选的，这里安全策略也可以从AF网元得到，也可以从上述从其他网元请求获得，或者根据多播组的标识以及本地策略判定安全策略。
示例性的，如果安全策略的加密保护需求为required，那么NEF网元确定保护方式指示对用户面数据执行加密保护。但是如果NEF网元的能力不支持执行加密保护，则NEF网元向AF网元发送通知，以通知AF网元不能执行加密保护，并拒绝AF网元的多播会话建立请求。
如果安全策略的加密保护需求为preferred，那么NEF网元可以根据本地策略确定 开启对用户面数据执行加密保护，或关闭对用户面数据执行加密保护。如果NEF网元确定开启对用户面数据执行加密保护，则确定保护方式指示对用户面数据执行加密保护；如果NEF网元确定关闭对用户面数据执行加密保护，则确定保护方式指示不对用户面数据执行加密保护。可选的，NEF网元并向AF网元发送通知，以通知AF是否开启了加密保护。
如果安全策略的加密保护需求为not needed，那么NEF网元确定保护方式指示不对用户面数据执行加密保护。
另外，针对安全策略的完整性保护需求与加密保护需求的处理类似，不再一一赘述。
进一步的，NEF网元可以继续根据保护方式生成安全信息。
在一些实施例中，安全信息用于对多播组的用户面数据进行加密保护和/或完整性保护，安全信息包括加密密钥k1和加密算法a1，和/或，完整性保护密钥k2和完整性保护算法a2。
示例性的，如果保护方式指示对用户面数据执行加密保护，则NEF网元确定k1和a1；如果保护方式指示不对用户面数据执行加密保护，则NEF网元不需要确定k1和a1；
如果保护方式指示对用户面数据执行完整性保护，则NEF网元确定k2和a2；如果保护方式指示不对用户面数据执行完整性保护，则NEF网元不需要确定k2和a2。
在一些实施例中，NEF网元根据保护方式生成k1和k2的方式可以有多种。例如，NEF网元可以根据保护方式直接生成k1和k2，或者NEF网元还可以请求其他网元根据保护方式生成k1和k2后返回给NEF网元，本申请不进行限制。
在一些实施例中，NEF网元根据保护方式生成a1和a2的方式也可以有多种。例如，NEF网元可以根据保护方式直接生成a1和a2，或者NEF网元还可以请求其他网元根据保护方式生成a1和a2后返回给NEF网元，本申请不进行限制。在一些实施例中，如果保护方式指示不对用户面数据执行加密保护，那么a1可以为空算法，如果保护方式指示不对用户面数据执行完整性保护，那么a2可以为空算法。
在一些实施例中，如果保护方式指示不对用户面数据执行加密保护，以及不对用户面数据执行完整性保护，NEF网元也可以生成a1、a2、k1和k2，但是a1和a2均为空算法。
在一些实施例中，NEF网元还可以选择SMF，SMF的选择方式不限制。可选的，这里SMF可以为专门为多播或者广播服务的SMF功能网元。
503、NEF网元向UDR网元发送多播组的标识和安全信息。
在一些实施例中，如果步骤502中确定的保护方式指示对用户面数据进行加密保护和完整性保护，那么步骤503中发送的安全信息包括上述a1、a2、k1和k2；
如果步骤502中确定的保护方式指示对用户面数据进行加密保护，且指示不对用户面数据进行完整性保护，那么步骤503中发送的安全信息可以包括上述k1和a1，但是不包括k2和/或a2，即使包括k2或a2，k2和a2也为空；
如果步骤502中确定的保护方式指示不对用户面数据进行加密保护，且指示对用户面数据进行完整性保护，那么步骤503中发送的安全信息可以包括上述k2和a2， 但是不包括k1和/或a1，即使包括k1或a2，k1和a1也为空。
在一些实施例中，安全信息还可以包括保护方式。
在一些实施例中，安全信息还可以包括安全策略。
在一些实施例中，安全信息还可以包括SMF ID，SMF ID为NEF网元选择的SMF的ID。
在一些实施例中，NEF网元可以通过multicast session request消息向UDR网元或其他NF网元发送多播组的标识和安全信息。以下步骤以UDR网元接收到multicast session request消息为例进行描述。
504、UDR网元确定并保存安全信息与多播组的标识的对应关系。
在一些实施例中，UDR网元接收到的安全信息还包括SMF的ID时，UDR网元还可以保存SMF的ID。UDR网元还可以向NEF网元发送多播会话响应(multicast session response)消息，以指示接收到安全信息和多播组的标识。
505、NEF网元向SMF网元发送多播组的标识和安全信息。
在一些实施例中，NEF网元可以通过multicast distribution request(多播分配请求)消息发送多播组的标识和安全信息。
在一些实施例中，NEF网元还可以向PCF网元发送策略授权请求，PCF网元向NEF网元发送策略授权响应。
506、SMF网元确定并保存安全信息与多播组的标识的对应关系。
在一些实施例中，SMF网元接收到对应关系时，可以向NEF网元发送多播配置会话响应(multicast distribution session response)消息，该消息还可以携带UPF网元的入口地址(ingress address)。
在一些实施例中，NEF网元还可以向AF网元发送multicast session response消息，该消息中可以携带NEF网元的ingress address，还可以携带保护方式。
AF网元可以保存该保护方式。如果AF网元确定需要更新保护方式时，还可以根据保护方式调整安全策略，根据调整后的安全策略重新发起本实施例的方法流程。
在一些实施例中，SMF网元还可以向PCF网元发送MBS策略协商请求(policy association request)消息，PCF网元再向SMF网元发送MBS策略协商响应(MBS policy association response)消息。
507、SMF网元向UPF网元发送安全信息和多播组的标识的对应关系。
在一些实施例中，SMF网元可以通过会话请求(session request)消息向UPF网元发送该对应关系，相应地，UPF网元可以向SMF网元反馈会话响应(session response)消息，以指示接收到该对应关系。这里的会话响应可以包括UPF网元的入口地址。
508、UPF网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
由于后续AF网元发送下行的用户面数据时，AF网元是将用户面数据直接发送给UPF网元的，因此，当UPF网元保存有该安全信息时，UPF网元可以根据安全信息确定如何对用户面数据进行加密保护和完整性保护。而后，UPF网元可以将通过加密保护和完整性保护的用户面数据通过RAN网元发送UE。
在一些实施例中，若安全信息包括k1和a1，或者保护方式指示需要对用户面数据进行加密保护；则UPF网元根据k1和a1对接收到的用户面数据执行加密保护；
若安全信息包括k2和a2，或者保护方式指示需要对用户面数据进行完整性保护；则UPF网元根据k2和a2对接收到的用户面数据执行完整性保护；
若安全信息不包括k1和a1，或者保护方式指示不需要对用户面数据进行加密保护；则UPF网元不对接收到的用户面数据执行加密保护；
若安全信息不包括k2和a2法，或者保护方式指示不需要对用户面数据进行完整性保护；则UPF网元不对用户面数据执行完整性保护；
换句话说，若安全信息包括k1，且k1不是空算法，那么UPF网元根据k1对用户面数据执行加密保护；若安全信息包括k2，且k2不是空算法，那么UPF网元根据k2对用户面数据执行完整性保护；
若安全信息包括k1，且k1是空算法，那么UPF网元不对用户面数据执行加密保护；若安全信息包括k2，且k2是空算法，那么UPF网元不对用户面数据执行完整性保护。
在一些实施例中，如果保护方式指示需要执行加密保护或者完整性保护，而UPF网元当前不支持开启加密保护，则UPF网元发送拒绝消息至SMF网元。在一些实施例中，SMF网元可以拒绝建立多播会话，发送拒绝消息至NEF网元，NEF网元可以发送拒绝消息至AF网元，拒绝消息指示拒绝建立多播会话。或者，SMF网元可以重新选择UPF网元，并再次从步骤507开始执行。
在一些实施例中，后续如果新加入到多播组的UE想要获得安全信息时，UE可以通过RAN网元以及AMF网元向SMF网元请求该安全信息，或者，UE可以通过RAN网元以及UPF网元向SMF网元请求该安全信息，SMF网元如果保存有上述对应关系，可以向UE发送安全信息，SMF网元如果未保存有上述对应关系，SMF网元可以向UDR网元或PCF网元请求安全信息后下发给UE，以便UE根据安全信息对接收到的用户面数据进行解密。
需要说明的是，上述步骤502中，还包括其他可能性：NEF网元不确定保护方式，NEF网元从其他网元确定算法和密钥之后，发送算法和密钥至UDR网元。之后，NEF网元还可以发送安全策略至SMF网元，SMF网元可以根据安全策略确定保护方式，或者SMF网元发送安全策略至UPF网元，由UPF网元确定保护方式后发送给SMF网元。SMF网元还可以发送保护方式至NEF网元，之后NEF网元将保护方式保存在UDR网元。上述方式的好处在于，由最终执行加密保护和完整性保护的UPF网元来判断是否开启加密保护或者完整性保护。
在一些实施例中，上述安全信息的配置流程不需要安全策略和保护方式的处理动作，仅包括NEF网元确定加密密钥和加密算法、完整性保护密钥和完整性保护算法以及后续加密密钥和加密算法的保存和传递动作。
由此，本申请实施例提供的方法流程可以适用于5G MBS服务下的安全信息的配置流程。上述实施例主要阐述了通过NEF网元确定安全信息后存储在UDR网元中。
实施例二
如图6所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
601、AF网元向NEF网元发送多播组的标识。
在一些实施例中，AF网元还可以向NEF网元发送多播组的标识对应的安全策略。
步骤601的实现方式可以参考上述步骤501的实现方式。
602、NEF网元向UDR网元发送多播组的标识。
在一些实施例中，NEF网元还可以向UDR网元发送安全策略。
603、UDR网元根据安全策略确定多播组的标识对应的保护方式，根据保护方式生成多播组的标识对应的安全信息。
步骤603中的安全策略可以是UDR网元从其他网元(例如NEF网元)接收到的，也可以是UDR网元根据多播组的标识在本地确定的。
在一些实施例中，UDR网元也可以发送安全策略至其他网元，由其他网元根据安全策略生成了安全信息之后，再将安全信息发送给UDR网元。
其中，UDR根据多播组的标识和安全策略确定保护方式的实现方式可以参见上述步骤602中NEF网元的实现方式。
604、UDR网元向NEF网元发送多播组的标识和安全信息。
605、NEF网元向SMF网元发送多播组的标识和安全信息。
606、SMF网元向UPF网元发送多播组的标识和安全信息。
607、UPF网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
UPF网元可以根据安全信息对多播组的用户面数据进行加密保护和/或完整性保护。具体可以参见步骤508的实现方式。
与实施例一类似的，新加入多播组的UE可以向SMF网元请求安全信息，SMF网元如果保存有上述对应关系，可以向UE发送安全信息，SMF网元如果未保存有上述对应关系，SMF网元可以向UDR网元或PCF网元请求安全信息后下发给UE，以便UE根据安全信息对接收到的用户面数据进行解密。
实施例三
如图7所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
701、AF网元向NEF网元发送多播组的标识。
在一些实施例中，AF网元还可以向NEF网元发送多播组的标识对应的安全策略。
步骤701的实现方式可以参考上述步骤501的实现方式。
702、NEF网元根据多播组的标识确定多播组的标识对应的保护方式。
步骤702中的安全策略可以是NEF网元从其他网元(例如AF网元)接收到的，也可以是NEF网元根据多播组的标识在本地确定的。
步骤702的实现方式可以参考上述步骤502的实现方式。
703、NEF网元向UDR网元发送多播组的标识和保护方式。
704、UDR网元根据保护方式生成多播组的标识对应的安全信息。
UDR根据多播组的标识和安全策略确定保护方式的实现方式可以参见上述步骤602中NEF网元的实现方式。
705、UDR网元向NEF网元发送多播组的标识和安全信息。
706、NEF网元向SMF网元发送多播组的标识和安全信息。
707、SMF网元向UPF网元发送多播组的标识和安全信息。
708、UPF网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
步骤708的实现方式可以参见上述步骤508的实现方式。
可以理解，本实施例中由NEF网元确定保护方式，UDR网元根据保护方式生成安全信息发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例四
如图8所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
801、AF网元向NEF网元发送多播组的标识。
在一些实施例中，AF网元还可以向NEF网元发送多播组的标识对应的安全策略。
步骤801的实现方式可以参考上述步骤501的实现方式。
802、NEF网元向SMF网元发送多播组的标识。
在一些实施例中，NEF网元还可以向SMF网元发送多播组的标识对应的安全策略。
803、SMF网元根据安全策略确定多播组的标识对应的安全信息。
步骤803中的安全策略可以是SMF网元从NEF网元接收到的，或者SMF网元根据多播组的标识在本地生成的。
SMF网元根据安全策略确定安全信息的实现方式可以参见上述步骤502中NEF网元的实现方式。
或者，SMF网元可以根据安全策略生成保护方式，将保护方式和多播组的标识发送给NEF网元，NEF网元根据保护方式生成安全信息后反馈给SMF网元。
804、SMF网元向UDR网元发送多播组的标识和安全信息。
在一些实施例中，SMF网元还可以向PCF网元发送该多播组的标识和安全信息。
805、SMF网元向UPF网元发送多播组的标识和安全信息。
806、UPF网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
步骤806的实现方式可以参见上述步骤508的实现方式。
可以理解，本实施例中可以由SMF网元生成安全信息发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例五
如图9所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
901、AF网元向NEF网元发送多播组的标识。
在一些实施例中，AF网元还可以向NEF网元发送多播组的标识对应的安全策略。
步骤801的实现方式可以参考上述步骤501的实现方式。
902、NEF网元根据安全策略确定多播组的标识对应的保护方式。
步骤902中的安全策略可以是NEF网元从AF网元接收到的，或者NEF网元根据多播组的标识在本地生成的。
NEF网元根据安全策略确定保护方式的实现方式可以参见上述步骤502中NEF网元的实现方式。
903、NEF网元向SMF网元发送多播组的标识和保护方式。
904、SMF网元根据保护方式生成多播组的标识对应的安全信息。
SMF网元根据保护方式生成安全信息的实现方式可以参见上述步骤502中NEF网元的实现方式。
905、SMF网元向UDR网元发送多播组的标识和安全信息。
在一些实施例中，SMF网元还可以向PCF网元发送该多播组的标识和安全信息。
906、SMF网元向UPF网元发送多播组的标识和安全信息。
907、UPF网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
步骤907的实现方式可以参见上述步骤508的实现方式。
可以理解，本实施例中可以由NEF网元确定保护方式，SMF网元根据保护方式生成安全信息发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例一至实施例五的实现方式可以适用于上述架构1。
实施例六
如图10所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
101、AF网元向MSF-C网元发送多播组的标识。
在一些实施例中，AF网元还可以向MSF-C网元发送多播组的标识对应的安全策略。
步骤101的实现方式可以参见上述步骤501中AF网元向NEF网元发送多播组的标识和安全策略的实现方式。
102、MSF-C网元向UDR网元发送多播组的标识。
在一些实施例中，MSF-C网元还可以向UDR网元发送多播组的标识对应的安全策略。
103、UDR网元根据安全策略确定多播组的标识对应的安全信息。
在一些实施例中，步骤103中的安全策略可以是UDR网元从MSF-C网元接收到的，或者UDR网元根据多播组的标识在本地生成的。
步骤103的实现方式可以参见上述步骤502中NEF确定安全信息的实现方式。
104、UDR网元向MSF-C网元发送多播组的标识和安全信息。
105、MSF-C网元向MSF-U网元发送多播组的标识和安全信息。
106、MSF-U网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
步骤106的实现方式可以参见上述步骤508中UPF网元的实现方式。例如，当MSF-U网元接收到AF网元发送的多播组的用户面数据时，可以对用户面数据执行保护后发送给UPF2网元，UPF2网元通过RAN网元向UE下发用户面数据，UE可以根据从UDR网元请求得到的安全信息对用户面数据进行解密。
在一些实施例中，MSF-C网元还可以向AF网元发送保护方式。
可以理解，本实施例中可以由UDR网元根据从MSF-C网元接收到的安全策略生成安全信息，并发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例七
如图11所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
111、AF网元向MSF-C网元发送多播组的标识。
在一些实施例中，AF网元还可以向MSF-C网元发送多播组的标识对应的安全策略。
步骤101的实现方式可以参见上述步骤501中AF网元向NEF网元发送多播组的 标识和安全策略的实现方式。
112、MSF-C网元确定多播组的标识对应的保护方式。
在一些实施例中，步骤112中的安全策略可以是MSF-C网元从AF网元接收到的，或者MSF-C网元根据多播组的标识在本地生成的。
步骤112的实现方式可以参见上述步骤502中NEF网元确定保护方式的实现方式。
113、MSF-C网元向UDR网元发送多播组的标识和保护方式。
114、UDR网元根据保护方式确定多播组的标识对应的安全信息。
步骤114的实现方式可以参见上述步骤502中NEF网元确定安全信息的实现方式。
115、UDR网元向MSF-C网元发送多播组的标识和安全信息。
116、MSF-C网元向MSF-U网元发送多播组的标识和安全信息。
117、MSF-U网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
可以理解，本实施例中可以由MSF-C网元确定多播组的标识对应的保护方式，由UDR网元根据从MSF-C网元接收到的保护方式生成安全信息，并发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例八
如图12所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
121、AF网元向MSF-C网元发送多播组的标识。
在一些实施例中，AF网元还可以向MSF-C网元发送多播组的标识对应的安全策略。
步骤101的实现方式可以参见上述步骤501中AF网元向NEF网元发送多播组的标识和安全策略的实现方式。
122、MSF-C网元根据安全策略确定多播组的标识对应的安全信息。
在一些实施例中，步骤122中的安全策略可以是MSF-C网元从AF网元接收到的，或者MSF-C网元根据多播组的标识在本地生成的。
步骤122的实现方式可以参见上述步骤502中NEF网元确定安全信息的实现方式。
123、MSF-C网元向UDR网元发送多播组的标识和安全信息。
124、MSF-C网元向MSF-U网元发送多播组的标识和安全信息。
125、MSF-U网元根据安全信息执行对多播组的标识对应的用户面数据的保护。
需要说明的是，上述MSF-U网元为可选的，如果MSF-C网元确定不执行保护，那么MSF-C网元也可以不选择MSF-U。
可以理解，本实施例中可以由MSF-C网元确定多播组的标识对应的安全信息，并发送给其他NF网元执行MBS的用户面数据的保护，以保证5G MBS的用户面数据的安全。
实施例六至实施例八中，MSF-C网元也可以发送多播组的标识和安全信息至SMF网元或PCF网元，由SMF网元或PCF网元存储安全信息，后续UE请求得到安全信息时，可以向SMF网元或PCF网元请求安全信息。当然，也可以向UDR网元请求安全信息。
实施例九
实施例九将阐述UE加入多播组的标识对应的业务流程时，获取安全信息的多种 可能性实现方式。
如图13所示，本申请实施例还提供一种安全信息的配置方法，该方法包括：
131、AF网元执行多播组的安全配置流程。
该安全配置流程例如可以参考上述实施例一至实施例八中的任一实施例的配置流程。
在一些实施例中，该步骤131为可选的，即网络侧已经完成了安全配置流程，例如UDR网元中保存了多播组的标识和安全信息的对应关系；或者，网络的还未完成安全配置流程，即未执行上述实施例的配置流程。
其中，AF网元也可以替换为上下文提供者(content provider，CP)网元。
132、UE完成向网络的注册流程。
在一些实施例中，UE可以完成与网络的会话建立流程。
133、网络侧完成多播业务公告，以使得UE感知到多播业务。
步骤133为可选的。
134、UE通过用户面的方式或控制面的方式接入多播组的标识对应业务。
步骤134的目的在于，SMF1网元会确定UE希望接入的多播组的标识，具体可以根据用户面的方式中UE发送的多播组信息，例如网际组管理协议(internet group management protocol，IGMP)报文，或者多播地址，或者多播业务或应用所在的网络标识，或者多播服务/应用标识，或者多播组标识等确定，或者是根据控制面的方式中UE发送的多播组信息，例如多播地址，或者多播业务或应用所在的网络标识，或者多播服务/应用标识，或者多播组标识等确定。
这里SMF1确定多播组信息，例如多播组标识的方式不做限制。假设SMF1网元确定了UE希望接入的多播组的标识，那么该方法还包括：
135、SMF1网元请求获取多播组的标识对应的安全信息。
在一些实施例中，SMF1可以向UDR网元发送multicast request消息，消息中携带多播组的标识，以请求获取多播组的标识对应的安全信息。UDR网元存储有该安全信息时，可以通过multicast response消息向SMF1网元发送安全信息。
在一些实施例中，如果安全信息保存在PCF网元中，SMF1网元也可以向PCF网元请求获取安全信息。
在一些实施例中，这里SMF网元可以确定多播组的地址等信息，并发送多播组的地址信息至UDR网元，由UDR网元根据地址信息确定是否有对应的安全信息。
可选的，这里UE发送的多播组信息，可以为多播组的标识或者地址等，以及SMF确定的多播组信息，可以为多播组的标识或者地址等，与实施例1中AF发送的多播组的标识可以不同，但是它们具有关联性。例如多播组信息中多播的地址或者网络标识等可以与AF发送的多播组标识或者多播组标识中的网络标识一致。这里关联的方式不做限制。UDR可以根据SMF发送的多播组的信息确定之前从NEF接收到的多播组标识是否匹配。
136、SMF1网元向AMF网元发送多播组的标识和安全信息。
示例性的，SMF1网元可以通过Namf_Communication_N1N2Message Transfer消息向AMF网元发送多播组的标识和安全信息。
在一些实施例中，SMF1可以只发送安全信息至AMF。
137、AMF网元向RAN网元发送多播组的标识和安全信息。
示例性的，AMF网元可以通过N2 session request消息向RAN网元发送多播组的标识和安全信息。
在一些实施例中，AMF网元可以只发送安全信息至RAN网元。
138、RAN网元向UE发送多播组的标识和安全信息。
在一些实施例中，RAN网元可以通过PDU会话修改/接受(PDU session modification/accept)消息向UE发送多播组的标识和安全信息。
在一些实施例中，RAN网元可以只发送安全信息至UE。
在一些实施例中，PDU session modification/accept消息也可以是SMF1网元通过AMF网元和RAN网元发送给UE的消息，该消息被封装在了Namf_Communication_N1N2Message Transfer_N2 session request和RRC消息中发送给了UE。
在一些实施例中，RAN网元在还可以根据多播组的标识和安全信息完成接入网络资源的修改。
于是，UE可以根据多播组的标识和安全信息，在接收到多播组的标识对应业务的用户面数据时，可以根据安全信息对接收到的用户面数据进行解密。
下面选择执行步骤139或步骤143。
139、RAN网元向AMF网元发送N2 session response消息，该消息用于指示采用多播的方式向UE发送用户面数据。而后，可以继续执行步骤140或步骤142。
140、AMF网元向SMF1网元发送N11 session response消息，该消息用于指示采用多播的方式发送用户面数据。
在一些实施例中，如果RAN网元选择多播的方式发送用户面数据给UE，那么SMF1网元在接收到N11 session response消息时，该方法还包括：
141、SMF1网元向SMF2网元发送多播组的标识和安全信息，SMF2网元向UPF2网元发送多播组的标识和安全信息，由UPF2网元执行对该多播组的用户面数据的保护；或者，SMF1网元向SMF2网元发送多播组的标识和安全信息，SMF2网元向MSF-U网元发送多播组的标识和安全信息，由MSF-U网元执行对该多播组的用户面数据的保护(图13中未示出)。
142、AMF网元向SMF2网元发送多播组的标识和安全信息，SMF2网元向UPF2或MSF-U网元发送多播组的标识和安全信息，由UPF2网元或MSF-U网元执行对该多播组的用户面数据的保护；或者，AMF网元向MSF-C网元发送多播组的标识和安全信息，MSF-C网元再向MSF-U网元发送多播组的标识和安全信息，由MSF-U网元执行对该多播组的用户面数据的保护(图13中未示出)。
143、RAN网元向AMF网元发送N2 session response消息，该消息用于指示采用单播的方式向UE发送用户面数据。
144、AMF网元向SMF1网元发送N11 session response消息，该消息用于指示采用单播的方式发送用户面数据。
145、SMF1网元向SMF2网元发送多播组的标识和安全信息，SMF2网元向UPF2 网元或MSF-U网元发送多播组的标识和安全信息，由UPF2网元或MSF-U网元执行对该单播的用户面数据的保护；或者，SMF1网元向MSF-C网元发送多播组的标识和安全信息，MSF-C网元向MSF-U网元发送多播组的标识和安全信息，由MSF-U网元执行对该单播的用户面数据的保护。
需要说明的是，上述步骤135可以是在UDR网元保存有安全信息时，SMF1网元向UDR网元请求获得的安全信息，也就是说，步骤135是在步骤131执行了网络侧的安全配置流程之后的操作。但是，如果未执行步骤131，即未完成安全配置流程时，步骤135的实现方式可以替换为(步骤135的替换步骤在图13中未示出)：
135a、SMF1网元确定多播组的标识对应的安全信息，向UDR网元发送安全信息，由UDR保存多播组的标识与安全信息的对应关系。
后续如果UE通过SMF1网元接入多播组时，SMF1网元仍然可以从UDR网元中获取安全信息发送给UE。
或者替换为：
135b、SMF1网元向UDR网元发送多播组的标识，以请求获取安全信息。UDR网元确定安全信息后，将安全信息发送给SMF1网元。
也有可能是，UDR网元中未存储有多播组的标识对应的安全信息时，UDR网元向SMF1网元反馈未存储安全信息的指示，这时SMF1网元需要自己确定多播组的标识对应的安全信息。
或者替换为：
135c、SMF1网元向SMF2网元发送多播组的标识，以请求获取安全信息。SMF2网元确定安全信息后，将安全信息发送给UPF2网元，由UPF2网元执行对用户面数据的保护。并且，SMF2网元向SMF1网元发送安全信息。
或者替换为：
135d、SMF1网元向MSF-C网元发送多播组的标识，以请求获取安全信息。MSF-C网元确定安全信息后，将安全信息发送给MSF-U网元，由MSF-U网元执行对用户面数据的保护。并且，MSF-C网元向SMF1网元发送安全信息。
由此，本申请通过在UE注册到包括5G MBS的网络流程中添加安全信息的配置流程，可以使得5G MBS中用户面数据下发的安全性。
实施例十
实施例十将阐述UE加入多播组的标识对应的业务流程时，从网络侧只获得多播组的安全策略的一种实现方式，可以实现未与网络侧签约的UE获取签约的UE的安全策略，保证未签约的UE的数据安全。
如图14所示，本申请实施例提供一种安全策略的配置方法，该方法包括:
151、AF网元向NEF网元发送多播会话请求，请求中携带多播组的标识和安全策略。
在一些实施例中，多播会话请求为multicast session request，multicast session request中携带多播组的标识、服务质量(quality of service，QoS)请求和安全策略。
152、NEF网元确定授权为该多播组的标识提供服务时，选择SMF2网元。
153、NEF网元向UDR网元发送多播会话请求消息，请求消息中携带多播组的标 识、SMF 2ID以及安全策略。
154、UDR网元确定并保存多播组的标识和安全策略的对应关系。
155、UDR网元向NEF网元发送多播会话响应消息。
156、NEF网元向SMF2网元发送多播配置会话请求(multicast distribution session request)消息，消息中携带多播组的标识。
157、SMF2网元向PCF网元发送MBS策略协商请求(policy association request)消息，消息中携带多播组的标识。
158、PCF网元向SMF2网元发送MBS策略协商响应(policy association response)消息。
159、SMF2网元向UPF2网元发送会话请求消息。
160、UPF2网元向SMF2网元发送会话响应消息，消息中携带UPF2的ingress address。
161、SMF2网元向NEF网元发送多播配置会话响应消息，消息中携带SMF2的ingress address。
162、NEF网元向AF网元发送多播会话响应消息，消息中携带NEF网元的ingress address。
本实施例的重点为步骤151、步骤152、步骤154和步骤155。其他步骤可以为可选的。
之后，如果UE向SMF1网元请求加入多播组时，SMF2网元可以根据确定的多播组标识，向UDR网元发送该多播组标识，请求该安全策略。UDR网元根据多播组标识确定保存的安全策略之后，向SMF2网元发送安全策略，SMF2网元可以将该安全策略发送给RAN网元，以使RAN网元根据安全策略确定其与UE之间的空口保护方式，并且将空口保护方式发送给UE。通过这种方式，RAN网元基于AF网元发送给网络的安全策略，完成UE多播数据保护的定制，保证UE的数据安全。
需要说明的是，针对本申请的实施例，还可以包括去除安全策略和保护方式的协商和发送等动作，此时本申请的方案可以仅包括确定安全信息中的密钥(加密密钥和完整性保护密钥)和保护算法(加密算法和完整性保护算法)的动作。去除安全策略和保护方式等动作后，本申请的实施例可聚焦实现密钥和保护算法的共享。另外，本申请的方案也可以支持根据默认策略仅执行加密保护，或仅执行完整性保护，或者同时执行加密保护和完整性保护的机制。
针对本申请的实施例，对于密钥和/或保护算法生成的部分，可以由NEF网元/UDR网元/SMF网元等独立完成，也可以通过调用其他NF网元来完成，本申请不做限制。例如NEF网元发送保护方式至某个密钥管理网元，请求该密钥管理网元根据保护方式生成对应加密密钥和/或完整性保护密钥。之后，该密钥管理网元返回加密密钥和/或完整性保护密钥至NEF网元。另外，保护算法的选择与密钥类似，也可以由其他NF网元完成。另外，也可以密钥和算法都由其他实体完成后反馈给NEF网元。此类处理方式，可以更好的基于调用完成安全信息的确定，简化NEF网元/UDR网元/SMF网元等实体的功能。
针对本申请的实施例，UDR网元的动作也可以UDM网元等来执行，本申请实施 例不做限制。
可以理解的是，为了实现上述功能，本申请提供的网络功能网元包含了执行各个功能相应的硬件和/或软件模块。结合本文中所公开的实施例描述的各示例的算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。本领域技术人员可以结合实施例对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本实施例可以根据上述方法示例对网络功能网元进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。该网络功能网元可以为统一的数据存储库(例如UDR)网元、网络开放功能(例如NEF)网元、会话管理功能(例如SMF)网元和多播服务功能的控制面功能(MSF-C)网元等。上述集成的模块可以采用硬件的形式实现。需要说明的是，本实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用对应各个功能划分各个功能模块的情况下，图15示出了上述实施例中涉及的网络功能网元150的一种可能的组成示意图，如图15所示，该网络功能网元150可以包括：接收单元1501、确定单元1502和发送单元1503。
以下说明以UDR网元为例进行说明。
其中，接收单元1501可以用于支持网络功能网元150执行上述步骤503、步骤602、步骤703、步骤804、步骤905、步骤113、步骤123、步骤135a、步骤135b、步骤153等，和/或用于本文所描述的技术的其他过程。
确定单元1502可以用于支持网络功能网元150执行上述步骤504、步骤603、步骤704、步骤103、步骤114、步骤154等，和/或用于本文所描述的技术的其他过程。
发送单元1503可以用于支持网络功能网元150执行上述步骤604、步骤705、步骤104、步骤115、步骤155等，和/或用于本文所描述的技术的其他过程。
需要说明的是，上述方法实施例涉及的各步骤的所有相关内容均可以援引到对应功能模块的功能描述，在此不再赘述。
本实施例提供的网络功能网元150，用于执行上述安全信息的配置方法，因此可以达到与上述实现方法相同的效果。
在采用集成的单元的情况下，网络功能网元150可以包括处理模块、存储模块和通信模块。其中，处理模块可以用于对网络功能网元150的动作进行控制管理，例如，可以用于支持网络功能网元150执行上述确定单元1502执行的步骤。存储模块可以用于支持网络功能网元150存储程序代码和数据等。通信模块，可以用于支持网络功能网元150与其他设备的通信，例如与其他网络功能网元的通信，可以支持网络功能网元150执行上述接收单元1501和发送单元1503执行的步骤。
其中，处理模块可以是处理器或控制器。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理(digital signal processing，DSP)和微处理器的组合等等。存储模块可以是存储器。通信模块具体可以为射频电路、蓝 牙芯片、Wi-Fi芯片等与其他网络功能网元交互的设备。
在一个实施例中，当处理模块为处理器，存储模块为存储器，通信模块为收发器时，本实施例所涉及的网络功能网元可以为具有图16所示结构的网络功能网元160。
本申请实施例还提供一种网络功能网元，包括一个或多个处理器以及一个或多个存储器。该一个或多个存储器与一个或多个处理器耦合，一个或多个存储器用于存储计算机程序代码，计算机程序代码包括计算机指令，当一个或多个处理器执行计算机指令时，使得电子设备执行上述相关方法步骤实现上述实施例中的安全信息的配置方法。
本申请的实施例还提供一种计算机可读存储介质，该计算机存储介质中存储有计算机指令，当该计算机指令在网络功能网元上运行时，使得网络功能网元执行上述相关方法步骤实现上述实施例中的安全信息的配置方法。
本申请的实施例还提供了一种计算机程序产品，当该计算机程序产品在计算机上运行时，使得计算机执行上述相关步骤，以实现上述实施例中网络功能网元执行的安全信息的配置方法。
另外，本申请的实施例还提供一种装置，这个装置具体可以是芯片，组件或模块，该装置可包括相连的处理器和存储器；其中，存储器用于存储计算机执行指令，当装置运行时，处理器可执行存储器存储的计算机执行指令，以使芯片执行上述各方法实施例中网络功能网元执行的安全信息的配置方法。
其中，本实施例提供的网络功能网元、计算机存储介质、计算机程序产品或芯片均用于执行上文所提供的对应的方法，因此，其所能达到的有益效果可参考上文所提供的对应的方法中的有益效果，此处不再赘述。
本申请另一实施例提供了一种系统，该系统可以包括统一的数据存储库(例如UDR)网元、网络开放功能(例如NEF)网元、会话管理功能(例如SMF)网元和多播服务功能的控制面功能(MSF-C)网元中的至少一个网元，可以用于实现上述安全信息的配置方法。
通过以上实施方式的描述，所属领域的技术人员可以了解到，为描述的方便和简洁，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。
在本申请所提供的几个实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述模块或单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个装置，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是一个物理单元或多个物理单元，即可以位于一个地方，或者也可以分布到多个不同地方。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上内容，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (23)

  1. 一种安全信息的配置方法，其特征在于，所述方法应用于包括多播-广播服务架构的系统，所述系统包括第一网络功能网元和第二网络功能网元，所述方法包括：
    所述第一网络功能网元接收多播组的标识，确定所述多播组的标识对应的安全信息，所述安全信息用于对所述多播组的用户面数据进行加密保护和/或完整性保护，所述安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法；
    所述第一网络功能网元向所述第二网络功能网元发送所述安全信息，所述第二网络功能网元包括多播服务功能的用户面功能网元、多播服务功能的控制面功能网元、网络开放功能网元或会话管理功能网元中的一个或多个。
  2. 根据权利要求1所述的方法，其特征在于，所述安全信息还包括所述用户面数据的安全策略和/或保护方式；
    所述安全策略指示所述用户面数据的保护需求，所述保护需求包括加密保护需求，和/或，完整性保护需求；
    所述保护方式指示是否对所述用户面数据执行加密保护，和/或，是否对所述用户面数据执行完整性保护。
  3. 根据权利要求2所述的方法，其特征在于，所述安全信息还包括所述保护方式；
    所述接收多播组的标识，确定所述多播组的标识对应的安全信息包括：
    接收来自网络开放功能网元或多播服务功能的控制面功能网元的所述多播组的标识和所述安全策略；根据所述安全策略确定所述保护方式；或者，接收来自网络开放功能网元或多播服务功能的控制面功能网元的所述多播组的标识和所述保护方式；
    根据所述保护方式生成所述安全信息。
  4. 根据权利要求3所述的方法，其特征在于，所述向所述第二网络功能网元发送所述安全信息包括:
    向所述网络开放功能网元或所述多播服务功能的控制面功能网元发送所述安全信息。
  5. 根据权利要求3或4所述的方法，其特征在于，所述第一网络功能网元包括统一的数据存储库网元；
    根据所述保护方式生成所述安全信息之后，所述方法还包括：所述统一的数据存储库网元确定所述安全信息与所述多播组的标识的对应关系；
    所述接收多播组的标识，确定所述多播组的标识对应的安全信息还包括：
    所述统一的数据存储库网元接收来自会话管理功能网元的请求消息，所述请求消息包括所述多播组的标识；
    所述统一的数据存储库网元根据所述对应关系确定所述多播组的标识对应的安全信息；
    所述向所述第二网络功能网元发送所述安全信息包括：
    所述统一的数据存储库网元向所述会话管理功能网元发送所述安全信息。
  6. 根据权利要求2所述的方法，其特征在于，所述第一网络功能网元包括所述网络开放功能网元或所述多播服务功能的控制面功能网元，所述安全信息还包括所述保护方式；
    所述接收多播组的标识，确定所述多播组的标识对应的安全信息包括：
    所述网络开放功能网元或所述多播服务功能的控制面功能网元接收来自应用功能网元的所述多播组的标识和所述安全策略；
    所述网络开放功能网元或所述多播服务功能的控制面功能网元根据所述安全策略确定所述保护方式；
    所述网络开放功能网元或所述多播服务功能的控制面功能网元根据所述保护方式生成所述安全信息；
    所述向所述第二网络功能网元发送所述安全信息包括：所述网络开放功能网元或所述多播服务功能的控制面功能网元向统一的数据存储库网元发送所述安全信息。
  7. 根据权利要求3或6所述的方法，其特征在于，所述根据所述保护方式生成所述安全信息包括：
    若所述保护方式指示对所述用户面数据执行加密保护，则生成所述加密密钥和所述加密算法；
    若所述保护方式指示对所述用户面数据执行完整性保护，则生成所述完整性保护密钥和所述完整性保护算法。
  8. 根据权利要求2所述的方法，其特征在于，所述第一网络功能网元包括所述网络开放功能网元或所述多播服务功能的控制面功能网元；
    所述接收多播组的标识，确定所述多播组的标识对应的安全信息包括：
    所述网络开放功能网元或所述多播服务功能的控制面功能网元接收来自应用功能网元的所述多播组的标识和所述安全策略；
    所述网络开放功能网元或所述多播服务功能的控制面功能网元向统一的数据存储库网元发送所述安全策略和所述多播组的标识；或者，所述网络开放功能网元或所述多播服务功能的控制面功能网元根据所述安全策略确定所述保护方式，向统一的数据存储库网元发送所述保护方式和所述多播组的标识；
    所述网络开放功能网元或所述多播服务功能的控制面功能网元接收来自所述统一的数据存储库网元的所述安全信息。
  9. 根据权利要求7或8所述的方法，其特征在于，所述向所述第二网络功能网元发送所述安全信息包括：
    向多播服务功能的用户面功能网元或会话管理功能网元发送所述安全信息。
  10. 一种安全信息的配置方法，其特征在于，所述方法应用于终端设备，所述终端设备所在的网络包括会话管理功能网元，所述方法包括：
    向所述会话管理功能网元发送多播组的标识，以请求加入所述多播组；
    接收来自所述会话管理功能网元的安全信息，所述安全信息用于对所述多播组的用户面数据进行加密保护和/或完整性保护，所述安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，所述安全信息还包括所述用户面数据的安全策略和/或保护方式；所述安全策略指示所述用户面数据的保护需求，所述保护需求包括加密保护需求，和/或，完整性保护需求；所述保护方式指示是否对所述用户面数据执行加密保护，和/或，是否对所述用户面数据执行完整性保护；
    根据所述安全信息进行对接收到的所述用户面数据进行解密。
  11. 一种网络功能网元，其特征在于，所述网络功能网元为第一网络功能网元，所述第一网络功能网元应用于多播-广播服务架构的系统，所述系统包括所述第一网络功能网元和第二网络功能网元，所述第一网络功能网元包括：
    收发器，用于接收多播组的标识；
    处理器，用于确定所述多播组的标识对应的安全信息，所述安全信息用于对所述多播组的用户面数据进行加密保护和/或完整性保护，所述安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法；
    所述收发器，还用于向所述第二网络功能网元发送所述安全信息，所述第二网络功能网元包括多播服务功能的用户面功能网元、多播服务功能的控制面功能网元、网络开放功能网元或会话管理功能网元中的一个或多个。
  12. 根据权利要求11所述的网络功能网元，其特征在于，所述安全信息还包括所述用户面数据的安全策略和/或保护方式；
    所述安全策略指示所述用户面数据的保护需求，所述保护需求包括加密保护需求，和/或，完整性保护需求；
    所述保护方式指示是否对所述用户面数据执行加密保护，和/或，是否对所述用户面数据执行完整性保护。
  13. 根据权利要求12所述的网络功能网元，其特征在于，所述安全信息还包括所述保护方式；
    所述收发器，用于接收来自网络开放功能网元或多播服务功能的控制面功能网元的所述多播组的标识和所述安全策略，所述处理器，用于根据所述安全策略确定所述保护方式；或者，所述收发器，用于来自网络开放功能网元或多播服务功能的控制面功能网元的所述多播组的标识和所述保护方式；
    所述处理器，用于根据所述保护方式生成所述安全信息。
  14. 根据权利要求13所述的网络功能网元，其特征在于，所述收发器，用于:
    向所述网络开放功能网元或所述多播服务功能的控制面功能网元发送所述安全信息。
  15. 根据权利要求13或14所述的网络功能网元，其特征在于，所述第一网络功能网元包括统一的数据存储库网元；
    所述处理器，还用于确定所述安全信息与所述多播组的标识的对应关系；
    所述收发器，还用于接收来自会话管理功能网元的请求消息，所述请求消息包括所述多播组的标识；
    所述处理器，还用于根据所述对应关系确定所述多播组的标识对应的安全信息；
    所述收发器，还用于向所述会话管理功能网元发送所述安全信息。
  16. 根据权利要求12所述的网络功能网元，其特征在于，所述第一网络功能网元包括所述网络开放功能网元或所述多播服务功能的控制面功能网元，所述安全信息还包括所述保护方式；
    所述收发器，用于接收来自应用功能网元的所述多播组的标识和所述安全策略；
    所述处理器，用于根据所述安全策略确定所述保护方式；
    所述处理器，用于根据所述保护方式生成所述安全信息；
    所述收发器，用于向统一的数据存储库网元发送所述安全信息。
  17. 根据权利要求13或16所述的网络功能网元，其特征在于，所述处理器，用于：
    若所述保护方式指示对所述用户面数据执行加密保护，则生成所述加密密钥和所述加密算法；
    若所述保护方式指示对所述用户面数据执行完整性保护，则生成所述完整性保护密钥和所述完整性保护算法。
  18. 根据权利要求12所述的网络功能网元，其特征在于，所述第一网络功能网元包括所述网络开放功能网元或所述多播服务功能的控制面功能网元；
    所述收发器，用于接收来自应用功能网元的所述多播组的标识和所述安全策略；
    所述收发器，用于向统一的数据存储库网元发送所述安全策略和所述多播组的标识；或者，所述处理器，用于根据所述安全策略确定所述保护方式，所述收发器，用于向统一的数据存储库网元发送所述保护方式和所述多播组的标识；
    所述收发器，用于接收来自所述统一的数据存储库网元的所述安全信息。
  19. 根据权利要求17或18所述的网络功能网元，其特征在于，所述收发器，用于：
    向多播服务功能的用户面功能网元或会话管理功能网元发送所述安全信息。
  20. 一种终端设备，其特征在于，所述终端设备所在的网络包括会话管理功能网元，所述终端设备包括：
    收发器，用于向所述会话管理功能网元发送多播组的标识，以请求加入所述多播组；
    所述收发器，还用于接收来自所述会话管理功能网元的安全信息，所述安全信息用于对所述多播组的用户面数据进行加密保护和/或完整性保护，所述安全信息包括加密密钥和加密算法，和/或，完整性保护密钥和完整性保护算法，所述安全信息还包括所述用户面数据的安全策略和/或保护方式；所述安全策略指示所述用户面数据的保护需求，所述保护需求包括加密保护需求，和/或，完整性保护需求；所述保护方式指示是否对所述用户面数据执行加密保护，和/或，是否对所述用户面数据执行完整性保护；
    处理器，用于根据所述安全信息进行对接收到的所述用户面数据进行解密。
  21. 根据权利要求10所述的方法或20所述的终端设备，其特征在于，所述安全信息还包括所述用户面数据的安全策略和/或保护方式；
    所述安全策略指示所述用户面数据的保护需求，所述保护需求包括加密保护需求，和/或，完整性保护需求；
    所述保护方式指示是否对所述用户面数据执行加密保护，和/或，是否对所述用户面数据执行完整性保护。
  22. 一种计算机可读存储介质，其特征在于，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述权利要求1-9中的任一项所述的方法。
  23. 一种计算机可读存储介质，其特征在于，包括计算机指令，当计算机指令在电子设备上运行时，使得电子设备执行上述权利要求10或21所述的方法。
PCT/CN2020/108022 2020-08-07 2020-08-07 一种安全信息的配置方法和装置 WO2022027696A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/CN2020/108022 WO2022027696A1 (zh) 2020-08-07 2020-08-07 一种安全信息的配置方法和装置
CN202080104217.0A CN116134841A (zh) 2020-08-07 2020-08-07 一种安全信息的配置方法和装置
EP20947824.7A EP4187937A4 (en) 2020-08-07 2020-08-07 METHOD AND DEVICE FOR CONFIGURATION OF SECURITY INFORMATION

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/108022 WO2022027696A1 (zh) 2020-08-07 2020-08-07 一种安全信息的配置方法和装置

Publications (1)

Publication Number Publication Date
WO2022027696A1 true WO2022027696A1 (zh) 2022-02-10

Family

ID=80116866

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/108022 WO2022027696A1 (zh) 2020-08-07 2020-08-07 一种安全信息的配置方法和装置

Country Status (3)

Country Link
EP (1) EP4187937A4 (zh)
CN (1) CN116134841A (zh)
WO (1) WO2022027696A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024083105A1 (en) * 2022-10-21 2024-04-25 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for user plane security of virtual network group

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110169104A (zh) * 2017-01-05 2019-08-23 华为技术有限公司 具有组播和广播多媒体子系统能力的网络架构
CN111406415A (zh) * 2017-11-22 2020-07-10 华为技术有限公司 多播和广播服务的方法和系统
CN111465060A (zh) * 2019-01-21 2020-07-28 华为技术有限公司 一种确定安全保护方式的方法、装置及系统
WO2020153894A1 (en) * 2019-01-21 2020-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Securing the user plane path for a group communication session based on a security policy common to all devices in the group

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108347416B (zh) * 2017-01-24 2021-06-29 华为技术有限公司 一种安全保护协商方法及网元

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110169104A (zh) * 2017-01-05 2019-08-23 华为技术有限公司 具有组播和广播多媒体子系统能力的网络架构
CN111406415A (zh) * 2017-11-22 2020-07-10 华为技术有限公司 多播和广播服务的方法和系统
CN111465060A (zh) * 2019-01-21 2020-07-28 华为技术有限公司 一种确定安全保护方式的方法、装置及系统
WO2020153894A1 (en) * 2019-01-21 2020-07-30 Telefonaktiebolaget Lm Ericsson (Publ) Securing the user plane path for a group communication session based on a security policy common to all devices in the group

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024083105A1 (en) * 2022-10-21 2024-04-25 Telefonaktiebolaget Lm Ericsson (Publ) Method and apparatus for user plane security of virtual network group

Also Published As

Publication number Publication date
EP4187937A4 (en) 2023-08-02
CN116134841A (zh) 2023-05-16
EP4187937A1 (en) 2023-05-31

Similar Documents

Publication Publication Date Title
US20210051474A1 (en) Network architecture having multicast and broadcast multimedia subsystem capabilities
US9520996B2 (en) Ciphering data for transmission in a network
EP1530339B1 (en) Method and apparatuses for access control to encrypted data services for a vehicle entertainment and information processing device
JP4634389B2 (ja) 無線通信システムにおけるブロードキャストアプリケーションのための方法および装置
US8495363B2 (en) Securing messages associated with a multicast communication session within a wireless communications system
US8184569B2 (en) Method for terminal to join multicast broadcast service in wireless network and system using thereof
WO2021189933A1 (zh) 一种配置无线承载的方法、装置及系统
US20230179400A1 (en) Key management method and communication apparatus
WO2022027696A1 (zh) 一种安全信息的配置方法和装置
JP2023550280A (ja) マルチキャスト暗号化鍵を分配するための方法及びデバイス
US20090136043A1 (en) Method and apparatus for performing key management and key distribution in wireless networks
WO2009003383A1 (fr) Procédé de multidiffusion, dispositif de réseau et système de multidiffusion
WO2022033491A1 (zh) 用于鉴权的方法和通信装置
US9686254B2 (en) Method, wireless device, computer program and computer program product for assisting access to access protected services
WO2022036600A1 (zh) 密钥更新方法、装置、设备及存储介质
ES2354428T3 (es) Procedimiento y aparato para aplicación de difusión en un sistema de comunicación inalámbrica.
CN116830533A (zh) 用于分发多播加密密钥的方法和设备
CN116506810A (zh) 一种验证方法、通信装置及通信系统
CN117158010A (zh) 组播广播服务密钥
KR20050076433A (ko) 멀티미디어 방송/멀티캐스트 서비스 시스템에서 방송서비스 데이터를 효율적으로 보호화 하는 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20947824

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2020947824

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2020947824

Country of ref document: EP

Effective date: 20230223

NENP Non-entry into the national phase

Ref country code: DE