WO2022087993A1 - 一种数据传输方法及相关装置 - Google Patents

一种数据传输方法及相关装置 Download PDF

Info

Publication number
WO2022087993A1
WO2022087993A1 PCT/CN2020/124975 CN2020124975W WO2022087993A1 WO 2022087993 A1 WO2022087993 A1 WO 2022087993A1 CN 2020124975 W CN2020124975 W CN 2020124975W WO 2022087993 A1 WO2022087993 A1 WO 2022087993A1
Authority
WO
WIPO (PCT)
Prior art keywords
request message
security
access network
secure communication
information
Prior art date
Application number
PCT/CN2020/124975
Other languages
English (en)
French (fr)
Inventor
陶振宇
张友明
曾侃
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2020/124975 priority Critical patent/WO2022087993A1/zh
Publication of WO2022087993A1 publication Critical patent/WO2022087993A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/10—Integrity
    • H04W12/108—Source integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent

Definitions

  • the present application relates to the field of communications, and in particular, to a data transmission method and related apparatus.
  • location service is becoming more and more important in practical applications, and users are paying more and more attention to the security of personal privacy-sensitive data, especially enterprise users.
  • LCS location service
  • the LCS function can involve specific positioning services for enterprise users, such as asset inventory, resource scheduling and other services.
  • specific positioning service is involved, when the LCS function is applied, sensitive data including the user's personal privacy can be transmitted between different communication devices. For example, terminal equipment, access and mobility management function (AMF) network elements, location management function (location management function, LMF) network elements, etc.
  • AMF access and mobility management function
  • LMF location management function
  • the embodiments of the present application provide a data transmission method and a related device, and by implementing the embodiments of the present application, the security of data transmission is improved in the process of implementing the positioning service.
  • a first aspect a data transmission method, the method is applied to a first device, and the method includes:
  • the first information is obtained according to the second information.
  • the second device is the terminal device, and the method further includes:
  • the first secure communication tunnel establishment request message is used to request the establishment of a first secure communication tunnel
  • the first secure communication tunnel establishment request message includes a first security protection parameters
  • the first security protection parameter includes a first encryption algorithm and a first integrity protection algorithm
  • the first security protection parameter is used for the terminal device to perform secure communication
  • the sending the security-protected first request message to the second device includes:
  • the first request message protected by security is sent to the terminal device through the first secure communication tunnel.
  • the method further includes:
  • the performing security protection on the first request message to obtain the security-protected first request message includes:
  • security protection is performed on the first request message to obtain the security-protected first request message.
  • the security protection of the first request message based on the LCS security capability information of the terminal device is implemented, thereby improving the security of data transmission in the process of implementing the positioning service.
  • the method further includes:
  • the second security protection parameter includes a first encryption key and a first integrity protection key; or, the second security protection parameter includes a first parameter, and the first parameter is used to determine the first an encryption key and the first integrity protection key;
  • the performing security protection on the first request message according to the LCS security capability information of the terminal device to obtain the security-protected first request message including:
  • security protection is performed on the first request message to obtain the security-protected first request message.
  • the acquisition of the second security protection parameter is achieved, so that the first device can perform security protection on the first request message according to the second security protection parameter, thereby improving the data transmission in the process of implementing the positioning service. security.
  • the second device is the access network device, and the method further includes:
  • the second secure communication tunnel establishment request message is used to request establishment of a second secure communication tunnel
  • the second secure communication tunnel establishment request message includes a third a security protection parameter
  • the third security protection parameter includes a second encryption algorithm and a second integrity protection algorithm
  • the third security protection parameter is used for the access network device to perform secure communication
  • the sending the security-protected first request message to the second device includes:
  • the first request message protected by security is sent to the access network device through the second secure communication tunnel.
  • the method further includes:
  • the performing security protection on the first request message to obtain the security-protected first request message includes:
  • the security protection of the first request message is implemented based on the second encryption algorithm and the second integrity protection algorithm, thereby improving the security of data transmission in the process of implementing the positioning service.
  • the method further includes:
  • the performing security protection on the first request message to obtain the security-protected first request message includes:
  • security protection is performed on the first request message to obtain the security-protected first request message.
  • the security protection of the first request message is implemented based on the LCS security capability information of the access network device, thereby improving the security of data transmission in the process of implementing the positioning service.
  • the method further includes:
  • the fourth security protection parameter includes a second encryption key and a second integrity protection key; or, the fourth security protection parameter includes a second parameter, and the second parameter is used to determine the second an encryption key and the second integrity protection key;
  • the performing security protection on the first request message according to the LCS security capability information of the access network device to obtain the security-protected first request message including:
  • security protection is performed on the first request message to obtain the security-protected first request message.
  • the acquisition of the fourth security protection parameter is realized, so that the first device can perform security protection on the first request message according to the fourth security protection parameter, thereby improving the data transmission in the process of implementing the positioning service. security.
  • the obtaining the first information according to the second information includes:
  • the first information is obtained by decrypting and verifying the integrity protection of the second information according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key.
  • the obtaining the first information according to the second information includes:
  • Decryption and integrity protection verification are performed on the second information according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key to obtain the first information.
  • the access network device includes a first access network device and a second access network device, the first access network device is a device currently accessed by the terminal device, and the second access network device is The network device is an access network device to which a neighboring cell of the current serving cell of the terminal device belongs, and the method further includes:
  • the third secure communication tunnel establishment request message is used to request the establishment of a third secure communication tunnel
  • the third secure communication tunnel establishment request message includes a fifth security protection parameter, where the fifth security protection parameter includes a third encryption algorithm and a third integrity protection algorithm, and the fifth security protection parameter is used for the first access network device to perform secure communication;
  • the sending the security-protected first request message to the second device includes:
  • the first request message protected by security is sent to the second access network device through the fourth secure communication tunnel.
  • the obtaining the first information according to the second information includes:
  • Decryption and integrity protection verification are performed on the second information according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key to obtain the first information.
  • a data transmission method is provided, the method is applied to a second device, and the method includes:
  • the second information is sent to the first device.
  • the second device is the terminal device, and the method further includes:
  • first secure communication tunnel establishment request message from the first device, where the first secure communication tunnel establishment request message is used to request establishment of a first secure communication tunnel, and the first secure communication tunnel establishment request message includes a first secure communication tunnel establishment request message.
  • Security protection parameters include a first encryption algorithm and a first integrity protection algorithm, and the first security protection parameters are used for the terminal device to perform secure communication;
  • the receiving the first security-protected request message from the first device includes:
  • the secured first request message from the first device is received through the first secure communication tunnel.
  • the obtaining the first request message according to the security-protected first request message includes:
  • the performing security protection on the first information to obtain the second information includes:
  • the method further includes:
  • the fourth device Send a first registration request message to the fourth device, where the first registration request message includes the identifier of the terminal device and the LCS security capability information of the terminal device.
  • the second device is an access network device, and the method further includes:
  • the second secure communication tunnel establishment request message is used to request establishment of a second secure communication tunnel
  • the second secure communication tunnel establishment request message includes a third a security protection parameter
  • the third security protection parameter includes a second encryption algorithm and a second integrity protection algorithm
  • the third security protection parameter is used for the access network device to perform secure communication
  • the receiving the first security-protected request message from the first device includes:
  • the secured first request message from the first device is received through the second secure communication tunnel.
  • the method further includes:
  • the method further includes:
  • the obtaining the first request message according to the security-protected first request message includes:
  • the performing security protection on the first information to obtain the second information includes:
  • the second device is an access network device
  • the access network device includes a first access network device and a second access network device
  • the first access network device is the current terminal device.
  • the second access network device is the access network device to which the neighboring cell of the current serving cell of the terminal device belongs, and the method further includes:
  • the first access network device receives a third secure communication tunnel establishment request message from the first device, where the third secure communication tunnel establishment request message is used to request establishment of a third secure communication tunnel, and the third secure communication tunnel establishment request message is used to request the establishment of a third secure communication tunnel.
  • the communication tunnel establishment request message includes a fifth security protection parameter, the fifth security protection parameter includes a third encryption algorithm and a third integrity protection algorithm, and the fifth security protection parameter is used by the first access network device to perform secure communications;
  • the second access network device receives a fourth secure communication tunnel establishment request message from the first device, where the fourth secure communication tunnel establishment request message is used to request establishment of a fourth secure communication tunnel, and the fourth secure communication tunnel establishment request message is used to request the establishment of a fourth secure communication tunnel.
  • the communication tunnel establishment request message includes a sixth security protection parameter, the sixth security protection parameter includes a fourth encryption algorithm and a fourth integrity protection algorithm, and the sixth security protection parameter is used for the second access network device to perform secure communications;
  • the receiving the first security-protected request message from the first device includes:
  • the second access network device receives the security-protected first request message from the first device through the fourth secure communication tunnel.
  • the obtaining the first request message according to the security-protected first request message includes:
  • the third encryption algorithm the third integrity protection algorithm, the third encryption key and the third integrity protection key, the first access network device performing decryption and integrity protection verification on the first request message to obtain the first request message;
  • the fourth encryption algorithm the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key, the second access network device
  • the first request message is decrypted and integrity protected and verified to obtain the first request message.
  • the performing security protection on the first information to obtain the second information includes:
  • the first access network device performs processing on the first information according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key. Security protection, obtaining the second information;
  • the second access network device performs processing on the first information according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key. For security protection, the second information is obtained.
  • a first device including a processing module and a transceiver module, wherein,
  • the processing module is configured to perform security protection on the first request message, and obtain the security-protected first request message, where the first request message is used to request first information of the terminal device, and the first information includes Location information or positioning measurement information of the terminal device;
  • the transceiver module configured to send the security-protected first request message to a second device, where the second device is the terminal device or an access network device;
  • the transceiver module is further configured to receive second information from the second device, where the second information includes the security-protected first information;
  • the processing module is further configured to obtain the first information according to the second information.
  • the second device is the terminal device, and the transceiver module is also used for
  • the transceiver module When sending the security-protected first request message to the second device, the transceiver module is configured to send the security-protected first request message to the terminal device through the first secure communication tunnel The first request message.
  • the transceiver module is further configured to receive LCS security capability information of the terminal device;
  • the processing module is further configured to perform security on the first request message according to the LCS security capability information of the terminal device protection, and obtain the first request message that is protected by security.
  • the transceiver module is further configured to send a second request message to a third device, where the second request message includes an identifier of the terminal device, and the second request message is used to request a second security protection parameter ; receive a response from the second request message from the third device, where the response to the second request message includes the second security protection parameter;
  • the second security protection parameter includes a first encryption key and a first integrity protection key; or, the second security protection parameter includes a first parameter, and the first parameter is used to determine the first an encryption key and the first integrity protection key;
  • the processing module When performing security protection on the first request message according to the LCS security capability information of the terminal device, and obtaining the security-protected first request message, the processing module is configured to perform security protection on the first request message according to the terminal device the LCS security capability information and the second security protection parameter, perform security protection on the first request message, and obtain the security-protected first request message.
  • the second device is the access network device, and the transceiver module is further configured to
  • the transceiver module When sending the security-protected first request message to the second device, the transceiver module is configured to send the security-protected request message to the access network device through the second secure communication tunnel the first request message.
  • the transceiver module is further configured to receive the identifier of the access network device
  • the processing module is further configured to determine a second encryption algorithm and a second integrity protection algorithm corresponding to the access network device according to the identifier of the access network device;
  • the processing module is configured to, according to the second encryption algorithm and the second integrity protection algorithm, perform a The first request message is subjected to security protection, and the security-protected first request message is obtained.
  • the transceiver module is further configured to receive the LCS security capability information of the access network device;
  • the processing module is further configured to, according to the LCS security capability information of the access network device, perform a Perform security protection on a request message, and obtain the security-protected first request message.
  • the transceiver module is further configured to send a third request message to a third device, where the third request message includes an identifier of the access network device, and the third request message is used to request a fourth security protection parameters; receiving a response to the third request message from the third device, where the response to the third request message includes the fourth security protection parameter;
  • the fourth security protection parameter includes a second encryption key and a second integrity protection key; or, the fourth security protection parameter includes a second parameter, and the second parameter is used to determine the second an encryption key and the second integrity protection key;
  • the processing module When performing security protection on the first request message according to the LCS security capability information of the access network device, and obtaining the security-protected first request message, the processing module is further configured to LCS security capability information of the access network device and the fourth security protection parameter, perform security protection on the first request message, and obtain the security-protected first request message.
  • the processing module is configured to
  • the first information is obtained by decrypting and verifying the integrity protection of the second information according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key.
  • the processing module is configured to
  • Decryption and integrity protection verification are performed on the second information according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key to obtain the first information.
  • the access network device includes a first access network device and a second access network device, the first access network device is a device currently accessed by the terminal device, and the second access network device is The network device is the access network device to which the neighboring cell of the current serving cell of the terminal device belongs, and the transceiver module is further used for
  • the third secure communication tunnel establishment request message is used to request the establishment of a third secure communication tunnel
  • the third secure communication tunnel establishment request message includes a fifth security protection parameter, where the fifth security protection parameter includes a third encryption algorithm and a third integrity protection algorithm, and the fifth security protection parameter is used for the first access network device to perform secure communication;
  • Sending a fourth secure communication tunnel establishment request message to the second access network device where the fourth secure communication tunnel establishment request message is used to request the establishment of a fourth secure communication tunnel, and the fourth secure communication tunnel establishment request message includes a sixth security protection parameter, the sixth security protection parameter includes a fourth encryption algorithm and a fourth integrity protection algorithm, and the sixth security protection parameter is used for the second access network device to perform secure communication;
  • the transceiver module When sending the security-protected first request message to the second device, the transceiver module is configured to:
  • the first request message protected by security is sent to the second access network device through the fourth secure communication tunnel.
  • the processing module is configured to
  • Decryption and integrity protection verification are performed on the second information according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key to obtain the first information.
  • a second device including a transceiver module and a processing module, wherein,
  • the transceiver module is configured to receive a first security-protected request message from a first device, where the first request message is used to request first information of a terminal device, where the first information includes the location of the terminal device information or positioning measurement information;
  • the processing module is configured to obtain the first request message according to the security-protected first request message; obtain the first information according to the first request message; performing security protection to obtain second information, where the second information includes the security-protected first information;
  • the transceiver module is further configured to send the second information to the first device.
  • the second device is the terminal device, and the transceiver module is also used for
  • first secure communication tunnel establishment request message from the first device, where the first secure communication tunnel establishment request message is used to request establishment of a first secure communication tunnel, and the first secure communication tunnel establishment request message includes a first secure communication tunnel establishment request message.
  • Security protection parameters include a first encryption algorithm and a first integrity protection algorithm, and the first security protection parameters are used for the terminal device to perform secure communication;
  • the transceiver module is further configured to
  • the secured first request message from the first device is received through the first secure communication tunnel.
  • the processing module is configured to:
  • the processing module when performing security protection on the first information and obtaining the second information, is configured to:
  • the transceiver module is further configured to send a first registration request message to the fourth device, where the first registration request message includes the identifier of the terminal device and the LCS security capability information of the terminal device.
  • the second device is an access network device, and the transceiver module is further used for
  • the second secure communication tunnel establishment request message is used to request establishment of a second secure communication tunnel
  • the second secure communication tunnel establishment request message includes a third a security protection parameter
  • the third security protection parameter includes a second encryption algorithm and a second integrity protection algorithm
  • the third security protection parameter is used for the access network device to perform secure communication
  • the transceiver module is further configured to
  • the secured first request message from the first device is received through the second secure communication tunnel.
  • the transceiver module is further configured to send the identifier of the access network device to the first device.
  • the transceiver module is further configured to send the LCS security capability information of the access network device to the first device.
  • the processing module is configured to:
  • the processing module when performing security protection on the first information and obtaining the second information, is configured to:
  • the second device is an access network device, the access network device includes a first access network device and a second access network device, and the first access network device is the current terminal device.
  • the second access network device is the access network device to which the neighboring cell of the current serving cell of the terminal device belongs,
  • the transceiver module is configured to receive a third secure communication tunnel establishment request message from the first device, the third secure communication tunnel establishment request The message is used to request the establishment of a third secure communication tunnel, the third secure communication tunnel establishment request message includes a fifth security protection parameter, and the fifth security protection parameter includes a third encryption algorithm and a third integrity protection algorithm, and the The fifth security protection parameter is used for the first access network device to perform secure communication;
  • the transceiver module is configured to receive a fourth secure communication tunnel establishment request message from the first device, the fourth secure communication tunnel establishment request The message is used to request the establishment of a fourth secure communication tunnel, the fourth secure communication tunnel establishment request message includes a sixth security protection parameter, and the sixth security protection parameter includes a fourth encryption algorithm and a fourth integrity protection algorithm, and the The sixth security protection parameter is used for the second access network device to perform secure communication;
  • the transceiver module is configured to send a response to the third secure communication tunnel establishment request message
  • the transceiver module is configured to send a response to the fourth secure communication tunnel establishment request message
  • the transceiver module is configured to receive, through the third secure communication tunnel, the security-protected first access network device from the first device. a request message;
  • the transceiver module is configured to receive the secured first device from the first device through the fourth secure communication tunnel. a request message.
  • the processing module is configured to, according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the The third integrity protection key is used to decrypt and verify the integrity protection of the security-protected first request message to obtain the first request message;
  • the processing module is configured to, according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the The fourth integrity protection key is used to decrypt the security-protected first request message and perform integrity protection verification to obtain the first request message.
  • the processing module is configured to, according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, to perform security protection on the first information, to obtain the second information;
  • the processing module is configured to, according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the The fourth integrity protection key is used to perform security protection on the first information to obtain the second information.
  • a first device comprising a processor, a memory, an input interface and an output interface
  • the input interface is used to receive information from other communication devices other than the first device
  • the output interface is used for For outputting information to other communication devices other than the first device
  • the processor invokes the computer program stored in the memory to implement the method according to any one of the first aspects.
  • the first device may be a chip implementing the method in the first aspect or a device including a chip.
  • a second device comprising a processor, a memory, an input interface and an output interface, the input interface is used to receive information from other communication devices other than the second device, and the output interface is used for For outputting information to other communication devices other than the second device, the processor invokes the computer program stored in the memory to implement the method according to any one of the second aspects.
  • the first device may be a chip implementing the method of the second aspect or a device including a chip.
  • a computer-readable storage medium is provided, and a computer program is stored in the computer-readable storage medium, and when the computer program is executed, any one of the first aspect or the second aspect is implemented. method.
  • a computer program product which, when a computer reads and executes the computer program product, causes the computer to execute the method to implement any one of the first aspect or the second aspect.
  • a communication system including the above-mentioned first device, and/or the above-mentioned second device.
  • FIG. 1 is an architecture diagram of a location positioning service of a 5G network in a non-roaming scenario provided by an embodiment of the present application;
  • FIG. 2A is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2B is a schematic diagram of a specific possible network architecture to which the embodiment of the present application is applicable;
  • FIG. 3 is a schematic flowchart of a data transmission method provided by an embodiment of the present application.
  • Figure 4 is a protocol layer
  • FIG. 5 is another protocol layer
  • FIG. 6 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of a simplified terminal device provided by an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a simplified access network device according to an embodiment of the present application.
  • At least one (a) of a, b, or c can represent: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c may be single or multiple .
  • the singular expressions "a”, “an”, “the”, “above”, “the” and “the” are intended to also include such expressions as “one or more” unless the context clearly dictates otherwise. to the contrary.
  • the ordinal numbers such as “first” and “second” mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used to limit the order, sequence, priority or priority of multiple objects. Importance.
  • references to "one embodiment” or “some embodiments” or the like described in the embodiments of the present application mean that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the present application.
  • appearances of the phrases “in one embodiment,” “in some embodiments,” “in other embodiments,” “in other embodiments,” etc. in various places in this specification are not necessarily All refer to the same embodiment, but mean “one or more but not all embodiments” unless specifically emphasized otherwise.
  • the terms “including”, “including”, “having” and their variants mean “including but not limited to” unless specifically emphasized otherwise.
  • the first request message refers to a message for requesting a positioning task for a specific terminal device.
  • the positioning task can be a location immediate request (LIR) service or a location deferred request (LDR) service.
  • LIR location immediate request
  • LDR location deferred request
  • the mobile communication network can inform the positioning of the location information of the terminal device or the location-related positioning events.
  • the requester of the task that is, the positioning requester.
  • a location server or a location management function (LMF) network element can be used to manage location requests for specific terminal devices.
  • LMF location management function
  • the management of the first request message means that the designated location server or the LMF network element can be used to feed back the location information of the terminal device to the location requester according to the first request message sent by the location requester, or indicate to the location requester that the terminal device has been positioned. Requests the indicated location event.
  • the immediate request service is a positioning service of "immediate request, immediate response", and the first request message may include LIR.
  • the location request is directed to the core network element where the terminal device is located, such as the access and mobility management function (AMF) network element or the gateway mobile location center (GMLC)
  • the network element sends the LIR, which is forwarded by the AMF network element or GMLC to the positioning server or other network elements in the core network, such as the LMF network element, so that the positioning server or the LMF network element can immediately feed back the location information of the terminal device to the positioning requester based on the LIR.
  • AMF access and mobility management function
  • GMLC gateway mobile location center
  • the location delay request service is delayed, and the location requester is equivalent to subscribing to the terminal device, the core network element where the terminal device is located, or other related network elements for the location report of the terminal device.
  • the report can be triggered after a certain location event is met. Positioning events, for example, the terminal device moves out of or moves to a certain area, the terminal device moves a distance that reaches a threshold distance, or satisfies a preset reporting period, etc.
  • the report can carry the location information of the terminal device, and/or the report is available It is used to indicate that the above location events are satisfied, such as instructing the terminal device to move out or move to a certain area and so on.
  • the core network element where the terminal device is located can calculate and obtain the location information of the terminal device.
  • the LMF network element or the positioning server may calculate and obtain the position information of the terminal device based on the first request message sent by the positioning requester and the positioning measurement information of the terminal device reported by the terminal device, and feed back the position of the terminal device to the positioning requester. information.
  • the LMF network element or the positioning server may generate the above-mentioned positioning event report according to the position information of the terminal device.
  • the positioning measurement information of the terminal device includes one or more of the following: longitude where the terminal device is located, latitude where the terminal device is located, altitude where the terminal device is located, horizontal speed and vertical speed.
  • the location information of the terminal device which may be the geographic location coordinates in a certain location system (for example, a global positioning system (GPS) or a Beidou satellite system).
  • the terminal device in this embodiment of the present application, is an object that specifies the positioning task requested by the bit requester.
  • the secure user plane location enabled terminal SET
  • the client of the location service that is, the object of the location task requested by the location requester, such as an Android smartphone.
  • the network element of the core network where the terminal equipment is located such as the LMF network element or the positioning server, can provide the positioning requester with the location information of the terminal equipment based on the positioning request of the positioning requester, or inform the positioning requester that the terminal equipment has satisfied the positioning indicated by the positioning request. event.
  • the positioning requester refers to a network element of the core network, such as an LMF network element or a positioning server, that requests a communication device for providing a positioning task for a terminal, which may be a terminal device or an external device with positioning requirements.
  • Clients such as servers, network elements in a wireless communication network, or other carriers that have location requirements for locating terminal equipment.
  • a secure user plane location (SUPL) agent is an application that needs to obtain location information, that is, a location service client defined by a 5G network.
  • SUPL Agent can run in SET or in SUPL network. Among them, if the SUPL Agent runs in the SET, the positioning requester is the terminal device. If the SUPL Agent runs in the SUPL network, the positioning requester is an external client with positioning requirements.
  • the positioning server is deployed in the MEC manner in this embodiment of the present application, which may be an MEC platform or a server.
  • the specific deployment form of the positioning server is not limited in this application. Specifically, it may be cloud deployment, or may be independent computer equipment or chips.
  • the data interaction between the positioning server and the terminal device can be directly carried out through the user plane.
  • SUPL is a positioning protocol defined by the operation administration and maintenance (OAM) organization.
  • OAM operation administration and maintenance
  • the positioning server can interact with the terminal device through the user plane based on the SUPL protocol, that is, the terminal device can transmit SUPL packets through the user plane.
  • the SUPL message can encapsulate the location information, location measurement information, etc. of the terminal device reported by the terminal and the first request message issued by the location server to the terminal device.
  • the location-based service architecture of a 5G network may include terminal equipment, access network equipment, location service (LCS) client, access and mobility management function (AMF) network element, location management function (LMF) network element, unified data management (UDM) network element, gateway mobile location center (GMLC) network element, location retrieval function (location retrieval function) function, LRF) network element, network exposure function (NEF) network element, application function (application function, AF) network element.
  • the GMLC network element and the LRF network element may be deployed in a convergent manner, or may be deployed independently. Further, when the LMF network element is not deployed, the AMF network element and the GMLC network element can be used to realize positioning.
  • FIG. 1 is an architectural diagram of a location positioning service of a 5G network in a non-roaming scenario provided by an embodiment of the present application.
  • the terminal equipment can be connected with the AMF network element, and the access network equipment can also be connected with the AMF network element.
  • the AMF network element can be connected to the UDM network element, the LMF network element, the NEF network element, and the GMLC network element, respectively.
  • the UDM network element can be connected to the NEF network element and the GMLC network element respectively.
  • the NEF network element can be connected to the AF network element and the GMLC network element respectively.
  • the LCS client can be connected to the GMLC network element and the LRF network element respectively.
  • the N1 interface is the reference point between the terminal device and the AMF network element.
  • the N2 interface is the reference point between the access network device and the AMF network element, and is used for sending non-access stratum (NAS) messages and next generation application protocol (NGAP) messages, etc.
  • the NL1 interface is the reference point between the AMF network element and the LMF network element.
  • the N8 interface is the reference point between the AMF network element and the UDM network element.
  • the NL2 interface is the reference point between the AMF network element and the GMLC network element.
  • the N51 interface is the reference point between the AMF network element and the NEF network element.
  • the NL7 interface is the reference point between the LMF network element and other LMF network elements.
  • the N52 interface is the reference point between the UDM network element and the NEF network element.
  • the NL6 interface is the reference point between the UDM network element and the GMLC network element.
  • the NL5 interface is the reference point between the NEF network element and the GMLC network element.
  • the N33 interface is the reference point between the NEF network element and the AF network element.
  • the Le interface may be the reference point between the LCS client and the GMLC network element, or may be the reference point between the LCS client and the LRF network element.
  • the protocol standard positioning services can be divided into three types: terminal originating location request (MO-LR), terminal terminating location request (MT-LR) and terminal terminating location request (MT-LR) and Network induced location request (NI-LR).
  • MO-LR is a positioning request initiated by the terminal device
  • MT-LR is a positioning request initiated by the LCS client to the LCS server
  • NI-LR is a positioning request initiated from the PLMN that is serving the terminal device.
  • a user equipment (UE) assisted positioning procedure can be used to achieve positioning, or a UE based positioning procedure (UE based positioning procedure) can be used to achieve positioning, or Positioning can be achieved using a network assisted positioning procedure.
  • UE assisted positioning procedure user equipment assisted positioning procedure
  • UE based positioning procedure UE based positioning procedure
  • Positioning can be achieved using a network assisted positioning procedure.
  • an embodiment of the present application proposes a data transmission method to solve the above problem, and the embodiment of the present application is described in detail below.
  • the technical solutions in the embodiments of the present application can be applied to a long term evolution (long term evolution, LTE) architecture, a fifth generation mobile communication technology (5th generation mobile networks, 5G), a 4.5 generation mobile communication technology (the 4.5 generation mobile communication technology) networks, 4.5G), wireless local area networks (WLAN) systems, etc.
  • LTE long term evolution
  • 5G fifth generation mobile communication technology
  • 4.5 generation mobile communication technology the 4.5 generation mobile communication technology
  • WLAN wireless local area networks
  • FIG. 2A is a schematic structural diagram of a communication system provided by an embodiment of the present application. As shown in FIG. 2A , the communication system includes a first device 20 , a second device 21 and a third device 22 .
  • the first device 20 is configured to provide a selection of a corresponding positioning method according to positioning accuracy requirements, time delay requirements, etc., and selection of a corresponding communication protocol to complete the interaction of information required for positioning.
  • the first device 20 is also used to provide other information or a positioning strategy required for the positioning service.
  • the first device 20 may receive a request from an external network function or application to obtain the location of the terminal device, request to obtain the location information of the terminal device after verifying that the request is an allowed request, and provide the obtained location information of the terminal device to the external device.
  • Network function or application It can be understood that in 5G communication, the first device 20 has the function of the LMF network element and the function of the GMLC network element.
  • the names of LMF network elements and GMLC network elements, in future communications such as 6th generation (6G) communications are still LMF network elements, GMLC network elements, or have other names, which are not limited in this application.
  • the first device 20 may include a module for implementing the LMF network element function and a module for implementing the GMLC network element function.
  • An internal channel is included between the two modules, and the internal channel is an API call, and the information sharing between the two modules is realized by calling the API.
  • the two modules share the database, so as to realize the sharing of information, which is not limited here.
  • the first device 20 is configured to select a corresponding positioning method according to positioning accuracy requirements, time delay requirements, etc., and select a corresponding communication protocol to complete the interaction of information required for positioning, and use to provide other information required for location services, or location strategies.
  • the first device may be an evolved serving mobile location center (evolved serving mobile location center, eSMLC).
  • eSMLC evolved serving mobile location center
  • 5G communication the first device 20 may be an LMF network element.
  • future communications such as 6th generation (6G) communication the first device 20 may still be an LMF network element, or have other names. This is not limited.
  • the second device 21 includes a terminal device 211 or an access network device 212 .
  • the terminal device 211 is an entity on the user side that is used for receiving a signal, or sending a signal, or receiving a signal and sending a signal.
  • the terminal device 211 is used to provide one or more of voice service and data connectivity service to the user.
  • the terminal device 211 may be a device that includes a wireless transceiving function and that can cooperate with an access network device to provide a communication service for the user.
  • the terminal device 211 may refer to a user equipment (user equipment, UE), an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a terminal, a wireless communication device, a user agent or user device.
  • the terminal device 211 may also be a drone, an internet of things (IoT) device, a station (ST) in a WLAN, a cellular phone (cellular phone), a smart phone (smart phone), a cordless phone, wireless data Cards, tablet computers, session initiation protocol (SIP) phones, wireless local loop (WLL) stations, personal digital assistant (PDA) devices, laptop computers (laptop computer) ), machine type communication (MTC) terminals, handheld devices with wireless communication capabilities, computing devices or other processing devices connected to wireless modems, in-vehicle devices, wearable devices (also known as wearable smart devices) , virtual reality (VR) terminal, augmented reality (AR) terminal, wireless terminal in industrial control (industrial control), wireless terminal in unmanned driving (self driving), remote medical (remote medical) Wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, etc.
  • IoT internet of things
  • ST in a WLAN
  • cellular phone cellular phone
  • the terminal device 211 may also be a device to device (device to device, D2D) device, for example, an electricity meter, a water meter, and the like.
  • the terminal device 211 may also be a terminal in a 3G system or a terminal in a next-generation communication system, which is not limited in this embodiment of the present application.
  • the access network device 212 is an entity on the network side for sending a signal, or receiving a signal, or sending a signal and receiving a signal.
  • the access network device 212 may be a device deployed in a radio access network (radio access network, RAN) to provide a wireless communication function for the terminal device 211, such as a transmission reception point (transmission reception point, TRP), a base station, various form control node.
  • RAN radio access network
  • TRP transmission reception point
  • base station various form control node.
  • a network controller a wireless controller, a wireless controller in a cloud radio access network (CRAN) scenario, etc.
  • CRAN cloud radio access network
  • the access network equipment may be various forms of macro base station, micro base station (also called small cell), relay station, access point (AP), radio network controller (RNC), Node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or home node B, HNB), baseband unit (baseBand unit, BBU), transmission point (transmitting and receiving point, TRP), transmitting point (transmitting point, TP), mobile switching center), etc., can also be the antenna panel of the base station.
  • the control node can connect to multiple base stations, and configure resources for multiple terminals covered by multiple base stations.
  • the names of devices with base station functions may vary.
  • it can be an evolved base station (evolutional node B, eNB or eNodeB) in an LTE system, a wireless controller in a cloud radio access network (CRAN) scenario, or a 5G network gNB, or the access network device 212 may be a relay station, an access point, a vehicle-mounted device, a wearable device, a network-side device in a network after 5G or an access network device in a future evolved PLMN network, etc.
  • the specific name of the access network device is not limited.
  • the third device 22 may be used for processing user identification, access authentication or registration, and the like.
  • the third device 22 may be a UDM network element, wherein Nudm is a service-based interface provided by the UDM network element, and the UDM network element can communicate with other network functions through Nudm.
  • the third device 22 may still be a UDM network element, or have another name, which is not limited in this embodiment of the present application.
  • the communication system may further include a fourth device 23 and a location service client 24 .
  • the communication system may further include an access network device 212 and the like.
  • the communication system may further include a terminal device 211, a fifth device 25, a sixth device 26, and the like.
  • the fourth device 23 is mainly used for the registration, mobility management, and tracking area update procedures of the terminal device in the mobile network.
  • the fourth device 23 terminates non-access stratum (non access stratum, NAS) messages, completes registration management, connection management and reachability management, assigns a tracking area list (track area list, TA list) and mobility management, etc., and Transparent routing of session management (SM) messages to session management network elements.
  • NAS non access stratum
  • the fourth device 23 may be an AMF network element
  • Namf is a service-based interface provided by the AMF network element, and the AMF network element can communicate with other network functions through Namf.
  • future communications such as 6th generation (6th generation, 6G) communications, the fourth device 23 may still be an AMF network element, or have other names, which are not limited in this application.
  • the location service client 24 may be a communication device that requests the first device 20 or the location server in Embodiment 2 to provide a location task for the terminal, or a secure user plane location (SUPL) agent (agent). ).
  • SUPL Agent is an application that needs to obtain location information.
  • SUPL Agent can run in SET or in SUPL network. Among them, if the SUPL Agent runs in the SET, the positioning requester is the terminal device. If the SUPL Agent runs in the SUPL network, the positioning requester is an external client with positioning requirements.
  • the fifth device 25 may receive a request from an external network function or application to obtain the location of the terminal device, and after verifying that the request is an allowed request, request the first device 20 in the above-mentioned Embodiment 2 to obtain the location information of the terminal device, and The acquired location information of the terminal device is provided to an external network function or application.
  • the fifth device 25 may be a core network GMLC network element, and in future communications such as 6th generation (6G) communication, the fifth device 25 may still be a GMLC network element, or have other names.
  • 6G 6th generation
  • the sixth device 26 is used for providing a service discovery function, a function of maintaining the NF description information of an effective network function entity (network function, NF) network element in the core network, and a function of maintaining services supported by an effective NF network element in the core network .
  • the service discovery function refers to receiving a discovery request message from an NF network element of any core network, and providing the NF network element with the information of the target NF network element for which discovery is requested.
  • the sixth device 26 may be a network function repository function (NRF) network element. It can be understood that in future communications, the network element responsible for network function registration and discovery functions may still be an NRF network element, or there may be Other names are not limited in this application.
  • GMLC network element gNB
  • terminal equipment NRF network element and location service client
  • the N1 interface, the N2 interface, the N8 interface, the NL1 interface, the NL2 interface, and the Le interface in FIG. 2B may refer to the relevant descriptions in FIG. 1 , which will not be repeated here.
  • the Le interface in FIG. 2B is the reference point between the GMLC network element and the location service client.
  • the Nnrf interface is the reference point between the NRF network element and the AMF network element.
  • AMF network elements, NRF network elements, UDM network elements and other control plane network elements can also use service interfaces for interaction.
  • the service interface provided by the AMF network element can be Namf
  • the service interface provided by the NRF network element can be Nnrf
  • the service interface provided by the UDM network element can be Nudm.
  • the above network elements or functions may be network elements in hardware devices, software functions running on dedicated hardware, or virtualized functions instantiated on a platform (eg, a cloud platform).
  • the above network elements or functions may be divided into one or more services, and further, services that exist independently of network functions may also appear.
  • an instance of the above-mentioned function, or an instance of a service included in the above-mentioned function, or an instance of a service that exists independently of a network function may be referred to as a service instance.
  • FIG. 3 is a schematic flowchart of a data transmission method provided by an embodiment of the present application.
  • the first device in FIG. 3 may be the first device 20 in the foregoing Embodiment 1 or the foregoing Embodiment 2, and the second device in FIG. 3 may be the second device 21 in FIG. 2A .
  • the method includes but is not limited to the following steps:
  • the first device performs security protection on the first request message, and obtains the security-protected first request message.
  • security protection may include encryption and/or integrity protection.
  • Encryption may include encryption using an encryption algorithm and an encryption key
  • integrity protection may include integrity protection using an integrity protection algorithm and an integrity protection key. It can be understood that secured means encrypted and integrity protected.
  • the security-protected first request message may refer to first using an integrity protection algorithm and an integrity protection key to perform integrity protection on the first request message, and then using an encryption algorithm and an encryption key to perform integrity protection on the integrity-protected second request message. The result of encrypting a request message.
  • the first request message is used to request first information of the terminal device, where the first information includes location information of the terminal device or positioning measurement information of the terminal device.
  • the first request message includes a Long Term Evolution Positioning Protocol (LTE positioning protocol, LPP) message or a first New Radio Positioning Protocol (NR positioning protocol a, NRPPa) message.
  • LTE positioning protocol Long Term Evolution Positioning Protocol
  • NR positioning protocol a NRPPa
  • the LPP message is used to request the location information of the terminal device or the location measurement information of the terminal device.
  • the LPP message includes an LPP positioning request (positioning request) message, an LPP request positioning message (request location information), or an LPP request assistance (request assist) message or a newly added message, which is not limited herein.
  • the first NRPPa message is used to request positioning measurement information of the terminal device.
  • the first NRPPa message includes a first NRPPa positioning request (positioning request) message, a first NRPPa request for location information (request location information), or a newly added message, which is not limited herein.
  • the positioning measurement information of the terminal device reference may be made to the foregoing related description, and the positioning measurement information may be used to determine the position information of the terminal device.
  • the location information of the terminal device may be the geographic coordinates where the terminal device is located, or may be the cell or base station or location area where the terminal device is located, which is not limited.
  • the method further includes: the first device receives the LCS security capability information of the terminal device from the fourth device; or, the first device receives the identifier of the terminal device from the fourth device; or, the first device A device receives the LCS security capability information of the access network device from the fourth device; or, the first device receives the identifier of the access network device from the fourth device.
  • the LCS security capability information of the terminal device is used to indicate the encryption algorithm and the integrity protection algorithm supported by the terminal device, or the LCS security capability information of the terminal device includes the first encryption algorithm and the first integrity protection algorithm.
  • the encryption algorithm supported by the terminal device may be one or more encryption algorithms
  • the integrity protection algorithm supported by the terminal device may be one or more integrity protection algorithms, which is not limited herein.
  • the encryption algorithm or the first encryption algorithm supported by the terminal device may be, for example, 128-NEA1, 128-NEA2, and 128-NEA3 and the integrity protection algorithm or the first integrity protection algorithm supported by the terminal device may be, for example, 128-NIA1, 128-NIA2, 128-NIA3, etc., for details, please refer to standard 33.501, which will not be repeated here.
  • the identifier of the terminal device may include one of the following: a user permanent identifier (subscription permanent identifier, SUPI), a permanent equipment identifier (permanent equipment identifier, PEI), a general public user identifier (generic public subscription identifier, GPSI), location service Correlation ID (LCS Correlation ID), subscription ID (subscription ID) and routing ID (routing ID).
  • the LCS security capability information of the access network device is used to indicate the encryption algorithm and the integrity protection algorithm supported by the access network device, or the LCS security capability information of the access network device includes the second encryption algorithm and the second integrity Protection algorithm.
  • the encryption algorithm supported by the access network device may be one or more encryption algorithms
  • the integrity protection algorithm supported by the access network device may be one or more integrity protection algorithms, which are not limited herein.
  • the encryption algorithm or the second encryption algorithm supported by the access network device may be, for example, 128-NEA1, 128-NEA2, 128-NEA3, and the second integrity protection algorithm may be, for example, 128-NIA1, 128-NIA2, 128-NIA3, etc., you can refer to the standard 33.501 for details, which will not be repeated here.
  • the identification of the access network equipment includes one of the following: a global radio access network identification (global RAN ID) and address information of the access network equipment.
  • a global radio access network identification global RAN ID
  • address information of the access network equipment address information of the access network equipment.
  • the address information of the access network device may be the internet protocol address (internet protocol address) of the access network device, or, the IP address and port number of the access network device, which is not limited here.
  • step 301 includes: the first device performs security protection on the first request message according to the LCS security capability information of the terminal device, and obtains the security Protected first request message.
  • step 301 includes: the first device determines the first encryption algorithm and the first integrity protection algorithm corresponding to the terminal device according to the identifier of the terminal device; A device performs security protection on the first request message according to the first encryption algorithm and the first integrity protection algorithm, and obtains the security-protected first request message.
  • the fourth device when the fourth device sends the LCS security capability information of the terminal device to the first device, the fourth device may also send the identifier of the terminal device to the first device. That is, the first device may receive the LCS security capability information of the terminal device and the identification of the terminal device from the fourth device. In addition, when the fourth device sends the LCS security capability information of the terminal device and the identifier of the terminal device to the first device, the fourth device may send the LCS security capability information of the terminal device and the identifier of the terminal device to the first device through a fourth request message a device. Alternatively, when the fourth device sends the identification of the terminal device to the first device, the fourth device may send the identification of the terminal device to the first device through a fourth request message, which is not limited herein.
  • the fourth request message may be Nlmf_Location_DeterminLocation Request message 1.
  • the method further includes: the first device sends a second request message to the third device, the second request message includes the identifier of the terminal device, and the second request message is used to request the second security protection parameter; The first device receives a response to the second request message from the third device, where the response to the second request message includes the second security protection parameter.
  • the second request message may be LCS_Security_Data_Get_Request1.
  • the response of the second request message may be LCS_Security_Data_Get_Response1.
  • the second security protection parameter includes the first encryption key and the first integrity protection key; or, the second security protection parameter includes the first parameter.
  • the second security protection parameter is obtained by the third device according to the identifier of the terminal device, and the first parameter is used to determine the first encryption key and the first integrity protection key.
  • the first parameter may include a first initial encryption key and a first initial integrity protection key.
  • the first device performs security protection on the first request message according to the LCS security capability information of the terminal device, and obtains the security-protected first request message, including: the first device performs security protection on the first request message according to the LCS security capability information of the terminal device and the second security
  • the protection parameter is used to perform security protection on the first request message to obtain the security-protected first request message.
  • the second security protection parameter includes the first encryption key and the first integrity protection key, then the first device can determine the first encryption key according to the first initial encryption key and the first value; the first device can determine the first encryption key according to the first initial encryption key and the first value; The integrity protection key and the second value determine the first integrity protection key. If the second security protection parameter includes the first parameter, the first device may determine the first initial key as the first encryption key, and the first initial integrity protection key as the first integrity protection key .
  • first numerical value and the second numerical value may be the same or different, which are not limited herein.
  • the first device determining the first encryption key according to the first initial encryption key and the first value and the first device determining the first integrity protection key according to the first initial integrity protection key and the second value, it is possible to Refer to the standard 33.220, which will not be repeated here.
  • the first device if the LCS security capability information of the terminal device is used to indicate the encryption algorithm and the integrity protection algorithm supported by the terminal device, then the first device, according to the LCS security capability information of the terminal device and the second security protection parameter, Performing security protection on the request message, and obtaining the security-protected first request message, including: the first device determining the first encryption algorithm and the first integrity protection algorithm according to the LCS security capability information of the terminal device; the first device determining the first encryption algorithm and the first integrity protection algorithm according to the first encryption The algorithm, the first integrity protection algorithm, the first encryption key, and the first integrity protection key perform security protection on the first request message to obtain a security-protected first request message.
  • the first device may first perform integrity protection on the first request message according to the first integrity protection algorithm and the first integrity protection key, and then perform integrity protection on the first request message according to the first encryption algorithm and the first encryption key.
  • the first request message is encrypted to obtain the first request message protected by security.
  • the first device performs the processing on the first request message according to the LCS security capability information and the second security protection parameter of the terminal device.
  • Security protection obtaining the security-protected first request message, including: the first device, according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, executes the request message for the first request message. Perform security protection to obtain the security-protected first request message.
  • the first device performs security protection on the first request message according to the first encryption algorithm and the first integrity protection algorithm, and obtains the first request message protected by security, including: the first device according to the first encryption algorithm, the first request message
  • the integrity protection algorithm and the second security protection parameter perform security protection on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the second security protection parameter includes the first encryption key and the first integrity protection key, the first device may determine the first encryption key according to the first initial encryption key and the first value; the first device may The first integrity protection key is determined according to the first initial integrity protection key and the second value. If the second security protection parameter includes the first parameter, the first device may determine the first initial key as the first encryption key, and the first initial integrity protection key as the first integrity protection key .
  • the first device if the first request message is an LPP message, the first device, according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, The first request message is subjected to security protection, and the security-protected first request message is obtained.
  • the acquisition of the second security protection parameter is achieved, so that the first device can perform security protection on the first request message according to the second security protection parameter, thereby improving data transmission in the process of implementing the positioning service. security.
  • step 301 includes: the first device performs security protection on the first request message according to the LCS security capability information of the access network device. , to obtain the first request message protected by security.
  • step 301 includes: the first device determines the second encryption algorithm and the second encryption algorithm corresponding to the access network device according to the identifier of the access network device. an integrity protection algorithm; the first device performs security protection on the first request message according to the second encryption algorithm and the second integrity protection algorithm, and obtains the security-protected first request message.
  • the fourth device when the fourth device sends the LCS security capability information of the access network device to the first device, the fourth device may also send the identifier of the access network device to the first device. That is, the first device may receive the LCS security capability information of the access network device and the identity of the access network device from the fourth device. In addition, when the fourth device sends the LCS security capability information of the access network device and the identifier of the access network device to the first device, the fourth device may send the LCS security capability information of the access network device and the access network device through the fifth request message. The identification of the network access device is sent to the first device. Alternatively, when the fourth device sends the identification of the access network device to the first device, the fourth device may send the identification of the access network device to the first device through a fifth request message, which is not limited herein.
  • the fifth request message may be Nlmf_Location_DeterminLocation Request message 2.
  • the method further includes: the first device sends a third request message to the third device, the third request message includes the identifier of the access network device, and the third request message is used to request the fourth security protection parameter; the first device receives a response to the third request message from the third device, and the response to the third request message includes the fourth security protection parameter.
  • the third request message may be LCS_Security_Data_Get_Request2.
  • the response of the third request message may be LCS_Security_Data_Get_Response2.
  • the fourth security protection parameter includes the second encryption key and the second integrity protection key; or, the fourth security protection parameter includes the second parameter.
  • the fourth security protection parameter is acquired by the third device according to the identifier of the access network device, and the second parameter is used to determine the second encryption key and the second integrity protection key.
  • the second parameter may include a second initial encryption key and a second initial integrity protection key.
  • the first device performs security protection on the first request message according to the LCS security capability information of the access network device, and obtains the security-protected first request message, including: the first device performs security protection on the first request message according to the LCS security capability information of the access network device. and the fourth security protection parameter, perform security protection on the first request message, and obtain the security-protected first request message.
  • the method further includes: If the fourth security protection parameter includes the second encryption key and the second integrity protection key, the first device may determine the second encryption key according to the second initial encryption key and the third value; the first device may determine the second encryption key according to the second initial encryption key and the third value; Two initial integrity protection keys and a fourth numerical value determine a second integrity protection key. If the fourth security protection parameter includes the second parameter, the first device may determine the first initial key as the second encryption key, and the second initial integrity protection key as the second integrity protection key .
  • the third numerical value and the fourth numerical value may be the same or different, which are not limited herein.
  • the first device will use the LCS security capability information of the access network device and the fourth security The protection parameter, performing security protection on the first request message, and obtaining the security-protected first request message, including: the first device determining the second encryption algorithm and the second integrity protection algorithm according to the LCS security capability information of the access network device ; The first device performs security protection on the first request message according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, and obtains the security-protected first request message.
  • the first device may first perform integrity protection on the first request message according to the second integrity protection algorithm and the second integrity protection key, and then perform integrity protection on the first request message according to the second encryption algorithm and the second encryption key.
  • the first request message is encrypted to obtain the first request message protected by security.
  • the first device performs a Performing security protection on a request message to obtain a security-protected first request message, including: the first device, according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, The first request message is subjected to security protection, and the security-protected first request message is obtained.
  • the first device performs security protection on the first request message according to the second encryption algorithm and the second integrity protection algorithm, and obtains the security-protected first request message, which may include: the first device according to the second encryption algorithm, the first request message
  • the second integrity protection algorithm and the fourth security protection parameter are used to perform security protection on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the fourth security protection parameter includes the second encryption key and the second integrity protection key, the first device may determine the second encryption key according to the second initial encryption key and the third value; the first device may The second integrity protection key is determined according to the second initial integrity protection key and the fourth value. If the fourth security protection parameter includes the second parameter, the first device may determine the first initial key as the second encryption key, and the second initial integrity protection key as the second integrity protection key .
  • the first device will use the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key according to the , performing security protection on the first request message to obtain the security-protected first request message.
  • the acquisition of the fourth security protection parameter is realized, so that the first device can perform security protection on the first request message according to the fourth security protection parameter, thereby improving the data transmission in the process of implementing the positioning service. security.
  • the first device receives the LCS security capability information of the access network device from the fourth device, including: the first device receiving The LCS security capability information of the first access network device from the fourth device; the first device receives the LCS security capability information of the second access network device from the fourth device; or, the first device receives the access network from the fourth device.
  • the identification of the network access device includes: the first device receives the identification of the first access network device from the fourth device; the first device receives the identification of the second access network device from the fourth device.
  • the first access network device is a device currently accessed by the terminal device
  • the second access network device is an access network device to which a neighboring cell of the current serving cell of the terminal device belongs.
  • the second access network device may be one or more access network devices, which is not limited herein.
  • the LCS security capability information of the first access network device and the LCS security capability information of the second access network device may be sent by the fourth device to the first device in two separate If four devices send at the same time, there is no limit here.
  • the identifier of the first access network device and the identifier of the second access network device may be sent by the fourth device to the first device in two separate times, or sent by the fourth device simultaneously, which is not limited here.
  • the LCS security capability information of the first access network device is used to indicate the encryption algorithm and the integrity protection algorithm supported by the first access network device, or the LCS security capability information of the first access network device includes the first access network device.
  • Three encryption algorithms and a third integrity protection algorithm may be understood that the encryption algorithm supported by the first access network device may be one or more encryption algorithms, and the integrity protection algorithm supported by the first access network device may be one or more integrity protection algorithms. Not limited.
  • the encryption algorithm or the third encryption algorithm supported by the first access network device may be, for example, 128-NEA1, 128-NEA2, 128-NEA3, the integrity protection algorithm or the third encryption algorithm supported by the first access network device.
  • the three integrity protection algorithms may be, for example, 128-NIA1, 128-NIA2, 128-NIA3, etc.
  • reference may be made to Standard 33.501, which will not be repeated here.
  • the LCS security capability information of the second access network device is used to indicate the encryption algorithm and the integrity protection algorithm supported by the second access network device, or the LCS security capability information of the second access network device includes the first Four encryption algorithms and a fourth integrity protection algorithm.
  • the encryption algorithm supported by the second access network device may be one or more encryption algorithms
  • the integrity protection algorithm supported by the second access network device may be one or more integrity protection algorithms. Not limited.
  • the encryption algorithm or the fourth encryption algorithm supported by the second access network device may be, for example, 128-NEA1, 128-NEA2, 128-NEA3, the integrity protection algorithm or the fourth encryption algorithm supported by the second access network device.
  • the four-integrity protection algorithm may be, for example, 128-NIA1, 128-NIA2, 128-NIA3, etc.
  • reference may be made to Standard 33.501, which will not be repeated here.
  • the identifier of the first access network device includes one of the following: a first global radio access network identifier (global RAN ID) and address information of the first access network device.
  • a first global radio access network identifier global RAN ID
  • address information of the first access network device includes one of the following: a first global radio access network identifier (global RAN ID) and address information of the first access network device.
  • the address information of the first access network device may be the internet protocol address (internet protocol address) of the first access network device, or the IP address and port number of the first access network device, which is not limited here .
  • the identifier of the second access network device includes one of the following: a second global radio access network identifier (global RAN ID) and address information of the second access network device.
  • a second global radio access network identifier global RAN ID
  • address information of the second access network device includes one of the following: a second global radio access network identifier (global RAN ID) and address information of the second access network device.
  • the address information of the second access network device may be an internet protocol address (internet protocol address) of the second access network device, or the IP address and port number of the second access network device, which is not limited here .
  • step 301 includes: the first device requests the first request according to the LCS security capability information of the first access network device.
  • the message is protected by security, and the first request message protected by security is obtained.
  • step 301 includes: the first device determines the third encryption corresponding to the access network device according to the identifier of the first access network device. an algorithm and a third integrity protection algorithm; the first device performs security protection on the first request message according to the third encryption algorithm and the third integrity protection algorithm, and obtains the security-protected first request message.
  • the fourth device when the fourth device sends the LCS security capability information of the first access network device to the first device, the fourth device may also send the identifier of the first access network device to the first device. That is, the first device may receive the LCS security capability information of the first access network device and the identity of the first access network device from the fourth device. In addition, when the fourth device sends the LCS security capability information of the first access network device and the identifier of the first access network device to the first device, the fourth device may send the information of the first access network device to the first access network device through the sixth request message. The LCS security capability information and the identifier of the first access network device are sent to the first device. Alternatively, when the fourth device sends the identifier of the first access network device to the first device, the fourth device may send the identifier of the first access network device to the first device through a sixth request message, which is not limited here .
  • the sixth request message may be Nlmf_Location_DeterminLocation Request message 3.
  • the method further includes: the first device sends a seventh request message to the third device, the seventh request message includes the identifier of the first access network device, and the seventh request message is used to request the seventh request message.
  • Security protection parameters the first device receives a response to the seventh request message from the third device, where the response to the seventh request message includes the seventh security protection parameter.
  • the seventh request message may be LCS_Security_Data_Get_Request3.
  • the response of the seventh request message may be LCS_Security_Data_Get_Response3.
  • the seventh security protection parameter includes a third encryption key and a third integrity protection key; or, the seventh security protection parameter includes a third parameter.
  • the seventh security protection parameter is acquired by the third device according to the identifier of the first access network device, and the third parameter is used to determine the third encryption key and the third integrity protection key.
  • the third parameter may include a third initial encryption key and a third initial integrity protection key.
  • the first device performs security protection on the first request message according to the LCS security capability information of the first access network device, and obtains the security-protected first request message, which may include: the first device performs security protection on the first request message according to the first access network device.
  • the LCS security capability information and the seventh security protection parameter are obtained, and the security protection is performed on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the seventh security protection parameter includes the third encryption key and the third integrity protection key, the first device may determine the third encryption key according to the third initial encryption key and the fifth value; the first device may The third integrity protection key is determined according to the third initial integrity protection key and the sixth value. If the seventh security protection parameter includes the third parameter, the first device may determine the first initial key as the third encryption key, and the third initial integrity protection key as the third integrity protection key .
  • the fifth numerical value and the sixth numerical value may be the same or different, which are not limited herein.
  • the first device determines the third encryption key according to the third initial encryption key and the fifth numerical value; the first device determines the third integrity protection key according to the third initial integrity protection key and the sixth numerical value, which can be Refer to the standard 33.220, which will not be repeated here.
  • the first device is based on the LCS security of the first access network device.
  • the capability information and the seventh security protection parameter performing security protection on the first request message, and obtaining the security-protected first request message, including: the first device determining the third encryption according to the LCS security capability information of the first access network device algorithm and a third integrity protection algorithm; the first device performs security protection on the first request message according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, and obtains the The first request message for security protection.
  • the first device may first perform integrity protection on the first request message according to the third integrity protection algorithm and the third integrity protection key, and then perform integrity protection on the first request message according to the third encryption algorithm and the third encryption key.
  • the first request message is encrypted to obtain the first request message protected by security.
  • the first device can protect the LCS according to the LCS security capability information of the first access network device and the seventh security protection algorithm. parameter, perform security protection on the first request message, and obtain the security-protected first request message, including: the first device according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection The key is used to perform security protection on the first request message to obtain the security-protected first request message.
  • the first device performs security protection on the first request message according to the third encryption algorithm and the third integrity protection algorithm, and obtains the security-protected first request message, including: the first device according to the third encryption algorithm, the third The integrity protection algorithm and the seventh security protection parameter perform security protection on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the seventh security protection parameter includes the third encryption key and the third integrity protection key, the first device may determine the third encryption key according to the third initial encryption key and the fifth value; the first device may The third integrity protection key is determined according to the third initial integrity protection key and the sixth value. If the seventh security protection parameter includes the third parameter, the first device may determine the first initial key as the third encryption key, and the third initial integrity protection key as the third integrity protection key .
  • the seventh security protection parameter is obtained, so that the first device can perform security protection on the first request message according to the seventh security protection parameter, thereby improving data transmission in the process of implementing the positioning service. security.
  • step 301 includes: the first device requests the first request according to the LCS security capability information of the second access network device.
  • the message is protected by security, and the first request message protected by security is obtained.
  • step 301 includes: the first device determines the fourth encryption corresponding to the access network device according to the identifier of the second access network device. algorithm and a fourth integrity protection algorithm; the first device performs security protection on the first request message according to the fourth encryption algorithm and the fourth integrity protection algorithm, and obtains the security-protected first request message.
  • the fourth device when the fourth device sends the LCS security capability information of the second access network device to the first device, the fourth device may also send the identifier of the second access network device to the first device. That is, the first device may receive the LCS security capability information of the second access network device and the identity of the second access network device from the fourth device. In addition, when the fourth device sends the LCS security capability information of the second access network device and the identifier of the second access network device to the first device, the fourth device may send the information of the second access network device to the second access network device through the eighth request message. The LCS security capability information and the identifier of the second access network device are sent to the first device. Alternatively, when the fourth device sends the identifier of the second access network device to the first device, the fourth device may send the identifier of the second access network device to the first device through the eighth request message, which is not limited here .
  • the eighth request message may be Nlmf_Location_DeterminLocation Request message 4.
  • the LCS security capability information of the first access network device, the LCS security capability information of the second access network device, the identifier of the first access network device and the identifier of the second access network device are the fourth device It is sent to the first device in two times, or, the identifier of the first access network device and the identifier of the second access network device are sent by the fourth device to the first device twice, then the sixth request message and the first Eight request messages can be different messages; if the LCS security capability information of the first access network device, the LCS security capability information of the second access network device, the identifier of the first access network device, and the The identifier is sent by the fourth device at the same time, or, the identifier of the first access network device and the identifier of the second access network device are sent by the fourth device at the same time, then the sixth request message and the eighth request message can be the same message , which is not limited here.
  • the method further includes: the first device sends a ninth request message to the third device, the ninth request message includes the identifier of the second access network device, and the ninth request message is used to request the eighth request message.
  • Security protection parameters the first device receives a response to the ninth request message from the third device, where the response to the ninth request message includes the eighth security protection parameter.
  • the ninth request message may be LCS_Security_Data_Get_Request4.
  • the response of the ninth request message may be LCS_Security_Data_Get_Response4.
  • the eighth security protection parameter includes a fourth encryption key and a fourth integrity protection key; or, the eighth security protection parameter includes a fourth parameter.
  • the eighth security protection parameter is acquired by the third device according to the identifier of the second access network device, and the fourth parameter is used to determine the fourth encryption key and the fourth integrity protection key.
  • the fourth parameter may include a fourth initial encryption key and a fourth initial integrity protection key.
  • the first device performs security protection on the first request message according to the LCS security capability information of the second access network device, and obtains the security-protected first request message, which may include: the first device according to the second access network device.
  • the LCS security capability information and the eighth security protection parameter are obtained, and the security protection is performed on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the eighth security protection parameter includes the fourth encryption key and the fourth integrity protection key, the first device may determine the fourth encryption key according to the fourth initial encryption key and the seventh value; the first device may The fourth integrity protection key is determined according to the fourth initial integrity protection key and the eighth numerical value. If the eighth security protection parameter includes the fourth parameter, the first device may determine the first initial key as the fourth encryption key, and determine the fourth initial integrity protection key as the fourth integrity protection key .
  • the seventh numerical value and the eighth numerical value may be the same or different, which are not limited herein.
  • the first device determines the fourth encryption key according to the fourth initial encryption key and the seventh numerical value; the first device determines the fourth integrity protection key according to the fourth initial integrity protection key and the eighth numerical value. Refer to the standard 33.220, which will not be repeated here.
  • the first device is based on the LCS security of the second access network device.
  • the capability information and the eighth security protection parameter, performing security protection on the first request message, and obtaining the security-protected first request message including: the first device determining the fourth encryption according to the LCS security capability information of the second access network device algorithm and the fourth integrity protection algorithm; the first device performs security protection on the first request message according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key, and obtains the received The first request message for security protection.
  • the first device may first perform integrity protection on the first request message according to the fourth integrity protection algorithm and the fourth integrity protection key, and then perform integrity protection on the first request message according to the fourth encryption algorithm and the fourth encryption key.
  • the first request message is encrypted to obtain the first request message protected by security.
  • the first device will use the LCS security capability information of the second access network device and the eighth security protection algorithm. parameter, perform security protection on the first request message, and obtain the security-protected first request message, including: the first device according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection The key is used to perform security protection on the first request message to obtain the security-protected first request message.
  • the first device performs security protection on the first request message according to the fourth encryption algorithm and the fourth integrity protection algorithm, and obtains the security-protected first request message, which may include: the first device according to the fourth encryption algorithm, the first request message
  • the fourth integrity protection algorithm and the eighth security protection parameter perform security protection on the first request message to obtain the security-protected first request message.
  • the method further includes: Including: if the eighth security protection parameter includes the fourth encryption key and the fourth integrity protection key, the first device may determine the fourth encryption key according to the fourth initial encryption key and the seventh value; the first device may The fourth integrity protection key is determined according to the fourth initial integrity protection key and the eighth numerical value. If the eighth security protection parameter includes the fourth parameter, the first device may determine the first initial key as the fourth encryption key, and determine the fourth initial integrity protection key as the fourth integrity protection key .
  • the seventh request message further includes the identifier of the second access network device
  • the first device does not need to send the ninth request message to the third device.
  • the seventh request message is further used to request the eighth security protection parameter
  • the response of the seventh request message further includes the eighth security protection parameter.
  • the access network device includes a first access network device and a second access network device
  • the first NRPPa message is used to request the positioning measurement information of the terminal device, which can be understood as: for the first access network device , the first NRPPa message is used to request the first positioning measurement information of the terminal device, and for the second access network device, the first NRPPa message is used to request the second positioning measurement information of the terminal device.
  • the first device performs security protection on the first request message according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, and obtains the security-protected first request message , it can be understood as: the first device performs security protection on the first NRPPa message according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, and obtains the first NRPPa message protected by security.
  • a NRPPa message is referred to: the first device performs security protection on the first NRPPa message according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, and obtains the first NRPPa message protected by security.
  • the first device performs security protection on the first request message according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key, and obtains the security-protected first request message, which may be It is understood that the first device performs security protection on the first NRPPa message according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key, and obtains the first NRPPa that is protected by security. information.
  • the eighth security protection parameter is obtained, so that the first device can perform security protection on the first request message according to the eighth security protection parameter, thereby improving data transmission in the process of implementing the positioning service. security.
  • the second device receives the first security-protected request message from the first device.
  • the first device sends the security-protected first request message to the second device.
  • step 302 includes: the terminal device receives the first security-protected request message from the first device through the first secure communication tunnel.
  • the first secure communication tunnel is a secure communication tunnel between the first device and the terminal device. Specifically, see FIG. 4 , which is a protocol layer. With reference to FIG. 4 , the first secure communication channel is a secure communication tunnel between the LPP layer of the first device and the LPP layer of the terminal device.
  • the method further includes: the terminal device receives a first secure communication tunnel establishment request from the first device.
  • the first secure communication tunnel establishment request message is used to request the establishment of the first secure communication tunnel
  • the first secure communication tunnel establishment request message includes the first security protection parameter
  • the first security protection parameter includes the first encryption algorithm and the first integrity
  • the protection algorithm the first security protection parameter is used for the terminal device to perform secure communication
  • the terminal device sends a response message of the first secure communication tunnel establishment request message.
  • the first secure communication tunnel establishment request message may be an LPP security establishment request (LPP security establishment request).
  • the terminal device receiving the first secure communication tunnel establishment request message from the first device includes: the terminal device receiving the first secure communication tunnel establishment request message from the first device through the fourth device.
  • the terminal device receives the first secure communication tunnel establishment request message from the first device through the fourth device, which can be understood as: the terminal device receives the first secure communication tunnel establishment request message sent by the access network device, and the access network device receives the first secure communication tunnel establishment request message.
  • the first secure communication tunnel establishment request message sent by the fourth device, and the fourth device receives the first secure communication tunnel establishment request message sent by the first device.
  • the terminal device receives a downlink non-access stratum transport (downlink NAS transport) message 1 sent by the access network device, where the downlink NAS transport message 1 includes a first secure communication tunnel establishment request message.
  • the access network device receives a downlink non-access stratum transmission message 2 sent by the fourth device, where the downlink non-access stratum transmission message 2 includes a first secure communication tunnel establishment request message.
  • the fourth device receives the Namf_Communication_NIN2Message Transfer message 1 sent by the first device, where the Namf_Communication_NIN2Message Transfer message 1 includes a first secure communication tunnel establishment request message.
  • secure communication may refer to communication after encryption and integrity protection.
  • the terminal device receives the first security-protected request message from the first device through the first secure communication tunnel.
  • the response message of the first secure communication tunnel establishment request message may be an LPP security establishment response (LPP security establishment response).
  • sending the response message of the first secure communication tunnel establishment request message by the terminal device includes: the terminal device sending the response message of the first secure communication tunnel establishment request message through the access network device.
  • the terminal device sends a response message of the first secure communication tunnel establishment request message through the access network device, which can be understood as: the terminal device sends a response message of the first secure communication tunnel establishment request message to the access network device, and the access network device sends a response message to the first secure communication tunnel establishment request message.
  • a response message of the first secure communication tunnel establishment request message is sent to the fourth device, and the fourth device sends a response message of the first secure communication tunnel establishment request message to the first device.
  • the terminal device sends an uplink non-access stratum transport (uplink NAS transport) message 1 to the access network device, and the uplink NAS transport message 1 includes a response message of the first secure communication tunnel establishment request message, and the access
  • the network device sends an uplink non-access stratum transmission message 2 to the fourth device, the uplink non-access stratum transmission message 2 includes a response message to the first secure communication tunnel establishment request message, and the fourth device sends a Namf_Communication_NIinfoNotify message 1 to the first device,
  • the Namf_Communication_NIinfoNotify message is a response message to the first secure communication tunnel establishment request message.
  • step 302 includes: the access network device receives the security-protected first request message from the first device through the second secure communication tunnel.
  • the second secure communication tunnel is a secure communication tunnel between the first device and the access network device. Specifically, see FIG. 5 , which is another protocol layer. With reference to FIG. 5 , the second secure communication channel is a secure communication tunnel between the NRPPa layer of the first device and the NRPPa layer of the access network device.
  • the method further includes: the access network device receives the second secure request message from the first device.
  • the communication tunnel establishment request message, the second secure communication tunnel establishment request message is used to request the establishment of the second secure communication tunnel, the second secure communication tunnel establishment request message includes the third security protection parameter, and the third security protection parameter includes the second encryption algorithm and The second integrity protection algorithm and the third security protection parameter are used for the access network device to perform secure communication; the access network device sends a response to the second secure communication tunnel establishment request message.
  • the second secure communication tunnel establishment request message may be the first NRPPa security establishment request (NRPPa security establishment request).
  • the access network device receiving the second secure communication tunnel establishment request message from the first device includes: the access network device receiving the second secure communication tunnel establishment request message from the first device through the fourth device.
  • the fact that the access network device receives the second secure communication tunnel establishment request message from the first device through the fourth device can be understood as: the access network device receives the second secure communication tunnel establishment request message sent by the fourth device, and the fourth device receives the second secure communication tunnel establishment request message sent by the fourth device.
  • the device receives a second secure communication tunnel establishment request message sent by the first device.
  • the access network device receives a downlink non-access stratum transmission message 3 sent by the fourth device, where the downlink non-access stratum transmission message 3 includes a second secure communication tunnel establishment request message.
  • the fourth device receives the Namf_Communication_NIN2Message Transfer message 2 sent by the first device, where the Namf_Communication_NIN2Message Transfer message 2 includes a second secure communication tunnel establishment request message.
  • the response message of the second secure communication tunnel establishment request message may be the first NRPPa security establishment response (NRPPa security establishment response).
  • the access network device sending a response to the second secure communication tunnel establishment request message includes: the access network device sending a response to the second secure communication tunnel establishment request message through a fourth device.
  • the fact that the access network device sends a response to the second secure communication tunnel establishment request message through the fourth device can be understood as: the access network device sends a response to the second secure communication tunnel establishment request message to the fourth device, and the fourth device sends a response to the second secure communication tunnel establishment request message to the fourth device.
  • the first device sends a response to the second secure communication tunnel establishment request message.
  • the access network device sends an uplink non-access stratum transmission message 3 to the fourth device, where the uplink non-access stratum transmission message 3 includes a response to the second secure communication tunnel establishment request message.
  • the fourth device sends a Namf_Communication_NIinfoNotify message 2 to the first device, where the Namf_Communication_NIinfoNotify message 2 includes a response to the second secure communication tunnel establishment request message.
  • step 302 includes: the first access network device receives a secure communication channel from the first device through a third secure communication tunnel. The protected first request message; the second access network device receives the security-protected first request message from the first device through the fourth secure communication tunnel.
  • the third secure communication tunnel is a secure communication tunnel between the first device and the first access network device.
  • the third secure communication channel is a secure communication tunnel between the NRPPa layer of the first device and the NRPPa layer of the first access network device.
  • the fourth secure communication tunnel is a secure communication tunnel between the first device and the second access network device.
  • the fourth secure communication channel is a secure communication tunnel between the NRPPa layer of the first device and the NRPPa layer of the second access network device.
  • the method further includes: the first access network device receives the first request message from the first device.
  • the third secure communication tunnel establishment request message the third secure communication tunnel establishment request message is used to request the establishment of the third secure communication tunnel, the third secure communication tunnel establishment request message includes the fifth security protection parameter, and the fifth security protection parameter includes the first There are three encryption algorithms and a third integrity protection algorithm, and the fifth security protection parameter is used for the first access network device to perform secure communication; the first access network device sends a response to the third secure communication tunnel establishment request message.
  • the third secure communication tunnel establishment request message may be the second NRPPa security establishment request (NRPPa security establishment request).
  • the first access network device receiving the third secure communication tunnel establishment request message from the first device includes: the first access network device receives the third secure communication tunnel establishment request from the first device through the fourth device information.
  • the first access network device receives the third secure communication tunnel establishment request message from the first device through the fourth device, which can be understood as: the first access network device receives the third secure communication tunnel establishment request sent by the fourth device message, the fourth device receives the third secure communication tunnel establishment request message sent by the first device.
  • the first access network device receives a downlink non-access stratum transmission message 4 sent by the fourth device, where the downlink non-access stratum transmission message 4 includes a third secure communication tunnel establishment request message.
  • the fourth device receives the Namf_Communication_NIN2Message Transfer message 3 sent by the first device, where the Namf_Communication_NIN2Message Transfer message 3 includes a third secure communication tunnel establishment request message.
  • the response message of the third secure communication tunnel establishment request message may be the second NRPPa security establishment response (NRPPa security establishment response).
  • the first access network device sending a response to the third secure communication tunnel establishment request message includes: the first access network device sending a response to the third secure communication tunnel establishment request message through the fourth device.
  • the response that the first access network device sends the third secure communication tunnel establishment request message through the fourth device can be understood as: the first access network device sends a response to the third secure communication tunnel establishment request message to the fourth device, The fourth device sends a response to the third secure communication tunnel establishment request message to the first device.
  • the first access network device sends an uplink non-access stratum transmission message 4 to the fourth device, where the uplink non-access stratum transmission message 4 includes a response to the third secure communication tunnel establishment request message.
  • the fourth device sends a Namf_Communication_NIinfoNotify message 3 to the first device, where the Namf_Communication_NIinfoNotify message 3 includes a response to the third secure communication tunnel establishment request message.
  • the method further includes: the second access network device receives the first request message from the first device.
  • the fourth secure communication tunnel establishment request message the fourth secure communication tunnel establishment request message is used to request the establishment of the fourth secure communication tunnel, the fourth secure communication tunnel establishment request message includes the sixth security protection parameter, and the sixth security protection parameter includes the The fourth encryption algorithm and the fourth integrity protection algorithm, and the sixth security protection parameter are used for the second access network device to perform secure communication; the second access network device sends a response to the fourth secure communication tunnel establishment request message.
  • the fourth secure communication tunnel establishment request message may be a third NRPPa security establishment request (NRPPa security establishment request).
  • the second access network device receiving the fourth secure communication tunnel establishment request message from the first device includes: the second access network device receiving the fourth secure communication tunnel establishment request from the first device through the fourth device information.
  • the second access network device receives the fourth secure communication tunnel establishment request message from the first device through the fourth device, which can be understood as: the second access network device receives the fourth secure communication tunnel establishment request sent by the fourth device message, the fourth device receives the fourth secure communication tunnel establishment request message sent by the first device.
  • the second access network device receives a downlink non-access stratum transmission message 5 sent by the fourth device, where the downlink non-access stratum transmission message 5 includes a fourth secure communication tunnel establishment request message.
  • the fourth device receives the Namf_Communication_NIN2Message Transfer message 4 sent by the first device, where the Namf_Communication_NIN2Message Transfer message 4 includes a fourth secure communication tunnel establishment request message.
  • the response message of the fourth secure communication tunnel establishment request message may be the third NRPPa security establishment response (NRPPa security establishment response).
  • the second access network device sending a response to the fourth secure communication tunnel establishment request message includes: the second access network device sending a response to the fourth secure communication tunnel establishment request message through the fourth device.
  • the second access network device sends a response to the fourth secure communication tunnel establishment request message through the fourth device, which can be understood as: the second access network device sends a response to the fourth secure communication tunnel establishment request message to the fourth device, The fourth device sends a response to the fourth secure communication tunnel establishment request message to the first device.
  • the second access network device sends an uplink non-access stratum transmission message 5 to the fourth device, where the uplink non-access stratum transmission message 5 includes a response to the fourth secure communication tunnel establishment request message.
  • the fourth device sends a Namf_Communication_NIinfoNotify message 4 to the first device, where the Namf_Communication_NIinfoNotify message 4 includes a response to the fourth secure communication tunnel establishment request message.
  • the second device obtains the first request message according to the first request message protected by the security.
  • step 303 includes: the terminal device, according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, performs an encryption of the security-protected data.
  • the first request message is decrypted and integrity protected and verified to obtain the first request message.
  • the terminal device may first use the first encryption algorithm and the first encryption key to decrypt the first security-protected request message, and then use the first integrity protection algorithm and the first integrity protection key to decrypt the decrypted first request message.
  • a request message is subjected to integrity protection verification to obtain a first request message.
  • the method further includes: the terminal device determines the first encryption key according to the first value and the first initial encryption key ; The terminal device determines the first integrity protection key according to the second value and the first initial integrity protection key.
  • the method further includes: the terminal device determines the first initial encryption key as the first encryption key; the terminal device determines the first initial encryption key as the first encryption key; The first initial integrity protection key is determined as the first integrity protection key.
  • the first initial encryption key and the first initial integrity protection key may be configured in the terminal device, such as being programmed into the USIM card.
  • step 303 includes: the access network device according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, Decryption and integrity protection verification are performed on the security-protected first request message to obtain the first request message.
  • the access network device may first use the second encryption algorithm and the second encryption key to decrypt the first security-protected request message, and then use the second integrity protection algorithm and the second integrity protection key to decrypt the decrypted
  • the integrity protection verification is performed on the first request message, and the first request message is obtained.
  • the access network device is configured according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity before obtaining the first request message, the method further includes: the access network device determines the first request message according to the third value and the second initial encryption key Two encryption keys; the access network device determines the second integrity protection key according to the fourth value and the second initial integrity protection key.
  • the method further includes: the access network device determining the second initial encryption key as the second encryption key key; the access network device determines the second initial integrity protection key as the second integrity protection key.
  • the second initial encryption key and the second initial integrity protection key may be configured in the access network device.
  • step 303 includes: the first access network device according to the third encryption algorithm, the third integrity protection algorithm, the third The encryption key and the third integrity protection key are used to decrypt and verify the integrity protection of the security-protected first request message to obtain the first request message; the second access network device uses the fourth encryption algorithm, the fourth integrity The security protection algorithm, the fourth encryption key and the fourth integrity protection key are used to decrypt and verify the integrity protection of the first request message protected by the security to obtain the first request message.
  • the first access network device may first use the third encryption algorithm and the third encryption key to decrypt the first security-protected request message, and then use the third integrity protection algorithm and the third integrity protection key to pair the The decrypted first request message is subjected to integrity protection verification to obtain the first request message.
  • the first access network device can perform the data according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third encryption key.
  • the integrity protection key is used to decrypt and verify the integrity protection of the first request message protected by security.
  • the method further includes: the first access network device encrypts the first request message according to the fifth value and the third initial encryption. The key determines the third encryption key; the first access network device determines the third integrity protection key according to the sixth value and the third initial integrity protection key.
  • the first access network device can perform the encryption according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third encryption key.
  • the integrity protection key decrypting and verifying the integrity protection of the first request message protected by security, and before obtaining the first request message, the method further includes: the first access network device determines the third initial encryption key as the third encryption key; the first access network device determines the third initial integrity protection key as the third integrity protection key.
  • the third initial encryption key and the third initial integrity protection key may be configured in the first access network device.
  • the second access network device may first use the fourth encryption algorithm and the fourth encryption key to decrypt the first security-protected request message, and then use the fourth integrity protection algorithm and the fourth integrity protection key to pair The decrypted first request message is subjected to integrity protection verification to obtain the first request message.
  • the second access network device performs the encryption according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth encryption key.
  • the integrity protection key is used to decrypt and verify the integrity protection of the first request message protected by security.
  • the method further includes: the second access network device encrypts the first request message according to the seventh value and the fourth initial encryption. The key determines the fourth encryption key; the second access network device determines the fourth integrity protection key according to the eighth numerical value and the fourth initial integrity protection key.
  • the second access network device will perform the encryption according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth the integrity protection key, decrypting and verifying the integrity protection of the first request message protected by security, and before obtaining the first request message, the method further includes: the second access network device determines the fourth initial encryption key as the fourth encryption key; the second access network device determines the fourth initial integrity protection key as the fourth integrity protection key.
  • the fourth initial encryption key and the fourth initial integrity protection key may be configured in the second access network device.
  • the second device acquires the first information according to the first request message.
  • step 304 includes: the terminal device acquires the first information according to the LPP message. If the LPP message is used to request the location information of the terminal device, the terminal device can obtain the location information of the terminal device according to the LPP message; if the LPP message is used to request the location measurement information of the terminal device, the terminal device can obtain the terminal device according to the LPP message. Positioning measurement information of the device.
  • step 304 includes: the access network device acquires the positioning measurement information of the terminal device according to the first NRPPa message.
  • step 304 includes: the first access network device acquires the first positioning measurement information of the terminal device according to the first NRPPa message ;
  • the second access network device obtains the second positioning measurement information of the terminal device according to the first NRPPa message.
  • first positioning measurement information and the second positioning measurement information of the terminal device For the first positioning measurement information and the second positioning measurement information of the terminal device, reference may be made to the foregoing related description, and the first positioning measurement information and the second positioning measurement information may be used to determine the position information of the terminal device.
  • the second device performs security protection on the first information to obtain the second information.
  • the second information includes first information protected by security.
  • step 305 includes: the terminal device encrypts the first information according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key. Carry out security protection and obtain second information.
  • the terminal device may first use the first integrity protection algorithm and the first integrity protection key to perform integrity protection on the first information, and then use the first encryption algorithm and the first encryption key to perform integrity protection on the integrity-protected first information.
  • the information is encrypted to obtain the second information.
  • the terminal device performs security protection on the first information according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, and obtains the second information, which can be understood as: the terminal device According to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, the location information of the terminal device or the positioning measurement information of the terminal device is securely protected, and a security-protected terminal is obtained.
  • step 305 includes: the access network device according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, The security protection is performed on the first information, and the second information is obtained.
  • the access network device may first use the second integrity protection algorithm and the second integrity protection key to perform integrity protection on the first information, and then use the second encryption algorithm and the second encryption key to perform integrity protection on the integrity-protected information.
  • the first information is encrypted to obtain the second information.
  • the access network device performs security protection on the first information according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, and obtains the second information, which can be understood as:
  • the access network device performs security protection on the positioning measurement information of the terminal device according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, and obtains the security protection of the terminal device. Positioning measurement information.
  • step 305 includes: the first access network device according to the third encryption algorithm, the third integrity protection algorithm, the third The encryption key and the third integrity protection key perform security protection on the first information to obtain the second information; the second access network device uses the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the The fourth integrity protection key is used to secure the first information to obtain the second information.
  • the first access network device may first use the third integrity protection algorithm and the third integrity protection key to integrity-protect the first information, and then use the third encryption algorithm and the third encryption key to integrity-protect the first information.
  • the first information is encrypted to obtain the second information.
  • the first access network device performs security protection on the first information according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key to obtain the second information. is: the first access network device performs security protection on the first positioning measurement information of the terminal device according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key, and obtains the received The first positioning measurement information of the security protected terminal device.
  • the second access network device may first use the fourth integrity protection algorithm and the fourth integrity protection key to perform integrity protection on the first information, and then use the fourth encryption algorithm and the fourth encryption key to perform integrity protection on the first information.
  • the first information is encrypted to obtain the second information.
  • the second access network device performs security protection on the first information according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key to obtain the second information. is: the second access network device performs security protection on the second positioning measurement information of the terminal device according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key, and obtains the received The second positioning measurement information of the security protected terminal device.
  • the first device receives the second information from the second device.
  • the second device sends the second information to the first device.
  • step 306 includes: the first device receives the second information from the terminal device through the first secure communication tunnel.
  • the first device receives the second information from the terminal device through the first secure communication tunnel, which can be understood as: the first device receives the location information or the security-protected terminal device from the terminal device through the first secure communication tunnel. Positioning measurement information of the protected terminal equipment.
  • the first device receives the location information of the security-protected terminal device or the location measurement information of the security-protected terminal device from the terminal device through the first secure communication tunnel, including: the first device passing the first secure communication tunnel A response message to the LPP message from the terminal device is received, where the response message to the LPP message includes location information of the security-protected terminal device or location measurement information of the security-protected terminal device.
  • the first device receives the response message of the LPP message from the terminal device through the first secure communication tunnel, which can be understood as: the first device receives the response message of the LPP message from the fourth device through the first secure communication tunnel, the fourth device The device receives the response message of the LPP message from the access network device through the first secure communication tunnel, and the access network device receives the response message of the LPP message from the terminal device through the first secure communication tunnel.
  • the first device receives a Namf_Communication_NIinfoNotify message 5 from the fourth device through the first secure communication tunnel, where the Namf_Communication_NIinfoNotify message 5 includes a response message of the LPP message.
  • the fourth device receives the uplink non-access stratum transmission message 6 from the access network device through the first secure communication tunnel, and the uplink non-access stratum transmission message 6 includes a response message of the LPP message.
  • step 306 includes: the first device receives the second information from the access network device through the second secure communication tunnel.
  • the first device receives the second information from the access network device through the second secure communication tunnel, which can be understood as: the first device receives the location of the security-protected terminal device from the access network device through the second secure communication tunnel measurement information.
  • the first device receives, through the second secure communication tunnel, the location measurement information from the terminal device protected by the access network device, including: the first device receives the first device from the access network device through the second secure communication tunnel.
  • the first device receives the response message of the first NRPPa message from the access network device through the second secure communication tunnel, which can be understood as: the first device receives the first NRPPa message from the fourth device through the second secure communication tunnel The fourth device receives the response message of the first NRPPa message from the access network device through the second secure communication tunnel.
  • the first device receives a Namf_Communication_NIinfoNotify message 6 from the fourth device through the second secure communication tunnel, where the Namf_Communication_NIinfoNotify message 6 includes a response message to the first NRPPa message.
  • the fourth device receives the uplink non-access stratum transmission message 7 from the access network device through the second secure communication tunnel, and the uplink non-access stratum transmission message 7 includes a response message of the first NRPPa message.
  • step 306 includes: the first device receives the second information from the first access network device through the third secure communication tunnel ; the first device receives the second information from the second access network device through the fourth secure communication tunnel.
  • the first device receives the second information from the first access network device through the third secure communication tunnel, which can be understood as: the first device receives the security-protected information from the first access network device through the third secure communication tunnel First positioning measurement information of the terminal device.
  • the first device receiving, through the third secure communication tunnel, the first location measurement information from the terminal device protected by the security of the first access network device includes: the first device receiving, through the third secure communication tunnel, the first location measurement information from the first A response message of the first NRPPa message of the access network device, where the response message of the first NRPPa message includes the first positioning measurement information of the security-protected terminal device.
  • the first device receives the response message of the first NRPPa message from the first access network device through the third secure communication tunnel, which can be understood as: the first device receives the first NRPPa message from the fourth device through the third secure communication tunnel For the response message of the NRPPa message, the fourth device receives the response message of the first NRPPa message from the first access network device through the third secure communication tunnel.
  • the first device receives a Namf_Communication_NIinfoNotify message 7 from the fourth device through the third secure communication tunnel, where the Namf_Communication_NIinfoNotify message 7 includes a response message to the first NRPPa message.
  • the fourth device receives the uplink non-access stratum transmission message 8 from the first access network device through the third secure communication tunnel, and the uplink non-access stratum transmission message 8 includes a response message of the first NRPPa message.
  • the fact that the first device receives the second information from the second access network device through the fourth secure communication tunnel can be understood as: the first device receives the security-protected information from the second access network device through the fourth secure communication tunnel Second positioning measurement information of the terminal device.
  • the first device receives the second positioning measurement information from the terminal device protected by the security of the second access network device through the fourth secure communication tunnel, including: the first device receives data from the second access network device through the fourth secure communication tunnel.
  • the first device receives the response message of the first NRPPa message from the second access network device through the fourth secure communication tunnel, which can be understood as: the first device receives the first NRPPa message from the fourth device through the fourth secure communication tunnel For the response message of the NRPPa message, the fourth device receives the response message of the first NRPPa message from the second access network device through the fourth secure communication tunnel.
  • the first device receives a Namf_Communication_NIinfoNotify message 8 from the fourth device through the fourth secure communication tunnel, where the Namf_Communication_NIinfoNotify message 8 includes a response message to the first NRPPa message.
  • the fourth device receives the uplink non-access stratum transmission message 9 from the second access network device through the fourth secure communication tunnel, and the uplink non-access stratum transmission message 9 includes a response message of the first NRPPa message.
  • the first device obtains the first information according to the second information.
  • step 307 includes: the first device according to the first encryption algorithm, the first An integrity protection algorithm, a first encryption key and a first integrity protection key decrypt and verify the integrity of the location information of the security-protected terminal device or the location measurement information of the security-protected terminal device, and obtain the terminal The location information of the device or the positioning measurement information of the terminal device.
  • the first device locates the location information of the security-protected terminal device or the location of the security-protected terminal device according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key.
  • the measurement information is decrypted and integrity protected and verified, and the location information of the terminal device or the location measurement information of the terminal device is obtained.
  • the location information of the terminal device or the location measurement information of the security-protected terminal device is decrypted, and then the first integrity protection algorithm and the first integrity protection key are used to decrypt the decrypted location information of the terminal device or the location of the decrypted terminal device.
  • the integrity protection verification is performed on the measurement information, and the location information of the terminal device or the positioning measurement information of the terminal device is obtained.
  • step 307 includes: the first device according to the second encryption algorithm, the second integrity protection algorithm, the second The encryption key and the second integrity protection key perform decryption and integrity protection verification on the positioning measurement information of the security-protected terminal equipment to obtain the positioning measurement information of the terminal equipment.
  • the first device decrypts and verifies the integrity protection of the positioning measurement information of the security-protected terminal device according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, Obtaining the location measurement information of the terminal device can be understood as: the first device first uses the second encryption algorithm and the second encryption key to decrypt the location measurement information of the security-protected terminal device, and then uses the second integrity protection algorithm and the second encryption key to decrypt the location measurement information of the security-protected terminal device.
  • the second integrity protection key performs integrity protection verification on the decrypted positioning measurement information of the terminal device to obtain the positioning measurement information of the terminal device.
  • step 307 includes: the first device performs the first positioning measurement information on the security-protected terminal device according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key. Decryption and integrity protection verification to obtain the first positioning measurement information of the terminal device; the first device is securely protected according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key pair Perform decryption and integrity protection verification on the second positioning measurement information of the terminal device to obtain the second positioning measurement information of the terminal device.
  • the first device decrypts and integrity protects the first positioning measurement information of the security-protected terminal device according to the third encryption algorithm, the third integrity protection algorithm, the third encryption key and the third integrity protection key Verification and obtaining the first positioning measurement information of the terminal device can be understood as: the first device first uses the third encryption algorithm and the third encryption key to decrypt the first positioning measurement information of the security-protected terminal device, and then uses the third encryption algorithm and the third encryption key to decrypt the first positioning measurement information of the security-protected terminal device.
  • the three integrity protection algorithms and the third integrity protection key perform integrity protection verification on the decrypted first positioning measurement information of the terminal device to obtain the first positioning measurement information of the terminal device.
  • the first device decrypts and integrity-protects the second positioning measurement information of the security-protected terminal device according to the fourth encryption algorithm, the fourth integrity protection algorithm, the fourth encryption key and the fourth integrity protection key Verification and obtaining the second positioning measurement information of the terminal device can be understood as: the first device first uses the fourth encryption algorithm and the fourth encryption key to decrypt the second positioning measurement information of the security-protected terminal device, and then uses the fourth encryption algorithm and the fourth encryption key to decrypt the second positioning measurement information of the security-protected terminal device.
  • the fourth integrity protection algorithm and the fourth integrity protection key perform integrity protection verification on the decrypted second positioning measurement information of the terminal device to obtain the second positioning measurement information of the terminal device.
  • the method further includes: : the first device determines the location information of the terminal device according to the location measurement information of the terminal device; or, the first device determines the location measurement information of the terminal device according to the first location measurement information of the terminal device and the second location measurement information of the terminal device .
  • the first device may determine the geographic coordinates where the terminal device is located, the location where the terminal device is located, according to one or more of the longitude where the terminal device is located, the latitude where the terminal device is located, the altitude where the terminal device is located, the horizontal speed and the vertical speed.
  • the cell or base station or location area is not limited here.
  • the foregoing further includes: the terminal device sends a first registration request message to the fourth device, where the first registration request message includes the identifier of the terminal device and the LCS security of the terminal device. capability information.
  • the foregoing further includes: the first device sends a tenth request message to the fourth device through the first secure communication tunnel.
  • the tenth request message may include third information, and the third information may be false location information of the terminal device.
  • the first device sends the tenth request message to the fourth device through the first secure communication tunnel, which can be understood as: the first device sends Nlmf_Location_DeterminLocation Request message 2 and Nlmf_Location_DeterminLocation Request message 2 to the fourth device through the first secure communication tunnel A tenth request message is included.
  • the method further includes: the first device receives, through the first secure communication tunnel, a response to the tenth request message sent by the fourth device information.
  • the first device receives the response message of the tenth request message sent by the fourth device through the first secure communication tunnel, which can be understood as: the first device receives the Nlmf_Location_ProvidePositioninginfo Response message 1 sent by the fourth device through the first secure communication tunnel, Nlmf_Location_ProvidePositioninginfo Response message 1 includes a response message of the tenth request message.
  • the fifth device may not send the tenth request message to the fourth device, which is not limited herein.
  • the fourth device perceives that the positioning process has been completed, so as to prevent the fourth device from mistaking the positioning failure.
  • FIG. 6 is a schematic flowchart of still another data transmission method provided by an embodiment of the present application. It should be noted that other devices in Figure 6 use the 5G network as an example to illustrate the content involved. That is, the third device may be the UDM network element in FIG. 2B , the fourth device may be the AMF network element in FIG. 2B , and the location service client may be the location service client in FIG. 2B . As shown in Figure 6, the method includes but is not limited to the following steps:
  • the first device receives an eleventh request message from a location service client.
  • the location service client sends an eleventh request message to the first device.
  • the eleventh request message includes the positioning accuracy, the positioning type, the identification of the terminal device, the address information of the first device, the identification of the first device, and the like.
  • the address information of the first device may be the IP address of the first device, or may be the IP address and port number of the first device, which is not limited herein.
  • the identifier of the first device may be a network element instance identifier (NF instance ID) of the first device or a fully qualified domain name (fully qualified domain name, FQDN) of the first device, which is not limited here.
  • NF instance ID network element instance identifier
  • FQDN fully qualified domain name
  • step 601 may or may not be performed, which is not limited in this application.
  • the AMF network element receives the eleventh request message from the first device.
  • the first device sends an eleventh request message to the AMF network element.
  • the AMF network element when the AMF network element receives the eleventh request message from the first device, it can be understood as: the AMF network element receives the Namf_Location_ProvidePositioningInfo message sent by the first device, where the Namf_Location_ProvidePositioningInfo message includes the eleventh request message.
  • the AMF network element sends the LCS security capability information of the terminal device to the first device according to the identifier of the first device.
  • the first device receives the LCS security capability information of the terminal device from the AMF network element.
  • the method further includes: the AMF network element receiving the first registration request message AMF network element from the terminal device.
  • the AMF network element may determine that the first device is the first device in the above-mentioned Embodiment 1 according to the identifier of the first device, that is, the determination of the first device is also used to provide corresponding positioning according to positioning accuracy requirements, time delay requirements, etc. method, and selecting a corresponding communication protocol to complete the interaction of information required for positioning. And also used to provide other information needed for location service, or location strategy. Therefore, the AMF network element sends the LCS security capability information of the terminal device to the first device.
  • step 603 may be replaced with the AMF network element sending the identification of the terminal device to the first device according to the identification of the first device.
  • the AMF network element may also send the LCS security capability information of the access network device to the first device. If step 603 is replaced with the AMF network element sending the identification of the terminal device to the first device according to the identification of the first device, the AMF network element may also send the identification of the access network device to the first device, which is not limited here.
  • the first device sends a second request message to the UDM network element.
  • the UDM network element receives the second request message from the first device.
  • the UDM network element sends a response message of the second request message to the first device.
  • the first device receives a response message from the second request message sent by the UDM network element.
  • the first device performs security protection on the first request message according to the LCS security capability information of the terminal device, and obtains a security-protected first request message.
  • step 606 can be replaced by the first device determining the corresponding terminal device according to the identifier of the terminal device.
  • the first encryption algorithm and the first integrity protection algorithm, and the security protection of the first request message according to the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, and obtain The first request message protected by security is not limited here.
  • the first integrity protection algorithm For the first encryption algorithm, the first integrity protection algorithm, the first encryption key and the first integrity protection key, reference may be made to the relevant description in FIG. 3 , and details are not repeated here.
  • the first device sends a first secure communication tunnel establishment request message to the terminal device.
  • the terminal device receives the first secure communication tunnel establishment request message from the first device.
  • Step 606 may be executed first, and then step 607 may be executed; or step 607 may be executed first, and then step 606 may be executed; Steps 606 and 607 are executed, which is not limited here.
  • the first device receives a response message of the first secure communication tunnel establishment request message.
  • the terminal device sends a first secure communication tunnel establishment request message.
  • the first device sends a first secure-protected request message to the terminal device through the first secure communication tunnel.
  • the terminal device receives the first secure communication tunnel establishment request message from the first device through the first secure communication tunnel.
  • the terminal device obtains the first request message according to the first request message protected by security.
  • step 610 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the terminal device acquires the location information of the terminal device or the positioning measurement information of the terminal device according to the first request message.
  • step 611 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the terminal device performs security protection on the location information of the terminal device or the location measurement information of the terminal device, and obtains the location information of the security protected terminal device or the location measurement information of the security protected terminal device.
  • step 612 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the first device receives the location information of the security-protected terminal device or the location measurement information of the security-protected terminal device from the terminal device through the first secure communication tunnel.
  • the terminal device sends the location information of the security-protected terminal device or the location measurement information of the security-protected terminal device to the first device through the first secure communication tunnel.
  • the first device obtains the location information of the terminal device or the location measurement information of the terminal device according to the location information of the security-protected terminal device or the location measurement information of the security-protected terminal device.
  • step 614 reference may be made to the related description in FIG. 3, and details are not repeated here.
  • the location service client receives a response message from the eleventh request message sent by the first device.
  • the first device sends a response message of the eleventh request message to the location service client.
  • the response message of the eleventh request message includes the location information of the terminal device.
  • the first device may determine the location information of the terminal device according to the location measurement information of the terminal device.
  • FIG. 7 is a schematic flowchart of still another data transmission method provided by an embodiment of the present application. It should be noted that other devices in Fig. 7 use the 5G network as an example to illustrate the content involved. That is, the terminal device may be the terminal device in FIG. 2B , the third device may be the UDM network element in FIG. 2B , the fourth device may be the AMF network element in FIG. 2B , and the location service client may be the location in FIG. 2B service client. As shown in Figure 7, the method includes but is not limited to the following steps:
  • 701-702 are similar to 601-602 in FIG. 6 and will not be repeated here.
  • the AMF network element sends the LCS security capability information of the access network device to the first device according to the identifier of the first device.
  • the first device receives the LCS security capability information from the access network device of the AMF network element.
  • the AMF network element may determine that the first device is the first device in the above-mentioned Embodiment 1 according to the identifier of the first device, that is, the determination of the first device is also used to provide corresponding positioning according to positioning accuracy requirements, time delay requirements, etc. method, and selecting a corresponding communication protocol to complete the interaction of information required for positioning. And also used to provide other information needed for location service, or location strategy. Therefore, the AMF network element sends the LCS security capability information of the access network device to the first device.
  • step 703 may be replaced with the AMF network element sending the identification of the access network device to the first device according to the identification of the first device.
  • the AMF network element may also send the LCS security capability information of the terminal device to the first device. If step 703 is replaced with the AMF network element sending the identification of the access network device to the first device according to the identification of the first device, the AMF network element may also send the identification of the terminal device to the first device, which is not limited here.
  • the first device sends a third request message to the UDM network element.
  • the UDM network element receives the third request message from the first device.
  • the UDM network element sends a response message of the third request message to the first device.
  • the first device receives a response message of the third request message from the UDM network element.
  • the first device performs security protection on the first request message according to the LCS security capability information of the access network device, and obtains the security-protected first request message.
  • step 703 is replaced by the AMF network element sending the identifier of the access network device to the first device according to the identifier of the first device
  • step 706 can be replaced with the first device determining according to the identifier of the access network device.
  • the second encryption algorithm and the second integrity protection algorithm corresponding to the access network device, and according to the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, the first request The message is protected by security, and the first request message protected by security is obtained, which is not limited here.
  • the second integrity protection algorithm For the second encryption algorithm, the second integrity protection algorithm, the second encryption key and the second integrity protection key, reference may be made to the relevant description in FIG. 3 , and details are not repeated here.
  • the first device sends a second secure communication tunnel establishment request message to the access network device.
  • the access network device receives the second secure communication tunnel establishment request message from the first device.
  • Step 706 may be executed first, and then step 707 may be executed; or step 707 may be executed first, and then step 706 may be executed at the same time; Steps 706 and 707 are executed, which is not limited here.
  • the first device receives a response to the second secure communication tunnel establishment request message.
  • the access network device sends a response to the second secure communication tunnel establishment request message.
  • the first device sends the security-protected first request message to the access network device through the second secure communication tunnel.
  • the access network device receives the security-protected first request message from the first device through the second secure communication tunnel.
  • the access network device obtains the first request message according to the first request message protected by the security.
  • step 710 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the access network device acquires the positioning measurement information of the terminal device according to the first request message.
  • step 711 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the access network device may also acquire the positioning assistance information of the terminal device according to the first request message.
  • the positioning assistance information of the terminal device may include, for example, a sounding reference signal (sounding reference signal, SRS) and the like.
  • a sounding reference signal sounding reference signal, SRS
  • the access network device performs security protection on the location measurement information of the terminal device, and obtains the location measurement information of the security protected terminal device.
  • step 712 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the first device receives, through the second secure communication tunnel, the location measurement information of the security-protected terminal device from the access network device.
  • the access network device sends the location measurement information of the terminal device under security protection to the first device through the second secure communication tunnel.
  • the first device obtains the location measurement information of the terminal device according to the location measurement information of the security protected terminal device.
  • step 714 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the first device determines the location information of the terminal device according to the location measurement information of the terminal device.
  • step 716 which is the same as step 615 in FIG. 6 , and will not be repeated here.
  • the security of the data transmission is improved in the process of implementing the positioning service by performing security protection on the first request message and the positioning measurement information of the terminal device. At the same time, it also avoids the problem of possible information leakage when the user's personal privacy-sensitive data is transmitted between different communication devices.
  • the first device may be the first device 20 in the above-mentioned Embodiment 1, and the second device may be the access network device.
  • the access network device includes the first access network device and the second access network device.
  • FIG. 8 is a schematic flowchart of another data transmission method provided by an embodiment of the present application.
  • the other devices in Figure 8 use the 5G network as an example to illustrate the content involved. That is, the terminal device may be the terminal device in FIG. 2B , the third device may be the UDM network element in FIG. 2B , the fourth device may be the AMF network element in FIG. 2B , and the location service client may be the location in FIG. 2B service client.
  • the method includes but is not limited to the following steps:
  • 801-802 are the same as 701-702 in FIG. 7 and will not be repeated here.
  • the AMF network element sends the LCS security capability information of the first access network device to the first device according to the identifier of the first device.
  • the first device receives the LCS security capability information of the first access network device from the AMF network element.
  • the AMF network element may determine that the first device is the first device in the above-mentioned Embodiment 1 according to the identifier of the first device, that is, the determination of the first device is also used to provide corresponding positioning according to positioning accuracy requirements, time delay requirements, etc. method, and selecting a corresponding communication protocol to complete the interaction of information required for positioning. And also used to provide other information needed for location service, or location strategy. Therefore, the AMF network element sends the LCS security capability information of the first access network device to the first device.
  • step 803 may be replaced with the AMF network element sending the identifier of the first access network device to the first device according to the identifier of the first device.
  • the AMF network element may also send the LCS security capability information of the terminal device to the first device. If step 803 is replaced with the AMF network element sending the identification of the first access network device to the first device according to the identification of the first device, the AMF network element may also send the identification of the terminal device to the first device, which is not limited here. .
  • the AMF network element receives the twelfth request message from the first device and the identifier of the terminal device.
  • the first device sends the twelfth request message and the identifier of the terminal device to the AMF network element.
  • the twelfth request message is used to obtain fourth information.
  • the fourth information may include an identification and a frequency point of an access network device (eg, a second access network device) in a neighboring cell of the first cell.
  • the first cell is a cell of the first access network device.
  • the frequency point is the frequency point at which the first access network device measures a sounding reference signal (sounding reference signal, SRS).
  • SRS sounding reference signal
  • the twelfth request message may be the second NRPPa message.
  • the second NRPPa message may include a second NRPPa positioning request (positioning request) message, a second NRPPa requesting location information (request location information) message, or a newly added message, which is not limited herein.
  • the first access network device receives the twelfth request message from the AMF network element.
  • the AMF network element sends the twelfth request message to the first access network device according to the identifier of the terminal device.
  • the AMF network element sends the twelfth request message to the first access network device according to the identifier of the terminal device, which can be understood as: the AMF network element sends the downlink non-request message to the first access network device according to the identifier of the terminal device.
  • the access stratum transmits a message 6, and the downlink non-access stratum transmission 6 includes a twelfth request message.
  • the terminal device receives the twelfth request message from the first access network device.
  • the first access network device sends a twelfth request message to the terminal device.
  • the terminal device acquires the fourth information according to the twelfth request message.
  • the first access network device receives a response message of the twelfth request message from the terminal device.
  • the terminal device sends a response message of the twelfth request message to the first access network device.
  • the response message of the twelfth request message includes fourth information.
  • the response message of the twelfth request message is the response message of the second NRPPa message.
  • the AMF network element receives a response message of the twelfth request message from the first access network device.
  • the first access network device sends a response message of the twelfth request message to the AMF network element.
  • the first device receives a response message of the twelfth request message from the AMF network element.
  • the AMF network element sends a response message of the twelfth request message to the first device.
  • the first device may receive the LCS security capability information of the second access network device from the AMF network element.
  • the first device determines a fourth encryption algorithm and a fourth integrity protection algorithm corresponding to the second access network device according to the identifier of the access network device in the neighboring cell of the first cell.
  • the first device sends a seventh request message to the UDM network element.
  • the UDM network element receives the seventh request message from the first device.
  • the UDM network element sends a response message of the seventh request message to the first device.
  • the first device receives a response message of the seventh request message from the UDM network element.
  • steps 812 and 813 may be performed after or before any of the other steps in steps 803 to 815 except for steps 803 and 805, which are not limited in this application.
  • the first device sends a ninth request message to the UDM network element.
  • the UDM network element receives the ninth request message from the first device.
  • the UDM network element sends a response message of the ninth request message to the first device.
  • the first device receives a response message of the ninth request message from the UDM network element.
  • the first device performs security protection on the first request message according to the LCS security capability information of the first access network device, obtains the first request message protected by security, and obtains the security-protected first request message according to the fourth encryption algorithm and the fourth integrity protection algorithm. , a fourth encryption key and a fourth integrity protection key to perform security protection on the first request message to obtain a security-protected first request message.
  • step 816 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the first device sends a third secure communication tunnel establishment request message to the first access network device.
  • the first access network device receives a third secure communication tunnel establishment request message from the first device.
  • the first device sends a fourth secure communication tunnel establishment request message to the second access network device.
  • the second access network device receives the fourth secure communication tunnel establishment request message from the first device.
  • Step 817 may be executed first, and then step 818 may be executed; or step 818 may be executed first, and then step 817 may be executed; Step 817 and step 818 are executed, which is not limited here.
  • the first device receives a response message of the third secure communication tunnel establishment request message.
  • the first access network device sends a response message of the third secure communication tunnel establishment request message to the first device.
  • step 817 and step 819 may be performed after or before any one of the other steps in step 803 to step 815 except for step 803 and step 805, which is not limited in this application.
  • step 804 may be replaced by the AMF network element receiving the twelfth request message and the identifier of the terminal device from the first device through the third secure communication tunnel.
  • Step 805 may be replaced by the first access network device receiving the twelfth request message from the AMF network element through the third secure communication tunnel.
  • Step 806 may be replaced by the terminal device receiving the twelfth request message from the first access network device through the third secure communication tunnel.
  • Step 808 may be replaced by the first access network device receiving a response message for the twelfth request message from the terminal device through the third secure communication tunnel.
  • Step 809 may be replaced by the AMF network element receiving the response message of the twelfth request message from the first access network device through the third secure communication tunnel.
  • Step 810 may be replaced by the first device receiving the response message of the twelfth request message from the AMF network element through the third secure communication tunnel.
  • step 817 and step 819 are performed after step 806 and before step 807, steps 808-810 need to be replaced. If step 817 and step 819 are executed after step 807 and before step 808, steps 808 to 810 need to be replaced. For details, refer to the above description, which is not repeated here. If step 817 and step 819 are executed after step 808 and before step 809, steps 809-810 need to be replaced. For details, refer to the above description, which will not be repeated here. If step 817 and step 819 are executed after step 809 and before step 810, steps 809-810 need to be replaced. For details, refer to the above description, which will not be repeated here. If step 817 and step 819 are executed after step 809 and before step 810, steps 809-810 need to be replaced. For details, refer to the above description, which will not be repeated here. If step 817 and step 819 are executed after step 810 and before step 811, step 810 needs to be replaced.
  • the first device receives a response message of the fourth secure communication tunnel establishment request message, and correspondingly, the second access network device sends a response message of the fourth secure communication tunnel establishment request message to the first device.
  • step 819 may be executed first, and then step 820 may be executed; or step 820 may be executed first, and then step 819 may be executed; Step 819 and step 820 are executed, which is not limited here.
  • the first device sends a first security-protected request message to the first access network device through a third secure communication tunnel.
  • the first access network device receives the security-protected first request message from the first device through the third secure communication tunnel.
  • the first device sends the first security-protected request message to the second access network device through the fourth secure communication tunnel.
  • the second access network device receives the security-protected first request message from the first device through the fourth secure communication tunnel.
  • step 821 may be executed first, and then step 822 may be executed; or step 822 may be executed first, and then step 821 may be executed; Step 821 and step 822 are executed, which is not limited here.
  • the first access network device obtains the first request message according to the first request message protected by the security.
  • step 823 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the second access network device obtains the first request message according to the first request message protected by security.
  • step 824 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • step 823 may be executed first, and then step 824 may be executed; or step 824 may be executed first, and then step 823 may be executed; Step 823 and step 824 are executed, which is not limited here.
  • the first access network device acquires the first positioning measurement information of the terminal device according to the first request message.
  • step 825 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the second access network device acquires the second positioning measurement information of the terminal device according to the first request message.
  • step 826 reference may be made to the related description in FIG. 3, and details are not repeated here.
  • step 825 may be executed first, and then step 826 may be executed; or step 825 may be executed first, and then step 826 may be executed at the same time; Step 825 and step 826 are executed, which is not limited here.
  • the first access network device performs security protection on the first location measurement information of the terminal device, and obtains the first location measurement information of the security protected terminal device.
  • step 827 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the second access network device performs security protection on the second location measurement information of the terminal device, and obtains the second location measurement information of the security protected terminal device.
  • step 828 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • step 827 may be executed first, and then step 828 may be executed; or step 828 may be executed first, and then step 827 may be executed at the same time; Step 827 and step 828 are executed, which is not limited here.
  • the first device receives, through the third secure communication tunnel, the first positioning measurement information from the security-protected terminal device of the first access network device.
  • the first access network device sends the second positioning measurement information of the security-protected terminal device to the first device through the third secure communication tunnel.
  • the first device receives, through the fourth secure communication tunnel, the second positioning measurement information from the security-protected terminal device of the second access network device.
  • the second access network device sends the second positioning measurement information of the security-protected terminal device to the first device through the fourth secure communication tunnel.
  • Step 829 may be executed first, and then step 830 may be executed; or step 830 may be executed first, and then step 829 may be executed; Step 829 and step 830 are executed, which is not limited here.
  • the first device obtains the first positioning measurement information of the terminal device according to the first positioning measurement information of the security-protected terminal device, and obtains the second positioning measurement information of the terminal device according to the second positioning measurement information of the security-protected terminal device. Positioning measurement information.
  • step 831 reference may be made to the relevant description in FIG. 3, and details are not repeated here.
  • the first device determines the location information of the terminal device according to the first positioning measurement information of the terminal device and the second positioning measurement information of the terminal device.
  • step 833 It is the same as step 716 in FIG. 7, and is not repeated here.
  • the security of the data transmission is improved in the process of implementing the positioning service by performing security protection on the first request message and the positioning measurement information of the terminal device. At the same time, it also avoids the problem of possible information leakage when the user's personal privacy-sensitive data is transmitted between different communication devices.
  • FIG. 9 is a schematic flowchart of still another data transmission method provided by an embodiment of the present application. It should be noted that other devices in FIG. 9 use the 5G network as an example to illustrate the content involved. That is, the third device may be the UDM network element in FIG. 2B , the fourth device may be the AMF network element in FIG. 2B , the location service client may be the location service client in FIG. 2B , and the fifth device may be the GMLC network element, and the sixth device may be an NRF network element. As shown in Figure 9, the method includes but is not limited to the following steps:
  • Steps 901 to 902 are similar to steps 601 to 602 in FIG. 6 , and will not be repeated here.
  • the eleventh request message includes the positioning accuracy, the positioning type, the identification of the terminal device, the identification of the LMF network element, the identification of the GMLC network element, the first address information, and the like.
  • the identifier of the LMF network element may be the network element instance identifier of the LMF network element or the fully restricted domain name of the LMF network element.
  • the identifier of the GMLC network element is the network element instance identifier of the GMLC network element or the fully restricted domain name of the GMLC network element.
  • the first address information may be a feedback address (GMLC notify callback URI) notified by the GMLC.
  • the AMF network element sends a thirteenth request message to the NRF network element.
  • the NRF network element receives the thirteenth request message from the AMF network element.
  • the thirteenth request message is used to instruct the NRF network element to acquire the address information of the LMF network element according to the identifier of the LMF network element.
  • the address information of the LMF network element may be the IP address of the LMF network element, or may be the IP address and port number of the LMF network element, which is not limited herein.
  • the LMF network element sends a second registration request message to the NRF network element, where the second registration request message includes the identifier of the LMF network element.
  • the NRF network element may allocate an address to the LMF network element according to the identifier of the LMF network element.
  • the NRF network element sends a response message of the thirteenth request message to the AMF network element.
  • the AMF network element receives the response message of the thirteenth request message from the NRF network element.
  • the response message of the thirteenth request message includes address information of the LMF network element.
  • Steps 905 to 916 are similar to steps 603 to 614 in FIG. 6 , and are not repeated here.
  • step 905 when referring to step 603, the identifier of the first device involved in step 603 needs to be replaced with the address information of the LMF network element.
  • steps 905-916 when referring to steps 603-614, the first device involved in steps 603-614 needs to be replaced with an LMF network element.
  • the LMF network element sends a response message of the eleventh request message to the GMLC network element according to the identifier of the GMLC network element.
  • the GMLC network element receives the response message of the eleventh request message from the LMF network element.
  • step 615 in FIG. 6 For the response message of the eleventh request message, reference may be made to the relevant description of step 615 in FIG. 6 , which will not be repeated here.
  • step 917 can be replaced by the LMF network element sending the eleventh request message to the GMLC network element according to the first address information. response message.
  • the AMF network element also sends the identification of the GMLC network element to the LMF network element
  • the thirteenth request message may also include the identification of the GMLC network element
  • the thirteenth request message is also used to indicate the NRF.
  • the network element acquires the address information of the GMLC network element according to the identifier of the GMLC network element.
  • the address information of the GMLC network element may be the IP address of the GMLC network element, or may be the IP address and port number of the GMLC network element, which is not limited herein.
  • the GMLC network element may send a third registration request message to the NRF network element, where the third registration request message includes the identifier of the GMLC network element.
  • the NRF network element can allocate an address to the GMLC network element according to the identifier of the GMLC network element.
  • step 917 may be replaced with the LMF network element sending a response message of the eleventh request message to the GMLC network element according to the address information of the GMLC network element.
  • step 918 Similar to step 615 in FIG. 6 , details are not repeated here.
  • step 918 when referring to step 615, the first device involved in step 615 needs to be replaced with a GMLC network element.
  • FIG. 10 is a schematic flowchart of still another data transmission method provided by an embodiment of the present application.
  • the other devices in Figure 10 use the 5G network as an example to illustrate the content involved. That is, the third device may be the UDM network element in FIG. 2B , the fourth device may be the AMF network element in FIG. 2B , the location service client may be the location service client in FIG. 2B , and the fifth device may be the GMLC network element, and the sixth device may be an NRF network element.
  • the method includes but is not limited to the following steps:
  • Steps 1001 to 1004 are similar to steps 901 to 904 in FIG. 9 , and will not be repeated here.
  • Steps 1005 to 1017 are similar to steps 703 to 715 in FIG. 7 , and are not repeated here.
  • step 1005 when referring to step 703, the identifier of the first device involved in step 703 needs to be replaced with the address information of the LMF network element.
  • steps 1005-1017 when referring to steps 703-715, the first device involved in steps 703-715 needs to be replaced with an LMF network element.
  • Steps 1018 to 1019 are similar to steps 917 to 918 in FIG. 9 , and will not be repeated here.
  • the first device may be the first device 20 in the above-mentioned Embodiment 2, and the second device may be the access network device.
  • the access network device includes the first access network device and the second access network device.
  • Example. It can be understood that the first device may be the LMF network element in the foregoing Embodiment 2, and the access network device may be the access network device shown in FIG. 2B , and the access network device includes the first access network device and the second access network device. equipment.
  • FIG. 11 is a schematic flowchart of another data transmission method provided by an embodiment of the present application. It should be noted that the other devices in Figure 11 use the 5G network as an example to illustrate the content involved.
  • the terminal device may be the terminal device in FIG. 2B
  • the third device may be the UDM network element in FIG. 2B
  • the fourth device may be the AMF network element in FIG. 2B
  • the location service client may be the location in FIG. 2B service client.
  • the method includes but is not limited to the following steps:
  • Steps 1101 to 1104 are similar to steps 901 to 904 in FIG. 9 , and are not repeated here.
  • Steps 1105 to 1134 are similar to steps 803 to 832 in FIG. 8 , and are not repeated here.
  • step 1105 when referring to step 803, the identifier of the first device involved in step 803 needs to be replaced with the address information of the LMF network element.
  • steps 1105-1134 when referring to steps 803-832, the first device involved in steps 803-832 needs to be replaced with an LMF network element.
  • Steps 1135 to 1136 are similar to steps 917 to 918 in FIG. 9 , and are not repeated here.
  • each network element in the above-mentioned implementation includes corresponding hardware structures and/or software modules for executing each function.
  • the present application can be implemented in hardware or a combination of hardware and computer software with the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein. Whether a function is performed by hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
  • the first device or the second device may be divided into functional modules according to the foregoing method examples.
  • each functional module may be divided corresponding to each function, or two or more functions may be integrated into one processing module.
  • the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiments of the present application is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
  • FIG. 12 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • the communication device 1200 can be applied to the methods shown in FIGS. 3 to 11 .
  • the communication device 1200 includes a processing module 1201 and a transceiver module 1202 .
  • the processing module 1201 may be one or more processors, and the transceiver module 1202 may be a transceiver or a communication interface.
  • the communication apparatus can be used to implement the first device or the second device involved in any of the above method embodiments, or to implement the functions involved in the network element in any of the above method embodiments.
  • the network element or network function can be either a network element in a hardware device, a software function running on dedicated hardware, or a virtualized function instantiated on a platform (eg, a cloud platform).
  • the communication apparatus 1200 may further include a storage module 1203 for storing program codes and data of the communication apparatus 1200 .
  • the transceiver module 1202 is used to support communication with the second device, etc., and specifically perform the sending and/or receiving actions performed by the first device in FIG. 3 to FIG. 11 , such as supporting the first device to perform steps 306 and 401. one or more steps of, and or other processes for, the techniques described herein.
  • the processing module 1201 can be used to support the communication apparatus 1200 to perform the processing actions in the above-described method embodiments, for example, to support the first device to perform one or more of the steps 301 and 307, and or for other techniques described herein. process.
  • the communication device when used as the second device or is a chip applied in the second device, and performs the steps performed by the second device in the above method embodiments.
  • the transceiver module 1202 is used to support communication with the first device, etc., and specifically perform the sending and/or receiving actions performed by the second device in FIG. 3 to FIG. 11 , for example, support the second device to perform steps 302 and 306 one or more steps of, and or other processes for, the techniques described herein.
  • the processing module 1201 can be used to support the communication apparatus 1200 to perform the processing actions in the above-described method embodiments, for example, to support the second device to perform one or more of steps 303 and 304, and or for other techniques described herein. process.
  • the transceiver module 1202 may be an interface, a pin, a circuit, or the like.
  • the interface can be used to input data to be processed to the processor, and can output the processing result of the processor to the outside.
  • the interface can be a general purpose input output (GPIO) interface, which can communicate with multiple peripheral devices (such as a display (LCD), a camera (camara), a radio frequency (RF) module, an antenna, etc. )connect.
  • GPIO general purpose input output
  • peripheral devices such as a display (LCD), a camera (camara), a radio frequency (RF) module, an antenna, etc.
  • the interface is connected to the processor through a bus.
  • the processing module 1201 may be a processor, and the processor may execute computer-executed instructions stored in the storage module, so that the chip executes the methods involved in the embodiments of FIGS. 3 to 11 .
  • the processor may include a controller, an arithmetic unit and a register.
  • the controller is mainly responsible for instruction decoding, and sends control signals for operations corresponding to the instructions.
  • the arithmetic unit is mainly responsible for performing fixed-point or floating-point arithmetic operations, shift operations, and logical operations, and can also perform address operations and conversions.
  • Registers are mainly responsible for saving register operands and intermediate operation results temporarily stored during instruction execution.
  • the hardware architecture of the processor may be an application specific integrated circuits (ASIC) architecture, a microprocessor without interlocked piped stages architecture (MIPS) architecture, advanced reduced instructions Set machine (advanced RISC machines, ARM) architecture or network processor (network processor, NP) architecture and so on.
  • ASIC application specific integrated circuits
  • MIPS microprocessor without interlocked piped stages architecture
  • ARM advanced reduced instructions Set machine
  • NP network processor
  • the storage module may be a storage module in the chip, such as a register, a cache, and the like.
  • the storage module can also be a storage module located outside the chip, such as read only memory (Read Only Memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (Random Access Memory, RAM), etc. .
  • processors and the interface can be implemented by hardware design, software design, or a combination of software and hardware, which is not limited here.
  • FIG. 13 is a schematic structural diagram of a simplified terminal device provided by an embodiment of the present application.
  • the terminal device takes a mobile phone as an example.
  • the terminal device includes at least one processor, and may also include a radio frequency circuit, an antenna, and an input and output device.
  • the processor may be used to process communication protocols and communication data, and may also be used to control terminal equipment, execute software programs, and process data of software programs.
  • the terminal device may also include a memory, which is mainly used for storing software programs and data. These related programs can be loaded into the memory when the communication device leaves the factory, or can be loaded into the memory when needed later.
  • the radio frequency circuit is mainly used for the conversion of the baseband signal and the radio frequency signal and the processing of the radio frequency signal.
  • the antenna is mainly used for sending and receiving radio frequency signals in the form of electromagnetic waves, and the antenna is the antenna provided by this embodiment of the application.
  • Input and output devices such as touch screens, display screens, and keyboards, are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal equipment may not have input and output devices.
  • the processor When data needs to be sent, the processor performs baseband processing on the data to be sent, and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal and sends the radio frequency signal through the antenna in the form of electromagnetic waves.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, which converts the baseband signal into data and processes the data.
  • FIG. 13 only one memory and processor are shown in FIG. 13 . In an actual end device product, there may be one or more processors and one or more memories.
  • the memory may also be referred to as a storage medium or a storage device or the like.
  • the memory may be set independently of the processor, or may be integrated with the processor, which is not limited in this embodiment of the present application.
  • the antenna and radio frequency circuit with a transceiver function can be regarded as the receiving unit and the sending unit of the terminal device (also collectively referred to as a transceiver unit), and the processor with a processing function can be regarded as the processing unit of the terminal device .
  • the terminal device includes a receiving module 31 , a processing module 32 and a sending module 33 .
  • the receiving module 31 may also be called a receiver, a receiver, a receiving circuit, and the like
  • the sending module 33 may also be called a transmitter, a transmitter, a transmitting circuit, and the like.
  • the processing module 32 may also be referred to as a processor, a processing board, a processing device, or the like.
  • the processing module 32 is configured to perform the functions of the terminal device in any of the embodiments shown in FIG. 3 to FIG. 11 .
  • FIG. 14 is a schematic structural diagram of a simplified access network device according to an embodiment of the present application.
  • the access network equipment includes a radio frequency signal transceiving and converting part and a 42 part, and the radio frequency signal transceiving and converting part further includes a receiving module 41 part and a sending module 43 part (also collectively referred to as a transceiver module).
  • the radio frequency signal transceiver and conversion part is mainly used for the transmission and reception of radio frequency signals and the conversion of radio frequency signals and baseband signals; the 42 part is mainly used for baseband processing and control of access network equipment.
  • the receiving module 41 may also be called a receiver, a receiver, a receiving circuit, and the like
  • the sending module 43 may also be called a transmitter, a transmitter, a transmitter, a transmitting circuit, and the like.
  • Part 42 is usually the control center of the access network device, which can usually be called a processing module, and is used to control the access network device to perform the steps performed by the terminal device or the access network device in the above Figures 3 to 11 .
  • a processing module is usually the control center of the access network device, which can usually be called a processing module, and is used to control the access network device to perform the steps performed by the terminal device or the access network device in the above Figures 3 to 11 .
  • the 42 part may include one or more single boards, and each single board may include one or more processors and one or more memories, and the processors are used to read and execute programs in the memories to implement baseband processing functions and access control of network equipment. If there are multiple boards, each board can be interconnected to increase processing capacity. As an optional implementation manner, one or more processors may be shared by multiple boards, or one or more memories may be shared by multiple boards, or one or more processors may be shared by multiple boards at the same time. device.
  • the sending module 43 is configured to perform the functions of the access network device in any of the embodiments shown in FIG. 3 to FIG. 11 .
  • An embodiment of the present application further provides a first device, including a processor, a memory, an input interface, and an output interface, where the input interface is used to receive information from other communication devices other than the first device, and the output interface is used to send information to the first device Other communication devices other than those output information, and the processor invokes the computer program stored in the memory to implement any of the embodiments shown in FIG. 3-FIG. 11 .
  • Embodiments of the present application further provide a second device, including a processor, a memory, an input interface, and an output interface, where the input interface is used to receive information from other communication devices other than the second device, and the output interface is used to send information to the second device Other communication devices other than those output information, and the processor invokes the computer program stored in the memory to implement any of the embodiments shown in FIG. 3-FIG. 11 .
  • Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed, any of the embodiments shown in FIG. 3 to FIG. 11 are implemented.
  • the embodiments of the present application further provide a computer program product, when the computer reads and executes the computer program product, the computer executes any of the embodiments shown in FIG. 3 to FIG. 11 .
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated units are implemented in the form of software functional units and sold or used as independent products, they may be stored in a computer-readable storage medium.
  • the technical solutions of the present application are essentially or part of contributions to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a cloud server, or an access network device, etc.) to execute all or part of the steps of the above methods in the various embodiments of the present application.
  • a computer device which may be a personal computer, a cloud server, or an access network device, etc.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • U disk mobile hard disk
  • Read-Only Memory ROM, Read-Only Memory
  • RAM Random Access Memory
  • magnetic disk or optical disk and other media that can store program codes .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请提供了一种数据传输方法及相关装置，该方法包括：对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；向第二设备发送所述受安全保护的所述第一请求消息，所述第二设备为所述终端设备或接入网设备；接收来自所述第二设备的第二信息，所述第二信息包括受安全保护的所述第一信息；根据所述第二信息，获得所述第一信息。实施本申请实施例，使得在实现定位业务过程中提高了数据传输的安全性。

Description

一种数据传输方法及相关装置 技术领域
本申请涉及通信领域，尤其涉及一种数据传输方法及相关装置。
背景技术
目前，位置定位服务(location service，LCS)在实际应用中变得越来越重要，用户也越来越注重个人隐私敏感数据的安全性，尤其是企业用户。一般来说，在应用LCS功能时，可以涉及到企业用户专属的定位业务，比如资产盘点、资源调度等业务。无论涉及到哪种具体的定位业务，在应用LCS功能时，包括用户个人隐私敏感数据可以在不同的通信设备之间传输。比如，终端设备、接入和移动性管理功能(access and mobility management function，AMF)网元、位置管理功能(location management function，LMF)网元等。
然而，当包括用户个人隐私敏感数据在不同的通信设备之间传输时，可能存在信息泄露的问题。因此，在实现定位业务过程中如何提高数据传输的安全性成为当前急需解决的技术问题。
发明内容
本申请实施例提供了一种数据传输方法及相关装置，实施本申请实施例，使得在实现定位业务过程中提高了数据传输的安全性。
第一方面，一种数据传输方法，所述方法应用于第一设备，所述方法包括：
对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
向第二设备发送所述受安全保护的所述第一请求消息，所述第二设备为所述终端设备或接入网设备；
接收来自所述第二设备的第二信息，所述第二信息包括受安全保护的所述第一信息；
根据所述第二信息，获得所述第一信息。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
可选的，所述第二设备为所述终端设备，所述方法还包括：
向所述终端设备发送第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法，所述第一安全保护参数用于所述终端设备进行安全通信；
接收所述第一安全通信隧道建立请求消息的响应消息；
所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
通过所述第一安全通信隧道，向所述终端设备发送所述受安全保护的所述第一请求消 息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述方法还包括：
接收所述终端设备的位置定位服务LCS安全能力信息；
所述对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，包括：
根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得受安全保护的所述第一请求消息。
可以看出，上述技术方案中，实现基于终端设备的LCS安全能力信息对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，所述方法还包括：
向第三设备发送第二请求消息，所述第二请求消息包括所述终端设备的标识，所述第二请求消息用于请求第二安全保护参数；
接收来自所述第三设备的所述第二请求消息的响应，所述第二请求消息的响应包括所述第二安全保护参数；
其中，所述第二安全保护参数包括第一加密密钥和第一完整性保护密钥；或，所述第二安全保护参数包括第一参数，所述第一参数用于确定所述第一加密密钥和所述第一完整性保护密钥；
所述根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
根据所述终端设备的LCS安全能力信息和所述第二安全保护参数，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，实现了获取第二安全保护参数，从而使得第一设备可以根据第二安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，所述第二设备为所述接入网设备，所述方法还包括：
向所述接入网设备发送第二安全通信隧道建立请求消息，所述第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；
接收所述第二安全通信隧道建立请求消息的响应；
所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
通过所述第二安全通信隧道，向所述接入网设备发送所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述方法还包括：
接收所述接入网设备的标识；
根据所述接入网设备的标识，确定所述接入网设备对应的第二加密算法和第二完整性保护算法；
所述对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，包括：
根据所述第二加密算法和所述第二完整性保护算法，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，实现了基于第二加密算法和第二完整性保护算法，对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，所述方法还包括：
接收所述接入网设备的LCS安全能力信息；
所述对第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，实现了基于接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，所述方法还包括：
向第三设备发送第三请求消息，所述第三请求消息包括所述接入网设备的标识，所述第三请求消息用于请求第四安全保护参数；
接收来自所述第三设备的所述第三请求消息的响应，所述第三请求消息的响应包括所述第四安全保护参数；
其中，所述第四安全保护参数包括第二加密密钥和第二完整性保护密钥；或，所述第四安全保护参数包括第二参数，所述第二参数用于确定所述第二加密密钥和所述第二完整性保护密钥；
所述根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
根据所述接入网设备的LCS安全能力信息和所述第四安全保护参数，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，实现了获取第四安全保护参数，从而使得第一设备可以根据第四安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，所述根据所述第二信息，获得所述第一信息，包括：
根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
可选的，所述根据所述第二信息，获得所述第一信息，包括：
根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
可选的，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，所述方法还包括：
向所述第一接入网设备发送第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第三完整性保护算法，所述第五安全保护参数用于所述第一接入网设备进行安全通信；
向所述第二接入网设备发送第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
接收所述第三安全通信隧道建立请求消息的响应；
接收所述第四安全通信隧道建立请求消息的响应；
所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
通过所述第三安全通信隧道，向所述第一接入网设备发送所述受安全保护的所述第一请求消息；
通过所述第四安全通信隧道，向所述第二接入网设备发送所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述根据所述第二信息，获得所述第一信息，包括：
根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息；
根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
第二方面，提供一种数据传输方法，所述方法应用于第二设备，所述方法包括：
接收来自第一设备的受安全保护的第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
根据所述受安全保护的所述第一请求消息，获得所述第一请求消息；
根据所述第一请求消息，获取所述第一信息；
对所述第一信息进行安全保护，获得第二信息，所述第二信息包括受安全保护的所述第一信息；
向所述第一设备发送所述第二信息。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
可选的，所述第二设备为所述终端设备，所述方法还包括：
接收来自所述第一设备的第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法，所述 第一安全保护参数用于所述终端设备进行安全通信；
发送所述第一安全通信隧道建立请求消息的响应消息；
所述接收来自第一设备的受安全保护的第一请求消息，包括：
通过所述第一安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，所述对所述第一信息进行安全保护，获得第二信息，包括：
根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
可选的，所述方法还包括：
向第四设备发送第一注册请求消息，所述第一注册请求消息包括所述终端设备的标识和所述终端设备的LCS安全能力信息。
可选的，所述第二设备为接入网设备，所述方法还包括：
接收来自所述第一设备的第二安全通信隧道建立请求消息，所述第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；
发送所述第二安全通信隧道建立请求消息的响应；
所述接收来自第一设备的受安全保护的第一请求消息，包括：
通过所述第二安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述方法还包括：
向所述第一设备发送所述接入网设备的标识。
可选的，所述方法还包括：
向所述第一设备发送所述接入网设备的LCS安全能力信息。
可选的，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，所述对所述第一信息进行安全保护，获得第二信息，包括：
根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
可选的，所述第二设备为接入网设备，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，所述方法还包括：
所述第一接入网设备接收来自所述第一设备的第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第三完整性保护算法，所述第五安全保护参数用于所述第一接入网设备进行安全通信；
所述第二接入网设备接收来自所述第一设备的第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
所述第一接入网设备发送所述第三安全通信隧道建立请求消息的响应；
所述第二接入网设备发送所述第四安全通信隧道建立请求消息的响应；
所述接收来自第一设备的受安全保护的第一请求消息，包括：
所述第一接入网设备通过所述第三安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息；
所述第二接入网设备通过所述第四安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
可选的，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
所述第一接入网设备根据所述第三加密算法、所述第三完整性保护算法、所述第三加密密钥和所述第三完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息；
所述第二接入网设备根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，所述对所述第一信息进行安全保护，获得第二信息，包括：
所述第一接入网设备根据所述第三加密算法、所述第三完整性保护算法、所述第三加密密钥和所述第三完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息；
所述第二接入网设备根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
第三方面，提供一种第一设备，包括处理模块和收发模块，其中，
所述处理模块，用于对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
所述收发模块，用于向第二设备发送所述受安全保护的所述第一请求消息，所述第二设备为所述终端设备或接入网设备；
所述收发模块，还用于接收来自所述第二设备的第二信息，所述第二信息包括受安全保护的所述第一信息；
所述处理模块，还用于根据所述第二信息，获得所述第一信息。
可选的，所述第二设备为所述终端设备，所述收发模块，还用于
向所述终端设备发送第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法，所述第一安全保护参数用于所述终端设备进行安全通信；接收所述第一安全通信隧道建立请求消息的响应消息；
在向第二设备发送所述受安全保护的所述第一请求消息时，所述收发模块，用于通过所述第一安全通信隧道，向所述终端设备发送所述受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于接收所述终端设备的位置定位服务LCS安全能力信息；
在对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息时，所述处理模块还用于根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于向第三设备发送第二请求消息，所述第二请求消息包括所述终端设备的标识，所述第二请求消息用于请求第二安全保护参数；接收来自所述第三设备的所述第二请求消息的响应，所述第二请求消息的响应包括所述第二安全保护参数；
其中，所述第二安全保护参数包括第一加密密钥和第一完整性保护密钥；或，所述第二安全保护参数包括第一参数，所述第一参数用于确定所述第一加密密钥和所述第一完整性保护密钥；
在根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息时，所述处理模块，用于根据所述终端设备的LCS安全能力信息和所述第二安全保护参数，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可选的，所述第二设备为所述接入网设备，所述收发模块，还用于
向所述接入网设备发送第二安全通信隧道建立请求消息，所述第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；接收所述第二安全通信隧道建立请求消息的响应；
在向第二设备发送所述受安全保护的所述第一请求消息时，所述收发模块，用于通过所述第二安全通信隧道，向所述接入网设备发送所述受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于接收所述接入网设备的标识；
所述处理模块，还用于根据所述接入网设备的标识，确定所述接入网设备对应的第二加密算法和第二完整性保护算法；
在对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息时，所述处理模块，用于根据所述第二加密算法和所述第二完整性保护算法，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于接收所述接入网设备的LCS安全能力信息；
在对第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息时，所述处理模块，还用于根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于向第三设备发送第三请求消息，所述第三请求消息包括所述接入网设备的标识，所述第三请求消息用于请求第四安全保护参数；接收来自所述第三设备的所述第三请求消息的响应，所述第三请求消息的响应包括所述第四安全保护参数；
其中，所述第四安全保护参数包括第二加密密钥和第二完整性保护密钥；或，所述第四安全保护参数包括第二参数，所述第二参数用于确定所述第二加密密钥和所述第二完整性保护密钥；
在根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息时，所述处理模块，还用于根据所述接入网设备的LCS安全能力信息和所述第四安全保护参数，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
可选的，在根据所述第二信息，获得所述第一信息时，所述处理模块，用于
根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
可选的，在根据所述第二信息，获得所述第一信息时，所述处理模块，用于
根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
可选的，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，所述收发模块，还用于
向所述第一接入网设备发送第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第三完整性保护算法，所述第五安全保护参数用于所述第一接入网设备进行安全通信；
向所述第二接入网设备发送第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
接收所述第三安全通信隧道建立请求消息的响应；
接收所述第四安全通信隧道建立请求消息的响应；
在向第二设备发送所述受安全保护的所述第一请求消息时，所述收发模块，用于
通过所述第三安全通信隧道，向所述第一接入网设备发送所述受安全保护的所述第一请求消息；
通过所述第四安全通信隧道，向所述第二接入网设备发送所述受安全保护的所述第一请求消息。
可选的，在根据所述第二信息，获得所述第一信息时，所述处理模块，用于
根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息；
根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
第四方面，提供一种第二设备，包括收发模块和处理模块，其中，
所述收发模块，用于接收来自第一设备的受安全保护的第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
所述处理模块，用于根据所述受安全保护的所述第一请求消息，获得所述第一请求消息；根据所述第一请求消息，获取所述第一信息；对所述第一信息进行安全保护，获得第二信息，所述第二信息包括受安全保护的所述第一信息；
所述收发模块，还用于向所述第一设备发送所述第二信息。
可选的，所述第二设备为所述终端设备，所述收发模块，还用于
接收来自所述第一设备的第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法所述第一安全保护参数用于所述终端设备进行安全通信；
发送所述第一安全通信隧道建立请求消息的响应消息；
在接收来自第一设备的受安全保护的第一请求消息时，所述收发模块，还用于
通过所述第一安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可选的，在根据所述受安全保护的所述第一请求消息，获得所述第一请求消息时，所述处理模块，用于
根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，在对所述第一信息进行安全保护，获得第二信息时，所述处理模块，用于
根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
可选的，所述收发模块，还用于向第四设备发送第一注册请求消息，所述第一注册请求消息包括所述终端设备的标识和所述终端设备的LCS安全能力信息。
可选的，所述第二设备为接入网设备，所述收发模块，还用于
接收来自所述第一设备的第二安全通信隧道建立请求消息，所述第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；
发送所述第二安全通信隧道建立请求消息的响应；
在接收来自第一设备的受安全保护的第一请求消息时，所述收发模块，还用于
通过所述第二安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可选的，所述收发模块，还用于向所述第一设备发送所述接入网设备的标识。
可选的，所述收发模块，还用于向所述第一设备发送所述接入网设备的LCS安全能力信息。
可选的，在根据所述受安全保护的所述第一请求消息，获得所述第一请求消息时，所述处理模块，用于
根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，在对所述第一信息进行安全保护，获得第二信息时，所述处理模块，用于
根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
可选的，所述第二设备为接入网设备，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，
若所述接入网设备为所述第一接入网设备，所述收发模块，用于接收来自所述第一设备的第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第三完整性保护算法，所述第五安全保护参数用于所述第一接入网设备进行安全通信；
若所述接入网设备为所述第二接入网设备，所述收发模块，用于接收来自所述第一设备的第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
若所述接入网设备为所述第一接入网设备，所述收发模块，用于发送所述第三安全通信隧道建立请求消息的响应；
若所述接入网设备为所述第二接入网设备，所述收发模块，用于发送所述第四安全通 信隧道建立请求消息的响应；
在接收来自第一设备的受安全保护的第一请求消息时，
若所述接入网设备为所述第一接入网设备，所述收发模块，用于通过所述第三安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息；
若所述接入网设备为所述第二接入网设备，所述收发模块，用于通过所述第四安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
可选的，在根据所述受安全保护的所述第一请求消息，获得所述第一请求消息时，
若所述接入网设备为所述第一接入网设备，所述处理模块，用于根据所述第三加密算法、所述第三完整性保护算法、所述第三加密密钥和所述第三完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息；
若所述接入网设备为所述第一接入网设备，所述处理模块，用于根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
可选的，在对所述第一信息进行安全保护，获得第二信息时，
若所述接入网设备为所述第一接入网设备，所述处理模块，用于根据所述第三加密算法、所述第三完整性保护算法、所述第三加密密钥和所述第三完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息；
若所述接入网设备为所述第二接入网设备，所述处理模块，用于根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
第五方面，提供一种第一设备，包括处理器、存储器、输入接口和输出接口，所述输入接口用于接收来自所述第一设备之外的其它通信装置的信息，所述输出接口用于向所述第一设备之外的其它通信装置输出信息，所述处理器调用所述存储器中存储的计算机程序实现如第一方面任一项所述的方法。
在一种可能的设计中，该第一设备可以是实现第一方面中方法的芯片或者包含芯片的设备。
第六方面，提供一种第二设备，包括处理器、存储器、输入接口和输出接口，所述输入接口用于接收来自所述第二设备之外的其它通信装置的信息，所述输出接口用于向所述第二设备之外的其它通信装置输出信息，所述处理器调用所述存储器中存储的计算机程序实现如第二方面任一项所述的方法。
在一种可能的设计中，该第一设备可以是实现第二方面中方法的芯片或者包含芯片的设备。
第七方面，提供一种计算机可读存储介质，所述计算机可读存储介质中存储有计算机程序，当所述计算机程序被运行时，实现如第一方面或第二方面任一项所述的方法。
第八方面，提供一种计算机程序产品，当计算机读取并执行所述计算机程序产品时，使得计算机执行实现如第一方面或第二方面任一项所述的方法。
第九方面，提供一种通信系统，包括上述第一设备，和/或，上述第二设备。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
其中：
图1为本申请实施例提供的一种非漫游场景下5G网络的位置定位服务架构图；
图2A为本申请实施例提供的通信系统的架构示意图；
图2B为本申请实施例适用的一种具体可能的网络架构示意图；
图3为本申请实施例提供的一种数据传输方法的流程示意图；
图4为一种协议层；
图5为又一种协议层；
图6为本申请实施例提供的又一种数据传输方法的流程示意图；
图7为本申请实施例提供的又一种数据传输方法的流程示意图；
图8为本申请实施例提供的又一种数据传输方法的流程示意图；
图9为本申请实施例提供的又一种数据传输方法的流程示意图；
图10为本申请实施例提供的又一种数据传输方法的流程示意图；
图11为本申请实施例提供的又一种数据传输方法的流程示意图；
图12为本申请实施例提供的一种通信装置的结构示意图；
图13为本申请实施例提供的一种简化的终端设备的结构示意图；
图14为本申请实施例提供的一种简化的接入网设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
需要理解的是，本申请实施例中的术语“系统”和“网络”可被互换使用。“至少一个”是指一个或者多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。“以下至少一种(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a，b，或c中的至少一种(个)，可以表示：a，b，c，a-b，a-c，b-c，或a-b-c，其中a，b，c可以是单个，也可以是多个。单数表达形式“一个”、“一种”、“所述”、“上述”、“该”和“这一”旨在也包括例如“一个或多个”这种表达形式，除非其上下文中明确地有相反指示。以及，除非有相反的说明，本申请实施例提及“第一”、“第 二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。
在本申请实施例中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此，在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例，而是意味着“一个或多个但不是所有的实施例”，除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”，除非是以其他方式另外特别强调。
下面对本申请所涉及到的一些部分名词(或通信术语)进行解释说明。
1、第一请求消息
第一请求消息，在本申请实施例中是指用于请求针对特定的终端设备的定位任务的消息。定位任务可以是即时请求(location immediate request，LIR)业务或者位置延迟请求(location deferred request，LDR)业务，通过定位任务，移动通信网络可将终端设备的位置信息或者与位置有关的定位事件告知定位任务的请求方，即定位请求方。定位服务器或者位置管理功能(location management function，LMF)网元可用于管理针对特定的终端设备的定位请求。具体地，管理第一请求消息，是指定位服务器或LMF网元可用于根据定位请求方发送的第一请求消息，向定位请求方反馈终端设备的位置信息或者向定位请求方指示终端设备出现定位请求指示的定位事件。
即时请求业务是一种“即时请求，即时响应”的定位业务，其第一请求消息可包括LIR。在本申请实施中，定位请求方向终端设备所处的核心网网元如接入和移动性管理功能(access and mobility management function，AMF)网元或者网关移动位置中心(gateway mobile location centre，GMLC)网元发送LIR，由AMF网元或者GMLC转发给定位服务器或者核心网中的其它网元如LMF网元，以使定位服务器或者LMF网元基于LIR向定位请求方即时反馈终端设备的位置信息。
位置延迟请求业务具有延迟性，定位请求方相当于向终端设备、终端设备所处的核心网网元或其他相关网元订阅终端设备的定位报告，该报告可以在满足一定的定位事件后触发，定位事件例如，终端设备移动出或移动至某一区域、终端设备移动距离达到阈值距离或者满足预设的报告周期等等，该报告中可以携带终端设备的位置信息，和/或，该报告可用于指示满足以上的位置事件，如指示终端设备移动出或移动至某一区域等等。
2、终端设备的位置信息
基于定位任务，终端设备所在的核心网网元如LMF网元或者定位服务器可以计算获得终端设备的位置信息。具体例如，LMF网元或者定位服务器可基于定位请求方发送的第一请求消息以及终端设备上报的终端设备的定位测量信息，计算获得终端设备的位置信息，并向定位请求方反馈终端设备的位置信息。具体地，LMF网元或者定位服务器可以根据终端设备的位置信息生成上述定位事件报告。其中，终端设备的定位测量信息包括以下一种或多种：终端设备所在经度、终端设备所在纬度、终端设备所在海拔高度、水平速度和垂直速度。终端设备的位置信息，其可以为在某个位置系统(例如，全球定位系统(global positioning system，GPS)或北斗卫星系统)中的地理位置坐标。
终端设备，在本申请实施例中是指定位请求方所请求的定位任务的对象。比如，在3GPP规范中，安全用户面定位启用终端设备(secure user plane location enabled terminal，SET)为定位服务的客户端，即定位请求方所请求的定位任务的对象，例如安卓(android)智能手机，也即3GPP定义的终端设备。终端设备所在的核心网的网元如LMF网元或者定位服务器可基于定位请求方的定位请求，向定位请求方提供终端设备的位置信息，或告知定位请求方终端设备已满足定位请求指示的定位事件。
3、定位请求方
定位请求方，在本申请实施例中是指向核心网的网元如LMF网元或者定位服务器请求提供针对终端的定位任务的通信设备，其可以是一个终端设备，也可以是有定位需求的外部客户端，如服务器、无线通信网络中的网元或者具有定位终端设备的位置需求的其他载体。比如，安全用户面定位(secure user plane location，SUPL)代理(agent)是一个需要获取位置信息的应用程序，即5G网络定义的位置服务客户端。其中，SUPL Agent可以运行在SET中，也可以运行在SUPL网络中。其中，如果SUPL Agent运行在SET中，定位请求方即为终端设备。如果SUPL Agent运行在SUPL网络中，定位请求方即为有定位需求的外部客户端。
4、定位服务器
定位服务器，在本申请实施例中采用MEC方式进行部署，其可以为MEC平台或服务器。定位服务器的具体部署形态本申请不做限定，具体可以是云端部署，还可以是独立的计算机设备或芯片等。其中，定位服务器与终端设备之间的数据交互可直接通过用户面(user plane)进行。比如，SUPL是操作维护管理(operation administration and maintenance，OAM)组织定义的一种定位协议，定位服务器可以基于SUPL协议通过用户面与终端设备进行交互，即终端设备可以通过用户面来传送SUPL报文，SUPL报文可以封装终端上报的终端设备的位置信息、定位测量信息等以及定位服务器给终端设备下达的第一请求消息。
上述内容简要阐述了本申请实施例所涉及的部分名词(或通信术语)的含义，为更好地理解本申请实施例的提供的通信方法，下面将对本申请实施例提供的通信方法的系统架构和/或应用场景进行说明。可理解的，本申请实施例描述的场景是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定。
为了便于理解本申请，在此介绍本申请实施例涉及的相关技术知识。
在非漫游场景下，5G网络的位置定位服务架构可以包括终端设备、接入网设备、位置服务(location service，LCS)客户端、接入和移动性管理功能(access and mobility management function，AMF)网元、位置管理功能(location management function，LMF)网元、统一数据管理(unified data management，UDM)网元、网关移动位置中心(gateway mobile location centre，GMLC)网元、位置检索功能(location retrieval function，LRF)网元、网络开放功能(network exposure function，NEF)网元、应用功能(application function，AF)网元。其中，GMLC网元和LRF网元可以是融合部署，也可以是独立部署。进一步的，在未部署LMF网元时，可以采用AMF网元和GMLC网元实现定位。
具体的，参见图1，图1为本申请实施例提供的一种非漫游场景下5G网络的位置定位 服务架构图。如图1所示，可以看出，终端设备可与AMF网元连接，接入网设备也可与AMF网元连接。AMF网元可以分别与UDM网元、LMF网元、NEF网元、GMLC网元连接。UDM网元可以分别与NEF网元、GMLC网元连接。NEF网元可以分别与AF网元、GMLC网元连接。LCS客户端可以分别与GMLC网元、LRF网元连接。进一步的，N1接口为终端设备与AMF网元之间的参考点。N2接口为接入网设备与AMF网元之间的参考点，用于非接入层(non-access stratum，NAS)消息和下一代应用协议(next generation application protocol，NGAP)消息的发送等。NL1接口为AMF网元与LMF网元之间的参考点。N8接口为AMF网元与UDM网元之间的参考点。NL2接口为AMF网元与GMLC网元之间的参考点。N51接口为AMF网元与NEF网元之间的参考点。NL7接口为LMF网元与其他LMF网元之间的参考点。N52接口为UDM网元与NEF网元之间的参考点。NL6接口为UDM网元与GMLC网元之间的参考点。NL5接口为NEF网元与GMLC网元之间的参考点。N33接口为NEF网元与AF网元之间的参考点。Le接口可以为LCS客户端与GMLC网元之间的参考点，也可以为LCS客户端与LRF网元之间的参考点。
结合上面描述的系统架构，目前，协议标准定位业务可以分为三种：终端始发定位请求(mobile originating location request，MO-LR)、终端终止定位请求(mobile terminating location request，MT-LR)和网络触发定位请求(network induced location request，NI-LR)。其中，MO-LR是由终端设备发起的定位请求；MT-LR是LCS客户端向LCS服务器发起的定位请求；NI-LR是从正在为终端设备提供服务的PLMN内部发起的定位请求。
进一步的，在定位时，可以采用用户设备(user equipment，UE)辅助的位置定位流程(UE assisted positioning procedure)实现定位，也可以采用基于UE的位置定位流程(UE based positioning procedure)实现定位，也可以采用网络辅助的位置定位流程(network assisted positioning procedure)实现定位。
综上，可以看出，无论是采用哪种位置定位流程，均涉及到图1的系统架构，即均涉及到多个通信设备之间的交互过程。因此，包括用户个人隐私敏感数据也将在不同的通信设备之间传输。然而，当包括用户个人隐私敏感数据在不同的通信设备之间传输时，可能存在信息泄露的问题。因此，在实现定位业务过程中如何提高数据传输的安全性成为当前急需解决的技术问题。
基于此，提出本申请实施例提出一种数据传输方法以解决上述问题，下面对本申请实施例进行详细介绍。
应理解，本申请实施例的技术方案可以应用于长期演进(long term evolution，LTE)架构、第五代移动通信技术(5th generation mobile networks，5G)、第4.5代移动通信技术(the 4.5 generation mobile networks，4.5G)、无线局域网(wireless local area networks，WLAN)系统等等。本申请实施例的技术方案还可以应用于未来其它的通信系统，例如6G通信系统等，在未来通信系统中，可能保持功能相同，但名称可能会改变。
参见图2A，图2A为本申请实施例提供的通信系统的架构示意图。如图2A所示，该通信系统包括第一设备20、第二设备21和第三设备22。
在一种可能的实施方式1中，第一设备20用于提供根据定位精度要求、时延要求等选 择相应的定位方法、以及选择相应的通信协议来完成定位所需信息的交互。该第一设备20还用于为定位服务提供所需的其他信息，或者定位策略。第一设备20可以接收外部的网络功能或应用获取终端设备位置的请求，在验证该请求为允许的请求后请求获取终端设备的位置信息，以及将获取到的终端设备的位置信息提供给外部的网络功能或应用。可以理解的，在5G通信中，第一设备20具备LMF网元的功能和GMLC网元的功能。其中，LMF网元、GMLC网元的名称，在未来通信如第6代(6th generation，6G)通信中，依旧为LMF网元、GMLC网元，或者有其它名称，本申请对此不作限定。示例性的，第一设备20可以包括用于实现LMF网元功能的模块和用于实现GMLC网元功能的模块。两个模块之间包括内部通道，该内部通道为API调用，通过调用API实现两个模块之间的信息共享。或，两个模块共享数据库，从而实现信息的共享，在此不做限制。
在又一种可能的实施方式2中，第一设备20用于提供根据定位精度要求、时延要求等选择相应的定位方法、以及选择相应的通信协议来完成定位所需信息的交互，以及用于为定位服务提供所需的其他信息，或者定位策略。在4G通信中，第一设备可以是演进型服务移动位置中心(evolved serving mobile location center,eSMLC)。在5G通信中，第一设备20可以是LMF网元，在未来通信如第6代(6th generation，6G)通信中，第一设备20仍可以是LMF网元，或者有其它名称，本申请对此不作限定。
其中，第二设备21包括终端设备211或接入网设备212。
其中，终端设备211是用户侧的一种用于接收信号，或者，发送信号，或者，接收信号和发送信号的实体。终端设备211用于向用户提供语音服务和数据连通性服务中的一种或多种。终端设备211可以为包含无线收发功能、且可以与接入网设备配合为用户提供通讯服务的设备。具体地，终端设备211可以指用户设备(user equipment，UE)、接入终端、用户单元、用户站、移动站、移动台、远方站、远程终端、移动设备、终端、无线通信设备、用户代理或用户装置。终端设备211也可以是无人机、物联网(internet of things，IoT)设备、WLAN中的站点(station，ST)、蜂窝电话(cellular phone)、智能电话(smart phone)、无绳电话、无线数据卡、平板型电脑、会话启动协议(session initiation protocol，SIP)电话、无线本地环路(wireless local loop，WLL)站、个人数字处理(personal digital assistant，PDA)设备、膝上型电脑(laptop computer)、机器类型通信(machine type communication，MTC)终端、具有无线通信功能的手持设备、计算设备或连接到无线调制解调器的其它处理设备、车载设备、可穿戴设备(也可以称为穿戴式智能设备)、虚拟现实(virtual reality，VR)终端、增强现实(augmented reality，AR)终端、工业控制(industrial control)中的无线终端、无人驾驶(self driving)中的无线终端、远程医疗(remote medical)中的无线终端、智能电网(smart grid)中的无线终端、运输安全(transportation safety)中的无线终端、智慧城市(smart city)中的无线终端、智慧家庭(smart home)中的无线终端等。终端设备211也可以是设备到设备(device to device，D2D)设备，例如，电表、水表等。终端设备211还可以为3G系统中的终端，也可以为下一代通信系统中的终端，本申请实施例对此不作限定。
其中，接入网设备212为网络侧的一种用于发送信号，或者，接收信号，或者，发送信号和接收信号的实体。接入网设备212可以为部署在无线接入网(radio access network， RAN)中为终端设备211提供无线通信功能的装置，例如可以为传输接收点(transmission reception point，TRP)、基站、各种形式的控制节点。例如，网络控制器、无线控制器、云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器等。具体的，接入网设备可以为各种形式的宏基站，微基站(也称为小站)，中继站，接入点(access point，AP)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或home node B，HNB)、基带单元(baseBand unit，BBU)、传输点(transmitting and receiving point，TRP)、发射点(transmitting point，TP)、移动交换中心)等，也可以为基站的天线面板。控制节点可以连接多个基站，并为多个基站覆盖下的多个终端配置资源。在采用不同的无线接入技术的系统中，具备基站功能的设备的名称可能会有所不同。例如，可以是LTE系统中的演进型基站(evolutional node B，eNB或eNodeB)，还可以是云无线接入网络(cloud radio access network，CRAN)场景下的无线控制器，还可以是5G中的gNB，或者该接入网设备212可以为中继站、接入点、车载设备、可穿戴设备以及5G之后的网络中的网络侧设备或未来演进的PLMN网络中的接入网设备等，本申请对接入网设备的具体名称不作限定。
其中，第三设备22可以用于处理用户标识、接入鉴权或注册等。在5G通信系统中，第三设备22可以是UDM网元，其中，Nudm是UDM网元提供的基于服务的接口，UDM网元可以通过Nudm与其他的网络功能通信。在未来通信如6G通信系统中，第三设备22仍可以是UDM网元，或者有其它名称，本申请实施例对此不作限定。
结合图2A，该通信系统还可以包括第四设备23和位置服务客户端24。需要说明的，结合上述实施方式1，若第二设备21为终端设备211，该通信系统还可以包括接入网设备212等。结合上述实施方式2，若第二设备21为接入网设备212，该通信系统还可以包括终端设备211、第五设备25和第六设备26等。
其中，第四设备23主要用于移动网络中的终端设备的注册、移动性管理、跟踪区更新流程。第四设备23终结了非接入层(non access stratum，NAS)消息、完成注册管理、连接管理以及可达性管理、分配跟踪区域列表(track area list，TA list)以及移动性管理等，并且透明路由会话管理(session management，SM)消息到会话管理网元。在5G通信中，第四设备23可以是AMF网元，Namf是AMF网元提供的基于服务的接口，AMF网元可以通过Namf与其他的网络功能通信。在未来通信如第6代(6th generation，6G)通信中，第四设备23仍可以是AMF网元，或者有其它名称，本申请对此不作限定。
其中，位置服务客户端24可以是向上述实施方式2中的第一设备20或者定位服务器请求提供针对终端的定位任务的通信设备，或安全用户面定位(secure user plane location，SUPL)代理(agent)。其中，SUPL Agent是一个需要获取位置信息的应用程序。SUPL Agent可以运行在SET中，也可以运行在SUPL网络中。其中，如果SUPL Agent运行在SET中，定位请求方即为终端设备。如果SUPL Agent运行在SUPL网络中，定位请求方即为有定位需求的外部客户端。
其中，第五设备25可以接收外部的网络功能或应用获取终端设备位置的请求，在验证该请求为允许的请求后向上述实施方式2中的第一设备20请求获取终端设备的位置信息， 以及将获取到的终端设备的位置信息提供给外部的网络功能或应用。在5G通信中，第五设备25可以是核心网GMLC网元，在未来通信如第6代(6th generation，6G)通信中，第五设备25仍可以是GMLC网元，或者有其它名称，本申请对此不作限定。
其中，第六设备26用于提供服务发现功能、维护核心网中有效网络功能实体(network function，NF)网元的NF描述信息的功能，以及维护核心网中有效NF网元支持的服务的功能。其中，该服务发现功能是指从任一核心网的NF网元接收发现请求消息，并向该NF网元提供请求发现的目标NF网元的信息。在5G中，第六设备26可以是网络开放功能(network function repository function，NRF)网元，可以理解，在未来通信，负责网络功能注册和发现功能的网元仍可以是NRF网元，或有其它的名称，本申请不做限定。
下面结合上述实施方式2，以5G通信系统为例，结合图2B说明本申请实施例适用的一种具体可能的网络架构示意图，该网络结构可以包括上述LMF网元、UDM网元、AMF网元、GMLC网元、gNB、终端设备、NRF网元和位置服务客户端等。其中，图2B中N1接口、N2接口、N8接口、NL1接口、NL2接口、Le接口可以参考图1中相关描述，在此不加赘述。需要说明的，在图2B中Le接口为GMLC网元与位置服务客户端之间的参考点。其中，Nnrf接口为NRF网元与AMF网元之间的参考点。此外，AMF网元、NRF网元、UDM网元等控制面网元也可以采用服务化接口进行交互。比如，AMF网元对外提供的服务化接口可以为Namf；NRF网元对外提供的服务化接口可以为Nnrf；UDM网元对外提供的服务化接口可以为Nudm。相关描述可以参考23501标准中的5G系统架构(5G system architecture)图，在此不予赘述。
可以理解的是，上述网元或者功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。上述网元或者功能可划分出一个或多个服务，进一步，还可能会出现独立于网络功能存在的服务。在本申请中，上述功能的实例、或上述功能中包括的服务的实例、或独立于网络功能存在的服务实例均可称为服务实例。
下面结合图2A介绍本申请涉及的具体实施例。参见图3，图3为本申请实施例提供的一种数据传输方法的流程示意图。图3中的第一设备可以为上述实施方式1中或上述实施方式2中的第一设备20，图3中的第二设备可以为图2A中的第二设备21。如图3所示，该方法包括但不限于以下步骤：
301、第一设备对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，在本申请中，安全保护可以包括加密和/或完整性保护。加密可以包括采用加密算法和加密密钥进行加密，完整性保护可以包括采用完整性保护算法和完整性保护密钥进行完整性保护。可以理解的，受安全保护指受加密和完整性保护。
示例性的，受安全保护的第一请求消息可以指先采用完整性保护算法和完整性保护密钥对第一请求消息进行完整性保护，再采用加密算法和加密密钥对完整性保护后的第一请求消息进行加密的结果。
可选的，第一请求消息用于请求终端设备的第一信息，第一信息包括终端设备的位置信息或终端设备的定位测量信息。
可选的，第一请求消息包括长期演进技术定位协议(LTE positioning protocol，LPP)消息或第一新无线定位协议(NR positioning protocol a，NRPPa)消息。可选的，LPP消息用于请求终端设备的位置信息或终端设备的定位测量信息。
可选的，LPP消息包括LPP定位请求(positioning request)消息、LPP请求定位消息(request location information)、或LPP请求协助(request assistance)消息或新增消息，在此不做限制。
可选的，第一NRPPa消息用于请求终端设备的定位测量信息。
可选的，第一NRPPa消息包括第一NRPPa定位请求(positioning request)消息、第一NRPPa请求定位消息(request location information)、或新增消息，在此不做限制。
其中，终端设备的定位测量信息可以参见前述相关描述，该定位测量信息可以用于确定终端设备的位置信息。
其中，终端设备的位置信息可以是终端设备所在的地理坐标，也可以是终端设备所在的小区或基站或位置区，不予限制。
可选的，在步骤301之前，该方法还包括：第一设备接收来自第四设备的终端设备的LCS安全能力信息；或，第一设备接收来自第四设备的终端设备的标识；或，第一设备接收来自第四设备的接入网设备的LCS安全能力信息；或，第一设备接收来自第四设备的接入网设备的标识。
其中，终端设备的LCS安全能力信息用于指示终端设备所支持的加密算法和完整性保护算法，或，终端设备的LCS安全能力信息包括第一加密算法和第一完整性保护算法。可以理解的，终端设备所支持的加密算法可以为一个或多个加密算法，终端设备所支持的完整性保护算法可以为一个或多个完整性保护算法，在此不做限定。
示例性的，终端设备所支持的加密算法或第一加密算法例如可以为128-NEA1、128-NEA2、128-NEA3，终端设备所支持的完整性保护算法或第一完整性保护算法例如可以为128-NIA1、128-NIA2、128-NIA3等，具体可以参考标准33.501，在此不加赘述。
其中，终端设备的标识可以包括以下一种：用户永久标识(subscription permanent identifier，SUPI)、永久设备标识符(permanent equipment identifier，PEI)、通用公共用户标识(generic public subscription identifier，GPSI)、位置服务关联标识(LCS Correlation ID)、订阅标识(subscription ID)和路由标识(routing ID)。
其中，关于用户永久标识、永久设备标识符、通用公共用户标识、位置服务关联标识、订阅标识和路由标识，可以参考标准23.003，在此不加赘述。
其中，接入网设备的LCS安全能力信息用于指示接入网设备所支持的加密算法和完整性保护算法，或，接入网设备的LCS安全能力信息包括第二加密算法和第二完整性保护算法。可以理解的，接入网设备所支持的加密算法可以为一个或多个加密算法，接入网设备所支持的完整性保护算法可以为一个或多个完整性保护算法，在此不做限定。
示例性的，接入网设备所支持的加密算法或第二加密算法例如可以为128-NEA1、128-NEA2、128-NEA3，第二完整性保护算法例如可以为128-NIA1、128-NIA2、128-NIA3等，具体可以参考标准33.501，在此不加赘述。
其中，接入网设备的标识包括以下一种：全球无线接入网标识(global RAN ID)和接 入网设备的地址信息。
其中，关于全球无线接入网标识，可以参考标准38.413，在此不加赘述。
其中，接入网设备的地址信息可以是接入网设备的互联网协议地址(internet protocol address)，或，是接入网设备的IP地址和端口号，在此不做限制。
可选的，若第一设备接收来自第四设备的终端设备的LCS安全能力信息，步骤301包括：第一设备根据终端设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可选的，若第一设备接收来自第四设备的终端设备的标识，步骤301包括：第一设备根据终端设备的标识，确定终端设备对应的第一加密算法和第一完整性保护算法；第一设备根据第一加密算法和第一完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
需要说明的，在本申请中，第四设备向第一设备发送终端设备的LCS安全能力信息时，还可以向第一设备发送终端设备的标识。即，第一设备可以接收来自第四设备的终端设备的LCS安全能力信息和终端设备的标识。另外，当第四设备向第一设备发送终端设备的LCS安全能力信息和终端设备的标识时，第四设备可以通过第四请求消息将终端设备的LCS安全能力信息和终端设备的标识发送给第一设备。或者，当第四设备向第一设备发送终端设备的标识时，第四设备可以通过第四请求消息将终端设备的标识发送给第一设备，在此不做限制。
其中，第四请求消息可以为Nlmf_Location_DeterminLocation Request消息1。
可选的，在步骤301之前，该方法还包括：第一设备向第三设备发送第二请求消息，第二请求消息包括终端设备的标识，第二请求消息用于请求第二安全保护参数；第一设备接收来自第三设备的第二请求消息的响应，第二请求消息的响应包括第二安全保护参数。
可选的，第二请求消息可以为LCS_Security_Data_Get_Request1。第二请求消息的响应可以为LCS_Security_Data_Get_Response1。
可选的，第二安全保护参数包括第一加密密钥和第一完整性保护密钥；或，第二安全保护参数包括第一参数。第二安全保护参数是第三设备根据终端设备的标识获取的，第一参数用于确定第一加密密钥和第一完整性保护密钥。
其中，第一参数可以包括第一初始加密密钥和第一初始完整性保护密钥。
其中，第一设备根据终端设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据终端设备的LCS安全能力信息和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据终端设备的LCS安全能力信息和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第二安全保护参数包括第一加密密钥和第一完整性保护密钥，则第一设备可以根据第一初始加密密钥和第一数值确定第一加密密钥；第一设备可以根据第一初始完整性保护密钥和第二数值确定第一完整性保护密钥。若第二安全保护参数包括第一参数，则第一设备可以将第一初始密钥，确定为第一加密密钥，将第一初始完整性保护密钥，确定为第一完整性保护密钥。
其中，第一数值和第二数值可以相同或不同，在此不做限制。
其中，关于第一设备根据第一初始加密密钥和第一数值确定第一加密密钥，第一设备根据第一初始完整性保护密钥和第二数值确定第一完整性保护密钥，可以参考标准33.220，在此不加赘述。
可选的，若终端设备的LCS安全能力信息用于指示终端设备所支持的加密算法和完整性保护算法，则第一设备根据终端设备的LCS安全能力信息和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据终端设备的LCS安全能力信息，确定第一加密算法和第一完整性保护算法；第一设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。具体的，第一设备可以先根据第一完整性保护算法和第一完整性保护密钥对第一请求消息进行完整性保护，再根据第一加密算法和第一加密密钥对完整性保护后的第一请求消息进行加密，获得受安全保护的第一请求消息。
可选的，若终端设备的LCS安全能力信息包括第一加密算法和第一完整性保护算法，则第一设备根据终端设备的LCS安全能力信息和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，第一设备根据第一加密算法和第一完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第一加密算法、第一完整性保护算法和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第一加密算法、第一完整性保护算法和第二安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第二安全保护参数包括第一加密密钥和第一完整性保护密钥，则第一设备可以根据第一初始加密密钥和第一数值确定第一加密密钥；第一设备可以根据第一初始完整性保护密钥和第二数值确定第一完整性保护密钥。若第二安全保护参数包括第一参数，则第一设备可以将第一初始密钥，确定为第一加密密钥，将第一初始完整性保护密钥，确定为第一完整性保护密钥。
其中，关于第一数值和第二数值，可以参考上述相关描述，在此不再赘述。
需要说明的，在本申请中，若第一请求消息为LPP消息，则第一设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可以看出，上述技术方案中，实现了获取第二安全保护参数，从而使得第一设备可以根据第二安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，若第一设备接收来自第四设备的接入网设备的LCS安全能力信息，步骤301包括：第一设备根据接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可选的，若第一设备接收来自第四设备的接入网设备的标识，步骤301包括：第一设备根据接入网设备的标识，确定接入网设备对应的第二加密算法和第二完整性保护算法； 第一设备根据第二加密算法和第二完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
需要说明的，在本申请中，第四设备向第一设备发送接入网设备的LCS安全能力信息时，还可以向第一设备发送接入网设备的标识。即，第一设备可以接收来自第四设备的接入网设备的LCS安全能力信息和接入网设备的标识。另外，当第四设备向第一设备发送接入网设备的LCS安全能力信息和接入网设备的标识时，第四设备可以通过第五请求消息将接入网设备的LCS安全能力信息和接入网设备的标识发送给第一设备。或者，当第四设备向第一设备发送接入网设备的标识时，第四设备可以通过第五请求消息将接入网设备的标识发送给第一设备，在此不做限制。
其中，第五请求消息可以为Nlmf_Location_DeterminLocation Request消息2。
可选的，在步骤301之前，该方法还包括：第一设备向第三设备发送第三请求消息，第三请求消息包括接入网设备的标识，第三请求消息用于请求第四安全保护参数；第一设备接收来自第三设备的第三请求消息的响应，第三请求消息的响应包括第四安全保护参数。
可选的，第三请求消息可以为LCS_Security_Data_Get_Request2。第三请求消息的响应可以为LCS_Security_Data_Get_Response2。
其中，第四安全保护参数包括第二加密密钥和第二完整性保护密钥；或，第四安全保护参数包括第二参数。第四安全保护参数是第三设备根据接入网设备的标识获取的，第二参数用于确定第二加密密钥和第二完整性保护密钥。
其中，第二参数可以包括第二初始加密密钥和第二初始完整性保护密钥。
其中，第一设备根据接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据接入网设备的LCS安全能力信息和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据接入网设备的LCS安全能力信息和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第四安全保护参数包括第二加密密钥和第二完整性保护密钥，则第一设备可以根据第二初始加密密钥和第三数值确定第二加密密钥；第一设备可以根据第二初始完整性保护密钥和第四数值确定第二完整性保护密钥。若第四安全保护参数包括第二参数，则第一设备可以将第一初始密钥，确定为第二加密密钥，将第二初始完整性保护密钥，确定为第二完整性保护密钥。
其中，第三数值和第四数值可以相同或不同，在此不做限制。
其中，关于第一设备根据第二初始加密密钥和第三数值确定第二加密密钥，第一设备根据第二初始完整性保护密钥和第四数值确定第二完整性保护密钥，可以参考标准33.220，在此不加赘述。
可选的，若接入网设备的LCS安全能力信息用于指示接入网设备所支持的加密算法和完整性保护算法，则第一设备根据接入网设备的LCS安全能力信息和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据接入网设备的LCS安全能力信息，确定第二加密算法和第二完整性保护算法；第一设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一请求 消息进行安全保护，获得受安全保护的第一请求消息。具体的，第一设备可以先根据第二完整性保护算法和第二完整性保护密钥对第一请求消息进行完整性保护，再根据第二加密算法和第二加密密钥对完整性保护后的第一请求消息进行加密，获得受安全保护的第一请求消息。
可选的，若接入网设备的LCS安全能力信息包括第二加密算法和第二完整性保护算法，则第一设备根据接入网设备的LCS安全能力信息和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，第一设备根据第二加密算法和第二完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以包括：第一设备根据第二加密算法、第二完整性保护算法和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第二加密算法、第二完整性保护算法和第四安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第四安全保护参数包括第二加密密钥和第二完整性保护密钥，则第一设备可以根据第二初始加密密钥和第三数值确定第二加密密钥；第一设备可以根据第二初始完整性保护密钥和第四数值确定第二完整性保护密钥。若第四安全保护参数包括第二参数，则第一设备可以将第一初始密钥，确定为第二加密密钥，将第二初始完整性保护密钥，确定为第二完整性保护密钥。
其中，关于第三数值和第四数值，可以参考上述相关描述，在此不再赘述。
需要说明的，在本申请中，若第一请求消息为第一NRPPa消息，则第一设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可以看出，上述技术方案中，实现了获取第四安全保护参数，从而使得第一设备可以根据第四安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，则第一设备接收来自第四设备的接入网设备的LCS安全能力信息，包括：第一设备接收来自第四设备的第一接入网设备的LCS安全能力信息；第一设备接收来自第四设备的第二接入网设备的LCS安全能力信息；或，第一设备接收来自第四设备的接入网设备的标识，包括：第一设备接收来自第四设备的第一接入网设备的标识；第一设备接收来自第四设备的第二接入网设备的标识。
其中，第一接入网设备为终端设备当前接入的设备，第二接入网设备为终端设备当前服务小区的邻区所属的接入网设备。第二接入网设备可以为一个或多个接入网设备，在此不做限定。
需要说明的，在本申请中，第一接入网设备的LCS安全能力信息和第二接入网设备的LCS安全能力信息可以是第四设备分成两次向第一设备发送的，或是第四设备同时发送的，在此不做限制。同理，第一接入网设备的标识和第二接入网设备的标识可以是第四设备分 成两次向第一设备发送的，或是第四设备同时发送的，在此不做限制。
可选的，第一接入网设备的LCS安全能力信息用于指示第一接入网设备所支持的加密算法和完整性保护算法，或，第一接入网设备的LCS安全能力信息包括第三加密算法和第三完整性保护算法。可以理解的，第一接入网设备所支持的加密算法可以为一个或多个加密算法，第一接入网设备所支持的完整性保护算法可以为一个或多个完整性保护算法，在此不做限定。
示例性的，第一接入网设备所支持的加密算法或第三加密算法例如可以为128-NEA1、128-NEA2、128-NEA3，第一接入网设备所支持的完整性保护算法或第三完整性保护算法例如可以为128-NIA1、128-NIA2、128-NIA3等，具体可以参考标准33.501，在此不加赘述。
可选的，第二接入网设备的LCS安全能力信息用于指示第二接入网设备所支持的加密算法和完整性保护算法，或，第二接入网设备的LCS安全能力信息包括第四加密算法和第四完整性保护算法。可以理解的，第二接入网设备所支持的加密算法可以为一个或多个加密算法，第二接入网设备所支持的完整性保护算法可以为一个或多个完整性保护算法，在此不做限定。
示例性的，第二接入网设备所支持的加密算法或第四加密算法例如可以为128-NEA1、128-NEA2、128-NEA3，第二接入网设备所支持的完整性保护算法或第四完整性保护算法例如可以为128-NIA1、128-NIA2、128-NIA3等，具体可以参考标准33.501，在此不加赘述。
其中，第一接入网设备的标识包括以下一种：第一全球无线接入网标识(global RAN ID)和第一接入网设备的地址信息。
其中，关于第一全球无线接入网标识，可以参考标准38.413，在此不加赘述。
其中，第一接入网设备的地址信息可以是第一接入网设备的互联网协议地址(internet protocol address)，或，是第一接入网设备的IP地址和端口号，在此不做限制。
其中，第二接入网设备的标识包括以下一种：第二全球无线接入网标识(global RAN ID)和第二接入网设备的地址信息。
其中，关于第二全球无线接入网标识，可以参考标准38.413，在此不加赘述。
其中，第二接入网设备的地址信息可以是第二接入网设备的互联网协议地址(internet protocol address)，或，是第二接入网设备的IP地址和端口号，在此不做限制。
可选的，若第一设备接收来自第四设备的第一接入网设备的LCS安全能力信息，步骤301包括：第一设备根据第一接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可选的，若第一设备接收来自第四设备的第一接入网设备的标识，步骤301包括：第一设备根据第一接入网设备的标识，确定接入网设备对应的第三加密算法和第三完整性保护算法；第一设备根据第三加密算法和第三完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
需要说明的，在本申请中，第四设备向第一设备发送第一接入网设备的LCS安全能力信息时，还可以向第一设备发送第一接入网设备的标识。即，第一设备可以接收来自第四 设备的第一接入网设备的LCS安全能力信息和第一接入网设备的标识。另外，当第四设备向第一设备发送第一接入网设备的LCS安全能力信息和第一接入网设备的标识时，第四设备可以通过第六请求消息将第一接入网设备的LCS安全能力信息和第一接入网设备的标识发送给第一设备。或者，当第四设备向第一设备发送第一接入网设备的标识时，第四设备可以通过第六请求消息将第一接入网设备的标识发送给第一设备，在此不做限制。
其中，第六请求消息可以为Nlmf_Location_DeterminLocation Request消息3。
可选的，在步骤301之前，该方法还包括：第一设备向第三设备发送第七请求消息，第七请求消息包括第一接入网设备的标识，第七请求消息用于请求第七安全保护参数；第一设备接收来自第三设备的第七请求消息的响应，第七请求消息的响应包括第七安全保护参数。
可选的，第七请求消息可以为LCS_Security_Data_Get_Request3。第七请求消息的响应可以为LCS_Security_Data_Get_Response3。
其中，第七安全保护参数包括第三加密密钥和第三完整性保护密钥；或，第七安全保护参数包括第三参数。第七安全保护参数是第三设备根据第一接入网设备的标识获取的，第三参数用于确定第三加密密钥和第三完整性保护密钥。
其中，第三参数可以包括第三初始加密密钥和第三初始完整性保护密钥。
其中，第一设备根据第一接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以包括：第一设备根据第一接入网设备的LCS安全能力信息和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第一接入网设备的LCS安全能力信息和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第七安全保护参数包括第三加密密钥和第三完整性保护密钥，则第一设备可以根据第三初始加密密钥和第五数值确定第三加密密钥；第一设备可以根据第三初始完整性保护密钥和第六数值确定第三完整性保护密钥。若第七安全保护参数包括第三参数，则第一设备可以将第一初始密钥，确定为第三加密密钥，将第三初始完整性保护密钥，确定为第三完整性保护密钥。
其中，第五数值和第六数值可以相同或不同，在此不做限制。
其中，关于第一设备根据第三初始加密密钥和第五数值确定第三加密密钥；第一设备根据第三初始完整性保护密钥和第六数值确定第三完整性保护密钥，可以参考标准33.220，在此不加赘述。
可选的，若第一接入网设备的LCS安全能力信息用于指示第一接入网设备所支持的加密算法和完整性保护算法，则第一设备根据第一接入网设备的LCS安全能力信息和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第一接入网设备的LCS安全能力信息，确定第三加密算法和第三完整性保护算法；第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。具体的，第一设备可以先根据第三完整性保护算法和第三完整性保护密钥对第一请求消息进行完整性保护，再根据第三加密算法和第三加密密钥对完整性保护后的第一请求消息进行加密，获得受安 全保护的第一请求消息。
可选的，若第一接入网设备的LCS安全能力信息包括第三加密算法和第三完整性保护算法，则第一设备根据第一接入网设备的LCS安全能力信息和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，第一设备根据第三加密算法和第三完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第三加密算法、第三完整性保护算法和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第三加密算法、第三完整性保护算法和第七安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第七安全保护参数包括第三加密密钥和第三完整性保护密钥，则第一设备可以根据第三初始加密密钥和第五数值确定第三加密密钥；第一设备可以根据第三初始完整性保护密钥和第六数值确定第三完整性保护密钥。若第七安全保护参数包括第三参数，则第一设备可以将第一初始密钥，确定为第三加密密钥，将第三初始完整性保护密钥，确定为第三完整性保护密钥。
其中，关于第五数值和第六数值，可以参考上述相关描述，在此不再赘述。
可以看出，上述技术方案中，实现了获取第七安全保护参数，从而使得第一设备可以根据第七安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
可选的，若第一设备接收来自第四设备的第二接入网设备的LCS安全能力信息，步骤301包括：第一设备根据第二接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
可选的，若第一设备接收来自第四设备的第二接入网设备的标识，步骤301包括：第一设备根据第二接入网设备的标识，确定接入网设备对应的第四加密算法和第四完整性保护算法；第一设备根据第四加密算法和第四完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
需要说明的，在本申请中，第四设备向第一设备发送第二接入网设备的LCS安全能力信息时，还可以向第一设备发送第二接入网设备的标识。即，第一设备可以接收来自第四设备的第二接入网设备的LCS安全能力信息和第二接入网设备的标识。另外，当第四设备向第一设备发送第二接入网设备的LCS安全能力信息和第二接入网设备的标识时，第四设备可以通过第八请求消息将第二接入网设备的LCS安全能力信息和第二接入网设备的标识发送给第一设备。或者，当第四设备向第一设备发送第二接入网设备的标识时，第四设备可以通过第八请求消息将第二接入网设备的标识发送给第一设备，在此不做限制。
其中，第八请求消息可以为Nlmf_Location_DeterminLocation Request消息4。
可以理解的，若第一接入网设备的LCS安全能力信息、第二接入网设备的LCS安全能力信息、第一接入网设备的标识和第二接入网设备的标识是第四设备分成两次向第一设备发送的，或，第一接入网设备的标识和第二接入网设备的标识是第四设备分成两次向第一 设备发送的，则第六请求消息和第八请求消息可以为不同的消息；若第一接入网设备的LCS安全能力信息、第二接入网设备的LCS安全能力信息、第一接入网设备的标识和第二接入网设备的标识是第四设备同时发送的，或，第一接入网设备的标识和第二接入网设备的标识是第四设备同时发送的，则第六请求消息和第八请求消息可以为同一消息，在此不做限制。
可选的，在步骤301之前，该方法还包括：第一设备向第三设备发送第九请求消息，第九请求消息包括第二接入网设备的标识，第九请求消息用于请求第八安全保护参数；第一设备接收来自第三设备的第九请求消息的响应，第九请求消息的响应包括第八安全保护参数。
可选的，第九请求消息可以为LCS_Security_Data_Get_Request4。第九请求消息的响应可以为LCS_Security_Data_Get_Response4。
其中，第八安全保护参数包括第四加密密钥和第四完整性保护密钥；或，第八安全保护参数包括第四参数。第八安全保护参数是第三设备根据第二接入网设备的标识获取的，第四参数用于确定第四加密密钥和第四完整性保护密钥。
其中，第四参数可以包括第四初始加密密钥和第四初始完整性保护密钥。
其中，第一设备根据第二接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以包括：第一设备根据第二接入网设备的LCS安全能力信息和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第二接入网设备的LCS安全能力信息和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第八安全保护参数包括第四加密密钥和第四完整性保护密钥，则第一设备可以根据第四初始加密密钥和第七数值确定第四加密密钥；第一设备可以根据第四初始完整性保护密钥和第八数值确定第四完整性保护密钥。若第八安全保护参数包括第四参数，则第一设备可以将第一初始密钥，确定为第四加密密钥，将第四初始完整性保护密钥，确定为第四完整性保护密钥。
其中，第七数值和第八数值可以相同或不同，在此不做限制。
其中，关于第一设备根据第四初始加密密钥和第七数值确定第四加密密钥；第一设备根据第四初始完整性保护密钥和第八数值确定第四完整性保护密钥，可以参考标准33.220，在此不加赘述。
可选的，若第二接入网设备的LCS安全能力信息用于指示第二接入网设备所支持的加密算法和完整性保护算法，则第一设备根据第二接入网设备的LCS安全能力信息和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第二接入网设备的LCS安全能力信息，确定第四加密算法和第四完整性保护算法；第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。具体的，第一设备可以先根据第四完整性保护算法和第四完整性保护密钥对第一请求消息进行完整性保护，再根据第四加密算法和第四加密密钥对完整性保护后的第一请求消息进行加密，获得受安全保护的第一请求消息。
可选的，若第二接入网设备的LCS安全能力信息包括第四加密算法和第四完整性保护算法，则第一设备根据第二接入网设备的LCS安全能力信息和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，包括：第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，第一设备根据第四加密算法和第四完整性保护算法，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以包括：第一设备根据第四加密算法、第四完整性保护算法和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。可以理解的，在第一设备根据第四加密算法、第四完整性保护算法和第八安全保护参数，对第一请求消息进行安全保护，获得受安全保护的第一请求消息之前，该方法还包括：若第八安全保护参数包括第四加密密钥和第四完整性保护密钥，则第一设备可以根据第四初始加密密钥和第七数值确定第四加密密钥；第一设备可以根据第四初始完整性保护密钥和第八数值确定第四完整性保护密钥。若第八安全保护参数包括第四参数，则第一设备可以将第一初始密钥，确定为第四加密密钥，将第四初始完整性保护密钥，确定为第四完整性保护密钥。
其中，关于第七数值和第八数值，可以参考上述相关描述，在此不再赘述。
需要说明的，在本申请中，若第七请求消息还包括第二接入网设备的标识，则第一设备无需再向第三设备发送第九请求消息。此时，第七请求消息还用于请求第八安全保护参数，第七请求消息的响应还包括第八安全保护参数。
需要说明的，若接入网设备包括第一接入网设备和第二接入网设备，则第一NRPPa消息用于请求终端设备的定位测量信息，可以理解为：针对第一接入网设备，第一NRPPa消息用于请求终端设备的第一定位测量信息，针对第二接入网设备，第一NRPPa消息用于请求终端设备的第二定位测量信息。另外，第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以理解为：第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一NRPPa消息进行安全保护，获得受安全保护的第一NRPPa消息。第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，可以理解为：第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一NRPPa消息进行安全保护，获得受安全保护的第一NRPPa消息。
可以看出，上述技术方案中，实现了获取第八安全保护参数，从而使得第一设备可以根据第八安全保护参数对第一请求消息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。
302、第二设备接收来自第一设备的受安全保护的第一请求消息。
相应的，第一设备向第二设备发送受安全保护的第一请求消息。
可选的，若第二设备为终端设备，步骤302，包括：终端设备通过第一安全通信隧道，接收来自第一设备的受安全保护的第一请求消息。
其中，第一安全通信隧道为第一设备和终端设备之间的安全通信隧道。具体的，参见 图4，图4为一种协议层。结合图4，第一安全通信通道为第一设备的LPP层和终端设备的LPP层之间的安全通信隧道。
可选的，在终端设备通过第一安全通信隧道，接收来自第一设备的受安全保护的第一请求消息之前，该方法还包括：终端设备接收来自第一设备的第一安全通信隧道建立请求消息，第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，第一安全通信隧道建立请求消息包括第一安全保护参数，第一安全保护参数包括第一加密算法和第一完整性保护算法，第一安全保护参数用于终端设备进行安全通信；终端设备发送第一安全通信隧道建立请求消息的响应消息。
其中，第一安全通信隧道建立请求消息可以为LPP安全建立请求(LPP security establishment request)。
可选的，终端设备接收来自第一设备的第一安全通信隧道建立请求消息，包括：终端设备通过第四设备接收来自第一设备的第一安全通信隧道建立请求消息。
其中，终端设备通过第四设备接收来自第一设备的第一安全通信隧道建立请求消息，可以理解为：终端设备接收接入网设备发送的第一安全通信隧道建立请求消息，接入网设备接收第四设备发送的第一安全通信隧道建立请求消息，第四设备接收第一设备发送的第一安全通信隧道建立请求消息。
示例性的，终端设备接收接入网设备发送的下行非接入层传输(downlink NAS transport)消息1，该下行非接入层传输消息1包括第一安全通信隧道建立请求消息。接入网设备接收第四设备发送的下行非接入层传输消息2，该下行非接入层传输消息2包括第一安全通信隧道建立请求消息。第四设备接收第一设备发送的Namf_Communication_NIN2Message Transfer消息1，该Namf_Communication_NIN2Message Transfer消息1包括第一安全通信隧道建立请求消息。
其中，安全通信可以指在加密和完整性保护后的通信。示例性的，终端设备通过第一安全通信隧道，接收来自第一设备的受安全保护的第一请求消息。
其中，第一安全通信隧道建立请求消息的响应消息可以为LPP安全建立响应(LPP security establishment response)。
可选的，终端设备发送第一安全通信隧道建立请求消息的响应消息，包括：终端设备通过接入网设备发送第一安全通信隧道建立请求消息的响应消息。
其中，终端设备通过接入网设备发送第一安全通信隧道建立请求消息的响应消息，可以理解为：终端设备向接入网设备发送第一安全通信隧道建立请求消息的响应消息，接入网设备向第四设备发送第一安全通信隧道建立请求消息的响应消息，第四设备向第一设备发送第一安全通信隧道建立请求消息的响应消息。
示例性的，终端设备向接入网设备发送上行非接入层传输(uplink NAS transport)消息1，该上行非接入层传输消息1包括第一安全通信隧道建立请求消息的响应消息，接入网设备向第四设备发送上行非接入层传输消息2，该上行非接入层传输消息2包括第一安全通信隧道建立请求消息的响应消息，第四设备向第一设备发送Namf_Communication_NIinfoNotify消息1，该Namf_Communication_NIinfoNotify消息1第一安全通信隧道建立请求消息的响应消息。
可选的，若第二设备为接入网设备，步骤302，包括：接入网设备通过第二安全通信隧道，接收来自第一设备的受安全保护的第一请求消息。
其中，第二安全通信隧道为第一设备和接入网设备之间的安全通信隧道。具体的，参见图5，图5为又一种协议层。结合图5，第二安全通信通道为第一设备的NRPPa层和接入网设备的NRPPa层之间的安全通信隧道。
可选的，在接入网设备通过第二安全通信隧道，接收来自第一设备的受安全保护的第一请求消息之前，该方法还包括：接入网设备接收来自第一设备的第二安全通信隧道建立请求消息，第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，第二安全通信隧道建立请求消息包括第三安全保护参数，第三安全保护参数包括第二加密算法和第二完整性保护算法，第三安全保护参数用于接入网设备进行安全通信；接入网设备发送第二安全通信隧道建立请求消息的响应。
其中，第二安全通信隧道建立请求消息可以为第一NRPPa安全建立请求(NRPPa security establishment request)。
可选的，接入网设备接收来自第一设备的第二安全通信隧道建立请求消息，包括：接入网设备通过第四设备接收来自第一设备的第二安全通信隧道建立请求消息。
其中，接入网设备通过第四设备接收来自第一设备的第二安全通信隧道建立请求消息，可以理解为：接入网设备接收第四设备发送的第二安全通信隧道建立请求消息，第四设备接收第一设备发送的第二安全通信隧道建立请求消息。
示例性的，接入网设备接收第四设备发送的下行非接入层传输消息3，该下行非接入层传输消息3包括第二安全通信隧道建立请求消息。第四设备接收第一设备发送的Namf_Communication_NIN2Message Transfer消息2，该Namf_Communication_NIN2Message Transfer消息2包括第二安全通信隧道建立请求消息。
其中，第二安全通信隧道建立请求消息的响应消息可以为第一NRPPa安全建立响应(NRPPa security establishment response)。
可选的，接入网设备发送第二安全通信隧道建立请求消息的响应，包括：接入网设备通过第四设备发送第二安全通信隧道建立请求消息的响应。
其中，接入网设备通过第四设备发送第二安全通信隧道建立请求消息的响应，可以理解为：接入网设备向第四设备发送第二安全通信隧道建立请求消息的响应，第四设备向第一设备发送第二安全通信隧道建立请求消息的响应。
示例性的，接入网设备向第四设备发送上行非接入层传输消息3，该上行非接入层传输消息3包括第二安全通信隧道建立请求消息的响应。第四设备向第一设备发送Namf_Communication_NIinfoNotify消息2，该Namf_Communication_NIinfoNotify消息2包括第二安全通信隧道建立请求消息的响应。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，步骤302，包括：第一接入网设备通过第三安全通信隧道，接收来自第一设备的受安全保护的第一请求消息；第二接入网设备通过第四安全通信隧道，接收来自第一设备的受安全保护的第一请求消息。
其中，第三安全通信隧道为第一设备和第一接入网设备之间的安全通信隧道。第三安全通信通道为第一设备的NRPPa层和第一接入网设备的NRPPa层之间的安全通信隧道。 第四安全通信隧道为第一设备和第二接入网设备之间的安全通信隧道。第四安全通信通道为第一设备的NRPPa层和第二接入网设备的NRPPa层之间的安全通信隧道。
可选的，在第一接入网设备通过第三安全通信隧道，接收来自第一设备的受安全保护的第一请求消息之前，该方法还包括：第一接入网设备接收来自第一设备的第三安全通信隧道建立请求消息，第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，第三安全通信隧道建立请求消息包括第五安全保护参数，第五安全保护参数包括第三加密算法和第三完整性保护算法，第五安全保护参数用于第一接入网设备进行安全通信；第一接入网设备发送第三安全通信隧道建立请求消息的响应。
其中，第三安全通信隧道建立请求消息可以为第二NRPPa安全建立请求(NRPPa security establishment request)。
可选的，第一接入网设备接收来自第一设备的第三安全通信隧道建立请求消息，包括：第一接入网设备通过第四设备接收来自第一设备的第三安全通信隧道建立请求消息。
其中，第一接入网设备通过第四设备接收来自第一设备的第三安全通信隧道建立请求消息，可以理解为：第一接入网设备接收第四设备发送的第三安全通信隧道建立请求消息，第四设备接收第一设备发送的第三安全通信隧道建立请求消息。
示例性的，第一接入网设备接收第四设备发送的下行非接入层传输消息4，该下行非接入层传输消息4包括第三安全通信隧道建立请求消息。第四设备接收第一设备发送的Namf_Communication_NIN2Message Transfer消息3，该Namf_Communication_NIN2Message Transfer消息3包括第三安全通信隧道建立请求消息。
其中，第三安全通信隧道建立请求消息的响应消息可以为第二NRPPa安全建立响应(NRPPa security establishment response)。
可选的，第一接入网设备发送第三安全通信隧道建立请求消息的响应，包括：第一接入网设备通过第四设备发送第三安全通信隧道建立请求消息的响应。
其中，第一接入网设备通过第四设备发送第三安全通信隧道建立请求消息的响应，可以理解为：第一接入网设备向第四设备发送第三安全通信隧道建立请求消息的响应，第四设备向第一设备发送第三安全通信隧道建立请求消息的响应。
示例性的，第一接入网设备向第四设备发送上行非接入层传输消息4，该上行非接入层传输消息4包括第三安全通信隧道建立请求消息的响应。第四设备向第一设备发送Namf_Communication_NIinfoNotify消息3，该Namf_Communication_NIinfoNotify消息3包括第三安全通信隧道建立请求消息的响应。
可选的，在第二接入网设备通过第四安全通信隧道，接收来自第一设备的受安全保护的第一请求消息之前，该方法还包括：第二接入网设备接收来自第一设备的第四安全通信隧道建立请求消息，第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，第四安全通信隧道建立请求消息包括第六安全保护参数，第六安全保护参数包括第四加密算法和第四完整性保护算法，第六安全保护参数用于第二接入网设备进行安全通信；第二接入网设备发送第四安全通信隧道建立请求消息的响应。
其中，第四安全通信隧道建立请求消息可以为第三NRPPa安全建立请求(NRPPa security establishment request)。
可选的，第二接入网设备接收来自第一设备的第四安全通信隧道建立请求消息，包括：第二接入网设备通过第四设备接收来自第一设备的第四安全通信隧道建立请求消息。
其中，第二接入网设备通过第四设备接收来自第一设备的第四安全通信隧道建立请求消息，可以理解为：第二接入网设备接收第四设备发送的第四安全通信隧道建立请求消息，第四设备接收第一设备发送的第四安全通信隧道建立请求消息。
示例性的，第二接入网设备接收第四设备发送的下行非接入层传输消息5，该下行非接入层传输消息5包括第四安全通信隧道建立请求消息。第四设备接收第一设备发送的Namf_Communication_NIN2Message Transfer消息4，该Namf_Communication_NIN2Message Transfer消息4包括第四安全通信隧道建立请求消息。
其中，第四安全通信隧道建立请求消息的响应消息可以为第三NRPPa安全建立响应(NRPPa security establishment response)。
可选的，第二接入网设备发送第四安全通信隧道建立请求消息的响应，包括：第二接入网设备通过第四设备发送第四安全通信隧道建立请求消息的响应。
其中，第二接入网设备通过第四设备发送第四安全通信隧道建立请求消息的响应，可以理解为：第二接入网设备向第四设备发送第四安全通信隧道建立请求消息的响应，第四设备向第一设备发送第四安全通信隧道建立请求消息的响应。
示例性的，第二接入网设备向第四设备发送上行非接入层传输消息5，该上行非接入层传输消息5包括第四安全通信隧道建立请求消息的响应。第四设备向第一设备发送Namf_Communication_NIinfoNotify消息4，该Namf_Communication_NIinfoNotify消息4包括第四安全通信隧道建立请求消息的响应。
可以看出，上述技术方案中，通过建立安全通信隧道，并通过安全通信隧道传输受安全保护的第一请求消息，从而再次提升了数据传输的安全性。
303、第二设备根据受安全保护的第一请求消息，获得第一请求消息。
可选的，若第二设备为终端设备，步骤303，包括：终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息。
其中，终端设备可以先采用第一加密算法和第一加密密钥对受安全保护的第一请求消息进行解密，再采用第一完整性保护算法和第一完整性保护密钥对解密后的第一请求消息进行完整性保护验证，获得第一请求消息。
可选的，若第一安全保护参数还包括上述第一数值和上述第二数值，在终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：终端设备根据第一数值和第一初始加密密钥确定第一加密密钥；终端设备根据第二数值和第一初始完整性保护密钥确定第一完整性保护密钥。
可选的，若第一安全保护参数不包括上述第一数值和上述第二数值，在终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：终端设备将第一初始加密密钥确定为第一加密密钥；终端设备将第一初始完整性保护密钥 确定为第一完整性保护密钥。
其中，第一初始加密密钥和第一初始完整性保护密钥可以配置在终端设备中，如烧录在USIM卡中。
可选的，若第二设备为接入网设备，步骤303，包括：接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息。
其中，接入网设备可以先采用第二加密算法和第二加密密钥对受安全保护的第一请求消息进行解密，再采用第二完整性保护算法和第二完整性保护密钥对解密后的第一请求消息进行完整性保护验证，获得第一请求消息。
可选的，若第三安全保护参数还包括上述第三数值和上述第四数值，在接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：接入网设备根据第三数值和第二初始加密密钥确定第二加密密钥；接入网设备根据第四数值和第二初始完整性保护密钥确定第二完整性保护密钥。
可选的，若第三安全保护参数不包括上述第三数值和上述第四数值，在接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：接入网设备将第二初始加密密钥确定为第二加密密钥；接入网设备将第二初始完整性保护密钥确定为第二完整性保护密钥。
其中，第二初始加密密钥和第二初始完整性保护密钥可以配置在接入网设备中。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，步骤303，包括：第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息；第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息。
其中，第一接入网设备可以先采用第三加密算法和第三加密密钥对受安全保护的第一请求消息进行解密，再采用第三完整性保护算法和第三完整性保护密钥对解密后的第一请求消息进行完整性保护验证，获得第一请求消息。
可选的，若第五安全保护参数还包括上述第五数值和上述第六数值，在第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：第一接入网设备根据第五数值和第三初始加密密钥确定第三加密密钥；第一接入网设备根据第六数值和第三初始完整性保护密钥确定第三完整性保护密钥。
可选的，若第五安全保护参数不包括上述第五数值和上述第六数值，在第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：第一接入网设备将第三初始加密密钥确定为第三加密密钥；第一接入网设备将第三初始完整性保护密钥确定为第三完整性保护密钥。
其中，第三初始加密密钥和第三初始完整性保护密钥可以配置在第一接入网设备中。
其中，第二接入网设备可以先采用第四加密算法和第四加密密钥对受安全保护的第一请求消息进行解密，再采用第四完整性保护算法和第四完整性保护密钥对解密后的第一请求消息进行完整性保护验证，获得第一请求消息。
可选的，若第六安全保护参数还包括上述第七数值和上述第八数值，在第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：第二接入网设备根据第七数值和第四初始加密密钥确定第四加密密钥；第二接入网设备根据第八数值和第四初始完整性保护密钥确定第四完整性保护密钥。
可选的，若第六安全保护参数不包括上述第七数值和上述第八数值，在第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对受安全保护的第一请求消息进行解密和完整性保护验证，获得第一请求消息之前，该方法还包括：第二接入网设备将第四初始加密密钥确定为第四加密密钥；第二接入网设备将第四初始完整性保护密钥确定为第四完整性保护密钥。
其中，第四初始加密密钥和第四初始完整性保护密钥可以配置在第二接入网设备中。
304、第二设备根据第一请求消息，获取第一信息。
可选的，若第二设备为终端设备，步骤304，包括：终端设备根据LPP消息，获取第一信息。若LPP消息用于请求终端设备的位置信息，则终端设备可以根据LPP消息，获取终端设备的位置信息；若LPP消息用于请求终端设备的定位测量信息，则终端设备可以根据LPP消息，获取终端设备的定位测量信息。
可选的，若第二设备为接入网设备，步骤304，包括：接入网设备根据第一NRPPa消息，获取终端设备的定位测量信息。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，步骤304，包括：第一接入网设备根据第一NRPPa消息，获取终端设备的第一定位测量信息；第二接入网设备根据第一NRPPa消息，获取终端设备的第二定位测量信息。
其中，终端设备的第一定位测量信息和第二定位测量信息可以参见前述相关描述，该第一定位测量信息和第二定位测量信息可以用于确定终端设备的位置信息。
305、第二设备对第一信息进行安全保护，获得第二信息。
可选的，第二信息包括受安全保护的第一信息。
可选的，若第二设备为终端设备，步骤305，包括：终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一信息进行安全保护，获得第二信息。
其中，终端设备可以先采用第一完整性保护算法和第一完整性保护密钥对第一信息进行完整性保护，再采用第一加密算法和第一加密密钥对完整性保护后的第一信息进行加密，获得第二信息。在本申请中，不做限制。
其中，终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一信息进行安全保护，获得第二信息，可以理解为：终端设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对终端设备的位 置信息或终端设备的定位测量信息进行安全保护，获得受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
可选的，若第二设备为接入网设备，步骤305，包括：接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一信息进行安全保护，获得第二信息。
其中，接入网设备可以先采用第二完整性保护算法和第二完整性保护密钥对第一信息进行完整性保护，再采用第二加密算法和第二加密密钥对完整性保护后的第一信息进行加密，获得第二信息。在本申请中，不做限制。
其中，接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一信息进行安全保护，获得第二信息，可以理解为：接入网设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对终端设备的定位测量信息进行安全保护，获得受安全保护的终端设备的定位测量信息。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，步骤305，包括：第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一信息进行安全保护，获得第二信息；第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一信息进行安全保护，获得第二信息。
其中，第一接入网设备可以先采用第三完整性保护算法和第三完整性保护密钥对第一信息进行完整性保护，再采用第三加密算法和第三加密密钥对完整性保护后的第一信息进行加密，获得第二信息。在本申请中，不做限制。
其中，第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对第一信息进行安全保护，获得第二信息，可以理解为：第一接入网设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥，对终端设备的第一定位测量信息进行安全保护，获得受安全保护的终端设备的第一定位测量信息。
其中，第二接入网设备可以先采用第四完整性保护算法和第四完整性保护密钥对第一信息进行完整性保护，再采用第四加密算法和第四加密密钥对完整性保护后的第一信息进行加密，获得第二信息。在本申请中，不做限制。
其中，第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一信息进行安全保护，获得第二信息，可以理解为：第二接入网设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对终端设备的第二定位测量信息进行安全保护，获得受安全保护的终端设备的第二定位测量信息。
306、第一设备接收来自第二设备的第二信息。
相应的，第二设备向第一设备发送第二信息。
可选的，若第二设备为终端设备，步骤306，包括：第一设备通过第一安全通信隧道接收来自终端设备的第二信息。
其中，第一设备通过第一安全通信隧道接收来自终端设备的第二信息，可以理解为： 第一设备通过第一安全通信隧道接收来自终端设备的受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
可选的，第一设备通过第一安全通信隧道接收来自终端设备的受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息，包括：第一设备通过第一安全通信隧道接收来自终端设备的LPP消息的响应消息，该LPP消息的响应消息包括受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
其中，第一设备通过第一安全通信隧道接收来自终端设备的LPP消息的响应消息，可以理解为：第一设备通过第一安全通信隧道，接收来自第四设备的LPP消息的响应消息，第四设备通过第一安全通信隧道，接收来自接入网设备的LPP消息的响应消息，接入网设备通过第一安全通信隧道，接收来自终端设备的LPP消息的响应消息。
示例性的，第一设备通过第一安全通信隧道，接收来自第四设备的Namf_Communication_NIinfoNotify消息5，该Namf_Communication_NIinfoNotify消息5包括LPP消息的响应消息。第四设备通过第一安全通信隧道，接收来自接入网设备的上行非接入层传输消息6，上行非接入层传输消息6包括LPP消息的响应消息。
可选的，若第二设备为接入网设备，步骤306，包括：第一设备通过第二安全通信隧道接收来自接入网设备的第二信息。
其中，第一设备通过第二安全通信隧道接收来自接入网设备的第二信息，可以理解为：第一设备通过第二安全通信隧道接收来自接入网设备的受安全保护的终端设备的定位测量信息。
可选的，第一设备通过第二安全通信隧道接收来自接入网设备的受安全保护的终端设备的定位测量信息，包括：第一设备通过第二安全通信隧道接收来自接入网设备的第一NRPPa消息的响应消息，该第一NRPPa消息的响应消息包括受安全保护的终端设备的定位测量信息。
其中，第一设备通过第二安全通信隧道接收来自接入网设备的第一NRPPa消息的响应消息，可以理解为：第一设备通过第二安全通信隧道，接收来自第四设备的第一NRPPa消息的响应消息，第四设备通过第二安全通信隧道，接收来自接入网设备的第一NRPPa消息的响应消息。
示例性的，第一设备通过第二安全通信隧道，接收来自第四设备的Namf_Communication_NIinfoNotify消息6，该Namf_Communication_NIinfoNotify消息6包括第一NRPPa消息的响应消息。第四设备通过第二安全通信隧道，接收来自接入网设备的上行非接入层传输消息7，上行非接入层传输消息7包括第一NRPPa消息的响应消息。
可选的，若接入网设备包括第一接入网设备和第二接入网设备，步骤306，包括：第一设备通过第三安全通信隧道接收来自第一接入网设备的第二信息；第一设备通过第四安全通信隧道接收来自第二接入网设备的第二信息。
其中，第一设备通过第三安全通信隧道接收来自第一接入网设备的第二信息，可以理解为：第一设备通过第三安全通信隧道接收来自第一接入网设备的受安全保护的终端设备的第一定位测量信息。
可选的，第一设备通过第三安全通信隧道接收来自第一接入网设备的受安全保护的终 端设备的第一定位测量信息，包括：第一设备通过第三安全通信隧道接收来自第一接入网设备的第一NRPPa消息的响应消息，该第一NRPPa消息的响应消息包括受安全保护的终端设备的第一定位测量信息。
其中，第一设备通过第三安全通信隧道接收来自第一接入网设备的第一NRPPa消息的响应消息，可以理解为：第一设备通过第三安全通信隧道，接收来自第四设备的第一NRPPa消息的响应消息，第四设备通过第三安全通信隧道，接收来自第一接入网设备的第一NRPPa消息的响应消息。
示例性的，第一设备通过第三安全通信隧道，接收来自第四设备的Namf_Communication_NIinfoNotify消息7，该Namf_Communication_NIinfoNotify消息7包括第一NRPPa消息的响应消息。第四设备通过第三安全通信隧道，接收来自第一接入网设备的上行非接入层传输消息8，上行非接入层传输消息8包括第一NRPPa消息的响应消息。
其中，第一设备通过第四安全通信隧道接收来自第二接入网设备的第二信息，可以理解为：第一设备通过第四安全通信隧道接收来自第二接入网设备的受安全保护的终端设备的第二定位测量信息。
可选的，第一设备通过第四安全通信隧道接收来自第二接入网设备的受安全保护的终端设备的第二定位测量信息，包括：第一设备通过第四安全通信隧道接收来自第二接入网设备的第一NRPPa消息的响应消息，该第一NRPPa消息的响应消息包括受安全保护的终端设备的第二定位测量信息。
其中，第一设备通过第四安全通信隧道接收来自第二接入网设备的第一NRPPa消息的响应消息，可以理解为：第一设备通过第四安全通信隧道，接收来自第四设备的第一NRPPa消息的响应消息，第四设备通过第四安全通信隧道，接收来自第二接入网设备的第一NRPPa消息的响应消息。
示例性的，第一设备通过第四安全通信隧道，接收来自第四设备的Namf_Communication_NIinfoNotify消息8，该Namf_Communication_NIinfoNotify消息8包括第一NRPPa消息的响应消息。第四设备通过第四安全通信隧道，接收来自第二接入网设备的上行非接入层传输消息9，上行非接入层传输消息9包括第一NRPPa消息的响应消息。
307、第一设备根据第二信息，获得第一信息。
可选的，若第二信息为来自终端设备的受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息，则步骤307，包括：第一设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥对受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息进行解密和完整性保护验证，获得终端设备的位置信息或终端设备的定位测量信息。
其中，第一设备根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥对受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息进行解密和完整性保护验证，获得终端设备的位置信息或终端设备的定位测量信息，可以理解为：第一设备先采用第一加密算法和第一加密密钥对受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息进行解密，再采用第一完整性保护算法和第一完整性保护密钥对解密后的终端设备的位置信息或解密后的终端设备的定位测量信息进行 完整性保护验证，获得终端设备的位置信息或终端设备的定位测量信息。
可选的，若第二信息为来自接入网设备的受安全保护的终端设备的定位测量信息，则步骤307，包括：第一设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥对受安全保护的终端设备的定位测量信息进行解密和完整性保护验证，获得终端设备的定位测量信息。
其中，第一设备根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥对受安全保护的终端设备的定位测量信息进行解密和完整性保护验证，获得终端设备的定位测量信息，可以理解为：第一设备先采用第二加密算法和第二加密密钥对受安全保护的终端设备的定位测量信息进行解密，再采用第二完整性保护算法和第二完整性保护密钥对解密后的终端设备的定位测量信息进行完整性保护验证，获得终端设备的定位测量信息。
可选的，若第二信息包括来自第一接入网设备的受安全保护的终端设备的第一定位测量信息和来自第二接入网设备的受安全保护的终端设备的第二定位测量信息，则步骤307，包括：第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥对受安全保护的终端设备的第一定位测量信息进行解密和完整性保护验证，获得终端设备的第一定位测量信息；第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥对受安全保护的终端设备的第二定位测量信息进行解密和完整性保护验证，获得终端设备的第二定位测量信息。
其中，第一设备根据第三加密算法、第三完整性保护算法、第三加密密钥和第三完整性保护密钥对受安全保护的终端设备的第一定位测量信息进行解密和完整性保护验证，获得终端设备的第一定位测量信息，可以理解为：第一设备先采用第三加密算法和第三加密密钥对受安全保护的终端设备的第一定位测量信息进行解密，再采用第三完整性保护算法和第三完整性保护密钥对解密后的终端设备的第一定位测量信息进行完整性保护验证，获得终端设备的第一定位测量信息。
其中，第一设备根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥对受安全保护的终端设备的第二定位测量信息进行解密和完整性保护验证，获得终端设备的第二定位测量信息，可以理解为：第一设备先采用第四加密算法和第四加密密钥对受安全保护的终端设备的第二定位测量信息进行解密，再采用第四完整性保护算法和第四完整性保护密钥对解密后的终端设备的第二定位测量信息进行完整性保护验证，获得终端设备的第二定位测量信息。
需要说明的，若第一信息为终端设备的定位测量信息，或，第一信息包括终端设备的第一定位测量信息和终端设备的第二定位测量信息，则在步骤307之后，该方法还包括：第一设备根据终端设备的定位测量信息，确定终端设备的位置信息；或，第一设备根据终端设备的第一定位测量信息和终端设备的第二定位测量信息，确定终端设备的定位测量信息。
示例性的，第一设备可以根据终端设备所在经度、终端设备所在纬度、终端设备所在海拔高度、水平速度和垂直速度中的一种或多种，确定终端设备所在的地理坐标、终端设备所在的小区或基站或位置区，在此不做限定。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
可选的，上述实施例的第一种可选实施场景中，上述还包括：终端设备向第四设备发送第一注册请求消息，第一注册请求消息包括终端设备的标识和终端设备的LCS安全能力信息。
可选的，上述实施例的第二种可选实施场景中，上述还包括：第一设备通过第一安全通信隧道，向第四设备发送第十请求消息。
其中，第十请求消息可以包括第三信息，第三信息可以为终端设备的虚假的位置信息。
其中，第一设备通过第一安全通信隧道，向第四设备发送第十请求消息，可以理解为：第一设备通过第一安全通信隧道，向第四设备发送Nlmf_Location_DeterminLocation Request消息2，Nlmf_Location_DeterminLocation Request消息2包括第十请求消息。
其中，在第一设备通过第一安全通信隧道，向第四设备发送第十请求消息之后，该方法还包括：第一设备通过第一安全通信隧道接收第四设备发送的第十请求消息的响应消息。
其中，第一设备通过第一安全通信隧道接收第四设备发送的第十请求消息的响应消息，可以理解为：第一设备通过第一安全通信隧道接收第四设备发送的Nlmf_Location_ProvidePositioninginfo Response消息1，Nlmf_Location_ProvidePositioninginfo Response消息1包括第十请求消息的响应消息。
需要说明的，在本申请中，第五设备可以不向第四设备发送第十请求消息，在此不做限定。
可以看出，上述技术方案中，通过向第四设备发送第十请求消息，使得第四设备感知定位流程已完成，避免第四设备误以为定位失败。
下面介绍第一设备可以为上述实施方式1中的第一设备20、第二设备可以为图2B中终端设备时所涉及到的实施例。参见图6，图6为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图6中其他设备均以5G网络为例来说明其涉及到的内容。即，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端。如图6所示，该方法包括但不限于以下步骤：
601、第一设备接收来自位置服务客户端的第十一请求消息。
相应的，位置服务客户端向第一设备发送第十一请求消息。
可选的，第十一请求消息包括定位精度、定位类型、终端设备的标识、第一设备的地址信息和第一设备的标识等。
其中，关于定位精度和定位类型，可以参考标准29.572，在此不加赘述。
其中，终端设备的标识，可以参考图3中相关描述，在此赘述。
可以理解的，第一设备的地址信息可以是第一设备的IP地址，或可以是第一设备的IP地址和端口号，在此不做限制。
其中，第一设备的标识可以为第一设备的网元实例标识(NF instance ID)或第一设备的完全限制域名(fully qualified domain name，FQDN)，在此不做限制。
可选的，步骤601可以执行或不执行，在本申请中，不做限制。
602、AMF网元接收来自第一设备的第十一请求消息。
相应的，第一设备向AMF网元发送第十一请求消息。
可选的，AMF网元接收来自第一设备的第十一请求消息，可以理解为：AMF网元接收第一设备发送的Namf_Location_ProvidePositioningInfo消息，该Namf_Location_ProvidePositioningInfo消息包括第十一请求消息。
603、AMF网元根据第一设备的标识，向第一设备发送终端设备的LCS安全能力信息。相应的，第一设备接收来自AMF网元的终端设备的LCS安全能力信息。
其中，关于终端设备的LCS安全能力信息，可以参考图3中相关内容，在此不加赘述。
可选的，在步骤603之前，该方法还包括：AMF网元接收来自终端设备的第一注册请求消息AMF网元。
其中，关于第一注册请求消息，可以参考图3中相关描述，在此不加赘述。
其中，AMF网元可以根据第一设备的标识确定第一设备为上述实施方式1中的第一设备，即，确定第一设备还用于提供根据定位精度要求、时延要求等选择相应的定位方法、以及选择相应的通信协议来完成定位所需信息的交互。以及还用于为定位服务提供所需的其他信息，或者定位策略。因此，AMF网元向第一设备发送终端设备的LCS安全能力信息。
可选的，步骤603可以替换为AMF网元根据第一设备的标识，向第一设备发送终端设备的标识。
其中，关于终端设备的标识，可以参考图3中相关描述，在此不加赘述。
需要说明的，在步骤603中，AMF网元还可以向第一设备发送接入网设备的LCS安全能力信息。若步骤603替换为AMF网元根据第一设备的标识，向第一设备发送终端设备的标识，则AMF网元还可以向第一设备发送接入网设备的标识，在此不做限制。
604、第一设备向UDM网元发送第二请求消息。
相应的，UDM网元接收来自第一设备的第二请求消息。
其中，关于第二请求消息，可以参考图3中相关描述，在此不加赘述。
605、UDM网元向第一设备发送第二请求消息的响应消息。
相应的，第一设备接收来自UDM网元发送的第二请求消息的响应消息。
其中，关于第二请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
606、第一设备根据终端设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，关于第一请求消息和受安全保护的第一请求消息，可以参考图3中相关描述，在此不加赘述。
可选的，若步骤603替换为AMF网元根据第一设备的标识，向第一设备发送终端设备的标识，则步骤606，可以替换为第一设备根据终端设备的标识，确定终端设备对应的第一加密算法和第一完整性保护算法，以及根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，在此不做限制。
其中，关于第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，可以参考图3中相关描述，在此不加赘述。
607、第一设备向终端设备发送第一安全通信隧道建立请求消息。
相应的，终端设备接收来自第一设备的第一安全通信隧道建立请求消息。
其中，第一安全通信隧道建立请求消息，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤606和步骤607之间没有必然的执行先后顺序，可以先执行步骤606，再执行步骤607；也可以先执行步骤607，再执行步骤606；还可以同时执行步骤606和步骤607，在此不做限制。
608、第一设备接收第一安全通信隧道建立请求消息的响应消息。
相应的，终端设备发送第一安全通信隧道建立请求消息。
其中，关于第一安全通信隧道建立请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
609、第一设备通过第一安全通信隧道，向终端设备发送受安全保护的第一请求消息。
相应的，终端设备通过第一安全通信隧道，接收来自第一设备的第一安全通信隧道建立请求消息。
其中，关于第一安全通信隧道，可以参考图3中相关描述，在此不加赘述。
610、终端设备根据受安全保护的第一请求消息，获得第一请求消息。
其中，关于步骤610，可以参考图3中相关描述，在此不加赘述。
611、终端设备根据第一请求消息，获取终端设备的位置信息或终端设备的定位测量信息。
其中，关于步骤611，可以参考图3中相关描述，在此不加赘述。
612、终端设备对终端设备的位置信息或终端设备的定位测量信息进行安全保护，获得受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
其中，关于步骤612，可以参考图3中相关描述，在此不加赘述。
613、第一设备通过第一安全通信隧道，接收来自终端设备的受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
相应的，终端设备通过第一安全通信隧道，向第一设备发送受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息。
614、第一设备根据受安全保护的终端设备的位置信息或受安全保护的终端设备的定位测量信息，获得终端设备的位置信息或终端设备的定位测量信息。
其中，关于步骤614，可以参考图3中相关描述，在此不加赘述。
615、位置服务客户端接收来自第一设备发送的第十一请求消息的响应消息。
相应的，第一设备向位置服务客户端发送第十一请求消息的响应消息。
其中，第十一请求消息的响应消息包括终端设备的位置信息。
可选的，在步骤615之前，针对终端设备的定位测量信息，第一设备可以根据终端设备的定位测量信息确定终端设备的位置信息。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在 不同的通信设备之间传输时可能存在信息泄露的问题。
下面介绍第一设备可以为上述实施方式1中的第一设备20、第二设备可以为图2A中接入网设备时所涉及到的实施例。参见图7，图7为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图7中其他设备均以5G网络为例来说明其涉及到的内容。即，终端设备可以为图2B中的终端设备，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端。如图7所示，该方法包括但不限于以下步骤：
701-702、与图6中601-602类似，在此不加赘述。
703、AMF网元根据第一设备的标识，向第一设备发送接入网设备的LCS安全能力信息。
相应的，第一设备接收来自AMF网元的接入网设备的LCS安全能力信息。
其中，关于第一设备的标识，可以参考图6中相关描述，在此不加赘述。
其中，关于接入网设备的LCS安全能力信息，可以参考图3中相关描述，在此不加赘述。
其中，AMF网元可以根据第一设备的标识确定第一设备为上述实施方式1中的第一设备，即，确定第一设备还用于提供根据定位精度要求、时延要求等选择相应的定位方法、以及选择相应的通信协议来完成定位所需信息的交互。以及还用于为定位服务提供所需的其他信息，或者定位策略。因此，AMF网元向第一设备发送接入网设备的LCS安全能力信息。
可选的，步骤703可以替换为AMF网元根据第一设备的标识，向第一设备发送接入网设备的标识。
其中，关于接入网设备的标识，可以参考图3中相关描述，在此不加赘述。
需要说明的，在步骤703中，AMF网元还可以向第一设备发送终端设备的LCS安全能力信息。若步骤703替换为AMF网元根据第一设备的标识，向第一设备发送接入网设备的标识，则AMF网元还可以向第一设备发送终端设备的标识，在此不做限制。
704、第一设备向UDM网元发送第三请求消息。
相应的，UDM网元接收来自第一设备的第三请求消息。
其中，关于第三请求消息，可以参考图3中相关描述，在此不加赘述。
705、UDM网元向第一设备发送第三请求消息的响应消息。
相应的，第一设备接收来自UDM网元的第三请求消息的响应消息。
其中，关于第三请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
706、第一设备根据接入网设备的LCS安全能力信息，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，关于第一请求消息和受安全保护的第一请求消息，可以参考图3中相关描述，在此不加赘述。
可选的，若步骤703替换为AMF网元根据第一设备的标识，向第一设备发送接入网设备的标识，则步骤706，可以替换为第一设备根据接入网设备的标识，确定接入网设备对 应的第二加密算法和第二完整性保护算法，以及根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息，在此不做限制。
其中，关于第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，可以参考图3中相关描述，在此不加赘述。
707、第一设备向接入网设备发送第二安全通信隧道建立请求消息。
相应的，接入网设备接收来自第一设备的第二安全通信隧道建立请求消息。
其中，第二安全通信隧道建立请求消息，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤706和步骤707之间没有必然的执行先后顺序，可以先执行步骤706，再执行步骤707；也可以先执行步骤707，再执行步骤706；还可以同时执行步骤706和步骤707，在此不做限制。
708、第一设备接收第二安全通信隧道建立请求消息的响应。
相应的，接入网设备发送第二安全通信隧道建立请求消息的响应。
其中，关于第二安全通信隧道建立请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
709、第一设备通过第二安全通信隧道，向接入网设备发送受安全保护的第一请求消息。
相应的，接入网设备通过第二安全通信隧道，接收来自第一设备的受安全保护的第一请求消息。
其中，关于第二安全通信隧道，可以参考图3中相关描述，在此不加赘述。
710、接入网设备根据受安全保护的第一请求消息，获得第一请求消息。
其中，关于步骤710，可以参考图3中相关描述，在此不加赘述。
711、接入网设备根据第一请求消息，获取终端设备的定位测量信息。
其中，关于步骤711，可以参考图3中相关描述，在此不加赘述。
可选的，在步骤711中，接入网设备还可以根据第一请求消息，获取终端设备的定位辅助信息。
其中，终端设备的定位辅助信息例如可以包括探测参考信号(sounding reference signal，SRS)等。
712、接入网设备对终端设备的定位测量信息进行安全保护，获得受安全保护的终端设备的定位测量信息。
其中，关于步骤712，可以参考图3中相关描述，在此不加赘述。
713、第一设备通过第二安全通信隧道，接收来自接入网设备的受安全保护的终端设备的定位测量信息。
相应的，接入网设备通过第二安全通信隧道，向第一设备发送受安全保护的终端设备的定位测量信息。
714、第一设备根据受安全保护的终端设备的定位测量信息，获得终端设备的定位测量信息。
其中，关于步骤714，可以参考图3中相关描述，在此不加赘述。
715、第一设备根据终端设备的定位测量信息，确定终端设备的位置信息。
716、与图6步骤615相同，在此不加赘述。
可以看出，上述技术方案中，通过对第一请求消息、终端设备的定位测量信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
下面介绍第一设备可以为上述实施方式1中的第一设备20、第二设备为接入网设备，接入网设备包括第一接入网设备和第二接入网设备时所涉及到的实施例。具体的，参见图8，图8为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图8中其他设备均以5G网络为例来说明其涉及到的内容。即，终端设备可以为图2B中的终端设备，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端。如图8所示，该方法包括但不限于以下步骤：
801-802、与图7中701-702相同，在此不加赘述。
803、AMF网元根据第一设备的标识，向第一设备发送第一接入网设备的LCS安全能力信息。
相应的，第一设备接收来自AMF网元的第一接入网设备的LCS安全能力信息。
其中，关于第一设备的标识，可以参考图6中相关描述，在此不加赘述。
其中，关于第一接入网设备的LCS安全能力信息，可以参考图3中相关描述，在此不加赘述。
其中，AMF网元可以根据第一设备的标识确定第一设备为上述实施方式1中的第一设备，即，确定第一设备还用于提供根据定位精度要求、时延要求等选择相应的定位方法、以及选择相应的通信协议来完成定位所需信息的交互。以及还用于为定位服务提供所需的其他信息，或者定位策略。因此，AMF网元向第一设备发送第一接入网设备的LCS安全能力信息。
可选的，步骤803可以替换为AMF网元根据第一设备的标识，向第一设备发送第一接入网设备的标识。
其中，关于第一接入网设备的标识，可以参考图3中相关描述，在此不加赘述。
需要说明的，在步骤803中，AMF网元还可以向第一设备发送终端设备的LCS安全能力信息。若步骤803替换为AMF网元根据第一设备的标识，向第一设备发送第一接入网设备的标识，则AMF网元还可以向第一设备发送终端设备的标识，在此不做限制。
804、AMF网元接收来自第一设备的第十二请求消息和终端设备的标识。
相应的，第一设备向AMF网元发送第十二请求消息和终端设备的标识。
可选的，第十二请求消息用于获取第四信息。第四信息可以包括第一小区的邻区的接入网设备(如第二接入网设备)的标识和频点。第一小区为第一接入网设备的小区。频点为第一接入网设备进行测量探测参考信号(sounding reference signal，SRS)的频点。
其中，第十二请求消息可以为第二NRPPa消息。
可选的，第二NRPPa消息可以包括第二NRPPa定位请求(positioning request)消息、第二NRPPa请求定位消息(request location information)、或新增消息，在此不做限制。
805、第一接入网设备接收来自AMF网元的第十二请求消息。
相应的，AMF网元根据终端设备的标识，向第一接入网设备发送第十二请求消息。
示例性的，AMF网元根据终端设备的标识，向第一接入网设备发送第十二请求消息，可以理解为：AMF网元根据终端设备的标识，向第一接入网设备发送下行非接入层传输消息6，该下行非接入层传输6包括第十二请求消息。
806、终端设备接收来自第一接入网设备的第十二请求消息。
相应的，第一接入网设备向终端设备发送第十二请求消息。
807、终端设备根据第十二请求消息获取第四信息。
808、第一接入网设备接收来自终端设备的第十二请求消息的响应消息。
相应的，终端设备向第一接入网设备发送第十二请求消息的响应消息。
可选的，第十二请求消息的响应消息包括第四信息。
其中，第十二请求消息的响应消息为第二NRPPa消息的响应消息。
809、AMF网元接收来自第一接入网设备的第十二请求消息的响应消息。
相应的，第一接入网设备向AMF网元发送第十二请求消息的响应消息。
810、第一设备接收来自AMF网元的第十二请求消息的响应消息。
相应的，AMF网元向第一设备发送第十二请求消息的响应消息。
可选的，步骤810，可以替换为第一设备接收来自AMF网元的第二接入网设备的LCS安全能力信息。
其中，关于第二接入网设备的LCS安全能力信息，可以参考图3中相关描述，在此不加赘述。
811、第一设备根据第一小区的邻区的接入网设备的标识，确定第二接入网设备对应的第四加密算法和第四完整性保护算法。
其中，关于第四加密算法和第四完整性保护算法，可以参考图3中相关描述，在此不加赘述。
812、第一设备向UDM网元发送第七请求消息。
相应的，UDM网元接收来自第一设备的第七请求消息。
其中，关于第七请求消息，可以参考图3中相关描述，在此不加赘述。
813、UDM网元向第一设备发送第七请求消息的响应消息。
相应的，第一设备接收来自UDM网元的第七请求消息的响应消息。
其中，关于第七请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
需要说明的，步骤812和步骤813可以在步骤803-步骤815中除步骤803和步骤805之外的其他步骤的任意一个步骤之后或之前执行，在本申请中不做限制。
814、第一设备向UDM网元发送第九请求消息。
相应的，UDM网元接收来自第一设备的第九请求消息。
其中，关于第九请求消息，可以参考图3中相关描述，在此不加赘述。
815、UDM网元向第一设备发送第九请求消息的响应消息。
相应的，第一设备接收来自UDM网元的第九请求消息的响应消息。
其中，关于第九请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
816、第一设备根据第一接入网设备的LCS安全能力信息，对第一请求消息进行安全 保护，获得受安全保护的第一请求消息，以及根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对第一请求消息进行安全保护，获得受安全保护的第一请求消息。
其中，关于步骤816，可以参考图3中相关描述，在此不加赘述。
817、第一设备向第一接入网设备发送第三安全通信隧道建立请求消息。
相应的，第一接入网设备接收来自第一设备的第三安全通信隧道建立请求消息。
其中，关于第三安全通信隧道建立请求消息，可以参考图3中相关描述，在此不加赘述。
818、第一设备向第二接入网设备发送第四安全通信隧道建立请求消息。
相应的，第二接入网设备接收来自第一设备的第四安全通信隧道建立请求消息。
其中，关于第四安全通信隧道建立请求消息，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤817和步骤818之间没有必然的执行先后顺序，可以先执行步骤817，再执行步骤818；也可以先执行步骤818，再执行步骤817；还可以同时执行步骤817和步骤818，在此不做限制。
819、第一设备接收第三安全通信隧道建立请求消息的响应消息。
相应的，第一接入网设备向第一设备发送第三安全通信隧道建立请求消息的响应消息。
其中，关于第三安全通信隧道建立请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
可选的，步骤817和步骤819可以在步骤803-步骤815中除步骤803和步骤805之外的其他步骤的任意一个步骤之后或之前执行，在本申请中不做限制。若步骤817和步骤819在步骤803之后，步骤804之前执行，步骤804可以替换为AMF网元通过第三安全通信隧道接收来自第一设备的第十二请求消息和终端设备的标识。步骤805可以替换为第一接入网设备通过第三安全通信隧道接收来自AMF网元的第十二请求消息。步骤806可以替换为终端设备通过第三安全通信隧道接收来自第一接入网设备的第十二请求消息。步骤808可以替换为第一接入网设备通过第三安全通信隧道接收来自终端设备的第十二请求消息的响应消息。步骤809可以替换为AMF网元通过第三安全通信隧道接收来自第一接入网设备的第十二请求消息的响应消息。步骤810可以替换为第一设备通过第三安全通信隧道接收来自AMF网元的第十二请求消息的响应消息。同理，若步骤817和步骤819在步骤804之后，步骤805之前执行，步骤805-806、步骤808-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤805之后，步骤806之前执行，步骤806、步骤808-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤806之后，步骤807之前执行，步骤808-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤807之后，步骤808之前执行，步骤808-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤808之后，步骤809之前执行，步骤809-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤809之后，步骤810之前执行，步骤809-810均需要替换，具体的，参考上述描述，在此不加赘述。若步骤817和步骤819在步骤810之后， 步骤811之前执行，步骤810均需要替换，具体的，参考上述描述，在此不加赘述。
820、第一设备接收第四安全通信隧道建立请求消息的响应消息，相应的，第二接入网设备向第一设备发送第四安全通信隧道建立请求消息的响应消息。
其中，关于第四安全通信隧道建立请求消息的响应消息，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤819和步骤820之间没有必然的执行先后顺序，可以先执行步骤819，再执行步骤820；也可以先执行步骤820，再执行步骤819；还可以同时执行步骤819和步骤820，在此不做限制。
821、第一设备通过第三安全通信隧道向第一接入网设备发送受安全保护的第一请求消息。
相应的，第一接入网设备通过第三安全通信隧道接收来自第一设备的受安全保护的第一请求消息。
822、第一设备通过第四安全通信隧道向第二接入网设备发送受安全保护的第一请求消息。
相应的，第二接入网设备通过第四安全通信隧道接收来自第一设备的受安全保护的第一请求消息。
需要说明的，本申请实施例中的步骤821和步骤822之间没有必然的执行先后顺序，可以先执行步骤821，再执行步骤822；也可以先执行步骤822，再执行步骤821；还可以同时执行步骤821和步骤822，在此不做限制。
823、第一接入网设备根据受安全保护的第一请求消息，获得第一请求消息。
其中，关于步骤823，可以参考图3中相关描述，在此不加赘述。
824、第二接入网设备根据受安全保护的第一请求消息，获得第一请求消息。
其中，关于步骤824，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤823和步骤824之间没有必然的执行先后顺序，可以先执行步骤823，再执行步骤824；也可以先执行步骤824，再执行步骤823；还可以同时执行步骤823和步骤824，在此不做限制。
825、第一接入网设备根据第一请求消息，获取终端设备的第一定位测量信息。
其中，关于步骤825，可以参考图3中相关描述，在此不加赘述。
826、第二接入网设备根据第一请求消息，获取终端设备的第二定位测量信息。
其中，关于步骤826，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤825和步骤826之间没有必然的执行先后顺序，可以先执行步骤825，再执行步骤826；也可以先执行步骤825，再执行步骤826；还可以同时执行步骤825和步骤826，在此不做限制。
827、第一接入网设备对终端设备的第一定位测量信息进行安全保护，获得受安全保护的终端设备的第一定位测量信息。
其中，关于步骤827，可以参考图3中相关描述，在此不加赘述。
828、第二接入网设备对终端设备的第二定位测量信息进行安全保护，获得受安全保护的终端设备的第二定位测量信息。
其中，关于步骤828，可以参考图3中相关描述，在此不加赘述。
需要说明的，本申请实施例中的步骤827和步骤828之间没有必然的执行先后顺序，可以先执行步骤827，再执行步骤828；也可以先执行步骤828，再执行步骤827；还可以同时执行步骤827和步骤828，在此不做限制。
829、第一设备通过第三安全通信隧道接收来自第一接入网设备的受安全保护的终端设备的第一定位测量信息。
相应的，第一接入网设备通过第三安全通信隧道向第一设备发送受安全保护的终端设备的第二定位测量信息。
830、第一设备通过第四安全通信隧道接收来自第二接入网设备的受安全保护的终端设备的第二定位测量信息。
相应的，第二接入网设备通过第四安全通信隧道向第一设备发送受安全保护的终端设备的第二定位测量信息。
需要说明的，本申请实施例中的步骤829和步骤830之间没有必然的执行先后顺序，可以先执行步骤829，再执行步骤830；也可以先执行步骤830，再执行步骤829；还可以同时执行步骤829和步骤830，在此不做限制。
831、第一设备根据受安全保护的终端设备的第一定位测量信息，获得终端设备的第一定位测量信息，以及根据受安全保护的终端设备的第二定位测量信息，获得终端设备的第二定位测量信息。
其中，关于步骤831，可以参考图3中相关描述，在此不加赘述。
832、第一设备根据终端设备的第一定位测量信息和终端设备的第二定位测量信息，确定终端设备的位置信息。
833、与图7步骤716相同，在此不加赘述。
可以看出，上述技术方案中，通过对第一请求消息、终端设备的定位测量信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
下面介绍第一设备可以为上述实施方式2中的第一设备20、第二设备可以为图2B中终端设备时所涉及到的实施例。可以理解的，第一设备可以为上述实施方式2中的LMF网元。参见图9，图9为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图9中其他设备均以5G网络为例来说明其涉及到的内容。即，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端，第五设备可以为GMLC网元，第六设备可以为NRF网元。如图9所示，该方法包括但不限于以下步骤：
901-902、与图6中步骤601-602类似，在此不加赘述。
需要说明的，在步骤901中，第十一请求消息包括定位精度、定位类型、终端设备的标识、LMF网元的标识、GMLC网元的标识和第一地址信息等。
其中，关于定位精度和定位类型，可以参考标准29.572，在此不加赘述。
其中，终端设备的标识，可以参考图3中相关描述，在此赘述。
可选的，LMF网元的标识可以为LMF网元的网元实例标识或LMF网元的完全限制域名。
可选的，GMLC网元的标识为GMLC网元的网元实例标识或GMLC网元的完全限制域名。
其中，第一地址信息可以为GMLC通知的反馈地址(GMLC notify callback URI)。
903、AMF网元向NRF网元发送第十三请求消息。
相应的，NRF网元接收来自AMF网元的第十三请求消息。
可选的，第十三请求消息用于指示NRF网元根据LMF网元的标识，获取LMF网元的地址信息。
可以理解的，LMF网元的地址信息可以是LMF网元的IP地址，也可以是LMF网元的IP地址和端口号，在此不做限制。
可选的，在步骤930之前，LMF网元向NRF网元发送第二注册请求消息，第二注册请求消息包括LMF网元的标识。NRF网元接收LMF网元发送的第二注册请求消息后，可以根据LMF网元的标识为LMF网元分配地址。
904、NRF网元向AMF网元发送第十三请求消息的响应消息。
相应的，AMF网元接收来自NRF网元的第十三请求消息的响应消息。
可选的，第十三请求消息的响应消息包括LMF网元的地址信息。
905-916、与图6中步骤603-614类似，在此不加赘述。
需要说明的，针对步骤905，在参考步骤603时，需要将步骤603涉及到的第一设备的标识替换为LMF网元的地址信息。
需要说明的，针对步骤905-916，在参考步骤603-614时，需要将步骤603-614涉及到的第一设备替换为LMF网元。
917、LMF网元根据GMLC网元的标识，向GMLC网元发送第十一请求消息的响应消息。
相应的，GMLC网元接收来自LMF网元的第十一请求消息的响应消息。
其中，关于第十一请求消息的响应消息，可以参考图6中步骤615相关描述，在此不加赘述。
可选的，若在步骤905中，AMF网元还向LMF网元发送第一地址信息，则步骤917可以替换为LMF网元根据第一地址信息，向GMLC网元发送第十一请求消息的响应消息。
可选的，若在步骤905中，AMF网元还向LMF网元发送GMLC网元的标识，则第十三请求消息还可以包括GMLC网元的标识，第十三请求消息还用于指示NRF网元根据GMLC网元的标识，获取GMLC网元的地址信息。
可以理解的，GMLC网元的地址信息可以是GMLC网元的IP地址，也可以是GMLC网元的IP地址和端口号，在此不做限制。
其中，在步骤930之前，GMLC网元可以向NRF网元发送第三注册请求消息，第三注册请求消息包括GMLC网元的标识。NRF网元接收来自GMLC网元的第三注册请求消息后，可以根据GMLC网元的标识为GMLC网元分配地址。
可选的，若LMF网元获取GMLC网元的地址信息，则步骤917可以替换为LMF网元 根据GMLC网元的地址信息，向GMLC网元发送第十一请求消息的响应消息。
918、与图6中步骤615类似，在此不加赘述。
需要说明的，针对步骤918，在参考步骤615时，需要将步骤615涉及到的第一设备替换为GMLC网元。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
下面介绍第一设备可以为上述实施方式2中的第一设备20、第二设备可以为图2A中接入网设备时所涉及到的实施例。可以理解的，第一设备可以为上述实施方式2中的LMF网元。参见图10，图10为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图10中其他设备均以5G网络为例来说明其涉及到的内容。即，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端，第五设备可以为GMLC网元，第六设备可以为NRF网元。如图10所示，该方法包括但不限于以下步骤：
1001-1004、与图9中步骤901-904类似，在此不加赘述。
1005-1017、与图7中步骤703-715类似，在此不加赘述。
需要说明的，针对步骤1005，在参考步骤703时，需要将步骤703涉及到的第一设备的标识替换为LMF网元的地址信息。
需要说明的，针对步骤1005-1017，在参考步骤703-715时，需要将步骤703-715涉及到的第一设备替换为LMF网元。
1018-1019、与图9中步骤917-918类似，在此不加赘述。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
下面介绍第一设备可以为上述实施方式2中的第一设备20、第二设备为接入网设备，接入网设备包括第一接入网设备和第二接入网设备时所涉及到的实施例。可以理解的，第一设备可以为上述实施方式2中的LMF网元，接入网设备可以为图2B中接入网设备，接入网设备包括第一接入网设备和第二接入网设备。具体的，参见图11，图11为本申请实施例提供的又一种数据传输方法的流程示意图。需要说明的，图11中其他设备均以5G网络为例来说明其涉及到的内容。即，终端设备可以为图2B中的终端设备，第三设备可以为图2B中的UDM网元，第四设备可以为图2B中的AMF网元，位置服务客户端可以为图2B中的位置服务客户端。如图11所示，该方法包括但不限于以下步骤：
1101-1104、与图9中步骤901-904类似，在此不加赘述。
1105-1134、与图8中步骤803-832类似，在此不加赘述。
需要说明的，针对步骤1105，在参考步骤803时，需要将步骤803涉及到的第一设备的标识替换为LMF网元的地址信息。
需要说明的，针对步骤1105-1134，在参考步骤803-832时，需要将步骤803-832涉及到的第一设备替换为LMF网元。
1135-1136、与图9中步骤917-918类似，在此不加赘述。
可以看出，上述技术方案中，通过对第一请求消息、第一信息进行安全保护，从而在实现定位业务过程中提高了数据传输的安全性。同时，也避免了用户个人隐私敏感数据在不同的通信设备之间传输时可能存在信息泄露的问题。
上述主要从各个网元之间交互的角度对本申请提供的方案进行了介绍。可以理解的是，上述实现各网元为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对第一设备或第二设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中，上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
在采用集成的单元的情况下，参见图12，图12为本申请实施例提供的一种通信装置的结构示意图。该通信装置1200可应用于上述图3至图11所示的方法中，如图12所示，该通信装置1200包括：处理模块1201和收发模块1202。处理模块1201可以是一个或多个处理器，收发模块1202可以是收发器或者通信接口。该通信装置可用于实现上述任一方法实施例中涉及第一设备或第二设备，或用于实现上述任一方法实施例中涉及网元的功能。该网元或者网络功能既可以是硬件设备中的网络元件，也可以是在专用硬件上运行的软件功能，或者是平台(例如，云平台)上实例化的虚拟化功能。可选的，该通信装置1200还可以包括存储模块1203，用于存储通信装置1200的程序代码和数据。
一种实例，当该通信装置作为第一设备或为应用于第一设备中的芯片，并执行上述方法实施例中由第一设备执行的步骤。收发模块1202，用于支持与第二设备等之间的通信，具体执行图3-图11中由第一设备执行的发送和或接收的动作，例如支持第一设备执行步骤306和步骤401中的一个或多个步骤，和或用于本文中所描述的技术的其他过程。处理模块1201可用于支持通信装置1200执行上述方法实施例中的处理动作，例如，支持第一设备执行步骤301和步骤307中的一个或多个步骤，和或用于本文所描述的技术的其它过程。
一种实例，当该通信装置作为第二设备或为应用于第二设备中的芯片，并执行上述方法实施例中由第二设备执行的步骤。收发模块1202，用于支持与第一设备等之间的通信，具体执行图3-图11中由第二设备执行的发送和或接收的动作，例如支持第二设备执行步骤302和步骤306中的一个或多个步骤，和或用于本文中所描述的技术的其他过程。处理模块1201可用于支持通信装置1200执行上述方法实施例中的处理动作，例如，支持第二设 备执行步骤303和步骤304中的一个或多个步骤，和或用于本文所描述的技术的其它过程。
在一种可能的实施方式中，当第一设备或第二设备为芯片时，收发模块1202可以是接口、管脚或电路等。接口可用于输入待处理的数据至处理器，并可以向外输出处理器的处理结果。具体实现中，接口可以是通用输入输出(general purpose input output，GPIO)接口，可以和多个外围设备(如显示器(LCD)、摄像头(camara)、射频(radio frequency，RF)模块、天线等等)连接。接口通过总线与处理器相连。
处理模块1201可以是处理器，该处理器可以执行存储模块存储的计算机执行指令，以使该芯片执行图3至图11实施例涉及的方法。
进一步的，处理器可以包括控制器、运算器和寄存器。示例性的，控制器主要负责指令译码，并为指令对应的操作发出控制信号。运算器主要负责执行定点或浮点算数运算操作、移位操作以及逻辑操作等，也可以执行地址运算和转换。寄存器主要负责保存指令执行过程中临时存放的寄存器操作数和中间操作结果等。具体实现中，处理器的硬件架构可以是专用集成电路(application specific integrated circuits，ASIC)架构、无互锁管道阶段架构的微处理器(microprocessor without interlocked piped stages architecture，MIPS)架构、进阶精简指令集机器(advanced RISC machines，ARM)架构或者网络处理器(network processor，NP)架构等等。处理器可以是单核的，也可以是多核的。
该存储模块可以为该芯片内的存储模块，如寄存器、缓存等。存储模块也可以是位于芯片外部的存储模块，如只读存储器(Read Only Memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(Random Access Memory，RAM)等。
需要说明的，处理器、接口各自对应的功能既可以通过硬件设计实现，也可以通过软件设计来实现，还可以通过软硬件结合的方式来实现，这里不作限制。
图13为本申请实施例提供的一种简化的终端设备的结构示意图。便于理解和图示方便，图13中，终端设备以手机作为例子。如图13所示，终端设备包括至少一个处理器，还可以包括射频电路、天线以及输入输出装置。其中，处理器可用于对通信协议以及通信数据进行处理，还可以用于对终端设备进行控制，执行软件程序，处理软件程序的数据等。该终端设备还可以包括存储器，存储器主要用于存储软件程序和数据，这些涉及的程序可以在该通信装置出厂时即装载再存储器中，也可以在后期需要的时候再装载入存储器。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号，且天线为本申请实施例提供的天线。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当需要发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。为便于说明，图13中仅示出了一个存储器和处理器。在实际的终端设备产品中，可以存在 一个或多个处理器和一个或多个存储器。存储器也可以称为存储介质或者存储设备等。存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
在本申请实施例中，可以将具有收发功能的天线和射频电路视为终端设备的接收单元和发送单元(也可以统称为收发单元)，将具有处理功能的处理器视为终端设备的处理单元。如图13所示，终端设备包括接收模块31、处理模块32和发送模块33。接收模块31也可以称为接收器、接收机、接收电路等，发送模块33也可以称为发送器、发射器、发射机、发射电路等。处理模块32也可以称为处理器、处理单板、处理装置等。
例如，处理模块32用于执行图3-图11所示任一实施例中终端设备的功能。
图14为本申请实施例提供的一种简化的接入网设备的结构示意图。接入网设备包括射频信号收发及转换部分以及42部分，该射频信号收发及转换部分又包括接收模块41部分和发送模块43部分(也可以统称为收发模块)。射频信号收发及转换部分主要用于射频信号的收发以及射频信号与基带信号的转换；42部分主要用于基带处理，对接入网设备进行控制等。接收模块41也可以称为接收器、接收机、接收电路等，发送模块43也可以称为发送器、发射器、发射机、发射电路等。42部分通常是接入网设备的控制中心，通常可以称为处理模块，用于控制接入网设备执行上述图3-图11中关于终端设备或接入网设备所执行的步骤。具体可参见上述相关部分的描述。
42部分可以包括一个或多个单板，每个单板可以包括一个或多个处理器和一个或多个存储器，处理器用于读取和执行存储器中的程序以实现基带处理功能以及对接入网设备的控制。若存在多个单板，各个单板之间可以互联以增加处理能力。作为一中可选的实施方式，也可以是多个单板共用一个或多个处理器，或者是多个单板共用一个或多个存储器，或者是多个单板同时共用一个或多个处理器。
例如，针对于接入网设备，发送模块43用于执行图3-图11所示任一实施例中接入网设备的功能。
本申请实施例还提供一种第一设备，包括处理器、存储器、输入接口和输出接口，输入接口用于接收来自第一设备之外的其它通信装置的信息，输出接口用于向第一设备之外的其它通信装置输出信息，处理器调用存储器中存储的计算机程序实现如图3-图11所示任一实施例。
本申请实施例还提供一种第二设备，包括处理器、存储器、输入接口和输出接口，输入接口用于接收来自第二设备之外的其它通信装置的信息，输出接口用于向第二设备之外的其它通信装置输出信息，处理器调用存储器中存储的计算机程序实现如图3-图11所示任一实施例。
本申请实施例还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序，当计算机程序被运行时，实现如图3-图11所示任一实施例。
本申请实施例还提供一种计算机程序产品，当计算机读取并执行计算机程序产品时，使得计算机执行实现如图3-图11所示任一实施例。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，云服务器，或者接入网设备等)执行本申请各个实施例上述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (28)

  1. 一种数据传输方法，其特征在于，所述方法应用于第一设备，所述方法包括：
    对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
    向第二设备发送所述受安全保护的所述第一请求消息，所述第二设备为所述终端设备或接入网设备；
    接收来自所述第二设备的第二信息，所述第二信息包括受安全保护的所述第一信息；
    根据所述第二信息，获得所述第一信息。
  2. 根据权利要求1所述的方法，其特征在于，所述第二设备为所述终端设备，所述方法还包括：
    向所述终端设备发送第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法，所述第一安全保护参数用于所述终端设备进行安全通信；
    接收所述第一安全通信隧道建立请求消息的响应消息；
    所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
    通过所述第一安全通信隧道，向所述终端设备发送所述受安全保护的所述第一请求消息。
  3. 根据权利要求1或2所述的方法，其特征在于，所述方法还包括：
    接收所述终端设备的位置定位服务LCS安全能力信息；
    所述对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，包括：
    根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得受安全保护的所述第一请求消息。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    向第三设备发送第二请求消息，所述第二请求消息包括所述终端设备的标识，所述第二请求消息用于请求第二安全保护参数；
    接收来自所述第三设备的所述第二请求消息的响应，所述第二请求消息的响应包括所述第二安全保护参数；
    其中，所述第二安全保护参数包括第一加密密钥和第一完整性保护密钥；或，所述第二安全保护参数包括第一参数，所述第一参数用于确定所述第一加密密钥和所述第一完整性保护密钥；
    所述根据所述终端设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
    根据所述终端设备的LCS安全能力信息和所述第二安全保护参数，对所述第一请求消 息进行安全保护，获得所述受安全保护的所述第一请求消息。
  5. 根据权利要求1所述的方法，其特征在于，所述第二设备为所述接入网设备，所述方法还包括：
    向所述接入网设备发送第二安全通信隧道建立请求消息，所述第二安全通信隧道建立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；
    接收所述第二安全通信隧道建立请求消息的响应；
    所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
    通过所述第二安全通信隧道，向所述接入网设备发送所述受安全保护的所述第一请求消息。
  6. 根据权利要求1或5所述的方法，其特征在于，所述方法还包括：
    接收所述接入网设备的标识；
    根据所述接入网设备的标识，确定所述接入网设备对应的第二加密算法和第二完整性保护算法；
    所述对第一请求消息进行安全保护，获得受安全保护的所述第一请求消息，包括：
    根据所述第二加密算法和所述第二完整性保护算法，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
  7. 根据权利要求1或5所述的方法，其特征在于，所述方法还包括：
    接收所述接入网设备的LCS安全能力信息；
    所述对第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
    根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息。
  8. 根据权利要求6或7所述的方法，其特征在于，所述方法还包括：
    向第三设备发送第三请求消息，所述第三请求消息包括所述接入网设备的标识，所述第三请求消息用于请求第四安全保护参数；
    接收来自所述第三设备的所述第三请求消息的响应，所述第三请求消息的响应包括所述第四安全保护参数；
    其中，所述第四安全保护参数包括第二加密密钥和第二完整性保护密钥；或，所述第四安全保护参数包括第二参数，所述第二参数用于确定所述第二加密密钥和所述第二完整性保护密钥；
    所述根据所述接入网设备的LCS安全能力信息，对所述第一请求消息进行安全保护，获得所述受安全保护的所述第一请求消息，包括：
    根据所述接入网设备的LCS安全能力信息和所述第四安全保护参数，对所述第一请求 消息进行安全保护，获得所述受安全保护的所述第一请求消息。
  9. 根据权利要求2-4任意一项所述方法，其特征在于，所述根据所述第二信息，获得所述第一信息，包括：
    根据第一加密算法、第一完整性保护算法、第一加密密钥和第一完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
  10. 根据权利要求5-8任意一项所述方法，其特征在于，所述根据所述第二信息，获得所述第一信息，包括：
    根据第二加密算法、第二完整性保护算法、第二加密密钥和第二完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
  11. 根据权利要求1所述的方法，其特征在于，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，所述方法还包括：
    向所述第一接入网设备发送第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第四完整性保护算法所述第五安全保护参数用于所述第一接入网设备进行安全通信；
    向所述第二接入网设备发送第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
    接收所述第三安全通信隧道建立请求消息的响应；
    接收所述第四安全通信隧道建立请求消息的响应；
    所述向第二设备发送所述受安全保护的所述第一请求消息，包括：
    通过所述第五安全通信隧道，向所述第一接入网设备发送所述受安全保护的所述第一请求消息；
    通过所述第六安全通信隧道，向所述第二接入网设备发送所述受安全保护的所述第一请求消息。
  12. 根据权利要求11所述的方法，其特征在于，所述根据所述第二信息，获得所述第一信息，包括：
    根据第三加密算法、第四完整性保护算法、第三加密密钥和第四完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息；
    根据第四加密算法、第四完整性保护算法、第四加密密钥和第四完整性保护密钥，对所述第二信息进行解密和完整性保护验证，获得所述第一信息。
  13. 一种数据传输方法，其特征在于，所述方法应用于第二设备，所述方法包括：
    接收来自第一设备的受安全保护的第一请求消息，所述第一请求消息用于请求终端设备的第一信息，所述第一信息包括所述终端设备的位置信息或定位测量信息；
    根据所述受安全保护的所述第一请求消息，获得所述第一请求消息；
    根据所述第一请求消息，获取所述第一信息；
    对所述第一信息进行安全保护，获得第二信息，所述第二信息包括受安全保护的所述第一信息；
    向所述第一设备发送所述第二信息。
  14. 根据权利要求13所述的方法，其特征在于，所述第二设备为所述终端设备，所述方法还包括：
    接收来自所述第一设备的第一安全通信隧道建立请求消息，所述第一安全通信隧道建立请求消息用于请求建立第一安全通信隧道，所述第一安全通信隧道建立请求消息包括第一安全保护参数，所述第一安全保护参数包括第一加密算法和第一完整性保护算法，所述第一安全保护参数用于所述终端设备进行安全通信；
    发送所述第一安全通信隧道建立请求消息的响应消息；
    所述接收来自第一设备的受安全保护的第一请求消息，包括：
    通过所述第一安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
  15. 根据权利要求14所述的方法，其特征在于，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
    根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
  16. 根据权利要求14或15所述的方法，其特征在于，所述对所述第一信息进行安全保护，获得第二信息，包括：
    根据所述第一加密算法、所述第一完整性保护算法、所述第一加密密钥和所述第一完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
  17. 根据权利要求14-16任意一项所述的方法，其特征在于，所述方法还包括：
    向第四设备发送第一注册请求消息，所述第一注册请求消息包括所述终端设备的标识和所述终端设备的LCS安全能力信息。
  18. 根据权利要求13所述的方法，其特征在于，所述第二设备为接入网设备，所述方法还包括：
    接收来自所述第一设备的第二安全通信隧道建立请求消息，所述第二安全通信隧道建 立请求消息用于请求建立第二安全通信隧道，所述第二安全通信隧道建立请求消息包括第三安全保护参数，所述第三安全保护参数包括第二加密算法和第二完整性保护算法，所述第三安全保护参数用于所述接入网设备进行安全通信；
    发送所述第二安全通信隧道建立请求消息的响应；
    所述接收来自第一设备的受安全保护的第一请求消息，包括：
    通过所述第二安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
  19. 根据权利要求13或18所述的方法，其特征在于，所述方法还包括：
    向所述第一设备发送所述接入网设备的标识。
  20. 根据权利要求13或18所述的方法，其特征在于，所述方法还包括：
    向所述第一设备发送所述接入网设备的LCS安全能力信息。
  21. 根据权利要求19-20任意一项所述的方法，其特征在于，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
    根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
  22. 根据权利要求19-21任意一项所述的方法，其特征在于，所述对所述第一信息进行安全保护，获得第二信息，包括：
    根据所述第二加密算法、所述第二完整性保护算法、所述第二加密密钥和所述第二完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
  23. 根据权利要求13所述的方法，其特征在于，所述第二设备为接入网设备，所述接入网设备包括第一接入网设备和第二接入网设备，所述第一接入网设备为所述终端设备当前接入的设备，所述第二接入网设备为所述终端设备当前服务小区的邻区所属的接入网设备，所述方法还包括：
    所述第一接入网设备接收来自所述第一设备的第三安全通信隧道建立请求消息，所述第三安全通信隧道建立请求消息用于请求建立第三安全通信隧道，所述第三安全通信隧道建立请求消息包括第五安全保护参数，所述第五安全保护参数包括第三加密算法和第四完整性保护算法，所述第五安全保护参数用于所述第一接入网设备进行安全通信；
    所述第二接入网设备接收来自所述第一设备的第四安全通信隧道建立请求消息，所述第四安全通信隧道建立请求消息用于请求建立第四安全通信隧道，所述第四安全通信隧道建立请求消息包括第六安全保护参数，所述第六安全保护参数包括第四加密算法和第四完整性保护算法，所述第六安全保护参数用于所述第二接入网设备进行安全通信；
    所述第一接入网设备发送所述第三安全通信隧道建立请求消息的响应；
    所述第二接入网设备发送所述第四安全通信隧道建立请求消息的响应；
    所述接收来自第一设备的受安全保护的第一请求消息，包括：
    所述第一接入网设备通过所述第三安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息；
    所述第二接入网设备通过所述第四安全通信隧道，接收来自所述第一设备的所述受安全保护的所述第一请求消息。
  24. 根据权利要求23所述的方法，其特征在于，所述根据所述受安全保护的所述第一请求消息，获得所述第一请求消息，包括：
    所述第一接入网设备根据所述第三加密算法、所述第四完整性保护算法、所述第三加密密钥和所述第四完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息；
    所述第二接入网设备根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述受安全保护的所述第一请求消息进行解密和完整性保护验证，获得所述第一请求消息。
  25. 根据权利要求23或24所述的方法，其特征在于，所述对所述第一信息进行安全保护，获得第二信息，包括：
    所述第一接入网设备根据所述第三加密算法、所述第四完整性保护算法、所述第三加密密钥和所述第四完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息；
    所述第二接入网设备根据所述第四加密算法、所述第四完整性保护算法、所述第四加密密钥和所述第四完整性保护密钥，对所述第一信息进行安全保护，获得所述第二信息。
  26. 一种第一设备，其特征在于，包括处理器和存储器，所述处理器调用所述存储器中存储的计算机程序实现如权利要求1-12任一项所述的方法。
  27. 一种第二设备，其特征在于，包括处理器和存储器，所述处理器调用所述存储器中存储的计算机程序实现如权利要求13-25任一项所述的方法。
  28. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序，当所述计算机程序被运行时，实现如权利要求1-12任一项所述的方法，或实现如权利要求13-25任一项所述的方法。
PCT/CN2020/124975 2020-10-29 2020-10-29 一种数据传输方法及相关装置 WO2022087993A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/124975 WO2022087993A1 (zh) 2020-10-29 2020-10-29 一种数据传输方法及相关装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/124975 WO2022087993A1 (zh) 2020-10-29 2020-10-29 一种数据传输方法及相关装置

Publications (1)

Publication Number Publication Date
WO2022087993A1 true WO2022087993A1 (zh) 2022-05-05

Family

ID=81381753

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/124975 WO2022087993A1 (zh) 2020-10-29 2020-10-29 一种数据传输方法及相关装置

Country Status (1)

Country Link
WO (1) WO2022087993A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115103443A (zh) * 2022-07-04 2022-09-23 中国联合网络通信集团有限公司 定位方法、装置和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101115307A (zh) * 2007-06-19 2008-01-30 中兴通讯股份有限公司 一种辅助全球定位过程中实现用户隐私安全的方法及系统
WO2009052763A1 (fr) * 2007-10-19 2009-04-30 Huawei Technologies Co., Ltd. Procédé et dispositif de mise en place de services de localisation, procédé de radiodiffusion d'informations de localisation géographique de station de base, station de base et terminal
CN106331035A (zh) * 2015-06-30 2017-01-11 北京壹人壹本信息科技有限公司 一种防追踪方法和终端
CN106922016A (zh) * 2015-12-24 2017-07-04 中国电信股份有限公司 定位方法、设备以及系统
CN111083098A (zh) * 2019-06-17 2020-04-28 南通大学 一种基于隐私保护的可信lbs服务协议实现方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101115307A (zh) * 2007-06-19 2008-01-30 中兴通讯股份有限公司 一种辅助全球定位过程中实现用户隐私安全的方法及系统
WO2009052763A1 (fr) * 2007-10-19 2009-04-30 Huawei Technologies Co., Ltd. Procédé et dispositif de mise en place de services de localisation, procédé de radiodiffusion d'informations de localisation géographique de station de base, station de base et terminal
CN106331035A (zh) * 2015-06-30 2017-01-11 北京壹人壹本信息科技有限公司 一种防追踪方法和终端
CN106922016A (zh) * 2015-12-24 2017-07-04 中国电信股份有限公司 定位方法、设备以及系统
CN111083098A (zh) * 2019-06-17 2020-04-28 南通大学 一种基于隐私保护的可信lbs服务协议实现方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115103443A (zh) * 2022-07-04 2022-09-23 中国联合网络通信集团有限公司 定位方法、装置和存储介质
CN115103443B (zh) * 2022-07-04 2024-04-19 中国联合网络通信集团有限公司 定位方法、装置和存储介质

Similar Documents

Publication Publication Date Title
US9648651B2 (en) Methods and apparatus to determine distance between devices for device to device communication and proximity services
JP7286751B2 (ja) 通信方法および通信装置
WO2022012310A1 (zh) 一种通信方法及装置
CN113132908B (zh) 一种业务管理方法及装置
US11729599B2 (en) Communication system
US9474095B2 (en) Systems, methods, and devices for distributed setup for a device-to-device session
CN114071452B (zh) 用户签约数据的获取方法及装置
WO2022087993A1 (zh) 一种数据传输方法及相关装置
EP4328815A1 (en) Federated learning method, federated learning system, first device, and third device
CN116723507B (zh) 针对边缘网络的终端安全方法及装置
US11343244B2 (en) Method and apparatus for multi-factor verification of a computing device location within a preset geographic area
CN109565514B (zh) 地点信息保护
WO2023241671A1 (zh) 定位广播的配置方法及通信装置
WO2022042476A1 (zh) 一种定位方法及相关装置
CN114584969B (zh) 基于关联加密的信息处理方法及装置
WO2023160624A1 (zh) 一种通信方法及装置
CN116528234B (zh) 一种虚拟机的安全可信验证方法及装置
WO2022239349A1 (ja) サーバ、要求エンティティ、及びこれらの方法
CN116561810B (zh) 基于混合云平台的仓储管理大数据处理方法及装置
EP4274161A1 (en) Apparatus, methods, and computer programs
WO2022176426A1 (ja) サーバ、要求エンティティ、及びこれらの方法
WO2022120709A1 (en) Apparatus, methods and computer programs for edge services
CN116996985A (zh) 一种基于边缘网络的通信方法及装置
WO2023143709A1 (en) Enabling rrc status information for enhanced positioning
KR20240039068A (ko) 엣지 컴퓨팅에서의 위치 서비스 방법

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20959156

Country of ref document: EP

Kind code of ref document: A1